read-api.test.ts

/**
 * Read API integration tests.
 *
 * Each test seeds D1 directly with the columns the handlers read, then
 * exercises the handler via `SELF.fetch` to a `/xrpc/...` URL — same path
 * a real client would take. Asserts on the envelope shape (uri, cid, did,
 * indexedAt, artifactCaches, labels) and on error mappings (404 NotFound, 400
 * InvalidRequest).
 *
 * Cache descriptors are operational delivery metadata rather than signed
 * release fields.
 */

import { NSID } from "@emdash-cms/registry-lexicons";
import { applyD1Migrations, env, SELF } from "cloudflare:test";
import { beforeAll, beforeEach, describe, expect, it } from "vitest";

interface TestEnv {
	DB: D1Database;
	TEST_MIGRATIONS: Parameters<typeof applyD1Migrations>[1];
}
const testEnv = env as unknown as TestEnv;

const DID_A = "did:plc:read000000000000000000aa";
const DID_B = "did:plc:read000000000000000000bb";
const NOW = new Date("2026-05-10T12:00:00.000Z");

beforeAll(async () => {
	await applyD1Migrations(testEnv.DB, testEnv.TEST_MIGRATIONS);
});

beforeEach(async () => {
	// Tables in dependency order: releases → packages (FK), then publishers
	// + verifications.
	await testEnv.DB.prepare("UPDATE public_projection_state SET active_generation = NULL").run();
	await testEnv.DB.prepare("DELETE FROM public_releases").run();
	await testEnv.DB.prepare("DELETE FROM public_packages").run();
	await testEnv.DB.prepare("DELETE FROM public_projection_generations").run();
	await testEnv.DB.prepare("DELETE FROM label_state").run();
	await testEnv.DB.prepare("DELETE FROM labellers").run();
	await testEnv.DB.prepare("DELETE FROM releases").run();
	await testEnv.DB.prepare("DELETE FROM package_release_history").run();
	await testEnv.DB.prepare("DELETE FROM packages").run();
	await testEnv.DB.prepare("DELETE FROM package_profile_heads").run();
	await testEnv.DB.prepare("DELETE FROM package_profile_revisions").run();
	await testEnv.DB.prepare("DELETE FROM publishers").run();
	await testEnv.DB.prepare("DELETE FROM publisher_verifications").run();
});

interface SeedPackageOpts {
	did?: string;
	slug?: string;
	type?: string;
	name?: string | null;
	description?: string | null;
	license?: string;
	keywords?: string[] | null;
	latestVersion?: string | null;
	cid?: string;
	indexedAt?: string;
	verifiedAt?: string;
	carBytes?: Uint8Array;
}

async function seedPackage(opts: SeedPackageOpts = {}): Promise<void> {
	const did = opts.did ?? DID_A;
	const slug = opts.slug ?? "demo";
	const indexedAt = opts.indexedAt ?? NOW.toISOString();
	await testEnv.DB.prepare(
		`INSERT INTO packages
		   (did, slug, type, name, description, license, authors, security, keywords,
		    sections, last_updated, latest_version, capabilities, record_blob,
		    signature_metadata, verified_at, indexed_at)
		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
	)
		.bind(
			did,
			slug,
			opts.type ?? "emdash-plugin",
			opts.name ?? "Demo Plugin",
			opts.description ?? "A demo plugin",
			opts.license ?? "MIT",
			JSON.stringify([{ name: "Tester" }]),
			JSON.stringify([{ email: "x@y.test" }]),
			opts.keywords === null ? null : JSON.stringify(opts.keywords ?? ["demo"]),
			null,
			NOW.toISOString(),
			opts.latestVersion ?? null,
			null,
			opts.carBytes ?? new Uint8Array([0xa1, 0xa2, 0xa3]),
			JSON.stringify({ cid: opts.cid ?? "bafyseed" }),
			opts.verifiedAt ?? NOW.toISOString(),
			indexedAt,
		)
		.run();
}

interface SeedReleaseOpts {
	did?: string;
	package?: string;
	version: string;
	versionSort?: string;
	tombstoned?: boolean;
	cid?: string;
	carBytes?: Uint8Array;
	artifacts?: unknown;
}

async function seedRelease(opts: SeedReleaseOpts): Promise<void> {
	const did = opts.did ?? DID_A;
	const pkg = opts.package ?? "demo";
	const rkey = `${pkg}:${opts.version}`;
	await testEnv.DB.prepare(
		`INSERT INTO releases
		   (did, package, version, rkey, version_sort, artifacts, requires, suggests,
		    emdash_extension, repo_url, cts, record_blob, signature_metadata,
		    verified_at, indexed_at, tombstoned_at)
		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
	)
		.bind(
			did,
			pkg,
			opts.version,
			rkey,
			opts.versionSort ?? defaultVersionSort(opts.version),
			JSON.stringify(
				opts.artifacts ?? {
					package: { url: "https://x.test/d.tgz", checksum: "bsha256-abc" },
				},
			),
			null,
			null,
			JSON.stringify({ declaredAccess: {} }),
			null,
			NOW.toISOString(),
			opts.carBytes ?? new Uint8Array([0xb1, 0xb2, 0xb3]),
			JSON.stringify({ cid: opts.cid ?? `bafrel-${opts.version}` }),
			NOW.toISOString(),
			NOW.toISOString(),
			opts.tombstoned ? NOW.toISOString() : null,
		)
		.run();
}

async function seedReleaseHistory(complete: boolean): Promise<void> {
	await testEnv.DB.prepare(
		`INSERT INTO package_release_history
		   (did, package, release_history_complete, first_observed_at, first_observed_source)
		 VALUES (?, ?, ?, ?, ?)`,
	)
		.bind(DID_A, "demo", complete ? 1 : 0, NOW.toISOString(), complete ? "jetstream" : "backfill")
		.run();
}

async function seedTakedown(uri: string, cid: string | null = null): Promise<void> {
	await testEnv.DB.prepare(
		`INSERT INTO labellers
		   (did, endpoint, signing_key, signing_key_id, trusted, added_at, last_resolved_at,
		    active, required_positive, accepted_state, redaction, policy_version)
		 VALUES ('did:web:labels.example', 'https://labels.example', 'key',
		         'did:web:labels.example#atproto_label', 1, ?, ?, 1, 0, 0, 1, 'test-v1')
		 ON CONFLICT(did) DO UPDATE SET active = 1, trusted = 1, redaction = 1`,
	)
		.bind(NOW.toISOString(), NOW.toISOString())
		.run();
	await testEnv.DB.prepare(
		`INSERT INTO label_state
		   (src, uri, val, cid, neg, cts, exp, trusted, cts_epoch, cts_fraction, collision)
		 VALUES ('did:web:labels.example', ?, '!takedown', ?, 0, ?, NULL, 1, ?, ?, 1)`,
	)
		.bind(uri, cid, NOW.toISOString(), Math.floor(NOW.getTime() / 1_000), "0".repeat(32))
		.run();
}

/** Naive 1.x.y zero-padded version_sort for the test fixtures. Real values
 * come from the consumer's `computeVersionSort`; tests just need the
 * relative ordering to be right. */
function defaultVersionSort(version: string): string {
	const [major = "0", minor = "0", patch = "0"] = version.split(".");
	const pad = (s: string) => s.padStart(10, "0");
	return `${pad(major)}.${pad(minor)}.${pad(patch)}.~`;
}

describe("getPackage", () => {
	it("returns the packageView envelope for an indexed package", async () => {
		await seedPackage({ slug: "demo", latestVersion: "1.0.0" });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=demo`,
		);
		expect(res.status).toBe(200);
		const body = (await res.json()) as Record<string, unknown>;
		expect(body).toMatchObject({
			uri: `at://${DID_A}/${NSID.packageProfile}/demo`,
			cid: "bafyseed",
			did: DID_A,
			slug: "demo",
			latestVersion: "1.0.0",
			indexedAt: NOW.toISOString(),
			labels: [],
		});
		// Artifact cache services apply to release blobs, not package profiles.
		expect(body).not.toHaveProperty("artifactCaches");
		const profile = body["profile"] as Record<string, unknown>;
		expect(profile["$type"]).toBe(NSID.packageProfile);
		expect(profile["id"]).toBe(`at://${DID_A}/${NSID.packageProfile}/demo`);
		expect(profile["license"]).toBe("MIT");
		expect(profile["slug"]).toBe("demo");
	});

	it("returns 404 NotFound when no row matches", async () => {
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=missing`,
		);
		expect(res.status).toBe(404);
		const body = (await res.json()) as { error: string };
		expect(body.error).toBe("NotFound");
	});

	it("reports complete all-time release history including tombstones", async () => {
		await seedPackage({ slug: "demo", latestVersion: "2.0.0" });
		await seedRelease({ version: "1.0.0", tombstoned: true });
		await seedRelease({ version: "2.0.0" });
		await seedReleaseHistory(true);

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=demo`,
		);

		expect(res.status).toBe(200);
		await expect(res.json()).resolves.toMatchObject({
			historicalReleaseCount: 2,
			releaseHistoryComplete: true,
		});
	});

	it("marks backfilled release history incomplete", async () => {
		await seedPackage({ slug: "demo", latestVersion: "1.0.0" });
		await seedRelease({ version: "1.0.0" });
		await seedReleaseHistory(false);

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=demo`,
		);

		expect(res.status).toBe(200);
		await expect(res.json()).resolves.toMatchObject({
			historicalReleaseCount: 1,
			releaseHistoryComplete: false,
		});
	});

	it("returns 400 InvalidRequest on missing required params", async () => {
		const res = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}`);
		expect(res.status).toBe(400);
	});

	it("sets Cache-Control: private, no-store on success", async () => {
		await seedPackage({ slug: "demo" });
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=demo`,
		);
		expect(res.headers.get("cache-control")).toBe("private, no-store");
	});

	it("omits latestVersion when no release has been written yet", async () => {
		await seedPackage({ slug: "fresh", latestVersion: null });
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetPackage}?did=${DID_A}&slug=fresh`,
		);
		const body = (await res.json()) as Record<string, unknown>;
		expect(body).not.toHaveProperty("latestVersion");
	});
});

describe("listReleases", () => {
	it("returns releases ordered by descending semver", async () => {
		await seedPackage({ slug: "demo", latestVersion: "2.0.0" });
		await seedRelease({ version: "1.0.0" });
		await seedRelease({ version: "1.10.0" });
		await seedRelease({ version: "2.0.0" });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=demo`,
		);
		expect(res.status).toBe(200);
		const body = (await res.json()) as { releases: Array<{ version: string }>; cursor?: string };
		expect(body.releases.map((r) => r.version)).toEqual(["2.0.0", "1.10.0", "1.0.0"]);
		expect(body).not.toHaveProperty("cursor");
	});

	it("filters tombstoned releases", async () => {
		await seedPackage({ slug: "demo" });
		await seedRelease({ version: "1.0.0" });
		await seedRelease({ version: "1.1.0", tombstoned: true });
		await seedRelease({ version: "1.2.0" });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=demo`,
		);
		const body = (await res.json()) as { releases: Array<{ version: string }> };
		expect(body.releases.map((r) => r.version)).toEqual(["1.2.0", "1.0.0"]);
	});

	it("paginates via cursor", async () => {
		await seedPackage({ slug: "demo" });
		for (let i = 1; i <= 5; i++) await seedRelease({ version: `1.${i}.0` });

		const first = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=demo&limit=2`,
		);
		const firstBody = (await first.json()) as {
			releases: Array<{ version: string }>;
			cursor: string;
		};
		expect(firstBody.releases.map((r) => r.version)).toEqual(["1.5.0", "1.4.0"]);
		expect(firstBody.cursor).toBeTruthy();

		const second = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=demo&limit=2&cursor=${encodeURIComponent(firstBody.cursor)}`,
		);
		const secondBody = (await second.json()) as {
			releases: Array<{ version: string }>;
			cursor?: string;
		};
		expect(secondBody.releases.map((r) => r.version)).toEqual(["1.3.0", "1.2.0"]);
		expect(secondBody.cursor).toBeTruthy();
	});

	it("returns 404 when the parent package is missing", async () => {
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=missing`,
		);
		expect(res.status).toBe(404);
	});

	it("400s on a provided-but-malformed cursor", async () => {
		await seedPackage({ slug: "demo" });
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorListReleases}?did=${DID_A}&package=demo&cursor=garbage!!!`,
		);
		expect(res.status).toBe(400);
	});
});

describe("getLatestRelease", () => {
	it("advertises the record-scoped Cumulus service for release blobs", async () => {
		const cid = "bafkreia6n3lf256wgzhov3k2orn2lreyllrloag5qxl467ycpppsssrt7q";
		await seedPackage({ slug: "demo", latestVersion: "1.0.0" });
		await seedRelease({
			version: "1.0.0",
			artifacts: {
				package: {
					blob: {
						$type: "blob",
						ref: { $link: cid },
						mimeType: "application/gzip",
						size: 6,
					},
					checksum: "bciqb43wwlv35mnso5lwvu5c3uxcjqwxcw4an3boxz57qe667fffdh7a",
				},
			},
		});

		const response = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=demo`,
		);
		const body = (await response.json()) as Record<string, unknown>;
		expect(body["artifactCaches"]).toEqual([
			{
				$type: "com.emdashcms.experimental.aggregator.defs#recordScopedBlobCache",
				serviceEndpoint: "https://cdn.em-da.sh",
			},
		]);
		expect(body).not.toHaveProperty("mirrors");
	});

	it("does not represent the cache descriptor as admission for a gated blob", async () => {
		await seedPackage({ slug: "demo", latestVersion: "1.0.0" });
		await seedRelease({
			version: "1.0.0",
			artifacts: {
				package: {
					blob: {
						$type: "blob",
						ref: {
							$link: "bafkreia6n3lf256wgzhov3k2orn2lreyllrloag5qxl467ycpppsssrt7q",
						},
						mimeType: "application/gzip",
						size: 6,
					},
					requiresAuth: true,
					checksum: "bciqb43wwlv35mnso5lwvu5c3uxcjqwxcw4an3boxz57qe667fffdh7a",
				},
			},
		});

		const response = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=demo`,
		);
		const body = (await response.json()) as Record<string, unknown>;
		expect(body["artifactCaches"]).toEqual([
			{
				$type: "com.emdashcms.experimental.aggregator.defs#recordScopedBlobCache",
				serviceEndpoint: "https://cdn.em-da.sh",
			},
		]);
	});

	it("returns the release pointed to by packages.latest_version", async () => {
		await seedPackage({ slug: "demo", latestVersion: "2.0.0" });
		await seedRelease({ version: "1.0.0" });
		await seedRelease({ version: "2.0.0" });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=demo`,
		);
		expect(res.status).toBe(200);
		const body = (await res.json()) as Record<string, unknown>;
		expect(body["version"]).toBe("2.0.0");
		expect(body["uri"]).toBe(`at://${DID_A}/${NSID.packageRelease}/demo:2.0.0`);
	});

	it("returns 404 when ALL releases are tombstoned (or none exist)", async () => {
		await seedPackage({ slug: "demo", latestVersion: "1.0.0" });
		await seedRelease({ version: "1.0.0", tombstoned: true });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=demo`,
		);
		expect(res.status).toBe(404);
	});

	it("falls back to the next-best release when latest_version points at a tombstoned one", async () => {
		// `latest_version` was set to 2.0.0, then 2.0.0 was tombstoned but
		// `refreshPackageLatestStmt` hasn't run yet (or failed). The fast-path
		// JOIN misses; the slow-path ORDER BY should still find 1.0.0 and
		// return it instead of 404ing.
		await seedPackage({ slug: "demo", latestVersion: "2.0.0" });
		await seedRelease({ version: "1.0.0" });
		await seedRelease({ version: "2.0.0", tombstoned: true });

		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=demo`,
		);
		expect(res.status).toBe(200);
		const body = (await res.json()) as Record<string, unknown>;
		expect(body["version"]).toBe("1.0.0");
	});

	it("returns 404 when no package row exists", async () => {
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorGetLatestRelease}?did=${DID_A}&package=missing`,
		);
		expect(res.status).toBe(404);
	});
});

describe("searchPackages", () => {
	it("returns FTS-matched packages", async () => {
		await seedPackage({ slug: "gallery", name: "Gallery Plugin", description: "image gallery" });
		await seedPackage({ slug: "form", name: "Form Plugin", description: "form builder" });

		const res = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorSearchPackages}?q=gallery`);
		expect(res.status).toBe(200);
		const body = (await res.json()) as { packages: Array<{ slug: string }> };
		expect(body.packages.map((p) => p.slug)).toContain("gallery");
		expect(body.packages.map((p) => p.slug)).not.toContain("form");
	});

	it("returns all packages ordered by last_updated DESC when q is empty", async () => {
		await seedPackage({ slug: "alpha" });
		await seedPackage({ slug: "beta" });
		const res = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorSearchPackages}`);
		const body = (await res.json()) as { packages: Array<{ slug: string }> };
		expect(body.packages.map((p) => p.slug).toSorted()).toEqual(["alpha", "beta"]);
	});

	it("excludes every package from a publisher with an active DID takedown", async () => {
		await seedPackage({ slug: "gallery", name: "Gallery Plugin" });
		await seedPackage({ did: DID_B, slug: "form", name: "Form Plugin" });
		await seedTakedown(DID_A);

		for (const query of ["", "?q=gallery"]) {
			const res = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorSearchPackages}${query}`);
			expect(res.status).toBe(200);
			const body = (await res.json()) as { packages: Array<{ did: string }> };
			expect(body.packages.map((pkg) => pkg.did)).not.toContain(DID_A);
		}
	});

	it("applies a profile takedown only to the exact CID", async () => {
		await seedPackage({ slug: "gallery", name: "Gallery Plugin", cid: "bafycurrent" });
		await seedTakedown(`at://${DID_A}/${NSID.packageProfile}/gallery`, "bafyprevious");

		const res = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorSearchPackages}?q=gallery`);
		expect(res.status).toBe(200);
		const body = (await res.json()) as { packages: Array<{ slug: string }> };
		expect(body.packages.map((pkg) => pkg.slug)).toContain("gallery");
	});

	it("paginates via offset cursor", async () => {
		for (let i = 0; i < 5; i++) await seedPackage({ slug: `pkg${i}` });

		const first = await SELF.fetch(`https://test/xrpc/${NSID.aggregatorSearchPackages}?limit=2`);
		const firstBody = (await first.json()) as {
			packages: Array<{ slug: string }>;
			cursor: string;
		};
		expect(firstBody.packages).toHaveLength(2);
		expect(firstBody.cursor).toBeTruthy();

		const second = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorSearchPackages}?limit=2&cursor=${encodeURIComponent(firstBody.cursor)}`,
		);
		const secondBody = (await second.json()) as { packages: Array<{ slug: string }> };
		expect(secondBody.packages).toHaveLength(2);
		// Distinct from page 1 — seeded slugs don't overlap.
		const overlap = firstBody.packages
			.map((p) => p.slug)
			.filter((s) => secondBody.packages.some((p) => p.slug === s));
		expect(overlap).toEqual([]);
	});

	it("doesn't blow up on FTS-unsafe query chars (defensive quoting)", async () => {
		await seedPackage({ slug: "demo", name: "Demo" });
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorSearchPackages}?q=${encodeURIComponent('demo "*"(')}`,
		);
		// Either matches nothing or matches normally — but doesn't 500.
		expect(res.status).toBe(200);
	});

	it("treats FTS operators as literal tokens (the escape actually works)", async () => {
		await seedPackage({ slug: "alpha", name: "Alpha" });
		await seedPackage({ slug: "beta", name: "Beta" });
		// `alpha OR beta` would match both packages if `OR` were interpreted
		// as the FTS5 operator. With proper escaping the whole string is one
		// literal phrase that can't possibly appear in either record's
		// indexed text → zero matches. A buggy escape that stripped the
		// quotes would return *both* packages.
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorSearchPackages}?q=${encodeURIComponent("alpha OR beta")}`,
		);
		expect(res.status).toBe(200);
		const body = (await res.json()) as { packages: Array<{ slug: string }> };
		expect(body.packages).toEqual([]);
	});

	it("400s on a provided-but-malformed cursor (no silent restart)", async () => {
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorSearchPackages}?cursor=not-a-valid-cursor`,
		);
		expect(res.status).toBe(400);
	});

	it("400s on a forged cursor with an out-of-range offset", async () => {
		// Encode {offset: 1_000_000} → over MAX_OFFSET → 400.
		const forged = btoa(JSON.stringify({ offset: 1_000_000 }))
			.replace(/\+/g, "-")
			.replace(/\//g, "_")
			.replace(/=+$/, "");
		const res = await SELF.fetch(
			`https://test/xrpc/${NSID.aggregatorSearchPackages}?cursor=${forged}`,
		);
		expect(res.status).toBe(400);
	});
});

describe("sync.getRecord", () => {
	const PATH = "/xrpc/com.atproto.sync.getRecord";

	it("returns CAR bytes for an indexed package profile", async () => {
		await seedPackage({ slug: "demo", carBytes: new Uint8Array([0x11, 0x22, 0x33]) });
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageProfile}&rkey=demo`,
		);
		expect(res.status).toBe(200);
		expect(res.headers.get("content-type")).toBe("application/vnd.ipld.car");
		expect(res.headers.get("cache-control")).toBe("private, no-store");
		const bytes = new Uint8Array(await res.arrayBuffer());
		expect([...bytes]).toEqual([0x11, 0x22, 0x33]);
	});

	it("returns CAR bytes for an indexed release", async () => {
		await seedPackage({ slug: "demo" });
		await seedRelease({ version: "1.0.0", carBytes: new Uint8Array([0x44, 0x55]) });
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageRelease}&rkey=demo:1.0.0`,
		);
		expect(res.status).toBe(200);
		const bytes = new Uint8Array(await res.arrayBuffer());
		expect([...bytes]).toEqual([0x44, 0x55]);
	});

	it("returns 404 for a tombstoned release", async () => {
		await seedPackage({ slug: "demo" });
		await seedRelease({ version: "1.0.0", tombstoned: true });
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageRelease}&rkey=demo:1.0.0`,
		);
		expect(res.status).toBe(404);
	});

	it("returns 404 for an unknown rkey", async () => {
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageProfile}&rkey=does-not-exist`,
		);
		expect(res.status).toBe(404);
	});

	it("returns 400 InvalidRequest on missing query params", async () => {
		const res = await SELF.fetch(`https://test${PATH}?did=${DID_A}`);
		expect(res.status).toBe(400);
	});

	it("returns 400 on a malformed DID", async () => {
		const res = await SELF.fetch(
			`https://test${PATH}?did=not-a-did&collection=${NSID.packageProfile}&rkey=demo`,
		);
		expect(res.status).toBe(400);
	});

	it("returns HEAD with content-length but no body", async () => {
		await seedPackage({ slug: "demo", carBytes: new Uint8Array([0x11, 0x22, 0x33]) });
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageProfile}&rkey=demo`,
			{ method: "HEAD" },
		);
		expect(res.status).toBe(200);
		expect(res.headers.get("content-length")).toBe("3");
		const bytes = new Uint8Array(await res.arrayBuffer());
		expect(bytes.byteLength).toBe(0);
	});

	it("rejects non-GET/HEAD methods with 405", async () => {
		const res = await SELF.fetch(
			`https://test${PATH}?did=${DID_A}&collection=${NSID.packageProfile}&rkey=demo`,
			{ method: "POST" },
		);
		expect(res.status).toBe(405);
		expect(res.headers.get("allow")).toBe("GET, HEAD");
	});

	it("only matches publisher.profile when rkey='self'", async () => {
		// publisher.profile rkey is always 'self'; any other rkey returns 404
		// even if the (did) row exists.
		await testEnv.DB.prepare(
			`INSERT INTO publishers
			   (did, display_name, record_blob, verified_at, indexed_at)
			 VALUES (?, ?, ?, ?, ?)`,
		)
			.bind(DID_B, "Pub", new Uint8Array([0x99]), NOW.toISOString(), NOW.toISOString())
			.run();
		const wrongRkey = await SELF.fetch(
			`https://test${PATH}?did=${DID_B}&collection=${NSID.publisherProfile}&rkey=other`,
		);
		expect(wrongRkey.status).toBe(404);
		const correctRkey = await SELF.fetch(
			`https://test${PATH}?did=${DID_B}&collection=${NSID.publisherProfile}&rkey=self`,
		);
		expect(correctRkey.status).toBe(200);
	});
});

describe("XRPC dispatcher", () => {
	it("returns 404 on non-XRPC paths", async () => {
		const res = await SELF.fetch("https://test/some/random/path");
		expect(res.status).toBe(404);
	});

	it("returns 404 on unknown XRPC NSIDs", async () => {
		const res = await SELF.fetch("https://test/xrpc/com.example.notARealEndpoint");
		expect(res.status).toBe(404);
	});
});