test: add comprehensive test suite for all packages (82 tests)

- packages/core: queries.test.js (16 tests) covering now(), requireItem,
  requireVersion, bumpVersion, buildChecklistTree, fullItem, allSummaries, wouldCycle
- packages/core: sse.test.js (9 tests) covering SSEBroadcaster register/broadcast/cleanup
- packages/api: auth.test.js (10 tests) covering hashKey, generateApiKey, checkRateLimit
- packages/mcp: tools.test.js (19 tests) covering all MCP tool handlers via LocalStore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: chapterjason

packages/api/src/__tests__/auth.test.js

@@ -0,0 +1,80 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { hashKey, generateApiKey } from "../auth/auth.js";
+
+// ---- hashKey ----
+describe("hashKey()", () => {
+  it("returns a 64-char hex string", () => {
+    const h = hashKey("sk-proj-abc123");
+    expect(h).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("is deterministic", () => {
+    expect(hashKey("foo")).toBe(hashKey("foo"));
+  });
+
+  it("is different for different inputs", () => {
+    expect(hashKey("a")).not.toBe(hashKey("b"));
+  });
+});
+
+// ---- generateApiKey ----
+describe("generateApiKey()", () => {
+  it("starts with sk-proj-", () => {
+    expect(generateApiKey()).toMatch(/^sk-proj-/);
+  });
+
+  it("generates unique keys", () => {
+    expect(generateApiKey()).not.toBe(generateApiKey());
+  });
+
+  it("has 56 chars total (sk-proj- + 48 hex chars)", () => {
+    expect(generateApiKey()).toHaveLength(56);
+  });
+});
+
+// ---- checkRateLimit ----
+// Import lazily so we can control Date.now() before the module's WINDOW_MS is read.
+// Rate limit state is module-level so we isolate by re-importing fresh per suite.
+describe("checkRateLimit()", () => {
+  let checkRateLimit;
+  let nowMs;
+
+  beforeEach(async () => {
+    nowMs = 1_000_000;
+    vi.spyOn(Date, "now").mockImplementation(() => nowMs);
+
+    // Reset module registry so counters Map is fresh
+    vi.resetModules();
+    ({ checkRateLimit } = await import("../auth/rate-limit.js"));
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("returns null when under the limit", () => {
+    expect(checkRateLimit("proj")).toBeNull();
+  });
+
+  it("returns retryAfter object when limit exceeded", () => {
+    const max = parseInt(process.env.BACKLOG_RATE_LIMIT_MAX ?? "200", 10);
+    for (let i = 0; i < max; i++) checkRateLimit("proj");
+    const result = checkRateLimit("proj");
+    expect(result).not.toBeNull();
+    expect(result.retryAfter).toBeGreaterThan(0);
+  });
+
+  it("resets counter after window expires", () => {
+    const max = parseInt(process.env.BACKLOG_RATE_LIMIT_MAX ?? "200", 10);
+    const windowMs = parseInt(process.env.BACKLOG_RATE_LIMIT_WINDOW ?? "60", 10) * 1000;
+    for (let i = 0; i < max + 1; i++) checkRateLimit("proj");
+    // Advance time past window
+    nowMs += windowMs + 1;
+    expect(checkRateLimit("proj")).toBeNull();
+  });
+
+  it("isolates counters per slug", () => {
+    expect(checkRateLimit("a")).toBeNull();
+    expect(checkRateLimit("b")).toBeNull();
+  });
+});

packages/core/src/__tests__/queries.test.js

@@ -0,0 +1,156 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { openDatabase } from "../db/schema.js";
+import { prepareStatements } from "../db/statements.js";
+import {
+  now, requireItem, buildChecklistTree, fullItem, allSummaries, summarize,
+  wouldCycle, requireVersion, bumpVersion, CHECKLIST_MAX_DEPTH,
+} from "../db/queries.js";
+import { NotFoundError, VersionConflictError } from "../db/errors.js";
+
+function makeDb() {
+  const db = openDatabase(":memory:");
+  const stmts = prepareStatements(db);
+  return { db, stmts };
+}
+
+function createItem(stmts, title = "Test", status = "open") {
+  const ts = now();
+  const result = stmts.createItem.run(title, status, "", ts, ts);
+  return stmts.getItem.get(result.lastInsertRowid);
+}
+
+describe("now()", () => {
+  it("returns an ISO string", () => {
+    expect(new Date(now()).toISOString()).toBe(now());
+  });
+});
+
+describe("requireItem()", () => {
+  it("returns item when found", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    expect(requireItem(stmts, item.id).id).toBe(item.id);
+  });
+
+  it("throws NotFoundError when missing", () => {
+    const { stmts } = makeDb();
+    expect(() => requireItem(stmts, 999)).toThrow(NotFoundError);
+  });
+});
+
+describe("requireVersion()", () => {
+  it("passes when version matches", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    expect(() => requireVersion(stmts, item.id, item.version)).not.toThrow();
+  });
+
+  it("throws VersionConflictError when version is stale", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    expect(() => requireVersion(stmts, item.id, 99)).toThrow(VersionConflictError);
+  });
+});
+
+describe("bumpVersion()", () => {
+  it("increments version", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    bumpVersion(stmts, item.id, item.version);
+    const updated = stmts.getItem.get(item.id);
+    expect(updated.version).toBe(item.version + 1);
+  });
+
+  it("throws VersionConflictError on concurrent bump", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    bumpVersion(stmts, item.id, item.version);
+    expect(() => bumpVersion(stmts, item.id, item.version)).toThrow(VersionConflictError);
+  });
+});
+
+describe("buildChecklistTree()", () => {
+  it("returns empty array for item with no checklist", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    expect(buildChecklistTree(stmts, item.id, null)).toEqual([]);
+  });
+
+  it("throws when depth exceeds max", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    // Insert checklist items directly at exactly max depth
+    let parentId = null;
+    for (let i = 0; i < CHECKLIST_MAX_DEPTH; i++) {
+      const r = stmts.addChecklist.run(item.id, parentId, `level ${i}`, i);
+      parentId = Number(r.lastInsertRowid);
+    }
+    // Reading this tree should throw
+    expect(() => buildChecklistTree(stmts, item.id, null)).toThrow(/maximum allowed depth/);
+  });
+});
+
+describe("fullItem()", () => {
+  it("returns item with checklist, dependencies, comments arrays", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts);
+    const full = fullItem(stmts, item.id);
+    expect(full.checklist).toBeInstanceOf(Array);
+    expect(full.dependencies).toBeInstanceOf(Array);
+    expect(full.comments).toBeInstanceOf(Array);
+  });
+});
+
+describe("allSummaries()", () => {
+  it("returns all items when no filter", () => {
+    const { stmts } = makeDb();
+    createItem(stmts, "A", "open");
+    createItem(stmts, "B", "done");
+    expect(allSummaries(stmts).length).toBe(2);
+  });
+
+  it("filters by status", () => {
+    const { stmts } = makeDb();
+    createItem(stmts, "A", "open");
+    createItem(stmts, "B", "done");
+    expect(allSummaries(stmts, "open").length).toBe(1);
+  });
+
+  it("excludes archived when includeArchived is false", () => {
+    const { stmts } = makeDb();
+    const item = createItem(stmts, "A", "open");
+    stmts.updateItem.run("A", "", "archived", now(), item.id, item.version);
+    expect(allSummaries(stmts, null, { includeArchived: false }).length).toBe(0);
+    expect(allSummaries(stmts, null, { includeArchived: true }).length).toBe(1);
+  });
+});
+
+describe("wouldCycle()", () => {
+  it("returns false when no cycle", () => {
+    const { stmts } = makeDb();
+    const a = createItem(stmts, "A");
+    const b = createItem(stmts, "B");
+    expect(wouldCycle(stmts, b.id, a.id)).toBe(false);
+  });
+
+  it("returns true for direct cycle", () => {
+    const { stmts } = makeDb();
+    const a = createItem(stmts, "A");
+    const b = createItem(stmts, "B");
+    // B depends on A
+    stmts.addDep.run(b.id, a.id);
+    // Now check if A depending on B would cycle
+    expect(wouldCycle(stmts, a.id, b.id)).toBe(true);
+  });
+
+  it("returns true for transitive cycle", () => {
+    const { stmts } = makeDb();
+    const a = createItem(stmts, "A");
+    const b = createItem(stmts, "B");
+    const c = createItem(stmts, "C");
+    stmts.addDep.run(b.id, a.id); // B -> A
+    stmts.addDep.run(c.id, b.id); // C -> B
+    // A -> C would create A -> C -> B -> A
+    expect(wouldCycle(stmts, a.id, c.id)).toBe(true);
+  });
+});

packages/core/src/__tests__/sse.test.js

@@ -0,0 +1,102 @@
+import { describe, it, expect, vi } from "vitest";
+import { SSEBroadcaster } from "../http/sse.js";
+
+function mockRes() {
+  return {
+    writableEnded: false,
+    writeHead: vi.fn(),
+    write: vi.fn(),
+    end: vi.fn(),
+    on: vi.fn(),
+  };
+}
+
+describe("SSEBroadcaster", () => {
+  it("registers a client and sends initial snapshot", () => {
+    const sse = new SSEBroadcaster("test");
+    const res = mockRes();
+    sse.register("proj", res, [{ id: 1 }]);
+    expect(res.writeHead).toHaveBeenCalledWith(200, expect.objectContaining({ "Content-Type": "text/event-stream" }));
+    expect(res.write).toHaveBeenCalledWith(expect.stringContaining(JSON.stringify([{ id: 1 }])));
+  });
+
+  it("broadcasts to registered clients", () => {
+    const sse = new SSEBroadcaster("test");
+    const res = mockRes();
+    sse.register("proj", res, []);
+    sse.broadcast("proj", [{ id: 2 }]);
+    expect(res.write).toHaveBeenCalledTimes(2); // initial + broadcast
+    const lastCall = res.write.mock.calls[1][0];
+    expect(lastCall).toContain(JSON.stringify([{ id: 2 }]));
+  });
+
+  it("skips clients with writableEnded", () => {
+    const sse = new SSEBroadcaster("test");
+    const res = mockRes();
+    sse.register("proj", res, []);
+    res.writableEnded = true;
+    sse.broadcast("proj", []);
+    expect(sse.clientCount("proj")).toBe(0);
+  });
+
+  it("removes client on write error", () => {
+    const sse = new SSEBroadcaster("test");
+    const res = mockRes();
+    sse.register("proj", res, []);
+    // Override write to throw on the next (broadcast) call
+    res.write.mockImplementation(() => { throw new Error("socket hang up"); });
+    sse.broadcast("proj", []);
+    expect(sse.clientCount("proj")).toBe(0);
+  });
+
+  it("cleanup function removes the client", () => {
+    const sse = new SSEBroadcaster("test");
+    const res = mockRes();
+    const cleanup = sse.register("proj", res, []);
+    expect(sse.clientCount("proj")).toBe(1);
+    cleanup();
+    expect(sse.clientCount("proj")).toBe(0);
+  });
+
+  it("broadcasts to multiple clients for same slug", () => {
+    const sse = new SSEBroadcaster("test");
+    const res1 = mockRes();
+    const res2 = mockRes();
+    sse.register("proj", res1, []);
+    sse.register("proj", res2, []);
+    sse.broadcast("proj", [{ id: 1 }]);
+    expect(res1.write).toHaveBeenCalledTimes(2);
+    expect(res2.write).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not broadcast to other slugs", () => {
+    const sse = new SSEBroadcaster("test");
+    const res1 = mockRes();
+    const res2 = mockRes();
+    sse.register("proj-a", res1, []);
+    sse.register("proj-b", res2, []);
+    sse.broadcast("proj-a", []);
+    expect(res1.write).toHaveBeenCalledTimes(2); // initial + broadcast
+    expect(res2.write).toHaveBeenCalledTimes(1); // initial only
+  });
+
+  it("closeAll ends all connections and clears state", () => {
+    const sse = new SSEBroadcaster("test");
+    const res1 = mockRes();
+    const res2 = mockRes();
+    sse.register("a", res1, []);
+    sse.register("b", res2, []);
+    sse.closeAll();
+    expect(res1.end).toHaveBeenCalled();
+    expect(res2.end).toHaveBeenCalled();
+    expect(sse.clientCount("a")).toBe(0);
+    expect(sse.clientCount("b")).toBe(0);
+  });
+
+  it("activeSlugs returns slugs with clients", () => {
+    const sse = new SSEBroadcaster("test");
+    sse.register("x", mockRes(), []);
+    sse.register("y", mockRes(), []);
+    expect([...sse.activeSlugs()]).toEqual(expect.arrayContaining(["x", "y"]));
+  });
+});