@gettersethya/mira 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/tests/collection-service/collection-service.test.js

@@ -1,15 +1,19 @@
-import { SqlClient } from "@effect/sql";
 import { SqliteClient } from "@effect/sql-sqlite-node";
-import { Effect, Either, Layer, Match } from "effect";
 import { describe, it } from "@effect/vitest";
-import { expect } from "vitest";
-import { BaseCollection } from "@gettersethya/mira-client";
+import { AuthCollection, BaseCollection } from "@gettersethya/mira-client";
 import { Field } from "@gettersethya/mira-client";
 import { ViewCollection } from "@gettersethya/mira-client";
-import { RepositoryLive } from "../../src/repository/repository.js";
+import { Effect, Layer, Match, Result } from "effect";
+import { SqlClient } from "effect/sql";
+import { expect } from "vitest";
+import { applyRulesToCollections, defineRule } from "../../src/app/index.js";
 import { CollectionService, makeCollectionServiceLayer } from "../../src/collection-service/collection-service.js";
-import { FileStorage, FileStorageNotFound } from "../../src/storage/storage.js";
 import { NodeCryptoLayer } from "../../src/crypto/node.js";
+import { Dialect } from "../../src/dialect/dialect.js";
+import { sqliteDialect } from "../../src/dialect/dialect-sqlite.js";
+import { NodeAuthServiceLayer } from "../../src/http/auth-node.js";
+import { RepositoryLive } from "../../src/repository/repository.js";
+import { FileStorage, FileStorageNotFound } from "../../src/storage/storage.js";
 // ---------------------------------------------------------------------------
 // Test layer
 // ---------------------------------------------------------------------------
@@ -22,8 +26,7 @@ const FileStorageTest = Layer.succeed(FileStorage, FileStorage.of({
     list: () => Effect.succeed([])
 }));
 const sqliteLayer = SqliteClient.layer({ filename: ":memory:" });
-const collectionServiceWithDeps = makeCollectionServiceLayer([]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer));
-const testLayer = Layer.mergeAll(collectionServiceWithDeps, sqliteLayer, FileStorageTest, NodeCryptoLayer);
+const DialectTest = Layer.succeed(Dialect, sqliteDialect);
 const noCtx = { headers: {}, query: {} };
 // ---------------------------------------------------------------------------
 // Table setup helpers
@@ -31,50 +34,50 @@ const noCtx = { headers: {}, query: {} };
 // ---------------------------------------------------------------------------
 const setupPostsTable = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    yield* sql.unsafe(`
-    CREATE TABLE IF NOT EXISTS "posts" (
-      "seqId"     INTEGER PRIMARY KEY AUTOINCREMENT,
-      "id"        TEXT NOT NULL UNIQUE,
-      "title"     TEXT NOT NULL,
-      "published" INTEGER NOT NULL DEFAULT 0,
-      "authorId"  TEXT,
-      "created"   TEXT NOT NULL,
-      "updated"   TEXT NOT NULL
-    )
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "posts" (
+      "seqId"     INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"        TEXT NOT NULL UNIQUE,
+      "title"     TEXT NOT NULL,
+      "published" INTEGER NOT NULL DEFAULT 0,
+      "authorId"  TEXT,
+      "created"   TEXT NOT NULL,
+      "updated"   TEXT NOT NULL
+    )
   `);
     yield* sql.unsafe(`DELETE FROM "posts"`);
 });
 // View collection tests: a base table + a SQLite VIEW over it
 const setupViewTables = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    yield* sql.unsafe(`
-    CREATE TABLE IF NOT EXISTS "posts_base" (
-      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
-      "id"      TEXT NOT NULL UNIQUE,
-      "title"   TEXT NOT NULL,
-      "status"  TEXT NOT NULL DEFAULT 'draft',
-      "created" TEXT NOT NULL,
-      "updated" TEXT NOT NULL
-    )
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "posts_base" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "title"   TEXT NOT NULL,
+      "status"  TEXT NOT NULL DEFAULT 'draft',
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
   `);
     yield* sql.unsafe(`DELETE FROM "posts_base"`);
     yield* sql.unsafe(`DROP VIEW IF EXISTS "active_posts"`);
-    yield* sql.unsafe(`
-    CREATE VIEW "active_posts" AS
-      SELECT seqId, id, title, status, created, updated FROM posts_base WHERE status = 'active'
+    yield* sql.unsafe(`
+    CREATE VIEW "active_posts" AS
+      SELECT seqId, id, title, status, created, updated FROM posts_base WHERE status = 'active'
   `);
 });
 const setupScoredTable = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    yield* sql.unsafe(`
-    CREATE TABLE IF NOT EXISTS "scored" (
-      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
-      "id"      TEXT NOT NULL UNIQUE,
-      "name"    TEXT NOT NULL,
-      "score"   REAL NOT NULL,
-      "created" TEXT NOT NULL,
-      "updated" TEXT NOT NULL
-    )
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "scored" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "name"    TEXT NOT NULL,
+      "score"   REAL NOT NULL,
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
   `);
     yield* sql.unsafe(`DELETE FROM "scored"`);
 });
@@ -82,45 +85,51 @@ const setupScoredTable = Effect.gen(function* () {
 // Collection definitions
 // ---------------------------------------------------------------------------
 // Base collection — all operations public
-const Posts = BaseCollection.define("posts", {
+const postsDef = BaseCollection.define("posts", {
     title: Field.text({ maxLength: 100 }),
     published: Field.boolean({ default: false }),
     authorId: Field.text({ required: false })
-}).rules((R) => ({
+});
+const postsRules = defineRule(postsDef, (R) => ({
     list: R.public(),
     view: R.public(),
     create: R.public(),
     update: R.public(),
     delete: R.public()
 }));
+const Posts = applyRulesToCollections([postsDef], [postsRules])[0];
 // Base collection — rule-enforced: only authorId "user1" can access
-const ProtectedPosts = BaseCollection.define("posts", {
+const protectedPostsDef = BaseCollection.define("posts", {
     title: Field.text(),
     published: Field.boolean({ default: false }),
     authorId: Field.text({ required: false })
-}).rules((R) => ({
+});
+const protectedPostsRules = defineRule(protectedPostsDef, (R) => ({
     list: R.field("authorId").eq(R.literal("user1")),
     view: R.field("authorId").eq(R.literal("user1")),
     create: R.field("authorId").eq(R.literal("user1")),
     update: R.field("authorId").eq(R.literal("user1")),
     delete: R.field("authorId").eq(R.literal("user1"))
 }));
+const ProtectedPosts = applyRulesToCollections([protectedPostsDef], [protectedPostsRules])[0];
 // Base collection — no rules (deny all by default)
 const NoRulePosts = BaseCollection.define("posts", {
     title: Field.text()
 });
 // View collection — public list/view, no create/update/delete
-const ActivePosts = ViewCollection.define("active_posts", "SELECT seqId, id, title, status, created, updated FROM posts_base WHERE status = 'active'", {
+const activePostsDef = ViewCollection.define("active_posts", "SELECT seqId, id, title, status, created, updated FROM posts_base WHERE status = 'active'", {
     seqId: Field.integer().view(),
     id: Field.text().view(),
     title: Field.text().view(),
     status: Field.text().view()
-}).rules((R) => ({
+});
+const activePostsRules = defineRule(activePostsDef, (R) => ({
     list: R.public(),
     view: R.public()
 }));
+const ActivePosts = applyRulesToCollections([activePostsDef], [activePostsRules])[0];
 // Collection with error callbacks for integration testing
-const Scored = BaseCollection.define("scored", {
+const scoredDef = BaseCollection.define("scored", {
     name: Field.text({
         minLength: 2,
         error: (kind) => Match.value(kind).pipe(Match.when("minLength", () => "Name too short"), Match.when("required", () => "Name is required"), Match.orElse(() => "Invalid name"))
@@ -130,16 +139,36 @@ const Scored = BaseCollection.define("scored", {
         max: 100,
         error: (kind) => Match.value(kind).pipe(Match.when("minimum", () => "Score below zero"), Match.when("maximum", () => "Score above 100"), Match.orElse(() => "Invalid score"))
     })
-}).rules((R) => ({
+});
+const scoredRules = defineRule(scoredDef, (R) => ({
+    create: R.public(),
+    update: R.public(),
+    list: R.public(),
+    view: R.public(),
+    delete: R.public()
+}));
+const Scored = applyRulesToCollections([scoredDef], [scoredRules])[0];
+// Collection with a literalText field
+const rolesDef = BaseCollection.define("roles", {
+    role: Field.literalText({ literal: ["admin", "agent", "readonly"] })
+});
+const rolesRules = defineRule(rolesDef, (R) => ({
     create: R.public(),
     update: R.public(),
     list: R.public(),
     view: R.public(),
     delete: R.public()
 }));
+const Roles = applyRulesToCollections([rolesDef], [rolesRules])[0];
+// PostsServiceLayer wires Posts into the collection service (registers `published` for boolean encode/decode)
+const collectionServiceWithDeps = makeCollectionServiceLayer([Posts]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
+const testLayer = Layer.mergeAll(collectionServiceWithDeps, sqliteLayer, FileStorageTest, NodeCryptoLayer);
 // ScoredServiceLayer wires Scored into the collection service
-const scoredServiceWithDeps = makeCollectionServiceLayer([Scored]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer));
+const scoredServiceWithDeps = makeCollectionServiceLayer([Scored]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
 const scoredTestLayer = Layer.mergeAll(scoredServiceWithDeps, sqliteLayer, FileStorageTest, NodeCryptoLayer);
+// RolesServiceLayer wires Roles into the collection service
+const rolesServiceWithDeps = makeCollectionServiceLayer([Roles]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
+const rolesTestLayer = Layer.mergeAll(rolesServiceWithDeps, sqliteLayer, FileStorageTest, NodeCryptoLayer);
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -237,12 +266,12 @@ describe("list", () => {
     it.effect("no rules → ForbiddenError", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.list(NoRulePosts, null, 10, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
-            if (result.left._tag === "ForbiddenError") {
-                expect(result.left.action).toBe("list");
+        const result = yield* svc.list(NoRulePosts, null, 10, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
+            if (result.failure._tag === "ForbiddenError") {
+                expect(result.failure.action).toBe("list");
             }
         }
     }).pipe(Effect.provide(testLayer)));
@@ -408,10 +437,10 @@ describe("view", () => {
     it.effect("returns NotFoundError for an unknown id", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.view(Posts, "nonexistent123", noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("NotFoundError");
+        const result = yield* svc.view(Posts, "nonexistent123", noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("seqId is NOT in the returned row", () => Effect.gen(function* () {
@@ -431,19 +460,19 @@ describe("view", () => {
         const id = created["id"];
         if (typeof id !== "string")
             throw new Error("expected string id");
-        const result = yield* svc.view(ProtectedPosts, id, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("NotFoundError");
+        const result = yield* svc.view(ProtectedPosts, id, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("no rules → ForbiddenError", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.view(NoRulePosts, "any", noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
+        const result = yield* svc.view(NoRulePosts, "any", noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
         }
     }).pipe(Effect.provide(testLayer)));
 });
@@ -466,46 +495,58 @@ describe("create", () => {
         const result = yield* svc.create(Posts, { title: "X" }, noCtx);
         expect("seqId" in result).toBe(false);
     }).pipe(Effect.provide(testLayer)));
+    it.effect("boolean field round-trips through SQLite encode/decode (true)", () => Effect.gen(function* () {
+        yield* setupPostsTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(Posts, { title: "Bool true", published: true }, noCtx);
+        expect(result["published"]).toBe(true);
+    }).pipe(Effect.provide(testLayer)));
+    it.effect("boolean field round-trips through SQLite encode/decode (false)", () => Effect.gen(function* () {
+        yield* setupPostsTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(Posts, { title: "Bool false", published: false }, noCtx);
+        expect(result["published"]).toBe(false);
+    }).pipe(Effect.provide(testLayer)));
     it.effect("ValidationError when required field is missing", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Posts, { published: true }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
-            if (result.left._tag === "ValidationError") {
-                expect(result.left.issues.some((i) => i.includes("title"))).toBe(true);
+        const result = yield* svc.create(Posts, { published: true }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+            if (result.failure._tag === "ValidationError") {
+                expect(result.failure.issues.some((i) => i.includes("title"))).toBe(true);
             }
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ValidationError when x-system field is in input", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Posts, { title: "X", id: "hacked" }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
-            if (result.left._tag === "ValidationError") {
-                expect(result.left.issues.some((i) => i.includes("id"))).toBe(true);
+        const result = yield* svc.create(Posts, { title: "X", id: "hacked" }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+            if (result.failure._tag === "ValidationError") {
+                expect(result.failure.issues.some((i) => i.includes("id"))).toBe(true);
             }
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ValidationError when seqId is in input", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Posts, { title: "X", seqId: 99 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
+        const result = yield* svc.create(Posts, { title: "X", seqId: 99 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ValidationError when type is wrong", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Posts, { title: 42 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
+        const result = yield* svc.create(Posts, { title: 42 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ValidationError when string exceeds maxLength", () => Effect.gen(function* () {
@@ -513,12 +554,12 @@ describe("create", () => {
         const svc = yield* CollectionService;
         const result = yield* svc
             .create(Posts, { title: "x".repeat(101) }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
-            if (result.left._tag === "ValidationError") {
-                expect(result.left.issues.some((i) => i.includes("100"))).toBe(true);
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+            if (result.failure._tag === "ValidationError") {
+                expect(result.failure.issues.some((i) => i.includes("100"))).toBe(true);
             }
         }
     }).pipe(Effect.provide(testLayer)));
@@ -528,10 +569,10 @@ describe("create", () => {
         // ProtectedPosts requires authorId = "user1"; supply "user2" → rule fails
         const result = yield* svc
             .create(ProtectedPosts, { title: "X", authorId: "user2" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("create succeeds when rule pre-check passes", () => Effect.gen(function* () {
@@ -543,10 +584,10 @@ describe("create", () => {
     it.effect("no rules → ForbiddenError", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(NoRulePosts, { title: "X" }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
+        const result = yield* svc.create(NoRulePosts, { title: "X" }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("view collection → ReadOnlyError", () => Effect.gen(function* () {
@@ -554,10 +595,10 @@ describe("create", () => {
         const svc = yield* CollectionService;
         const result = yield* svc
             .create(ActivePosts, { id: "x", title: "X", status: "active" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ReadOnlyError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ReadOnlyError");
         }
     }).pipe(Effect.provide(testLayer)));
 });
@@ -576,6 +617,16 @@ describe("update", () => {
         expect(updated["title"]).toBe("New");
         expect(updated["authorId"]).toBe("user1");
     }).pipe(Effect.provide(testLayer)));
+    it.effect("toggling a boolean field updates and round-trips correctly", () => Effect.gen(function* () {
+        yield* setupPostsTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(Posts, { title: "Toggle", published: false }, noCtx);
+        const id = created["id"];
+        if (typeof id !== "string")
+            throw new Error("expected string id");
+        const updated = yield* svc.update(Posts, id, { published: true }, noCtx);
+        expect(updated["published"]).toBe(true);
+    }).pipe(Effect.provide(testLayer)));
     it.live("updated timestamp is refreshed; created is unchanged", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
@@ -597,10 +648,10 @@ describe("update", () => {
             throw new Error("expected string id");
         const result = yield* svc
             .update(Posts, id, { title: "Y", id: "hacked", created: "1970" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("NotFoundError for unknown id", () => Effect.gen(function* () {
@@ -608,10 +659,10 @@ describe("update", () => {
         const svc = yield* CollectionService;
         const result = yield* svc
             .update(Posts, "nosuchid1234567", { title: "X" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("NotFoundError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ForbiddenError when rule blocks update", () => Effect.gen(function* () {
@@ -624,12 +675,12 @@ describe("update", () => {
             throw new Error("expected string id");
         const result = yield* svc
             .update(ProtectedPosts, id, { title: "Y" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
-            if (result.left._tag === "ForbiddenError") {
-                expect(result.left.action).toBe("update");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
+            if (result.failure._tag === "ForbiddenError") {
+                expect(result.failure.action).toBe("update");
             }
         }
     }).pipe(Effect.provide(testLayer)));
@@ -638,10 +689,10 @@ describe("update", () => {
         const svc = yield* CollectionService;
         const result = yield* svc
             .update(NoRulePosts, "anyid", { title: "X" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("view collection → ReadOnlyError", () => Effect.gen(function* () {
@@ -649,10 +700,10 @@ describe("update", () => {
         const svc = yield* CollectionService;
         const result = yield* svc
             .update(ActivePosts, "anyid", { title: "X" }, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ReadOnlyError");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ReadOnlyError");
         }
     }).pipe(Effect.provide(testLayer)));
 });
@@ -677,19 +728,19 @@ describe("delete", () => {
         if (typeof id !== "string")
             throw new Error("expected string id");
         yield* svc.delete(Posts, id, noCtx);
-        const result = yield* svc.view(Posts, id, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("NotFoundError");
+        const result = yield* svc.view(Posts, id, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("NotFoundError for unknown id", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.delete(Posts, "nosuchid1234567", noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("NotFoundError");
+        const result = yield* svc.delete(Posts, "nosuchid1234567", noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("ForbiddenError when rule blocks delete", () => Effect.gen(function* () {
@@ -701,31 +752,31 @@ describe("delete", () => {
             throw new Error("expected string id");
         const result = yield* svc
             .delete(ProtectedPosts, id, noCtx)
-            .pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
-            if (result.left._tag === "ForbiddenError") {
-                expect(result.left.action).toBe("delete");
+            .pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
+            if (result.failure._tag === "ForbiddenError") {
+                expect(result.failure.action).toBe("delete");
             }
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("no rules → ForbiddenError", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.delete(NoRulePosts, "anyid", noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ForbiddenError");
+        const result = yield* svc.delete(NoRulePosts, "anyid", noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ForbiddenError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("view collection → ReadOnlyError", () => Effect.gen(function* () {
         yield* setupViewTables;
         const svc = yield* CollectionService;
-        const result = yield* svc.delete(ActivePosts, "anyid", noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ReadOnlyError");
+        const result = yield* svc.delete(ActivePosts, "anyid", noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ReadOnlyError");
         }
     }).pipe(Effect.provide(testLayer)));
 });
@@ -736,46 +787,46 @@ describe("error callback — integration", () => {
     it.effect("minLength message propagates from create", () => Effect.gen(function* () {
         yield* setupScoredTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Scored, { name: "x", score: 50 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result) && result.left._tag === "ValidationError") {
-            expect(result.left.issues.some((i) => i.includes("Name too short"))).toBe(true);
+        const result = yield* svc.create(Scored, { name: "x", score: 50 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result) && result.failure._tag === "ValidationError") {
+            expect(result.failure.issues.some((i) => i.includes("Name too short"))).toBe(true);
         }
     }).pipe(Effect.provide(scoredTestLayer)));
     it.effect("minimum message propagates from create", () => Effect.gen(function* () {
         yield* setupScoredTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Scored, { name: "ok", score: -1 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result) && result.left._tag === "ValidationError") {
-            expect(result.left.issues.some((i) => i.includes("Score below zero"))).toBe(true);
+        const result = yield* svc.create(Scored, { name: "ok", score: -1 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result) && result.failure._tag === "ValidationError") {
+            expect(result.failure.issues.some((i) => i.includes("Score below zero"))).toBe(true);
         }
     }).pipe(Effect.provide(scoredTestLayer)));
     it.effect("maximum message propagates from create", () => Effect.gen(function* () {
         yield* setupScoredTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Scored, { name: "ok", score: 200 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result) && result.left._tag === "ValidationError") {
-            expect(result.left.issues.some((i) => i.includes("Score above 100"))).toBe(true);
+        const result = yield* svc.create(Scored, { name: "ok", score: 200 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result) && result.failure._tag === "ValidationError") {
+            expect(result.failure.issues.some((i) => i.includes("Score above 100"))).toBe(true);
         }
     }).pipe(Effect.provide(scoredTestLayer)));
     it.effect("required message propagates from create", () => Effect.gen(function* () {
         yield* setupScoredTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Scored, { score: 50 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result) && result.left._tag === "ValidationError") {
-            expect(result.left.issues.some((i) => i.includes("Name is required"))).toBe(true);
+        const result = yield* svc.create(Scored, { score: 50 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result) && result.failure._tag === "ValidationError") {
+            expect(result.failure.issues.some((i) => i.includes("Name is required"))).toBe(true);
         }
     }).pipe(Effect.provide(scoredTestLayer)));
     it.effect("Match.orElse fallback fires for type mismatch", () => Effect.gen(function* () {
         yield* setupScoredTable;
         const svc = yield* CollectionService;
-        const result = yield* svc.create(Scored, { name: 999, score: 50 }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result) && result.left._tag === "ValidationError") {
-            expect(result.left.issues.some((i) => i.includes("Invalid name"))).toBe(true);
+        const result = yield* svc.create(Scored, { name: 999, score: 50 }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result) && result.failure._tag === "ValidationError") {
+            expect(result.failure.issues.some((i) => i.includes("Invalid name"))).toBe(true);
         }
     }).pipe(Effect.provide(scoredTestLayer)));
     it.effect("update with too-short name produces default message (no custom error on update path)", () => Effect.gen(function* () {
@@ -785,12 +836,12 @@ describe("error callback — integration", () => {
         const id = created["id"];
         if (typeof id !== "string")
             throw new Error("expected string id");
-        const result = yield* svc.update(Scored, id, { name: "x" }, noCtx).pipe(Effect.either);
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left._tag).toBe("ValidationError");
-            if (result.left._tag === "ValidationError") {
-                expect(result.left.issues.length).toBeGreaterThan(0);
+        const result = yield* svc.update(Scored, id, { name: "x" }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+            if (result.failure._tag === "ValidationError") {
+                expect(result.failure.issues.length).toBeGreaterThan(0);
             }
         }
     }).pipe(Effect.provide(scoredTestLayer)));
@@ -802,4 +853,153 @@ describe("error callback — integration", () => {
         expect(result["score"]).toBe(50);
     }).pipe(Effect.provide(scoredTestLayer)));
 });
+// ---------------------------------------------------------------------------
+// literalText integration tests
+// ---------------------------------------------------------------------------
+const setupRolesTable = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "roles" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "role"    TEXT NOT NULL,
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
+  `);
+    yield* sql.unsafe(`DELETE FROM "roles"`);
+});
+describe("literalText integration", () => {
+    it.effect("create with valid literal value succeeds", () => Effect.gen(function* () {
+        yield* setupRolesTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(Roles, { role: "admin" }, noCtx);
+        expect(result["role"]).toBe("admin");
+    }).pipe(Effect.provide(rolesTestLayer)));
+    it.effect("create with invalid literal value fails with ValidationError", () => Effect.gen(function* () {
+        yield* setupRolesTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(Roles, { role: "superadmin" }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+        }
+    }).pipe(Effect.provide(rolesTestLayer)));
+    it.effect("update with invalid literal value fails with ValidationError", () => Effect.gen(function* () {
+        yield* setupRolesTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(Roles, { role: "admin" }, noCtx);
+        const id = created["id"];
+        if (typeof id !== "string")
+            throw new Error("expected string id");
+        const result = yield* svc.update(Roles, id, { role: "superadmin" }, noCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+        }
+    }).pipe(Effect.provide(rolesTestLayer)));
+    it.effect("update with valid literal value succeeds", () => Effect.gen(function* () {
+        yield* setupRolesTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(Roles, { role: "admin" }, noCtx);
+        const id = created["id"];
+        if (typeof id !== "string")
+            throw new Error("expected string id");
+        const updated = yield* svc.update(Roles, id, { role: "agent" }, noCtx);
+        expect(updated["role"]).toBe("agent");
+    }).pipe(Effect.provide(rolesTestLayer)));
+});
+// ---------------------------------------------------------------------------
+// AuthCollection create — regression: email/password were blocked by x-system
+// ---------------------------------------------------------------------------
+const superAdminDef = AuthCollection.define("_superadmin", {});
+const superAdminRules = defineRule(superAdminDef, (R) => ({
+    list: R.field("email").eq(R.literal("")),
+    view: R.field("email").eq(R.literal("")),
+    create: R.public(),
+    update: R.field("email").eq(R.literal("")),
+    delete: R.field("email").eq(R.literal(""))
+}));
+const SuperAdmin = applyRulesToCollections([superAdminDef], [superAdminRules])[0];
+const setupSuperAdminTable = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "_superadmin" (
+      "seqId"         INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"            TEXT NOT NULL UNIQUE,
+      "email"         TEXT NOT NULL UNIQUE,
+      "password"      TEXT NOT NULL,
+      "emailVerified" INTEGER NOT NULL DEFAULT 0,
+      "created"       TEXT NOT NULL,
+      "updated"       TEXT NOT NULL
+    )
+  `);
+    yield* sql.unsafe(`DELETE FROM "_superadmin"`);
+});
+const superAdminTestLayer = Layer.mergeAll(makeCollectionServiceLayer([SuperAdmin]).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer)), sqliteLayer, FileStorageTest, NodeCryptoLayer, NodeAuthServiceLayer);
+const adminCtx = { headers: {}, query: {}, admin: true };
+describe("AuthCollection create", () => {
+    it.effect("succeeds with email and password (regression: was blocked by x-system check)", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const record = yield* svc.create(SuperAdmin, { email: "admin@example.com", password: "hashed-pw" }, adminCtx);
+        expect(record["email"]).toBe("admin@example.com");
+        expect(typeof record["id"]).toBe("string");
+        expect(record["id"]).not.toBe("");
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("rejects attempt to set generated field id", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(SuperAdmin, { email: "a@b.com", password: "pw", id: "custom-id" }, adminCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+        }
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("fails validation when email is missing", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(SuperAdmin, { password: "pw" }, adminCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+        }
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("fails validation when email format is invalid", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const result = yield* svc.create(SuperAdmin, { email: "notanemail", password: "pw" }, adminCtx).pipe(Effect.result);
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("ValidationError");
+        }
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("hashes the password on create — the stored value is not the plaintext", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const record = yield* svc.create(SuperAdmin, { email: "hash@example.com", password: "plaintext-pw" }, adminCtx);
+        const stored = record["password"];
+        expect(typeof stored).toBe("string");
+        expect(stored).not.toBe("plaintext-pw");
+        expect(String(stored).startsWith("scrypt$")).toBe(true);
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("hashes a new password on update", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(SuperAdmin, { email: "upd@example.com", password: "first-pw" }, adminCtx);
+        const id = created["id"];
+        const updated = yield* svc.update(SuperAdmin, id, { password: "second-pw" }, adminCtx);
+        expect(updated["password"]).not.toBe("second-pw");
+        expect(String(updated["password"]).startsWith("scrypt$")).toBe(true);
+    }).pipe(Effect.provide(superAdminTestLayer)));
+    it.effect("empty password on update is dropped and keeps the existing hash", () => Effect.gen(function* () {
+        yield* setupSuperAdminTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(SuperAdmin, { email: "keep@example.com", password: "keep-pw" }, adminCtx);
+        const id = created["id"];
+        const before = created["password"];
+        const updated = yield* svc.update(SuperAdmin, id, { password: "" }, adminCtx);
+        expect(updated["password"]).toBe(before);
+    }).pipe(Effect.provide(superAdminTestLayer)));
+});
 //# sourceMappingURL=collection-service.test.js.map