@capxul/sdk 0.0.0-rc-2cdddbb91

package/dist/testing/index.d.mts

@@ -0,0 +1,151 @@
+import { Ao as TelemetryIdentifyInput, Mo as TelemetryPortEvent, R as CapxulClient, T as OpenfortBrowserSignerOptions, Vo as ObservationAdapter, Xo as CapxulResult, at as IdentityTransition, ba as CapxulSigner, c as CapxulClientInput, jo as TelemetryEvent, ko as TelemetryGroupInput, ro as OrganizationSetup } from "../index-Czjrh-Fo.mjs";
+import { Effect, Layer } from "effect";
+//#region src/platform/production-client.d.ts
+/** Per-client signing controls; only the testing entry exposes these to consumers. */
+interface ProductionSignerControls {
+  /** Final signing call. Address, readiness and session lifecycle retain their real owner. */
+  readonly signUserOpHash?: (hash: Parameters<CapxulSigner["signUserOpHash"]>[0], signer: CapxulSigner & {
+    readonly resetSession?: () => void;
+  }) => ReturnType<CapxulSigner["signUserOpHash"]>;
+  /** Embedded signing calls, including the existing recovery owner's single retry. */
+  readonly signEmbeddedUserOpHash?: OpenfortBrowserSignerOptions["signUserOpHash"];
+}
+//#endregion
+//#region src/testing/production-client.d.ts
+/** Create the one production client with per-client controls at its signing boundaries. */
+export declare function createCapxulProductionTestClient(input: CapxulClientInput, controls: ProductionSignerControls): Promise<CapxulResult<CapxulClient>>;
+//#endregion
+//#region src/testing/signer-faults.d.ts
+/**
+ * Which provider refusal to inject. The codes are the ones the SDK's own
+ * classifiers decode (`src/signing/signer.ts`), so a fault reaches the public error
+ * contract through the real decode path rather than a shortcut.
+ *
+ * - `missing-signer` — Openfort's typed not-ready code. `openfortSignerNotReadyCode`
+ *   decodes it, so the production recovery wrapper runs its single retry (A02).
+ * - `user-rejected` — the EIP-1193 4001 result. `signerFailure` decodes it to
+ *   `SIGNER_REJECTED`, an expected refusal (A08).
+ * - `unexpected` — no provider code at all, so it stays an unexpected
+ *   `PROVIDER_ERROR` (A09).
+ */
+type SignerFaultKind = "missing-signer" | "user-rejected" | "unexpected";
+/** The value a controlled fault throws. Named so a test can assert its origin. */
+export declare class ControlledSignerFault extends Error {
+  readonly kind: SignerFaultKind;
+  /** Provider code the SDK classifiers read; absent for `unexpected`. */
+  readonly code: string | number | undefined;
+  constructor(kind: SignerFaultKind);
+}
+/** Build one fault value without the harness, for a caller that writes its own control. */
+export declare function signerFaultCause(kind: SignerFaultKind): ControlledSignerFault;
+interface SignerFaultPlan {
+  /**
+   * Fault the next embedded signature ONCE, beneath the production recovery
+   * wrapper, then delegate every later call to the real signer. The address
+   * read and the readiness cycle still run first, so the fault lands at the
+   * actual final signing boundary after the prepared-command equality checks.
+   */
+  readonly signOnce?: SignerFaultKind;
+  /**
+   * Call the production signer's own `resetSession()` ONCE, immediately before
+   * the next signature and after the command is prepared. The delegate then
+   * re-runs the real readiness cycle, so the configure request under test is
+   * the first one the browser observes after the `reset-session` record (A03).
+   *
+   * Throws when the composed signer owns no session — a silently skipped reset
+   * would leave the run looking green while proving nothing.
+   */
+  readonly resetSessionBeforeNextSign?: boolean;
+}
+/** What the seam did. JSON-serializable, so a browser test can read it back. */
+interface SignerSeamRecord {
+  readonly boundary: "reset-session" | "embedded-sign";
+  /** 1-based count of calls at that boundary. */
+  readonly attempt: number;
+  readonly hash?: string;
+  /** Present only on the call that actually threw. */
+  readonly fault?: SignerFaultKind;
+  readonly atMs: number;
+}
+interface ArmedSignerSeam {
+  /** Hand these to `createCapxulProductionTestClient`. */
+  readonly controls: ProductionSignerControls;
+  /** Oldest first. Empty until the client reaches a signing boundary. */
+  readonly records: () => readonly SignerSeamRecord[];
+  /** True once every armed one-shot has fired. */
+  readonly spent: () => boolean;
+}
+/**
+ * Arm one-shot faults on the production embedded signer.
+ *
+ * ```ts
+ * const seam = armSignerFaults({ signOnce: "user-rejected" });
+ * const client = await createCapxulProductionTestClient(input, seam.controls);
+ * const result = await client.org(orgId).permissions.create(command);
+ * // result.error.code === "SIGNER_REJECTED"; nothing was submitted.
+ * // seam.records() names the boundary that refused.
+ * ```
+ *
+ * An empty plan installs no controls, which composes the ordinary client.
+ */
+export declare function armSignerFaults(plan?: SignerFaultPlan): ArmedSignerSeam;
+//#endregion
+//#region src/testing/organization-setup.d.ts
+/** Exact backend setup shape for SDK tests. */
+export declare function organizationSetupFixture(orgId: string, status?: OrganizationSetup["status"], overrides?: Partial<OrganizationSetup>): OrganizationSetup;
+//#endregion
+//#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
+type RecordingTelemetryOperation = {
+  readonly type: "emit";
+  readonly event: TelemetryPortEvent;
+} | {
+  readonly type: "identify";
+  readonly input: TelemetryIdentifyInput;
+} | {
+  readonly type: "group";
+  readonly input: TelemetryGroupInput;
+} | {
+  readonly type: "reset";
+};
+//#endregion
+//#region src/testing/index.d.ts
+export interface CreateCapxulTestClientOptions {
+  readonly requirement?: "none" | "counterfactual" | "deployed";
+  /** Optional Core SDK failure adapter for packed consumer proofs. */
+  readonly failureObservation?: ObservationAdapter;
+}
+export interface SeedTestIdentityInput {
+  readonly authUserId: string;
+  readonly email: string;
+  readonly displayName?: string;
+  readonly country?: string;
+}
+export interface CapxulTestClient {
+  readonly client: CapxulClient;
+  readonly clock: CapxulTestClock;
+  readonly observation: CapxulTestObservation;
+  readonly transitions: readonly IdentityTransition[];
+  readonly observations: readonly RecordingTelemetryOperation[];
+  readonly peekOtp: (email: string) => string | undefined;
+  readonly seedIdentity: (input: SeedTestIdentityInput) => Promise<void>;
+  readonly organizationSetup: {
+    readonly set: (setup: OrganizationSetup) => void;
+  };
+  readonly close: () => Promise<void>;
+}
+export interface CapxulTestClock {
+  readonly advance: (ms: number) => Promise<void>;
+}
+export interface CapxulTestObservation {
+  readonly emit: (event: TelemetryEvent) => Promise<void>;
+  readonly identify: (input: TelemetryIdentifyInput) => Promise<void>;
+  readonly group: (input: TelemetryGroupInput) => Promise<void>;
+  readonly reset: () => Promise<void>;
+}
+/**
+ * Assemble the real public client over deterministic in-memory ports.
+ * Unconfigured backend calls fail locally; no adapter owns a network exit.
+ */
+export declare function createCapxulTestClient(options?: CreateCapxulTestClientOptions): CapxulTestClient;
+//#endregion
+export type { ArmedSignerSeam, ProductionSignerControls, SignerFaultKind, SignerFaultPlan, SignerSeamRecord };