{"usingRealCookie":false,"summary":{"total":10,"passed":10,"failed":0,"skipped":0,"credentialLeaks":0},"verdict":"FAIL-CLOSED HOLDS","checks":[{"name":"baseline","expectation":"null (synthetic id is not a live session)","outcome":"null","pass":true,"ms":1064},{"name":"wrong-token","expectation":"null — rejected credential","outcome":"null","pass":true,"ms":32},{"name":"wrong-path","expectation":"null — non-2xx","outcome":"null","pass":true,"ms":7},{"name":"unreachable-host","expectation":"null — connection refused","outcome":"null","pass":true,"ms":1,"notes":"onError: TypeError: fetch failed"},{"name":"tiny-timeout","expectation":"null — abort at 1ms","outcome":"null","pass":true,"ms":4,"notes":"onError: AbortError: This operation was aborted"},{"name":"missing-url","expectation":"throws at construction — never degrades to a stub","outcome":"threw: Error: session-validation-client: validatorUrl is required.","pass":true,"ms":null},{"name":"missing-token","expectation":"throws at construction — never degrades to a stub","outcome":"threw: Error: session-validation-client: authToken is required.","pass":true,"ms":null},{"name":"stub in production, flag set","expectation":"null — production always fails closed, flag ignored","outcome":"null","pass":true,"ms":null},{"name":"stub in development, no flag","expectation":"null — opt-in required","outcome":"null","pass":true,"ms":null},{"name":"stub in development, flag set","expectation":"session — documented insecure dev behavior. NOTE: this check makes the package print its \"INSECURE dev stub active\" warning to the server log. That line is emitted BY THIS TEST, not by your app admitting anyone.","outcome":"session","pass":true,"ms":null}],"leaks":[]}