@app-studio/qa-harness 0.2.0

package/README.md

@@ -0,0 +1,99 @@
+# @app-studio/qa-harness
+
+The shape of a test harness, and a record/replay transport whose missing
+fixtures always fail.
+
+## The harness
+
+Two small types and a helper, deliberately:
+
+```ts
+import { defineActors, type TestApp } from '@app-studio/qa-harness';
+
+export async function createTestApp(): Promise<TestApp<Client>> { /* your bootstrap */ }
+
+const actors = defineActors(app, (app) => ({
+  signUp: (email: string) => /* … */,
+  createWorkspace: (owner: Actor) => /* … */,
+  addMember: (workspace: string, actor: Actor, role: Role) => /* … */,
+}));
+```
+
+What a harness must *be* is a rule, not a library, and this package cannot
+enforce it — only say it clearly:
+
+**The application under test has to be the application that ships.** Same
+composition, same HTTP configuration, same startup. A hand-assembled test app
+validates something that does not exist in production, and the resulting green
+suite is a statement about a program nobody runs. Write the factory against your
+real bootstrap.
+
+**Prefer listening on a real port** if the application attaches anything to the
+HTTP server — WebSockets, most commonly. On a server that was never started, the
+socket library's takeover of the request listeners races the framework's own
+handler, and the occasional request falls through as a 404 on a route that
+plainly exists. That failure is intermittent, which is the worst kind.
+
+**A fresh client per actor.** Sharing one client across two roles is how an
+authorization test quietly starts proving nothing.
+
+Actors are what make authorization testing cheap enough to actually do. When "an
+owner, a member and an outsider" costs three lines, every endpoint gets its
+cross-tenant probe; when it costs thirty, the probe is what gets skipped — and
+cross-tenant access is the single most common real-world API defect.
+
+## Record and replay
+
+For anything whose answer is neither stable nor free: a model, a payment
+provider, a third-party search.
+
+```ts
+import { assertReplayBootSafety, createReplayTransport } from '@app-studio/qa-harness/replay';
+
+assertReplayBootSafety({ mode: process.env.AI_MODE ?? 'live' });
+
+const ask = createReplayTransport<Request, Response>({
+  mode: process.env.AI_MODE as ReplayMode,
+  dir: 'tests/fixtures/ai',
+  live: (request) => realProvider.complete(request),
+  source: 'gpt-4o-2026-01',
+});
+```
+
+Three rules, each the fix for a specific way this goes wrong.
+
+**A missing fixture always fails.** Never a fallback, never a default answer. A
+transport that quietly substitutes something plausible turns "this test no
+longer asks the question it was written for" into a green run — the exact
+failure the fixtures exist to prevent.
+
+**The key is a digest of the request.** Not a filename somebody chose, and not
+the test's name. Change what you ask and the fixture stops matching, so a suite
+cannot keep replaying the answer to a question it no longer asks. Key order does
+not affect the digest, so refactoring the request object does not invalidate
+every recording.
+
+**A fixture says where it came from.** A recording captured against a version of
+a service that has since changed is indistinguishable from a fresh one, and
+tests replaying it assert last year's behaviour with total confidence. The
+provenance block is required on read; `qa-guard` denies committing a fixture
+without one.
+
+### The boot guard
+
+`assertReplayBootSafety` refuses to start in `live` or `record` mode under
+`NODE_ENV=test`. A guard at the transport is too late and too easy to bypass;
+the point is that a process which *could* reach the live service never starts
+inside a test run in the first place — a run that reaches a real service is
+slow, costs money, and is not reproducible.
+
+### Housekeeping
+
+`unusedFixtures(dir, usedDigests)` lists recordings nothing asked for. Worth
+checking after a recording session: a fixture nobody replays is either dead
+weight or evidence that a code path stopped being exercised, and both are things
+to know before they are a year old.
+
+## Requirements
+
+Node.js 20 or newer. No runtime dependencies beyond `@app-studio/qa-core`.

package/dist/app.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The shape of a test harness.
+ *
+ * Deliberately thin. What the harness must *be* is a rule, not a library: the
+ * application under test has to be the application that ships — the same
+ * composition, the same HTTP configuration, the same startup — because a
+ * hand-assembled test app validates something that does not exist in
+ * production. That rule cannot be enforced by a type, only by writing the
+ * factory against the real bootstrap; what this package can do is give the
+ * factory a common shape so actors, resets and fixtures compose across
+ * projects.
+ *
+ * One detail is worth stating because it is invisible until it bites: prefer
+ * *listening* on a real port over an in-process handler if the application
+ * attaches anything to the HTTP server — WebSockets, most commonly. On a server
+ * that was never started, the socket library's takeover of the request
+ * listeners races the framework's own handler, and the occasional request falls
+ * through as a 404 on a route that plainly exists.
+ */
+export interface TestApp<Client = unknown> {
+    /** Where the application is listening, e.g. `http://127.0.0.1:53314`. */
+    baseUrl: string;
+    /**
+     * A fresh client per call — one per actor, so their sessions stay separate.
+     * Sharing one client across two roles is how an authorization test quietly
+     * starts proving nothing.
+     */
+    client(): Client;
+    close(): Promise<void>;
+}
+export type AppFactory<Options, Client> = (options?: Options) => Promise<TestApp<Client>>;
+/**
+ * Binds a set of actor helpers to a running application.
+ *
+ * Actors are what make authorization testing cheap enough to actually do. When
+ * "an owner, a member and an outsider" costs three lines, every endpoint gets
+ * its cross-tenant probe; when it costs thirty, the probe is the thing that
+ * gets skipped — and cross-tenant access is the single most common real-world
+ * API defect.
+ */
+export declare function defineActors<Client, Actors extends Record<string, unknown>>(app: TestApp<Client>, build: (app: TestApp<Client>) => Actors): Actors;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,OAAO,CAAC,MAAM,GAAG,OAAO;IACvC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,IAAI,MAAM,CAAC;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EACpB,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,GACtC,MAAM,CAER"}

package/dist/app.js

@@ -0,0 +1,32 @@
+/**
+ * The shape of a test harness.
+ *
+ * Deliberately thin. What the harness must *be* is a rule, not a library: the
+ * application under test has to be the application that ships — the same
+ * composition, the same HTTP configuration, the same startup — because a
+ * hand-assembled test app validates something that does not exist in
+ * production. That rule cannot be enforced by a type, only by writing the
+ * factory against the real bootstrap; what this package can do is give the
+ * factory a common shape so actors, resets and fixtures compose across
+ * projects.
+ *
+ * One detail is worth stating because it is invisible until it bites: prefer
+ * *listening* on a real port over an in-process handler if the application
+ * attaches anything to the HTTP server — WebSockets, most commonly. On a server
+ * that was never started, the socket library's takeover of the request
+ * listeners races the framework's own handler, and the occasional request falls
+ * through as a 404 on a route that plainly exists.
+ */
+/**
+ * Binds a set of actor helpers to a running application.
+ *
+ * Actors are what make authorization testing cheap enough to actually do. When
+ * "an owner, a member and an outsider" costs three lines, every endpoint gets
+ * its cross-tenant probe; when it costs thirty, the probe is the thing that
+ * gets skipped — and cross-tenant access is the single most common real-world
+ * API defect.
+ */
+export function defineActors(app, build) {
+    return build(app);
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAoB,EACpB,KAAuC;IAEvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC"}

package/dist/factory.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Factories for test data.
+ *
+ * The problem they solve is not typing convenience. It is that hand-written
+ * fixtures collide: two tests both build "a user" with the same email, they
+ * pass alone and fail together, and the failure looks like a bug in the
+ * application. Every value that has to be unique comes from a sequence here, so
+ * the collision cannot happen.
+ *
+ * The second thing they solve is intent. `buildUser({ email: 'a@b.c', name: 'x',
+ * role: 'ADMIN', workspaceId: 'w1', … })` buries the one field the test is
+ * about in nine that it is not. A factory states the default world once and lets
+ * each test override only what it is testing — so the override *is* the
+ * documentation of what the test is about.
+ */
+export interface FactoryContext {
+    /** Increments on every build. Use it for anything that must be unique. */
+    sequence: number;
+}
+export type Trait<T> = Partial<T> | ((context: FactoryContext) => Partial<T>);
+export interface FactoryDefinition<T, TraitName extends string = string> {
+    /** The ordinary case — what this thing looks like when nothing special is going on. */
+    build(context: FactoryContext): T;
+    /**
+     * Named variations, e.g. `expired`, `admin`, `deleted`.
+     *
+     * A trait is worth having when a variation recurs across tests; a one-off
+     * difference is better expressed as an override at the call site, where the
+     * reader can see it.
+     */
+    traits?: Record<TraitName, Trait<T>>;
+}
+export interface Factory<T, TraitName extends string = string> {
+    build(overrides?: Partial<T>): T;
+    buildList(count: number, overrides?: Partial<T> | ((index: number) => Partial<T>)): T[];
+    /** A factory with these traits applied, left to right. Does not mutate this one. */
+    with(...traits: TraitName[]): Factory<T, TraitName>;
+    /**
+     * Resets the sequence.
+     *
+     * Rarely what you want: a suite that needs the sequence reset to pass is a
+     * suite asserting on generated values, which will break the next time
+     * anything else builds one first. Provided for the case where a snapshot
+     * genuinely has to be stable.
+     */
+    reset(): void;
+}
+export declare function defineFactory<T, TraitName extends string = string>(definition: FactoryDefinition<T, TraitName>, applied?: TraitName[]): Factory<T, TraitName>;
+/**
+ * Pairs a factory with something that persists what it builds.
+ *
+ * Kept separate from `defineFactory` so the pure half stays usable in a unit
+ * test with no database, and so persistence goes through the application's own
+ * services rather than an insert — the same rule as the seeds. A record written
+ * straight to the database has none of the side effects the real path produces,
+ * and every test that then relies on those is testing a world the application
+ * cannot make.
+ */
+export declare function persisted<T, Persisted = T, TraitName extends string = string>(factory: Factory<T, TraitName>, persist: (attributes: T) => Promise<Persisted>): {
+    build: Factory<T, TraitName>['build'];
+    create(overrides?: Partial<T>): Promise<Persisted>;
+    createList(count: number, overrides?: Partial<T> | ((index: number) => Partial<T>)): Promise<Persisted[]>;
+};
+//# sourceMappingURL=factory.d.ts.map

package/dist/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,iBAAiB,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,GAAG,MAAM;IACrE,uFAAuF;IACvF,KAAK,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,GAAG,MAAM;IAC3D,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxF,oFAAoF;IACpF,IAAI,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,GAAG,MAAM,EAChE,UAAU,EAAE,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,EAC3C,OAAO,GAAE,SAAS,EAAO,GACxB,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAyCvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,SAAS,MAAM,GAAG,MAAM,EAC3E,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,EAC9B,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,GAC7C;IACD,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CAC3G,CAcA"}

package/dist/factory.js

@@ -0,0 +1,72 @@
+/**
+ * Factories for test data.
+ *
+ * The problem they solve is not typing convenience. It is that hand-written
+ * fixtures collide: two tests both build "a user" with the same email, they
+ * pass alone and fail together, and the failure looks like a bug in the
+ * application. Every value that has to be unique comes from a sequence here, so
+ * the collision cannot happen.
+ *
+ * The second thing they solve is intent. `buildUser({ email: 'a@b.c', name: 'x',
+ * role: 'ADMIN', workspaceId: 'w1', … })` buries the one field the test is
+ * about in nine that it is not. A factory states the default world once and lets
+ * each test override only what it is testing — so the override *is* the
+ * documentation of what the test is about.
+ */
+export function defineFactory(definition, applied = []) {
+    let sequence = 0;
+    const factory = {
+        build(overrides = {}) {
+            sequence += 1;
+            const context = { sequence };
+            let value = definition.build(context);
+            for (const name of applied) {
+                const trait = definition.traits?.[name];
+                if (trait === undefined) {
+                    throw new Error(`This factory has no trait "${name}". Declared: ${Object.keys(definition.traits ?? {}).join(', ') || '(none)'}.`);
+                }
+                value = { ...value, ...(typeof trait === 'function' ? trait(context) : trait) };
+            }
+            return { ...value, ...overrides };
+        },
+        buildList(count, overrides) {
+            return Array.from({ length: count }, (_unused, index) => factory.build(typeof overrides === 'function' ? overrides(index) : overrides));
+        },
+        with(...traits) {
+            // A new factory rather than a mutation: `userFactory.with('admin')` must
+            // not turn every later `userFactory.build()` into an administrator, which
+            // is the kind of action-at-a-distance that costs an afternoon.
+            return defineFactory(definition, [...applied, ...traits]);
+        },
+        reset() {
+            sequence = 0;
+        },
+    };
+    return factory;
+}
+/**
+ * Pairs a factory with something that persists what it builds.
+ *
+ * Kept separate from `defineFactory` so the pure half stays usable in a unit
+ * test with no database, and so persistence goes through the application's own
+ * services rather than an insert — the same rule as the seeds. A record written
+ * straight to the database has none of the side effects the real path produces,
+ * and every test that then relies on those is testing a world the application
+ * cannot make.
+ */
+export function persisted(factory, persist) {
+    return {
+        build: (overrides) => factory.build(overrides),
+        create: async (overrides) => persist(factory.build(overrides)),
+        createList: async (count, overrides) => {
+            const created = [];
+            // Sequentially: concurrent creates against one database routinely deadlock
+            // on the same unique index, and the failure reads as flakiness.
+            for (const attributes of factory.buildList(count, overrides)) {
+                created.push(await persist(attributes));
+            }
+            return created;
+        },
+    };
+}
+//# sourceMappingURL=factory.js.map

package/dist/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsCH,MAAM,UAAU,aAAa,CAC3B,UAA2C,EAC3C,UAAuB,EAAE;IAEzB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,MAAM,OAAO,GAA0B;QACrC,KAAK,CAAC,SAAS,GAAG,EAAE;YAClB,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,OAAO,GAAmB,EAAE,QAAQ,EAAE,CAAC;YAC7C,IAAI,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEtC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,gBAAgB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACjH,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QACpC,CAAC;QAED,SAAS,CAAC,KAAK,EAAE,SAAS;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACtD,OAAO,CAAC,KAAK,CAAC,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,MAAM;YACZ,yEAAyE;YACzE,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAO,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK;YACH,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CACvB,OAA8B,EAC9B,OAA8C;IAM9C,OAAO;QACL,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACrC,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,2EAA2E;YAC3E,gEAAgE;YAChE,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { defineActors, type AppFactory, type TestApp } from './app.js';
+export { MissingFixtureError, ReplayBootError, assertReplayBootSafety, createReplayTransport, digestOf, unusedFixtures, type Fixture, type Provenance, type ReplayMode, type ReplayTransportOptions, } from './replay/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { defineActors } from './app.js';
+export { MissingFixtureError, ReplayBootError, assertReplayBootSafety, createReplayTransport, digestOf, unusedFixtures, } from './replay/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiC,MAAM,UAAU,CAAC;AAEvE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,QAAQ,EACR,cAAc,GAKf,MAAM,mBAAmB,CAAC"}

package/dist/nest/index.d.ts

@@ -0,0 +1,67 @@
+import type { TestApp } from '../app.js';
+/**
+ * The harness for a Nest application, with the one detail nobody gets right twice.
+ *
+ * Everything here is the same in any Nest repository: build a testing module,
+ * apply the overrides, create the application, hand it to the host's own HTTP
+ * configuration, start it, hand back a client factory and a close. What is *not*
+ * the same — which modules compose the app, how it is configured, what a client
+ * is — is passed in.
+ *
+ * **It listens on a real port rather than calling `init`.** That is the detail.
+ * If the application attaches anything to the HTTP server — a WebSocket gateway,
+ * most commonly — then on a server that was never started, the socket library's
+ * takeover of the request listeners races the framework's own handler, and the
+ * occasional request falls through as a 404 on a route that plainly exists. It
+ * looks like flakiness, it reproduces once an hour, and it costs an afternoon
+ * every time somebody meets it. Both repositories this was drawn from had found
+ * it and written the workaround in a comment; here it is not a comment.
+ *
+ * Typed structurally, so this package does not resolve its own copy of Nest —
+ * two Nest instances is two injection containers that cannot see each other's
+ * providers.
+ */
+export interface NestTestingBuilder {
+    overrideProvider(token: unknown): {
+        useValue(value: unknown): NestTestingBuilder;
+    };
+    compile(): Promise<{
+        createNestApplication(): NestApplication;
+    }>;
+}
+export interface NestApplication {
+    listen(port: number): Promise<unknown>;
+    getHttpServer(): unknown;
+    getUrl?(): Promise<string>;
+    close(): Promise<void>;
+    get<T>(token: unknown): T;
+}
+export interface NestHarnessOptions<Client> {
+    /**
+     * Builds the testing module. Given the modules to import, so a caller can
+     * leave one out and prove the application still composes without it.
+     */
+    createBuilder(imports: unknown[]): NestTestingBuilder;
+    /** The modules that make the application, in the order production uses. */
+    imports(): unknown[];
+    /**
+     * The host's own HTTP configuration — pipes, filters, cookie parsing.
+     *
+     * Required rather than optional, and unapologetically: an application
+     * assembled differently for tests validates something that does not ship.
+     */
+    configure(app: NestApplication): void | Promise<void>;
+    /** A fresh client per call, one per actor, so sessions stay separate. */
+    client(server: unknown): Client;
+    /** Providers to swap at true external boundaries only. */
+    overrides?: Array<{
+        token: unknown;
+        value: unknown;
+    }>;
+}
+export interface NestTestApp<Client> extends TestApp<Client> {
+    /** The running application, for the rare test that needs a provider. */
+    app: NestApplication;
+}
+export declare function createNestTestApp<Client>(options: NestHarnessOptions<Client>): Promise<NestTestApp<Client>>;
+//# sourceMappingURL=index.d.ts.map

package/dist/nest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAAA;KAAE,CAAC;IACnF,OAAO,IAAI,OAAO,CAAC;QAAE,qBAAqB,IAAI,eAAe,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,aAAa,IAAI,OAAO,CAAC;IACzB,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB,CAAC,MAAM;IACxC;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;IACtD,2EAA2E;IAC3E,OAAO,IAAI,OAAO,EAAE,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,yEAAyE;IACzE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,WAAW,CAAC,MAAM,CAAE,SAAQ,OAAO,CAAC,MAAM,CAAC;IAC1D,wEAAwE;IACxE,GAAG,EAAE,eAAe,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAuBjH"}

package/dist/nest/index.js

@@ -0,0 +1,19 @@
+export async function createNestTestApp(options) {
+    let builder = options.createBuilder(options.imports());
+    for (const { token, value } of options.overrides ?? []) {
+        builder = builder.overrideProvider(token).useValue(value);
+    }
+    const moduleRef = await builder.compile();
+    const app = moduleRef.createNestApplication();
+    await options.configure(app);
+    // Port zero: the operating system picks a free one, so suites never collide.
+    await app.listen(0);
+    const baseUrl = app.getUrl === undefined ? '' : await app.getUrl();
+    return {
+        app,
+        baseUrl,
+        client: () => options.client(app.getHttpServer()),
+        close: () => app.close(),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/nest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":"AAgEA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAS,OAAmC;IACjF,IAAI,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEvD,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACvD,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;IAE9C,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE7B,6EAA6E;IAC7E,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEpB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IAEnE,OAAO;QACL,GAAG;QACH,OAAO;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE;KACzB,CAAC;AACJ,CAAC"}

package/dist/replay/index.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Record and replay for non-deterministic services — a model, a payment
+ * provider, anything whose answer is neither stable nor free.
+ *
+ * Three rules, each the fix for a specific way this goes wrong.
+ *
+ * **A missing fixture always fails.** Never a fallback, never a default answer.
+ * A transport that quietly substitutes something plausible turns "this test no
+ * longer asks the question it was written for" into a green run — the exact
+ * failure the fixtures exist to prevent.
+ *
+ * **The key is a digest of the request.** Not a filename somebody chose, and
+ * not the test's name. Change what you ask and the fixture stops matching, so a
+ * suite cannot keep replaying the answer to a question it no longer asks.
+ *
+ * **A fixture says where it came from.** A recording captured against a version
+ * of a service that has since changed is indistinguishable from a fresh one,
+ * and tests replaying it assert last year's behaviour with total confidence.
+ */
+export type ReplayMode = 'live' | 'record' | 'replay';
+export interface Provenance {
+    /** What produced it — a model name, a provider, a version. */
+    source: string;
+    recordedAt: string;
+    requestDigest: string;
+    /** Anything else worth knowing when this is read a year from now. */
+    notes?: string;
+}
+export interface Fixture<Response> {
+    provenance: Provenance;
+    response: Response;
+}
+export declare class MissingFixtureError extends Error {
+    readonly digest: string;
+    readonly dir: string;
+    readonly known: string[];
+    constructor(digest: string, dir: string, known: string[]);
+}
+export declare class ReplayBootError extends Error {
+    constructor(mode: string);
+}
+/**
+ * Call this where the application boots.
+ *
+ * A guard at the transport is too late and too easy to bypass; the point is
+ * that a process which *could* reach the live service never starts inside a
+ * test run in the first place.
+ */
+export declare function assertReplayBootSafety(options: {
+    mode: string;
+    nodeEnv?: string | undefined;
+}): void;
+/** Stable digest of anything JSON-serialisable, with object keys sorted. */
+export declare function digestOf(request: unknown): string;
+export interface ReplayTransportOptions<Request, Response> {
+    mode: ReplayMode;
+    /** Where fixtures live, absolute or relative to the process. */
+    dir: string;
+    /** Overrides the default digest — use it to drop fields that legitimately vary. */
+    digest?: (request: Request) => string;
+    /** The real service. Required for `live` and `record`. */
+    live?: (request: Request) => Promise<Response>;
+    /** What to write into a new recording's provenance. */
+    source?: string;
+    now?: () => Date;
+}
+export declare function createReplayTransport<Request, Response>(options: ReplayTransportOptions<Request, Response>): (request: Request) => Promise<Response>;
+/**
+ * Fixtures in `dir` that nothing asked for during a run.
+ *
+ * Worth reporting after a recording session: a fixture nobody replays is either
+ * dead weight or evidence that a code path stopped being exercised, and both
+ * are things you want to know before they are a year old.
+ */
+export declare function unusedFixtures(dir: string, usedDigests: Iterable<string>): string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/replay/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/replay/index.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO,CAAC,QAAQ;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAFf,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EAAE;CAa3B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,IAAI,EAAE,MAAM;CAQzB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAKpG;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEjD;AAcD,MAAM,WAAW,sBAAsB,CAAC,OAAO,EAAE,QAAQ;IACvD,IAAI,EAAE,UAAU,CAAC;IACjB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC;IACtC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EACrD,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,GACjD,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA0CzC;AAaD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAGnF"}

package/dist/replay/index.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export class MissingFixtureError extends Error {
+    digest;
+    dir;
+    known;
+    constructor(digest, dir, known) {
+        super(`No recorded answer for request ${digest} in ${dir}.\n` +
+            'This is a failure, not a reason to fall back: an invented answer would let a test keep passing after ' +
+            'it stopped asking the question it was written for.\n' +
+            (known.length === 0
+                ? 'Nothing has been recorded here yet. Run with mode "record" against the real service.'
+                : `Recorded here: ${known.slice(0, 5).join(', ')}${known.length > 5 ? `, +${known.length - 5} more` : ''}. ` +
+                    'If the request changed on purpose, re-record it; the old fixture answers a question nobody asks any more.'));
+        this.digest = digest;
+        this.dir = dir;
+        this.known = known;
+        this.name = 'MissingFixtureError';
+    }
+}
+export class ReplayBootError extends Error {
+    constructor(mode) {
+        super(`Refusing to start in "${mode}" mode under NODE_ENV=test. A test run that reaches a real service is ` +
+            'slow, costs money, and — worse — is not reproducible: the suite passes or fails on something outside ' +
+            'the repository. Use mode "replay", or unset NODE_ENV if this really is a recording session.');
+        this.name = 'ReplayBootError';
+    }
+}
+/**
+ * Call this where the application boots.
+ *
+ * A guard at the transport is too late and too easy to bypass; the point is
+ * that a process which *could* reach the live service never starts inside a
+ * test run in the first place.
+ */
+export function assertReplayBootSafety(options) {
+    const nodeEnv = options.nodeEnv ?? process.env['NODE_ENV'];
+    if (nodeEnv !== 'test')
+        return;
+    if (options.mode === 'replay')
+        return;
+    throw new ReplayBootError(options.mode);
+}
+/** Stable digest of anything JSON-serialisable, with object keys sorted. */
+export function digestOf(request) {
+    return createHash('sha256').update(canonicalise(request)).digest('hex').slice(0, 16);
+}
+function canonicalise(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalise).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalise(entry)}`);
+    return `{${entries.join(',')}}`;
+}
+export function createReplayTransport(options) {
+    const digestOfRequest = options.digest ?? ((request) => digestOf(request));
+    return async function transport(request) {
+        const digest = digestOfRequest(request);
+        const path = join(options.dir, `${digest}.json`);
+        if (options.mode === 'replay') {
+            if (!existsSync(path))
+                throw new MissingFixtureError(digest, options.dir, recordedDigests(options.dir));
+            const fixture = JSON.parse(readFileSync(path, 'utf8'));
+            if (fixture.provenance === undefined) {
+                throw new Error(`${path} has no provenance block, so there is no way to tell whether it was recorded against a ` +
+                    'version of the service that still exists. Re-record it.');
+            }
+            return fixture.response;
+        }
+        if (options.live === undefined) {
+            throw new Error(`Mode "${options.mode}" needs a live implementation to call.`);
+        }
+        const response = await options.live(request);
+        if (options.mode === 'record') {
+            mkdirSync(options.dir, { recursive: true });
+            const fixture = {
+                provenance: {
+                    source: options.source ?? 'unknown',
+                    recordedAt: (options.now?.() ?? new Date()).toISOString(),
+                    requestDigest: digest,
+                },
+                response,
+            };
+            writeFileSync(path, `${JSON.stringify(fixture, null, 2)}\n`, 'utf8');
+        }
+        return response;
+    };
+}
+function recordedDigests(dir) {
+    try {
+        return readdirSync(dir)
+            .filter((entry) => entry.endsWith('.json'))
+            .map((entry) => entry.replace(/\.json$/, ''))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Fixtures in `dir` that nothing asked for during a run.
+ *
+ * Worth reporting after a recording session: a fixture nobody replays is either
+ * dead weight or evidence that a code path stopped being exercised, and both
+ * are things you want to know before they are a year old.
+ */
+export function unusedFixtures(dir, usedDigests) {
+    const used = new Set(usedDigests);
+    return recordedDigests(dir).filter((digest) => !used.has(digest));
+}
+//# sourceMappingURL=index.js.map

package/dist/replay/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/replay/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsCjC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IACA;IACA;IAHX,YACW,MAAc,EACd,GAAW,EACX,KAAe;QAExB,KAAK,CACH,kCAAkC,MAAM,OAAO,GAAG,KAAK;YACrD,uGAAuG;YACvG,sDAAsD;YACtD,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,sFAAsF;gBACxF,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI;oBAC1G,2GAA2G,CAAC,CACnH,CAAC;QAZO,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,UAAK,GAAL,KAAK,CAAU;QAWxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,IAAY;QACtB,KAAK,CACH,yBAAyB,IAAI,wEAAwE;YACnG,uGAAuG;YACvG,6FAA6F,CAChG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAuD;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO;IAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE1E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAeD,MAAM,UAAU,qBAAqB,CACnC,OAAkD;IAElD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpF,OAAO,KAAK,UAAU,SAAS,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;QAEjD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;YAE5E,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,yFAAyF;oBAC9F,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,CAAC,IAAI,wCAAwC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAsB;gBACjC,UAAU,EAAE;oBACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;oBACnC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;oBACzD,aAAa,EAAE,MAAM;iBACtB;gBACD,QAAQ;aACT,CAAC;YACF,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aAC5C,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAA6B;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@app-studio/qa-harness",
+  "version": "0.2.0",
+  "description": "The shape of a test harness — the real application under test, actors that make multi-role tests cheap — plus a record/replay transport whose missing fixtures always fail.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./replay": {
+      "types": "./dist/replay/index.d.ts",
+      "default": "./dist/replay/index.js"
+    },
+    "./nest": {
+      "types": "./dist/nest/index.d.ts",
+      "default": "./dist/nest/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@app-studio/qa-core": "^0.2.0"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsc -p tsconfig.json",
+    "test": "vitest run"
+  }
+}