feat: migrate workspace configuration domains to ServerApi

web/workspace/test/config-source/api.test.ts

@@ -1,11 +1,18 @@
 /// <reference lib="deno.ns" />
 
-import { assert, assertEquals } from "jsr:@std/assert";
+import {
+  assert,
+  assertEquals,
+  assertRejects,
+  assertThrows,
+} from "jsr:@std/assert";
 import {
   commitConfigTree,
+  ConfigSourceApiError,
   fetchConfigEntry,
   fetchConfigRevision,
   fetchConfigTree,
+  parseWorkspaceConfigTreeResponse,
 } from "../../src/lib/workspace/config-source/api.ts";
 
 function response(body: unknown, status = 200): Response {
@@ -15,11 +22,43 @@ function response(body: unknown, status = 200): Response {
   });
 }
 
+const entry = {
+  path: "profiles/main.dcdl",
+  content_type: "decodal",
+  content: "profile = {}",
+  content_digest: "sha256:entry",
+};
+const snapshot = {
+  revision: 7,
+  digest: "sha256:tree",
+  entries: { "profiles/main.dcdl": entry },
+};
+const tree = {
+  snapshot,
+  contract: {
+    contract_version: 1,
+    decodal_version: "0.4.0",
+    schema_version: 1,
+    entrypoints: ["main.dcdl"],
+    import_policy_version: 1,
+    schema_bundle: {
+      contributions: [],
+      source: "builtin",
+      fingerprint: "sha256:schema",
+    },
+    fingerprint: "sha256:toolchain",
+  },
+  projection_digest: "sha256:projection",
+};
+
 Deno.test("config source API commits directly through the workspace scope", async () => {
   const calls: Array<{ url: string; init?: RequestInit }> = [];
   const fetcher = ((input: string | URL | Request, init?: RequestInit) => {
-    calls.push({ url: String(input), init });
-    return Promise.resolve(response({ ok: true }));
+    const url = String(input);
+    calls.push({ url, init });
+    if (url.includes("/entries/")) return Promise.resolve(response(entry));
+    if (url.includes("/revisions/")) return Promise.resolve(response(snapshot));
+    return Promise.resolve(response(tree));
   }) as typeof fetch;
 
   await fetchConfigTree("w/one", fetcher);
@@ -44,7 +83,63 @@ Deno.test("config source API commits directly through the workspace scope", asyn
   );
 });
 
-Deno.test("config source API surfaces failed evaluation instead of treating it as a successful commit", async () => {
+Deno.test("config source API rejects unknown response fields", async () => {
+  const fetcher =
+    (() =>
+      Promise.resolve(response({ ...tree, unexpected: true }))) as typeof fetch;
+  await assertRejects(
+    () => fetchConfigTree("w", fetcher),
+    ConfigSourceApiError,
+    "invalid response",
+  );
+});
+
+Deno.test("config source API rejects mismatched entry map paths", async () => {
+  const invalid = {
+    ...tree,
+    snapshot: {
+      ...snapshot,
+      entries: { "profiles/other.dcdl": entry },
+    },
+  };
+  const fetcher = (() => Promise.resolve(response(invalid))) as typeof fetch;
+  await assertRejects(
+    () => fetchConfigTree("w", fetcher),
+    ConfigSourceApiError,
+    "invalid response",
+  );
+});
+
+Deno.test("config source API rejects unsafe revisions and oversized entry content", () => {
+  assertThrows(
+    () =>
+      parseWorkspaceConfigTreeResponse({
+        ...tree,
+        snapshot: { ...snapshot, revision: Number.MAX_SAFE_INTEGER + 1 },
+      }),
+    ConfigSourceApiError,
+    "invalid response",
+  );
+  assertThrows(
+    () =>
+      parseWorkspaceConfigTreeResponse({
+        ...tree,
+        snapshot: {
+          ...snapshot,
+          entries: {
+            "profiles/main.dcdl": {
+              ...entry,
+              content: "x".repeat(256 * 1024 + 1),
+            },
+          },
+        },
+      }),
+    ConfigSourceApiError,
+    "invalid response",
+  );
+});
+
+Deno.test("config source API surfaces bounded failed evaluation details", async () => {
   const fetcher = (() =>
     Promise.resolve(
       new Response("structured diagnostics", { status: 422 }),