@chidchanun/bcp 0.2.13 → 0.2.15

package/packages/client/src/testing.mjs

@@ -0,0 +1,2357 @@
+// packages/server/src/testing.ts
+import {
+  randomUUID
+} from "node:crypto";
+import {
+  isDeepStrictEqual
+} from "node:util";
+
+// packages/server/src/security.ts
+var DEFAULT_BODY_LIMIT = 1024 * 1024;
+function assertSafeMiddlewareTarget(target, originalUrl, kind) {
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new Error(
+      `BCP Framework: middleware ${kind} only supports http: and https: URLs.`
+    );
+  }
+  if (target.username || target.password) {
+    throw new Error(
+      `BCP Framework: middleware ${kind} URLs must not contain credentials.`
+    );
+  }
+  if (kind === "rewrite" && target.origin !== originalUrl.origin) {
+    throw new Error(
+      "BCP Framework: middleware rewrites must stay on the same origin."
+    );
+  }
+}
+
+// packages/server/src/middleware.ts
+var middlewareRedirectTargets = /* @__PURE__ */ new WeakMap();
+async function executeMiddlewarePipeline(module, input, downstream) {
+  const initialUrl = input.url instanceof URL ? new URL(
+    input.url.href
+  ) : new URL(
+    input.url
+  );
+  const method = input.method ?? "GET";
+  const initialHeaders = new Headers(
+    input.headers
+  );
+  if (!module || isFrameworkInternalPath(
+    initialUrl.pathname
+  ) || !matchesMiddleware(
+    initialUrl.pathname,
+    module.config?.matcher
+  )) {
+    return downstream({
+      url: initialUrl,
+      method,
+      headers: initialHeaders
+    });
+  }
+  const handlers = getMiddlewareHandlers(
+    module
+  );
+  if (handlers.length === 0) {
+    return downstream({
+      url: initialUrl,
+      method,
+      headers: initialHeaders
+    });
+  }
+  const current = {
+    url: initialUrl,
+    headers: initialHeaders
+  };
+  const context = {
+    state: /* @__PURE__ */ Object.create(
+      null
+    )
+  };
+  const dispatch = async (index) => {
+    if (index >= handlers.length) {
+      return downstream({
+        url: new URL(
+          current.url.href
+        ),
+        method,
+        headers: new Headers(
+          current.headers
+        )
+      });
+    }
+    const handler = handlers[index];
+    const request = createMiddlewareRequest(
+      current.url,
+      method,
+      current.headers
+    );
+    let nextPromise = null;
+    const runNext = () => {
+      if (nextPromise) {
+        throw new Error(
+          "BCP Framework: middleware next() may only be called once per handler."
+        );
+      }
+      nextPromise = dispatch(
+        index + 1
+      );
+      return nextPromise;
+    };
+    const invoke = handler;
+    const result = await invoke(
+      request,
+      runNext,
+      context
+    );
+    if (result === void 0) {
+      return nextPromise ? await nextPromise : runNext();
+    }
+    if (result instanceof Response) {
+      return result;
+    }
+    if (result.type === "redirect") {
+      const target = new URL(
+        result.url,
+        current.url
+      );
+      assertSafeMiddlewareTarget(
+        target,
+        current.url,
+        "redirect"
+      );
+      const headers2 = new Headers(
+        result.headers
+      );
+      headers2.set(
+        "Location",
+        target.href
+      );
+      const response2 = new Response(
+        null,
+        {
+          status: result.status,
+          headers: headers2
+        }
+      );
+      middlewareRedirectTargets.set(
+        response2,
+        target
+      );
+      return response2;
+    }
+    if (result.type === "rewrite") {
+      if (nextPromise) {
+        throw new Error(
+          "BCP Framework: rewrite() must be returned before middleware calls next()."
+        );
+      }
+      const target = new URL(
+        result.url,
+        current.url
+      );
+      assertSafeMiddlewareTarget(
+        target,
+        current.url,
+        "rewrite"
+      );
+      current.url = target;
+      current.headers = mergeHeaders(
+        current.headers,
+        result.requestHeaders
+      );
+      const response2 = await runNext();
+      return applyHeadersToResponse(
+        response2,
+        result.responseHeaders
+      );
+    }
+    current.headers = mergeHeaders(
+      current.headers,
+      result.requestHeaders
+    );
+    const response = nextPromise ? await nextPromise : await runNext();
+    return applyHeadersToResponse(
+      response,
+      result.responseHeaders
+    );
+  };
+  return dispatch(0);
+}
+function matchesMiddleware(pathname, matcher) {
+  if (matcher === void 0) {
+    return true;
+  }
+  const matchers = Array.isArray(
+    matcher
+  ) ? matcher : [
+    matcher
+  ];
+  if (matchers.length === 0) {
+    return false;
+  }
+  return matchers.some(
+    (value) => {
+      if (value instanceof RegExp) {
+        value.lastIndex = 0;
+        return value.test(
+          pathname
+        );
+      }
+      return matchPathPattern(
+        pathname,
+        value
+      );
+    }
+  );
+}
+function getMiddlewareHandlers(module) {
+  const value = module.middleware ?? module.default;
+  if (!value) {
+    return [];
+  }
+  return Array.isArray(
+    value
+  ) ? [
+    ...value
+  ] : [
+    value
+  ];
+}
+function createMiddlewareRequest(url, method, headers2) {
+  const requestUrl = new URL(
+    url.href
+  );
+  const requestHeaders = new Headers(
+    headers2
+  );
+  return {
+    url: requestUrl.href,
+    method,
+    headers: requestHeaders,
+    nextUrl: requestUrl,
+    cookies: createCookieStore(
+      requestHeaders.get(
+        "cookie"
+      )
+    )
+  };
+}
+function applyHeadersToResponse(response, additions) {
+  let hasAdditions = false;
+  additions.forEach(
+    () => {
+      hasAdditions = true;
+    }
+  );
+  if (!hasAdditions) {
+    return response;
+  }
+  const headers2 = new Headers(
+    response.headers
+  );
+  additions.forEach(
+    (value, key) => {
+      headers2.set(
+        key,
+        value
+      );
+    }
+  );
+  const wrapped = new Response(
+    response.body,
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: headers2
+    }
+  );
+  const redirectTarget = middlewareRedirectTargets.get(
+    response
+  );
+  if (redirectTarget) {
+    middlewareRedirectTargets.set(
+      wrapped,
+      redirectTarget
+    );
+  }
+  return wrapped;
+}
+function matchPathPattern(pathname, pattern) {
+  if (pattern === "*" || pattern === "/:path*") {
+    return true;
+  }
+  if (!pattern.startsWith(
+    "/"
+  )) {
+    throw new Error(
+      `BCP Framework: middleware matcher "${pattern}" must start with "/".`
+    );
+  }
+  const escaped = pattern.split("/").filter(
+    Boolean
+  ).map(
+    (segment) => {
+      if (segment === "*" || /^:[A-Za-z_][A-Za-z0-9_]*\*$/.test(
+        segment
+      )) {
+        return "(?:.*)?";
+      }
+      if (/^:[A-Za-z_][A-Za-z0-9_]*$/.test(
+        segment
+      )) {
+        return "[^/]+";
+      }
+      return escapeRegExp(
+        segment
+      );
+    }
+  );
+  if (escaped.length === 0) {
+    return pathname === "/";
+  }
+  const source = `^/${escaped.join("/")}/?$`;
+  return new RegExp(
+    source
+  ).test(
+    pathname
+  );
+}
+function createCookieStore(cookieHeader) {
+  const values = /* @__PURE__ */ new Map();
+  if (cookieHeader) {
+    for (const part of cookieHeader.split(";")) {
+      const separator = part.indexOf("=");
+      if (separator < 0) {
+        continue;
+      }
+      const name = part.slice(
+        0,
+        separator
+      ).trim();
+      const rawValue = part.slice(
+        separator + 1
+      ).trim();
+      if (!name) {
+        continue;
+      }
+      try {
+        values.set(
+          name,
+          decodeURIComponent(
+            rawValue
+          )
+        );
+      } catch {
+        values.set(
+          name,
+          rawValue
+        );
+      }
+    }
+  }
+  return {
+    get(name) {
+      return values.get(
+        name
+      ) ?? null;
+    },
+    has(name) {
+      return values.has(
+        name
+      );
+    }
+  };
+}
+function mergeHeaders(base, additions) {
+  const result = new Headers(
+    base
+  );
+  additions.forEach(
+    (value, key) => {
+      result.set(
+        key,
+        value
+      );
+    }
+  );
+  return result;
+}
+function isFrameworkInternalPath(pathname) {
+  return pathname === "/_bcp" || pathname.startsWith(
+    "/_bcp/"
+  );
+}
+function escapeRegExp(value) {
+  return value.replace(
+    /[.*+?^${}()|[\]\\]/g,
+    "\\$&"
+  );
+}
+
+// packages/server/src/session.ts
+import {
+  createHmac,
+  timingSafeEqual
+} from "node:crypto";
+
+// packages/server/src/request-context.ts
+import {
+  AsyncLocalStorage
+} from "node:async_hooks";
+var requestStorage = new AsyncLocalStorage();
+async function headers() {
+  const context = getRequestContext();
+  return new Headers(
+    context.headers
+  );
+}
+function getRequestContext() {
+  const context = requestStorage.getStore();
+  if (!context) {
+    throw new Error(
+      "BCP Framework: server request APIs can only be used while handling a request."
+    );
+  }
+  return context;
+}
+
+// packages/server/src/session.ts
+var DEFAULT_EXPIRES_IN = 60 * 60 * 12;
+var MAX_TOKEN_LENGTH = 16 * 1024;
+var MINIMUM_SECRET_BYTES = 32;
+async function createSessionToken(payload, options = {}) {
+  assertPayload(
+    payload
+  );
+  const secret = resolveSessionSecret(
+    options.secret
+  );
+  const expiresIn = resolveExpiresIn(
+    options.expiresIn
+  );
+  const issuer = resolveOptionalIssuer(
+    options.issuer
+  );
+  const audience = options.audience === void 0 ? void 0 : normalizeAudience(
+    options.audience
+  );
+  const now = Math.floor(
+    Date.now() / 1e3
+  );
+  const header = {
+    alg: "HS256",
+    typ: "JWT"
+  };
+  const claims = {
+    ...payload,
+    iat: now,
+    exp: now + expiresIn
+  };
+  if (issuer !== void 0) {
+    claims.iss = issuer;
+  }
+  if (audience !== void 0) {
+    claims.aud = audience;
+  }
+  const encodedHeader = encodeJson(
+    header
+  );
+  const encodedPayload = encodeJson(
+    claims
+  );
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = signHs256(
+    signingInput,
+    secret
+  );
+  return `${signingInput}.${signature}`;
+}
+function resolveSessionSecret(explicitSecret) {
+  const secret = explicitSecret ?? process.env.BCP_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "BCP Framework: BCP_SESSION_SECRET is required for session tokens."
+    );
+  }
+  if (Buffer.byteLength(
+    secret,
+    "utf8"
+  ) < MINIMUM_SECRET_BYTES) {
+    throw new Error(
+      `BCP Framework: session secret must be at least ${MINIMUM_SECRET_BYTES} bytes.`
+    );
+  }
+  return secret;
+}
+function resolveExpiresIn(value) {
+  const expiresIn = value ?? DEFAULT_EXPIRES_IN;
+  if (!Number.isFinite(
+    expiresIn
+  ) || expiresIn <= 0) {
+    throw new Error(
+      "BCP Framework: session expiresIn must be a positive finite number of seconds."
+    );
+  }
+  return Math.floor(
+    expiresIn
+  );
+}
+function resolveOptionalIssuer(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  assertNonEmptyString(
+    value,
+    "issuer"
+  );
+  return value;
+}
+function assertPayload(payload) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(
+    payload
+  )) {
+    throw new Error(
+      "BCP Framework: session payload must be a plain object."
+    );
+  }
+}
+function assertNonEmptyString(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(
+      `BCP Framework: session ${label} must be a non-empty string.`
+    );
+  }
+}
+function normalizeAudience(value) {
+  if (typeof value === "string") {
+    assertNonEmptyString(
+      value,
+      "audience"
+    );
+    return value;
+  }
+  if (!Array.isArray(
+    value
+  ) || value.length === 0) {
+    throw new Error(
+      "BCP Framework: session audience must contain at least one value."
+    );
+  }
+  for (const audience of value) {
+    assertNonEmptyString(
+      audience,
+      "audience"
+    );
+  }
+  return [
+    ...value
+  ];
+}
+function encodeJson(value) {
+  return Buffer.from(
+    JSON.stringify(
+      value
+    ),
+    "utf8"
+  ).toString(
+    "base64url"
+  );
+}
+function signHs256(signingInput, secret) {
+  return createHmac(
+    "sha256",
+    secret
+  ).update(
+    signingInput,
+    "utf8"
+  ).digest(
+    "base64url"
+  );
+}
+
+// packages/server/src/testing.ts
+function createTestApp(options) {
+  if (!options || typeof options.handler !== "function") {
+    throw new TypeError(
+      "BCP Testing: createTestApp requires a request handler."
+    );
+  }
+  const baseUrl = normalizeBaseUrl(
+    options.baseUrl ?? "http://bcp.test"
+  );
+  const initialHeaders = new Headers(
+    options.headers
+  );
+  const defaultHeaders = new Headers(
+    initialHeaders
+  );
+  const initialCookies = {
+    ...options.cookies ?? {}
+  };
+  const cookieJar = new Map(
+    Object.entries(initialCookies)
+  );
+  const app = {
+    baseUrl,
+    async request(path, requestOptions = {}) {
+      const method = normalizeMethod(
+        requestOptions.method ?? "GET"
+      );
+      const headers2 = new Headers(
+        defaultHeaders
+      );
+      for (const [name, value] of new Headers(
+        requestOptions.headers
+      )) {
+        headers2.set(name, value);
+      }
+      const requestCookies = new Map(cookieJar);
+      for (const [name, value] of Object.entries(
+        requestOptions.cookies ?? {}
+      )) {
+        requestCookies.set(name, value);
+      }
+      if (requestCookies.size > 0) {
+        headers2.set(
+          "Cookie",
+          serializeCookies(
+            requestCookies
+          )
+        );
+      }
+      let body = requestOptions.body ?? null;
+      if (requestOptions.json !== void 0) {
+        if (requestOptions.body !== void 0 && requestOptions.body !== null) {
+          throw new TypeError(
+            "BCP Testing: request cannot specify both body and json."
+          );
+        }
+        body = JSON.stringify(
+          requestOptions.json
+        );
+        if (!headers2.has("Content-Type")) {
+          headers2.set(
+            "Content-Type",
+            "application/json"
+          );
+        }
+      }
+      if (method === "GET" || method === "HEAD") {
+        body = null;
+      }
+      const request = new Request(
+        resolveTestUrl(
+          baseUrl,
+          path
+        ),
+        {
+          method,
+          headers: headers2,
+          body,
+          signal: requestOptions.signal
+        }
+      );
+      const response = await options.handler(
+        request
+      );
+      if (!(response instanceof Response)) {
+        throw new TypeError(
+          "BCP Testing: request handler must return a Response."
+        );
+      }
+      updateCookieJar(
+        cookieJar,
+        response.headers
+      );
+      return response;
+    },
+    get(path, requestOptions = {}) {
+      return app.request(
+        path,
+        {
+          ...requestOptions,
+          method: "GET"
+        }
+      );
+    },
+    post(path, requestOptions = {}) {
+      return app.request(
+        path,
+        {
+          ...requestOptions,
+          method: "POST"
+        }
+      );
+    },
+    put(path, requestOptions = {}) {
+      return app.request(
+        path,
+        {
+          ...requestOptions,
+          method: "PUT"
+        }
+      );
+    },
+    patch(path, requestOptions = {}) {
+      return app.request(
+        path,
+        {
+          ...requestOptions,
+          method: "PATCH"
+        }
+      );
+    },
+    delete(path, requestOptions = {}) {
+      return app.request(
+        path,
+        {
+          ...requestOptions,
+          method: "DELETE"
+        }
+      );
+    },
+    setCookie(name, value) {
+      cookieJar.set(
+        normalizeCookieName(name),
+        String(value)
+      );
+    },
+    clearCookie(name) {
+      cookieJar.delete(
+        normalizeCookieName(name)
+      );
+    },
+    cookies() {
+      return Object.fromEntries(
+        cookieJar
+      );
+    },
+    setHeader(name, value) {
+      defaultHeaders.set(
+        normalizeHeaderName(name),
+        String(value)
+      );
+    },
+    deleteHeader(name) {
+      defaultHeaders.delete(
+        normalizeHeaderName(name)
+      );
+    },
+    headers() {
+      return new Headers(
+        defaultHeaders
+      );
+    },
+    reset() {
+      cookieJar.clear();
+      for (const [name, value] of Object.entries(
+        initialCookies
+      )) {
+        cookieJar.set(name, value);
+      }
+      for (const name of [...defaultHeaders.keys()]) {
+        defaultHeaders.delete(name);
+      }
+      for (const [name, value] of initialHeaders) {
+        defaultHeaders.set(name, value);
+      }
+    }
+  };
+  return app;
+}
+function createRouteTestHandler(routeModule, options = {}) {
+  if (!routeModule || typeof routeModule !== "object") {
+    throw new TypeError(
+      "BCP Testing: route module must be an object."
+    );
+  }
+  return async (request) => {
+    const method = normalizeMethod(
+      request.method
+    );
+    const handler = routeModule[method] ?? (method === "HEAD" ? routeModule.GET : void 0);
+    if (!handler) {
+      const allow = knownRouteMethods.filter(
+        (candidate) => typeof routeModule[candidate] === "function"
+      ).join(", ");
+      return new Response(
+        null,
+        {
+          status: 405,
+          headers: allow ? {
+            Allow: allow
+          } : void 0
+        }
+      );
+    }
+    const context = options.context ? await options.context(
+      request
+    ) : void 0;
+    const value = await handler(
+      request,
+      context
+    );
+    return normalizeRouteResponse(
+      value,
+      method
+    );
+  };
+}
+function expectResponse(response) {
+  if (!(response instanceof Response)) {
+    throw new TypeError(
+      "BCP Testing: expectResponse requires a Response."
+    );
+  }
+  const expectation = {
+    response,
+    status(expected) {
+      if (response.status !== expected) {
+        throw new Error(
+          `BCP Testing: expected response status ${expected}, received ${response.status}.`
+        );
+      }
+      return expectation;
+    },
+    header(name, expected) {
+      const actual = response.headers.get(name);
+      if (typeof expected === "string" ? actual !== expected : !expected.test(
+        actual ?? ""
+      )) {
+        throw new Error(
+          `BCP Testing: response header "${name}" did not match. Received ${JSON.stringify(actual)}.`
+        );
+      }
+      return expectation;
+    },
+    async text(expected) {
+      const actual = await response.clone().text();
+      if (typeof expected === "string" ? actual !== expected : !expected.test(actual)) {
+        throw new Error(
+          `BCP Testing: response text did not match. Received ${JSON.stringify(actual)}.`
+        );
+      }
+      return expectation;
+    },
+    async json(expected) {
+      const actual = await response.clone().json();
+      if (!isDeepStrictEqual(actual, expected)) {
+        throw new Error(
+          `BCP Testing: response JSON did not match. Expected ${safeJson(expected)}, received ${safeJson(actual)}.`
+        );
+      }
+      return expectation;
+    },
+    async jsonMatches(expected) {
+      const actual = await response.clone().json();
+      if (!actual || typeof actual !== "object" || Array.isArray(actual)) {
+        throw new Error(
+          "BCP Testing: response JSON is not an object."
+        );
+      }
+      for (const [key, value] of Object.entries(expected)) {
+        if (!isDeepStrictEqual(
+          actual[key],
+          value
+        )) {
+          throw new Error(
+            `BCP Testing: response JSON key "${key}" did not match.`
+          );
+        }
+      }
+      return expectation;
+    }
+  };
+  return expectation;
+}
+function createFakeClock(initialValue = 0) {
+  assertFinite(
+    initialValue,
+    "fake clock initial value"
+  );
+  let current = initialValue;
+  return {
+    now() {
+      return current;
+    },
+    value() {
+      return current;
+    },
+    set(value) {
+      assertFinite(
+        value,
+        "fake clock value"
+      );
+      current = value;
+      return current;
+    },
+    advance(milliseconds) {
+      assertFinite(
+        milliseconds,
+        "fake clock advance"
+      );
+      current += milliseconds;
+      return current;
+    },
+    reset() {
+      current = initialValue;
+      return current;
+    }
+  };
+}
+function createSequenceIdFactory(prefix = "test", start = 1) {
+  const normalizedPrefix = String(prefix).trim();
+  if (!normalizedPrefix) {
+    throw new TypeError(
+      "BCP Testing: id prefix must be a non-empty string."
+    );
+  }
+  if (!Number.isInteger(start) || start < 0) {
+    throw new TypeError(
+      "BCP Testing: id sequence start must be a non-negative integer."
+    );
+  }
+  let sequence = start;
+  return () => `${normalizedPrefix}-${sequence++}`;
+}
+async function createTestAuthSession(user, options = {}) {
+  if (!user || typeof user.id !== "string" && typeof user.id !== "number") {
+    throw new TypeError(
+      "BCP Testing: auth user requires a string or number id."
+    );
+  }
+  const idFactory = options.idFactory ?? randomUUID;
+  const sid = normalizeNonEmpty(
+    options.sid ?? idFactory(),
+    "session id"
+  );
+  const cookieName = normalizeCookieName(
+    options.cookieName ?? "bcp_session"
+  );
+  const expiresIn = positiveInteger(
+    options.expiresIn ?? 60 * 60 * 12,
+    "session expiresIn"
+  );
+  const createdAt = Math.floor(
+    Date.now() / 1e3
+  );
+  const expiresAt = createdAt + expiresIn;
+  const payload = {
+    sid,
+    user,
+    ...options.data === void 0 ? {} : {
+      data: options.data
+    }
+  };
+  const token = await createSessionToken(
+    payload,
+    {
+      secret: options.secret,
+      expiresIn,
+      issuer: options.issuer,
+      audience: options.audience
+    }
+  );
+  if (options.store) {
+    await options.store.set({
+      sid,
+      userId: String(user.id),
+      createdAt,
+      expiresAt,
+      lastSeenAt: createdAt
+    });
+  }
+  return {
+    sid,
+    user,
+    ...options.data === void 0 ? {} : {
+      data: options.data
+    },
+    token,
+    cookieName,
+    cookieHeader: `${cookieName}=${token}`,
+    createdAt,
+    expiresAt
+  };
+}
+async function withTestTransaction(database, callback) {
+  if (!database || typeof database.transaction !== "function") {
+    throw new TypeError(
+      "BCP Testing: withTestTransaction requires a transactional database."
+    );
+  }
+  if (typeof callback !== "function") {
+    throw new TypeError(
+      "BCP Testing: transaction callback must be a function."
+    );
+  }
+  const marker = /* @__PURE__ */ Symbol("bcp-test-rollback");
+  let completed = false;
+  let value;
+  try {
+    await database.transaction(
+      async (transaction) => {
+        value = await callback(
+          transaction
+        );
+        completed = true;
+        throw new TestRollbackSignal(
+          marker
+        );
+      }
+    );
+  } catch (error) {
+    if (!(error instanceof TestRollbackSignal) || error.marker !== marker) {
+      throw error;
+    }
+  }
+  if (!completed) {
+    throw new Error(
+      "BCP Testing: rollback transaction did not complete the test callback."
+    );
+  }
+  return value;
+}
+async function runTestMiddleware(module, input, downstream) {
+  return executeMiddlewarePipeline(
+    module,
+    input,
+    async (execution) => {
+      const request = new Request(
+        execution.url,
+        {
+          method: execution.method ?? "GET",
+          headers: execution.headers
+        }
+      );
+      return downstream ? downstream(request) : new Response(
+        null,
+        {
+          status: 204
+        }
+      );
+    }
+  );
+}
+function createJobTestHarness(queue) {
+  if (!queue) {
+    throw new TypeError(
+      "BCP Testing: job harness requires a queue."
+    );
+  }
+  const harness = {
+    queue,
+    async drain(options = {}) {
+      const maxJobs = positiveInteger(
+        options.maxJobs ?? 1e3,
+        "maxJobs"
+      );
+      let processed = 0;
+      while (processed < maxJobs && !options.signal?.aborted) {
+        const didProcess = await queue.processNext(
+          options.signal
+        );
+        if (!didProcess) {
+          break;
+        }
+        processed += 1;
+      }
+      return processed;
+    },
+    async records(name) {
+      const records = await queue.list();
+      return name ? records.filter(
+        (record) => record.name === name
+      ) : records;
+    },
+    async count(options = {}) {
+      const records = await harness.records(
+        options.name
+      );
+      return records.filter(
+        (record) => !options.state || record.state === options.state
+      ).length;
+    },
+    async expectCount(expected, options = {}) {
+      const actual = await harness.count(options);
+      if (actual !== expected) {
+        throw new Error(
+          `BCP Testing: expected ${expected} jobs, received ${actual}.`
+        );
+      }
+    }
+  };
+  return harness;
+}
+function createWorkflowTestHarness(workflow) {
+  if (!workflow) {
+    throw new TypeError(
+      "BCP Testing: workflow harness requires a workflow."
+    );
+  }
+  const harness = {
+    workflow,
+    async startAndRun(input, options = {}) {
+      const run = await workflow.start(
+        input,
+        {
+          id: options.id
+        }
+      );
+      return harness.runUntilIdle(
+        run.id,
+        options
+      );
+    },
+    async runUntilIdle(id, options = {}) {
+      const maxPasses = positiveInteger(
+        options.maxPasses ?? 100,
+        "workflow maxPasses"
+      );
+      let run = await requireWorkflowRun(
+        workflow,
+        id
+      );
+      for (let pass = 0; pass < maxPasses; pass += 1) {
+        if (isWorkflowTerminal(run.state)) {
+          return run;
+        }
+        if (run.state === "waiting") {
+          if (!options.forceWaiting) {
+            return run;
+          }
+          run = await workflow.resume(
+            id,
+            {
+              force: true
+            }
+          );
+          continue;
+        }
+        run = await workflow.run(id);
+      }
+      throw new Error(
+        `BCP Testing: workflow "${id}" did not become idle within ${maxPasses} passes.`
+      );
+    },
+    async expectState(id, expected) {
+      const run = await requireWorkflowRun(
+        workflow,
+        id
+      );
+      if (run.state !== expected) {
+        throw new Error(
+          `BCP Testing: expected workflow "${id}" state ${expected}, received ${run.state}.`
+        );
+      }
+      return run;
+    }
+  };
+  return harness;
+}
+function createOutboxTestHarness(store, dispatcher) {
+  if (!store || !dispatcher) {
+    throw new TypeError(
+      "BCP Testing: outbox harness requires a store and dispatcher."
+    );
+  }
+  return {
+    store,
+    dispatcher,
+    async dispatchUntilIdle(maxBatches = 100) {
+      const limit = positiveInteger(
+        maxBatches,
+        "outbox maxBatches"
+      );
+      let published = 0;
+      for (let batch = 0; batch < limit; batch += 1) {
+        const count = await dispatcher.dispatchBatch();
+        published += count;
+        if (count === 0) {
+          return published;
+        }
+      }
+      return published;
+    },
+    async events(type) {
+      const events = await store.list();
+      return type ? events.filter(
+        (event) => event.type === type
+      ) : events;
+    },
+    stats() {
+      return store.stats();
+    },
+    async expectState(id, expected) {
+      const event = await store.get(id);
+      if (!event) {
+        throw new Error(
+          `BCP Testing: outbox event "${id}" does not exist.`
+        );
+      }
+      if (event.state !== expected) {
+        throw new Error(
+          `BCP Testing: expected outbox event "${id}" state ${expected}, received ${event.state}.`
+        );
+      }
+      return event;
+    }
+  };
+}
+function createRealtimeTestSocket() {
+  const sentMessages = [];
+  const messageListeners = /* @__PURE__ */ new Set();
+  const closeListeners = /* @__PURE__ */ new Set();
+  const errorListeners = /* @__PURE__ */ new Set();
+  let closed = false;
+  let closeCode;
+  let closeReason;
+  const socket = {
+    get closed() {
+      return closed;
+    },
+    get closeCode() {
+      return closeCode;
+    },
+    get closeReason() {
+      return closeReason;
+    },
+    send(data) {
+      if (closed) {
+        throw new Error(
+          "BCP Testing: realtime test socket is closed."
+        );
+      }
+      sentMessages.push(
+        String(data)
+      );
+    },
+    async close(code = 1e3, reason = "server closed") {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      closeCode = code;
+      closeReason = reason;
+      await notify(
+        closeListeners,
+        (listener) => listener()
+      );
+    },
+    onMessage(listener) {
+      messageListeners.add(listener);
+      return () => {
+        messageListeners.delete(listener);
+      };
+    },
+    onClose(listener) {
+      closeListeners.add(listener);
+      return () => {
+        closeListeners.delete(listener);
+      };
+    },
+    onError(listener) {
+      errorListeners.add(listener);
+      return () => {
+        errorListeners.delete(listener);
+      };
+    },
+    async receive(message) {
+      if (closed) {
+        throw new Error(
+          "BCP Testing: cannot receive on a closed realtime test socket."
+        );
+      }
+      const raw = typeof message === "string" ? message : JSON.stringify(message);
+      await notify(
+        messageListeners,
+        (listener) => listener(raw)
+      );
+    },
+    async closeFromClient(code = 1e3, reason = "client closed") {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      closeCode = code;
+      closeReason = reason;
+      await notify(
+        closeListeners,
+        (listener) => listener()
+      );
+    },
+    async fail(error) {
+      await notify(
+        errorListeners,
+        (listener) => listener(error)
+      );
+    },
+    sent() {
+      return [
+        ...sentMessages
+      ];
+    },
+    messages() {
+      return sentMessages.map(
+        (message) => JSON.parse(message)
+      );
+    },
+    clear() {
+      sentMessages.length = 0;
+    }
+  };
+  return socket;
+}
+function createRealtimeTestHarness(hub) {
+  if (!hub) {
+    throw new TypeError(
+      "BCP Testing: realtime harness requires a hub."
+    );
+  }
+  const harness = {
+    hub,
+    async connect(options = {}) {
+      const socket = createRealtimeTestSocket();
+      const connection = await hub.attachSocket(
+        socket,
+        options
+      );
+      return {
+        socket,
+        connection
+      };
+    },
+    expectEvent(socket, event, channel) {
+      const normalizedEvent = normalizeNonEmpty(
+        event,
+        "realtime event"
+      );
+      const messages = socket.messages();
+      const found = [...messages].reverse().find(
+        (message) => message.type === "event" && message.event === normalizedEvent && (channel === void 0 || message.channel === channel)
+      );
+      if (!found || !found.id || !found.channel || found.timestamp === void 0) {
+        throw new Error(
+          `BCP Testing: realtime event "${normalizedEvent}" was not sent.`
+        );
+      }
+      return {
+        id: found.id,
+        channel: found.channel,
+        event: normalizedEvent,
+        payload: found.payload,
+        timestamp: found.timestamp,
+        sourceId: found.sourceId,
+        excludeConnectionId: found.excludeConnectionId
+      };
+    }
+  };
+  return harness;
+}
+async function readSseEvents(response, options = {}) {
+  if (!(response instanceof Response)) {
+    throw new TypeError(
+      "BCP Testing: readSseEvents requires a Response."
+    );
+  }
+  if (!response.body) {
+    return [];
+  }
+  const limit = positiveInteger(
+    options.limit ?? 1,
+    "SSE event limit"
+  );
+  const timeoutMs = positiveInteger(
+    options.timeoutMs ?? 1e3,
+    "SSE timeoutMs"
+  );
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  const events = [];
+  let buffer = "";
+  try {
+    while (events.length < limit) {
+      const result = await readWithTimeout(
+        reader,
+        timeoutMs
+      );
+      if (result.done) {
+        break;
+      }
+      buffer += decoder.decode(
+        result.value,
+        {
+          stream: true
+        }
+      );
+      let boundary = buffer.indexOf("\n\n");
+      while (boundary >= 0) {
+        const frame = buffer.slice(
+          0,
+          boundary
+        );
+        buffer = buffer.slice(
+          boundary + 2
+        );
+        const event = parseSseFrame(
+          frame
+        );
+        if (event) {
+          events.push(event);
+          if (events.length >= limit) {
+            break;
+          }
+        }
+        boundary = buffer.indexOf("\n\n");
+      }
+    }
+  } finally {
+    await reader.cancel().catch(
+      () => void 0
+    );
+  }
+  return events;
+}
+var TestRollbackSignal = class extends Error {
+  constructor(marker) {
+    super("BCP Testing rollback");
+    this.marker = marker;
+    this.name = "BcpTestRollbackSignal";
+  }
+  marker;
+};
+var knownRouteMethods = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS"
+];
+function normalizeRouteResponse(value, method) {
+  if (value instanceof Response) {
+    if (method !== "HEAD") {
+      return value;
+    }
+    return new Response(
+      null,
+      {
+        status: value.status,
+        statusText: value.statusText,
+        headers: value.headers
+      }
+    );
+  }
+  if (value === void 0 || value === null) {
+    return new Response(
+      null,
+      {
+        status: 204
+      }
+    );
+  }
+  if (typeof value === "string") {
+    return new Response(value);
+  }
+  return Response.json(value);
+}
+async function requireWorkflowRun(workflow, id) {
+  const run = await workflow.get(id);
+  if (!run) {
+    throw new Error(
+      `BCP Testing: workflow run "${id}" does not exist.`
+    );
+  }
+  return run;
+}
+function isWorkflowTerminal(state) {
+  return state === "succeeded" || state === "failed" || state === "cancelled" || state === "compensated";
+}
+async function notify(listeners, invoke) {
+  for (const listener of [
+    ...listeners
+  ]) {
+    await invoke(listener);
+  }
+}
+function parseSseFrame(frame) {
+  const lines = frame.split(/\r?\n/);
+  let id;
+  let event;
+  const data = [];
+  for (const line of lines) {
+    if (!line || line.startsWith(":") || line.startsWith("retry:")) {
+      continue;
+    }
+    if (line.startsWith("id:")) {
+      id = line.slice(3).trimStart();
+      continue;
+    }
+    if (line.startsWith("event:")) {
+      event = line.slice(6).trimStart();
+      continue;
+    }
+    if (line.startsWith("data:")) {
+      data.push(
+        line.slice(5).trimStart()
+      );
+    }
+  }
+  if (id === void 0 && event === void 0 && data.length === 0) {
+    return null;
+  }
+  const rawData = data.join("\n");
+  let parsed;
+  if (rawData) {
+    try {
+      parsed = JSON.parse(rawData);
+    } catch {
+      parsed = rawData;
+    }
+  }
+  return {
+    id,
+    event,
+    data: parsed,
+    rawData: rawData || void 0
+  };
+}
+function readWithTimeout(reader, timeoutMs) {
+  return new Promise(
+    (resolve, reject) => {
+      const timer = setTimeout(
+        () => {
+          reject(
+            new Error(
+              `BCP Testing: timed out waiting for SSE data after ${timeoutMs}ms.`
+            )
+          );
+        },
+        timeoutMs
+      );
+      reader.read().then(
+        (value) => {
+          clearTimeout(timer);
+          resolve(value);
+        },
+        (error) => {
+          clearTimeout(timer);
+          reject(error);
+        }
+      );
+    }
+  );
+}
+function updateCookieJar(jar, headers2) {
+  const extended = headers2;
+  const values = typeof extended.getSetCookie === "function" ? extended.getSetCookie() : headers2.get("set-cookie") ? [
+    headers2.get("set-cookie")
+  ] : [];
+  for (const value of values) {
+    const first = value.split(";", 1)[0] ?? "";
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+      continue;
+    }
+    const name = first.slice(0, separator).trim();
+    const cookieValue = first.slice(separator + 1).trim();
+    const lower = value.toLowerCase();
+    if (cookieValue === "" || lower.includes("max-age=0") || lower.includes("expires=thu, 01 jan 1970")) {
+      jar.delete(name);
+    } else {
+      jar.set(name, cookieValue);
+    }
+  }
+}
+function serializeCookies(cookies2) {
+  return Array.from(
+    cookies2,
+    ([name, value]) => `${name}=${value}`
+  ).join("; ");
+}
+function normalizeMethod(value) {
+  const method = String(value).trim().toUpperCase();
+  if (!method) {
+    throw new TypeError(
+      "BCP Testing: request method must be a non-empty string."
+    );
+  }
+  return method;
+}
+function normalizeBaseUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError(
+      "BCP Testing: baseUrl must be an absolute URL."
+    );
+  }
+  return url.href.endsWith("/") ? url.href : `${url.href}/`;
+}
+function resolveTestUrl(baseUrl, path) {
+  const value = String(path ?? "").trim();
+  if (!value) {
+    return baseUrl;
+  }
+  try {
+    return new URL(value).href;
+  } catch {
+    return new URL(
+      value.replace(/^\//, ""),
+      baseUrl
+    ).href;
+  }
+}
+function normalizeCookieName(value) {
+  const name = normalizeNonEmpty(
+    value,
+    "cookie name"
+  );
+  if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) {
+    throw new TypeError(
+      "BCP Testing: cookie name contains invalid characters."
+    );
+  }
+  return name;
+}
+function normalizeHeaderName(value) {
+  return normalizeNonEmpty(
+    value,
+    "header name"
+  );
+}
+function normalizeNonEmpty(value, field) {
+  const text = String(value ?? "").trim();
+  if (!text) {
+    throw new TypeError(
+      `BCP Testing: ${field} must be a non-empty string.`
+    );
+  }
+  return text;
+}
+function positiveInteger(value, field) {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new TypeError(
+      `BCP Testing: ${field} must be a positive integer.`
+    );
+  }
+  return value;
+}
+function assertFinite(value, field) {
+  if (!Number.isFinite(value)) {
+    throw new TypeError(
+      `BCP Testing: ${field} must be finite.`
+    );
+  }
+}
+function safeJson(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+
+// packages/server/src/page-guard.ts
+async function executePageGuardFunctions(guards, params, requestUrl) {
+  if (guards.length === 0) {
+    return emptyGuardExecution();
+  }
+  const guardData = {};
+  for (const definition of guards) {
+    const result = await definition.guard({
+      params: {
+        ...params
+      },
+      searchParams: new URLSearchParams(
+        requestUrl.searchParams
+      ),
+      guardData: {
+        ...guardData
+      }
+    });
+    if (result instanceof Response) {
+      return {
+        hasGuard: true,
+        data: guardData,
+        response: result
+      };
+    }
+    if (result === void 0) {
+      continue;
+    }
+    assertGuardData(
+      result,
+      definition.filePath
+    );
+    Object.assign(
+      guardData,
+      result
+    );
+  }
+  return {
+    hasGuard: true,
+    data: guardData,
+    response: null
+  };
+}
+function emptyGuardExecution() {
+  return {
+    hasGuard: false,
+    data: {},
+    response: null
+  };
+}
+function assertGuardData(value, label) {
+  if (value === null || Array.isArray(
+    value
+  ) || typeof value !== "object") {
+    throw new Error(
+      `BCP Framework: guard "${label}" must return a plain object, undefined, or a Response.`
+    );
+  }
+  const prototype = Object.getPrototypeOf(
+    value
+  );
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error(
+      `BCP Framework: guard "${label}" must return a plain object, undefined, or a Response.`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  validateJsonValue(
+    value,
+    "$",
+    seen,
+    label
+  );
+}
+function validateJsonValue(value, location, seen, guardLabel) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isFinite(
+      value
+    )) {
+      return;
+    }
+    throwInvalidGuardData(
+      guardLabel,
+      location,
+      "numbers must be finite"
+    );
+  }
+  if (typeof value !== "object") {
+    throwInvalidGuardData(
+      guardLabel,
+      location,
+      `unsupported ${typeof value} value`
+    );
+  }
+  const objectValue = value;
+  if (seen.has(objectValue)) {
+    throwInvalidGuardData(
+      guardLabel,
+      location,
+      "circular references are not supported"
+    );
+  }
+  seen.add(
+    objectValue
+  );
+  try {
+    if (Array.isArray(value)) {
+      value.forEach(
+        (item, index) => {
+          validateJsonValue(
+            item,
+            `${location}[${index}]`,
+            seen,
+            guardLabel
+          );
+        }
+      );
+      return;
+    }
+    const prototype = Object.getPrototypeOf(
+      value
+    );
+    if (prototype !== Object.prototype && prototype !== null) {
+      throwInvalidGuardData(
+        guardLabel,
+        location,
+        "only plain objects and arrays are supported"
+      );
+    }
+    for (const [
+      key,
+      item
+    ] of Object.entries(
+      value
+    )) {
+      validateJsonValue(
+        item,
+        `${location}.${key}`,
+        seen,
+        guardLabel
+      );
+    }
+  } finally {
+    seen.delete(
+      objectValue
+    );
+  }
+}
+function throwInvalidGuardData(guardLabel, location, reason) {
+  throw new Error(
+    `BCP Framework: guard "${guardLabel}" returned non-serializable data at ${location}: ${reason}.`
+  );
+}
+
+// packages/server/src/form-action.ts
+var PAGE_ACTION_METHODS = [
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+];
+var ACTION_NAME_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var BLOCKED_ACTION_NAMES = /* @__PURE__ */ new Set([
+  "default",
+  "__proto__",
+  "prototype",
+  "constructor"
+]);
+function normalizePageActionMethod(value) {
+  const method = (value ?? "POST").trim().toUpperCase();
+  if (!PAGE_ACTION_METHODS.includes(
+    method
+  )) {
+    throw new Error(
+      `BCP Framework: unsupported form action method "${method || String(value)}". Use POST, PUT, PATCH, or DELETE.`
+    );
+  }
+  return method;
+}
+function assertPageActionName(name) {
+  if (!ACTION_NAME_PATTERN.test(
+    name
+  ) || BLOCKED_ACTION_NAMES.has(
+    name
+  )) {
+    throw new Error(
+      `BCP Framework: invalid form action name "${name}".`
+    );
+  }
+}
+async function executePageActionFunction(action, actionName, method, formData, params, requestUrl, guardData = {}, hasGuard = false, label = "actions.ts") {
+  assertPageActionName(
+    actionName
+  );
+  const result = await action(
+    formData,
+    {
+      params: {
+        ...params
+      },
+      searchParams: new URLSearchParams(
+        requestUrl.searchParams
+      ),
+      guardData: {
+        ...guardData
+      },
+      method
+    }
+  );
+  if (result instanceof Response) {
+    return {
+      hasGuard,
+      guardData: {
+        ...guardData
+      },
+      data: null,
+      response: result
+    };
+  }
+  const data = result === void 0 ? null : result;
+  assertActionData(
+    data,
+    `${label}#${actionName}`
+  );
+  return {
+    hasGuard,
+    guardData: {
+      ...guardData
+    },
+    data,
+    response: null
+  };
+}
+function assertActionData(value, actionLabel = "action") {
+  const seen = /* @__PURE__ */ new Set();
+  validateJsonValue2(
+    value,
+    "$",
+    seen,
+    actionLabel
+  );
+}
+function validateJsonValue2(value, location, seen, actionLabel) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isFinite(
+      value
+    )) {
+      return;
+    }
+    throwInvalidActionData(
+      actionLabel,
+      location,
+      "numbers must be finite"
+    );
+  }
+  if (typeof value !== "object") {
+    throwInvalidActionData(
+      actionLabel,
+      location,
+      `unsupported ${typeof value} value`
+    );
+  }
+  const objectValue = value;
+  if (seen.has(objectValue)) {
+    throwInvalidActionData(
+      actionLabel,
+      location,
+      "circular references are not supported"
+    );
+  }
+  seen.add(
+    objectValue
+  );
+  try {
+    if (Array.isArray(value)) {
+      value.forEach(
+        (item, index) => {
+          validateJsonValue2(
+            item,
+            `${location}[${index}]`,
+            seen,
+            actionLabel
+          );
+        }
+      );
+      return;
+    }
+    const prototype = Object.getPrototypeOf(
+      value
+    );
+    if (prototype !== Object.prototype && prototype !== null) {
+      throwInvalidActionData(
+        actionLabel,
+        location,
+        "only plain objects and arrays are supported"
+      );
+    }
+    for (const [
+      key,
+      item
+    ] of Object.entries(
+      value
+    )) {
+      validateJsonValue2(
+        item,
+        `${location}.${key}`,
+        seen,
+        actionLabel
+      );
+    }
+  } finally {
+    seen.delete(
+      objectValue
+    );
+  }
+}
+function throwInvalidActionData(actionLabel, location, reason) {
+  throw new Error(
+    `BCP Framework: action "${actionLabel}" returned non-serializable data at ${location}: ${reason}.`
+  );
+}
+
+// packages/server/src/page-loader.ts
+var GUARD_DATA_HEADER = "x-bcp-guard-data";
+async function executePageLoaderFunction(loader, params, requestUrl, label = "loader", explicitGuardData, explicitHasGuard) {
+  const headerGuardData = explicitGuardData === void 0 ? await readGuardDataHeader() : null;
+  const guardData = explicitGuardData ?? headerGuardData?.data ?? {};
+  const hasGuard = explicitHasGuard ?? headerGuardData?.hasGuard ?? false;
+  const result = await loader({
+    params: {
+      ...params
+    },
+    searchParams: new URLSearchParams(
+      requestUrl.searchParams
+    ),
+    guardData: {
+      ...guardData
+    }
+  });
+  if (result instanceof Response) {
+    return createExecution({
+      hasPageLoader: true,
+      hasGuard,
+      loaderData: void 0,
+      guardData,
+      response: result
+    });
+  }
+  assertLoaderData(
+    result,
+    label
+  );
+  return createExecution({
+    hasPageLoader: true,
+    hasGuard,
+    loaderData: result,
+    guardData,
+    response: null
+  });
+}
+function createExecution(input) {
+  const data = {
+    __bcp_server_data: true,
+    hasPageLoader: input.hasPageLoader,
+    hasGuard: input.hasGuard,
+    loaderData: input.loaderData,
+    guardData: {
+      ...input.guardData
+    }
+  };
+  return {
+    hasLoader: input.hasPageLoader || input.hasGuard,
+    hasPageLoader: input.hasPageLoader,
+    hasGuard: input.hasGuard,
+    data,
+    loaderData: input.loaderData,
+    guardData: data.guardData,
+    response: input.response
+  };
+}
+async function readGuardDataHeader() {
+  let requestHeaders;
+  try {
+    requestHeaders = await headers();
+  } catch {
+    return null;
+  }
+  const encoded = requestHeaders.get(
+    GUARD_DATA_HEADER
+  );
+  if (!encoded) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(
+      Buffer.from(
+        encoded,
+        "base64url"
+      ).toString(
+        "utf8"
+      )
+    );
+  } catch {
+    throw new Error(
+      "BCP Framework: invalid internal guard data header."
+    );
+  }
+  assertGuardHeaderData(
+    parsed
+  );
+  return {
+    hasGuard: true,
+    data: parsed
+  };
+}
+function assertGuardHeaderData(value) {
+  if (value === null || Array.isArray(
+    value
+  ) || typeof value !== "object") {
+    throw new Error(
+      "BCP Framework: invalid internal guard data header."
+    );
+  }
+  const prototype = Object.getPrototypeOf(
+    value
+  );
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error(
+      "BCP Framework: invalid internal guard data header."
+    );
+  }
+}
+function assertLoaderData(value, loaderLabel) {
+  const seen = /* @__PURE__ */ new Set();
+  validateJsonValue3(
+    value,
+    "$",
+    seen,
+    loaderLabel
+  );
+}
+function validateJsonValue3(value, location, seen, loaderLabel) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isFinite(
+      value
+    )) {
+      return;
+    }
+    throwInvalidLoaderData(
+      loaderLabel,
+      location,
+      "numbers must be finite"
+    );
+  }
+  if (typeof value !== "object") {
+    throwInvalidLoaderData(
+      loaderLabel,
+      location,
+      `unsupported ${typeof value} value`
+    );
+  }
+  const objectValue = value;
+  if (seen.has(objectValue)) {
+    throwInvalidLoaderData(
+      loaderLabel,
+      location,
+      "circular references are not supported"
+    );
+  }
+  seen.add(
+    objectValue
+  );
+  try {
+    if (Array.isArray(value)) {
+      value.forEach(
+        (item, index) => {
+          validateJsonValue3(
+            item,
+            `${location}[${index}]`,
+            seen,
+            loaderLabel
+          );
+        }
+      );
+      return;
+    }
+    const prototype = Object.getPrototypeOf(
+      value
+    );
+    if (prototype !== Object.prototype && prototype !== null) {
+      throwInvalidLoaderData(
+        loaderLabel,
+        location,
+        "only plain objects and arrays are supported"
+      );
+    }
+    for (const [
+      key,
+      item
+    ] of Object.entries(
+      value
+    )) {
+      validateJsonValue3(
+        item,
+        `${location}.${key}`,
+        seen,
+        loaderLabel
+      );
+    }
+  } finally {
+    seen.delete(
+      objectValue
+    );
+  }
+}
+function throwInvalidLoaderData(loaderLabel, location, reason) {
+  throw new Error(
+    `BCP Framework: loader "${loaderLabel}" returned non-serializable data at ${location}: ${reason}.`
+  );
+}
+
+// packages/server/src/testing-page.ts
+async function runTestPageLoader(loader, options = {}) {
+  assertFunction(
+    loader,
+    "page loader"
+  );
+  return executePageLoaderFunction(
+    loader,
+    {
+      ...options.params ?? {}
+    },
+    resolveTestPageUrl(
+      options.url
+    ),
+    "bcp/testing loader",
+    {
+      ...options.guardData ?? {}
+    },
+    options.hasGuard ?? Object.keys(
+      options.guardData ?? {}
+    ).length > 0
+  );
+}
+async function runTestPageGuards(guards, options = {}) {
+  const list = Array.isArray(guards) ? guards : [guards];
+  const definitions = list.map(
+    (candidate, index) => {
+      if (typeof candidate === "object" && candidate !== null && "guard" in candidate) {
+        const definition = candidate;
+        assertFunction(
+          definition.guard,
+          `page guard ${index + 1}`
+        );
+        return {
+          filePath: definition.filePath || `${options.label ?? "bcp/testing guard"}#${index + 1}`,
+          guard: definition.guard
+        };
+      }
+      assertFunction(
+        candidate,
+        `page guard ${index + 1}`
+      );
+      return {
+        filePath: `${options.label ?? "bcp/testing guard"}#${index + 1}`,
+        guard: candidate
+      };
+    }
+  );
+  return executePageGuardFunctions(
+    definitions,
+    {
+      ...options.params ?? {}
+    },
+    resolveTestPageUrl(
+      options.url
+    )
+  );
+}
+async function runTestPageAction(action, options = {}) {
+  assertFunction(
+    action,
+    "page action"
+  );
+  if (options.formData && options.fields) {
+    throw new TypeError(
+      "BCP Testing: page action test cannot specify both formData and fields."
+    );
+  }
+  const actionName = normalizeText(
+    options.actionName ?? "action",
+    "page action name"
+  );
+  const method = normalizePageActionMethod(
+    options.method ?? "POST"
+  );
+  const formData = options.formData ?? createTestFormData(
+    options.fields ?? {}
+  );
+  return executePageActionFunction(
+    action,
+    actionName,
+    method,
+    formData,
+    {
+      ...options.params ?? {}
+    },
+    resolveTestPageUrl(
+      options.url
+    ),
+    {
+      ...options.guardData ?? {}
+    },
+    options.hasGuard ?? Object.keys(
+      options.guardData ?? {}
+    ).length > 0,
+    options.label ?? "bcp/testing actions"
+  );
+}
+function createTestFormData(fields = {}) {
+  const formData = new FormData();
+  for (const [name, rawValue] of Object.entries(fields)) {
+    const values = Array.isArray(rawValue) ? rawValue : [rawValue];
+    for (const value of values) {
+      formData.append(
+        name,
+        value
+      );
+    }
+  }
+  return formData;
+}
+function resolveTestPageUrl(value) {
+  if (value instanceof URL) {
+    return new URL(
+      value.href
+    );
+  }
+  const candidate = value ?? "http://bcp.test/";
+  try {
+    return new URL(
+      candidate
+    );
+  } catch {
+    return new URL(
+      String(candidate).replace(
+        /^\//,
+        ""
+      ),
+      "http://bcp.test/"
+    );
+  }
+}
+function assertFunction(value, label) {
+  if (typeof value !== "function") {
+    throw new TypeError(
+      `BCP Testing: ${label} must be a function.`
+    );
+  }
+}
+function normalizeText(value, label) {
+  const text = String(value ?? "").trim();
+  if (!text) {
+    throw new TypeError(
+      `BCP Testing: ${label} must be a non-empty string.`
+    );
+  }
+  return text;
+}
+export {
+  createFakeClock,
+  createJobTestHarness,
+  createOutboxTestHarness,
+  createRealtimeTestHarness,
+  createRealtimeTestSocket,
+  createRouteTestHandler,
+  createSequenceIdFactory,
+  createTestApp,
+  createTestAuthSession,
+  createTestFormData,
+  createWorkflowTestHarness,
+  expectResponse,
+  readSseEvents,
+  runTestMiddleware,
+  runTestPageAction,
+  runTestPageGuards,
+  runTestPageLoader,
+  withTestTransaction
+};