Clarify and strengthen state invariant tests

test/data-consistency-regression.test.js

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { parseSubscriptionBody } from '../src/server/subscription.js';
+import { createStateSnapshot, normalizeStoredState } from '../src/shared/contracts/state.js';
+
+const outbound = (index) => ({
+  type: 'vless',
+  tag: index % 2 ? 'Amsterdam' : 'Frankfurt',
+  server: `vpn-${index}.example.test`,
+  server_port: 443,
+});
+
+const parse = (outbounds) => parseSubscriptionBody(JSON.stringify({ outbounds }));
+
+test('data invariant: 1, 30 and 300 servers keep unique IDs across reorder and duplicate labels', () => {
+  for (const size of [1, 30, 300]) {
+    const source = Array.from({ length: size }, (_, index) => outbound(index));
+    const before = parse(source).servers;
+    const after = parse([...source].reverse()).servers;
+
+    assert.equal(before.length, size);
+    assert.equal(new Set(before.map((server) => server.id)).size, size);
+    assert.deepEqual(
+      after.map((server) => server.id).sort(),
+      before.map((server) => server.id).sort(),
+    );
+  }
+});
+
+test('data invariant: one canonical snapshot owns server selection and never exposes the subscription URL', () => {
+  const servers = parse(Array.from({ length: 30 }, (_, index) => outbound(index))).servers;
+  const selectedServerId = servers[17].id;
+  const stored = normalizeStoredState({
+    revision: 9,
+    subscriptionUrl: 'https://provider.example/private-token',
+    servers,
+    selectedServerId,
+    appliedServerId: selectedServerId,
+  });
+  const snapshot = createStateSnapshot({
+    storedState: stored,
+    runtime: { running: false },
+    appMode: 'client',
+    configExists: true,
+    subscriptionHost: 'provider.example/…',
+    now: new Date('2026-07-12T12:00:00.000Z'),
+  });
+
+  assert.equal(snapshot.revision, 9);
+  assert.deepEqual(snapshot.selection, { desiredServerId: selectedServerId, appliedServerId: selectedServerId });
+  assert.equal(snapshot.servers.find((server) => server.id === selectedServerId)?.host, 'vpn-17.example.test');
+  assert.equal(JSON.stringify(snapshot).includes('private-token'), false);
+});