Support multi-screenshot calibration and cached shop context

test/market-import-proxy.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { forwardMarketBatch } from "../vite.config.js";
+import { forwardMarketBatch, rejectNonLocalRequest } from "../vite.config.js";
 
 test("keeps the import token in the local server-side forwarder", async () => {
   let forwarded;
@@ -19,3 +19,12 @@ test("keeps the import token in the local server-side forwarder", async () => {
   assert.equal(forwarded.init.body, '{"batchId":"one"}');
   assert.equal((await forwardMarketBatch("{}", {})).status, 503);
 });
+
+test("rejects cross-site and non-JSON calls before using the import token", () => {
+  assert.equal(
+    rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "application/json" } }),
+    null,
+  );
+  assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "https://evil.example", "content-type": "application/json" } }), 403);
+  assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "text/plain" } }), 415);
+});

test/market-outbox.test.js

@@ -11,6 +11,7 @@ test("keeps the same batch across retries and deletes only after acknowledgement
   const send = async (batch) => {
     sent.push(batch);
     if (fail) throw new Error("offline");
+    return { batchId: batch.batchId };
   };
   const options = { now: () => "2026-08-11T12:00:00.000Z", uuid: () => "batch-one" };
 
@@ -24,6 +25,27 @@ test("keeps the same batch across retries and deletes only after acknowledgement
   assert.deepEqual(await store.list(200), []);
 });
 
+test("keeps rows pending for a wrong acknowledgement and caps encoded batch size", async () => {
+  const store = memoryStore();
+  for (let index = 0; index < 80; index += 1) {
+    await store.add({ observationId: `observation-${index}`, rawText: "x".repeat(4096), storeRawText: "y".repeat(4096) });
+  }
+  let sent;
+  const outbox = new MarketOutbox(
+    store,
+    async (batch) => {
+      sent = batch;
+      return { batchId: "wrong" };
+    },
+    { now: () => "2026-08-11T12:00:00.000Z", uuid: () => "batch-two" },
+  );
+
+  await assert.rejects(outbox.flush(), /другой пакет/);
+  assert.ok(sent.observations.length < 80);
+  assert.ok(new TextEncoder().encode(JSON.stringify(sent)).byteLength <= 80 * 1024);
+  assert.equal((await store.list(200)).length, 80);
+});
+
 function memoryStore() {
   const observations = new Map();
   let batch = null;