Initial Commit

packages/api-stack/api/api-secrets-worker-proxy/tests/conformance/api-worker-rpc.conformance.test.ts

@@ -0,0 +1,37 @@
+/**
+ * §16 conformance proof — the worker-proxy package consumes the
+ * `@suaveplan/api-worker-rpc` contract directly (client + server +
+ * MessagePort transport). This test exercises the canonical
+ * `runWorkerRpcConformance` harness with a minimal handler set to
+ * prove the consumer is wire-compatible end-to-end (request frame,
+ * response frame, abort propagation) using the same port transport
+ * the package builds on top of in `src/main-side` / `src/worker-side`.
+ */
+import { afterEach, describe, expect, it } from "@suaveplan/testing/runner";
+import { runWorkerRpcConformance } from "../../../api-worker-rpc/src/testing/conformance.js";
+
+const handles: Array<{ dispose(): void }> = [];
+afterEach(() => {
+    while (handles.length > 0) handles.pop()?.dispose();
+});
+
+describe("api-worker-rpc contract conformance (consumer-side)", () => {
+    it("round-trips a request through the canonical harness", {
+        timeout: 5000,
+    }, async () => {
+        const h = runWorkerRpcConformance(() => ({
+            echo: (params: ReadonlyArray<unknown>) => params[0],
+        }));
+        handles.push(h);
+        const result = await h.client.call<number>("echo", [42]);
+        expect(result).toBe(42);
+    });
+
+    it("surfaces UNKNOWN_METHOD from the server", {
+        timeout: 5000,
+    }, async () => {
+        const h = runWorkerRpcConformance(() => ({}));
+        handles.push(h);
+        await expect(h.client.call("missing", [])).rejects.toThrow();
+    });
+});

packages/api-stack/api/api-secrets-worker-proxy/tests/conformance/run-secrets-conformance.test.ts

@@ -0,0 +1,49 @@
+/**
+ * Stage-4 precondition gate: the worker-side proxy surface MUST pass
+ * `runSecretsConformance` from `@suaveplan/api-secrets/testing`
+ * identically to a direct in-process adapter. This test is the
+ * cross-package contract proof.
+ */
+// NOTE: import from source not dist — api-secrets's dist bundles vitest
+// internals (a pre-existing build-config bug; tracked in main-side
+// integration). Source import goes through workspace TS resolution and
+// uses the local vitest instance.
+import {
+    runSecretsConformance,
+    type SecretsConformanceFixture,
+} from "../../../api-secrets/src/testing/conformance.js";
+import {
+    createSecretsProxyFixture,
+    type SecretsProxyFixture,
+} from "../../src/testing/testing.js";
+
+runSecretsConformance({
+    label: "worker-proxy",
+    factory: (seed): SecretsConformanceFixture => {
+        // The harness's `seed` carries the names the test will exercise;
+        // they MUST be in `allowedKeys` for the proxy to permit them.
+        // For the not-found scenario (seed is empty), also permit
+        // "MISSING" so the source-not-found path is exercised rather
+        // than the whitelist-rejection path. For the list scenario the
+        // seed is non-empty so we don't pollute the list.
+        const seeded = Object.keys(seed);
+        const allowed = seeded.length === 0 ? ["MISSING"] : seeded;
+        const fx: SecretsProxyFixture = createSecretsProxyFixture({
+            seed,
+            allowedKeys: allowed,
+        });
+        return {
+            secrets: fx.client,
+            teardown: () => {
+                fx.close();
+            },
+        };
+    },
+    // The proxy surfaces source-not-found as KEY_NOT_FOUND, not
+    // SECRET_NOT_FOUND. Override the predicate accordingly.
+    isNotFound: (err: unknown) =>
+        typeof err === "object" &&
+        err !== null &&
+        "code" in err &&
+        (err as { code: unknown }).code === "SECRETS_PROXY.KEY_NOT_FOUND",
+});