@memberjunction/testing-integration 0.0.0 → 5.49.0

package/dist/checks/self-test.check.js

@@ -0,0 +1,35 @@
+/**
+ * self-test.check.ts — the ONE check registered by Phase 0.
+ *
+ * It is not part of any migrated suite; it exists solely to give Phase 0 a green,
+ * end-to-end "the bootstrap installed an instrumented cache that actually sees
+ * RunView traffic" proof — the exact failure mode the harness warns about (cache
+ * installed AFTER provider setup is a silent no-op). Retain it as a permanent smoke
+ * check or remove at the team's discretion.
+ */
+import { RunView } from '@memberjunction/core';
+import { IntegrationCheckRegistry } from '../check-registry.js';
+import { Assert } from '../test-runner.js';
+IntegrationCheckRegistry.Instance.Register({
+    Id: 'self-test.cache-warm',
+    Name: 'Self-test: instrumented cache observes RunView traffic',
+    Fn: async (ctx) => {
+        ctx.Storage.ResetCounts();
+        const rv = new RunView();
+        // A cold, per-run-unique fingerprint forces a cache MISS (one RunViewCache write).
+        // Column-AGNOSTIC always-true predicate — the rls-isolation bundle documented why:
+        // UniqueFilter('ID', tag) feeds a non-GUID literal to the uniqueidentifier PK and
+        // errors. A pure string-literal comparison is always true and valid for any entity;
+        // the timestamp tag makes each run a distinct cold slot.
+        const r = await rv.RunView({
+            EntityName: 'MJ: Users',
+            ExtraFilter: `'p0-selftest-${Date.now()}' <> 'zzz-cache-test-marker'`,
+            Fields: ['ID'],
+            ResultType: 'simple'
+        }, ctx.User);
+        const writes = ctx.Storage.SetCount('RunViewCache');
+        Assert(r.Success, `RunView failed: ${r.ErrorMessage}`);
+        Assert(writes >= 1, `Expected >=1 RunViewCache write on cold miss, saw ${writes}`);
+    }
+});
+//# sourceMappingURL=self-test.check.js.map

package/dist/checks/self-test.check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-test.check.js","sourceRoot":"","sources":["../../src/checks/self-test.check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,wDAAwD;IAC9D,EAAE,EAAE,KAAK,EAAE,GAAG,EAAiB,EAAE;QAC7B,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,oFAAoF;QACpF,yDAAyD;QACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;YACvC,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,8BAA8B;YACrE,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;SACvB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,qDAAqD,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;CACJ,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,35 @@
+/** The database backend the integration run targets. Mirrors the repo-wide DB_PLATFORM convention. */
+export type IntegrationDbPlatform = 'sqlserver' | 'postgresql';
+/**
+ * Loads the repo-root .env into process.env. Must be called from a process whose
+ * cwd is the repository root (documented usage for the integration scripts).
+ */
+export declare function LoadEnv(): void;
+export interface DbConfig {
+    Host: string;
+    Port: number;
+    User: string;
+    Password: string;
+    Database: string;
+    Schema: string;
+    /** Which backend to bootstrap. Resolved from DB_PLATFORM (default 'sqlserver'). */
+    Platform: IntegrationDbPlatform;
+}
+/**
+ * Resolves database settings from mj.config.cjs (databaseSettings) with .env
+ * fallbacks. Throws with a clear message when required settings are missing.
+ */
+export declare function LoadDbConfig(): Promise<DbConfig>;
+export interface ClientConfig {
+    Url: string;
+    WsUrl: string;
+    MJAPIKey: string;
+}
+/**
+ * Resolves the MJAPI GraphQL endpoint and system API key from env:
+ *  - MJAPI_URL overrides everything; otherwise http://localhost:{GRAPHQL_PORT}{GRAPHQL_ROOT_PATH}
+ *  - MJAPI_WS_URL overrides the subscription endpoint; otherwise derived from Url (http→ws, https→wss)
+ *  - MJ_API_KEY is the system API key MJServer accepts via the x-mj-api-key header
+ */
+export declare function LoadClientConfig(): ClientConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAYA,sGAAsG;AACtG,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,YAAY,CAAC;AAmC/D;;;GAGG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAE9B;AAED,MAAM,WAAW,QAAQ;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,QAAQ,EAAE,qBAAqB,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CA2BtD;AAED,MAAM,WAAW,YAAY;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAU/C"}

package/dist/config.js

@@ -0,0 +1,81 @@
+/**
+ * config.ts — environment / database / client configuration resolution for the
+ * integration-test bootstrap. Lifted verbatim from the original live harness
+ * (packages/MJServer/integration-test-scripts/lib/harness.ts) so the standalone
+ * tsx scripts and the IntegrationTestDriver resolve settings identically.
+ *
+ * No hardcoded secrets: everything comes from the repo-root .env / mj.config.cjs.
+ */
+import dotenv from 'dotenv';
+import path from 'path';
+import { cosmiconfig } from 'cosmiconfig';
+/**
+ * Resolve the target backend from DB_PLATFORM. Mirrors the canonical
+ * resolveDbPlatformFromEnv (@memberjunction/generic-database-provider) but kept inline
+ * so the lightweight config layer doesn't pull that package's module-load cost in just
+ * to read one env var. Strict: only 'sqlserver' / 'postgresql' (case-insensitive),
+ * default 'sqlserver', throws on anything else (legacy aliases are not accepted).
+ */
+function resolveIntegrationDbPlatform() {
+    const raw = process.env.DB_PLATFORM;
+    if (raw === undefined || raw.trim() === '')
+        return 'sqlserver';
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === 'sqlserver' || normalized === 'postgresql')
+        return normalized;
+    throw new Error(`Invalid DB_PLATFORM value '${raw}'. Must be 'sqlserver' or 'postgresql' (case-insensitive).`);
+}
+/**
+ * Loads the repo-root .env into process.env. Must be called from a process whose
+ * cwd is the repository root (documented usage for the integration scripts).
+ */
+export function LoadEnv() {
+    dotenv.config({ path: path.resolve(process.cwd(), '.env'), quiet: true });
+}
+/**
+ * Resolves database settings from mj.config.cjs (databaseSettings) with .env
+ * fallbacks. Throws with a clear message when required settings are missing.
+ */
+export async function LoadDbConfig() {
+    const configResult = await cosmiconfig('mj').search();
+    const config = (configResult?.config ?? {});
+    const dbSettings = config.databaseSettings ?? {};
+    const host = dbSettings.host || process.env.DB_HOST;
+    const user = dbSettings.user || process.env.DB_USERNAME;
+    const password = dbSettings.password || process.env.DB_PASSWORD;
+    const database = dbSettings.database || process.env.DB_DATABASE;
+    if (!host || !user || !password || !database) {
+        throw new Error('Missing DB settings. Provide them via mj.config.cjs databaseSettings or .env ' +
+            '(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_DATABASE). Run from the repo root.');
+    }
+    // DB_PLATFORM ∈ {sqlserver, postgresql}; throws on invalid values.
+    const platform = resolveIntegrationDbPlatform();
+    const defaultPort = platform === 'postgresql' ? 5432 : 1433;
+    return {
+        Host: host,
+        Port: Number(dbSettings.port ?? process.env.DB_PORT ?? defaultPort),
+        User: user,
+        Password: password,
+        Database: database,
+        Schema: config.mjCoreSchema || dbSettings.mjCoreSchema || '__mj',
+        Platform: platform
+    };
+}
+/**
+ * Resolves the MJAPI GraphQL endpoint and system API key from env:
+ *  - MJAPI_URL overrides everything; otherwise http://localhost:{GRAPHQL_PORT}{GRAPHQL_ROOT_PATH}
+ *  - MJAPI_WS_URL overrides the subscription endpoint; otherwise derived from Url (http→ws, https→wss)
+ *  - MJ_API_KEY is the system API key MJServer accepts via the x-mj-api-key header
+ */
+export function LoadClientConfig() {
+    const apiKey = process.env.MJ_API_KEY;
+    if (!apiKey) {
+        throw new Error('MJ_API_KEY is not set in the environment — required for client-side tests.');
+    }
+    const port = process.env.GRAPHQL_PORT ?? '4000';
+    const rootPath = process.env.GRAPHQL_ROOT_PATH ?? '/';
+    const url = process.env.MJAPI_URL ?? `http://localhost:${port}${rootPath.startsWith('/') ? rootPath : `/${rootPath}`}`;
+    const wsUrl = process.env.MJAPI_WS_URL ?? url.replace(/^http/, 'ws');
+    return { Url: url, WsUrl: wsUrl, MJAPIKey: apiKey };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C;;;;;;GAMG;AACH,SAAS,4BAA4B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IACjF,MAAM,IAAI,KAAK,CACX,8BAA8B,GAAG,4DAA4D,CAChG,CAAC;AACN,CAAC;AAkBD;;;GAGG;AACH,MAAM,UAAU,OAAO;IACnB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,MAAM,MAAM,GAAkB,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAkB,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAChE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACX,+EAA+E;YAC/E,2EAA2E,CAC9E,CAAC;IACN,CAAC;IACD,mEAAmE;IACnE,MAAM,QAAQ,GAA0B,4BAA4B,EAAE,CAAC;IACvE,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,OAAO;QACH,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC;QACnE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,IAAI,MAAM;QAChE,QAAQ,EAAE,QAAQ;KACrB,CAAC;AACN,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,oBAAoB,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC;IACvH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @memberjunction/testing-integration — public API.
+ *
+ * Defines this package's surface only (no re-exports of other packages' symbols;
+ * InMemoryLocalStorageProvider etc. are imported from @memberjunction/core where used).
+ */
+export * from './config.js';
+export * from './tiers.js';
+export * from './instrumented-cache.js';
+export * from './test-runner.js';
+export * from './bootstrap.js';
+export * from './bootstrap-client.js';
+export * from './ai-verify.js';
+export * from './check.js';
+export * from './check-registry.js';
+import './checks/self-test.check.js';
+export * from './rls-fixture.js';
+export * from './types.js';
+export * from './IntegrationTestDriver.js';
+/**
+ * Tree-shake guard. Importing this module (or calling this function) ensures the
+ * check registrations and the IntegrationTestDriver @RegisterClass decorator have run.
+ */
+export declare function LoadTestingIntegration(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAI5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,OAAO,0BAA0B,CAAC;AAClC,cAAc,eAAe,CAAC;AAI9B,cAAc,SAAS,CAAC;AACxB,cAAc,yBAAyB,CAAC;AAQxC;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/index.js

@@ -0,0 +1,37 @@
+/**
+ * @memberjunction/testing-integration — public API.
+ *
+ * Defines this package's surface only (no re-exports of other packages' symbols;
+ * InMemoryLocalStorageProvider etc. are imported from @memberjunction/core where used).
+ */
+export * from './config.js';
+export * from './tiers.js';
+export * from './instrumented-cache.js';
+export * from './test-runner.js';
+export * from './bootstrap.js';
+// bootstrapIntegrationClient lives in the server-FREE bootstrap-client module (so client
+// dispatchers can import it via the `./client` subpath without dragging in server packages).
+// Re-exported here for backward-compat barrel consumers (the driver / server dispatchers).
+export * from './bootstrap-client.js';
+export * from './ai-verify.js';
+export * from './check.js';
+export * from './check-registry.js';
+import './checks/self-test.check.js'; // side effect: register the permanent Phase-0 smoke check
+export * from './rls-fixture.js';
+// NOTE: the check BUNDLES (MJ's own test content) live in the private
+// @memberjunction/integration-test-suite package — importing THAT package registers
+// every bundle on this registry. This framework package deliberately ships content-free.
+export * from './types.js';
+export * from './IntegrationTestDriver.js';
+// Re-export the bundle arrays + RunQuery fixture helpers AND, as a side effect of
+// evaluating these modules, register every bundled check on the IntegrationCheckRegistry.
+// The @RegisterClass decorator on IntegrationTestDriver fires via the export above.
+// Side-effect only: the permanent Phase-0 smoke check (no exports of its own).
+/**
+ * Tree-shake guard. Importing this module (or calling this function) ensures the
+ * check registrations and the IntegrationTestDriver @RegisterClass decorator have run.
+ */
+export function LoadTestingIntegration() {
+    /* no-op — importing this module is the side effect */
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,yFAAyF;AACzF,6FAA6F;AAC7F,2FAA2F;AAC3F,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,OAAO,0BAA0B,CAAC,CAAC,0DAA0D;AAC7F,cAAc,eAAe,CAAC;AAC9B,sEAAsE;AACtE,oFAAoF;AACpF,yFAAyF;AACzF,cAAc,SAAS,CAAC;AACxB,cAAc,yBAAyB,CAAC;AAExC,kFAAkF;AAClF,0FAA0F;AAC1F,oFAAoF;AAEpF,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IAClC,sDAAsD;AAC1D,CAAC"}

package/dist/instrumented-cache.d.ts

@@ -0,0 +1,47 @@
+/**
+ * instrumented-cache.ts — the InstrumentedLocalStorageProvider and UniqueFilter,
+ * lifted verbatim from the original live harness. These are the two net-new
+ * primitives this package introduces; everything else they touch
+ * (InMemoryLocalStorageProvider, ILocalStorageProvider) is imported from
+ * @memberjunction/core, never copied.
+ */
+import type { ILocalStorageProvider } from '@memberjunction/core';
+/**
+ * Wraps any ILocalStorageProvider with call counters so tests can prove cache
+ * behavior from the outside: a cache WRITE shows up as SetItemCount++, a cache
+ * READ as GetItemCount/GetItemsCount++, and "served without touching storage"
+ * (e.g. a dedup/linger hit) as no counter movement at all.
+ */
+export declare class InstrumentedLocalStorageProvider implements ILocalStorageProvider {
+    private readonly inner;
+    GetItemCount: number;
+    GetItemsCount: number;
+    SetItemCount: number;
+    RemoveCount: number;
+    private perCategory;
+    constructor(inner: ILocalStorageProvider);
+    ResetCounts(): void;
+    /**
+     * Per-category counters — IMPORTANT for assertions: LocalCacheManager also
+     * persists its registry index asynchronously (a different category), so tests
+     * about RunView cache traffic must scope to the 'RunViewCache' category rather
+     * than the global counters.
+     */
+    GetCount(category: string): number;
+    SetCount(category: string): number;
+    private bump;
+    GetItem<T = unknown>(key: string, category?: string): Promise<T | null>;
+    GetItems<T = unknown>(keys: string[], category?: string): Promise<Map<string, T | null>>;
+    SetItem<T>(key: string, value: T, category?: string): Promise<void>;
+    Remove(key: string, category?: string): Promise<void>;
+    ClearCategory(category: string): Promise<void>;
+    GetCategoryKeys(category: string): Promise<string[]>;
+}
+/**
+ * Returns an always-true ExtraFilter that is textually unique per tag — every tag
+ * yields a distinct cache fingerprint (Filter is part of the fingerprint) while
+ * matching the same rows. This lets each check start from a guaranteed-cold cache
+ * entry without mutating any data.
+ */
+export declare function UniqueFilter(column: string, tag: string): string;
+//# sourceMappingURL=instrumented-cache.d.ts.map

package/dist/instrumented-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumented-cache.d.ts","sourceRoot":"","sources":["../src/instrumented-cache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE;;;;;GAKG;AACH,qBAAa,gCAAiC,YAAW,qBAAqB;IAO9D,OAAO,CAAC,QAAQ,CAAC,KAAK;IAN3B,YAAY,SAAK;IACjB,aAAa,SAAK;IAClB,YAAY,SAAK;IACjB,WAAW,SAAK;IACvB,OAAO,CAAC,WAAW,CAAqD;gBAE3C,KAAK,EAAE,qBAAqB;IAElD,WAAW,IAAI,IAAI;IAQ1B;;;;;OAKG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIlC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIzC,OAAO,CAAC,IAAI;IAOC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAMvE,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAMxF,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9C,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAMpE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/instrumented-cache.js

@@ -0,0 +1,81 @@
+/**
+ * Wraps any ILocalStorageProvider with call counters so tests can prove cache
+ * behavior from the outside: a cache WRITE shows up as SetItemCount++, a cache
+ * READ as GetItemCount/GetItemsCount++, and "served without touching storage"
+ * (e.g. a dedup/linger hit) as no counter movement at all.
+ */
+export class InstrumentedLocalStorageProvider {
+    constructor(inner) {
+        this.inner = inner;
+        this.GetItemCount = 0;
+        this.GetItemsCount = 0;
+        this.SetItemCount = 0;
+        this.RemoveCount = 0;
+        this.perCategory = new Map();
+    }
+    ResetCounts() {
+        this.GetItemCount = 0;
+        this.GetItemsCount = 0;
+        this.SetItemCount = 0;
+        this.RemoveCount = 0;
+        this.perCategory.clear();
+    }
+    /**
+     * Per-category counters — IMPORTANT for assertions: LocalCacheManager also
+     * persists its registry index asynchronously (a different category), so tests
+     * about RunView cache traffic must scope to the 'RunViewCache' category rather
+     * than the global counters.
+     */
+    GetCount(category) {
+        return this.perCategory.get(category)?.Gets ?? 0;
+    }
+    SetCount(category) {
+        return this.perCategory.get(category)?.Sets ?? 0;
+    }
+    bump(category, kind) {
+        const key = category ?? 'default';
+        const entry = this.perCategory.get(key) ?? { Gets: 0, Sets: 0 };
+        entry[kind]++;
+        this.perCategory.set(key, entry);
+    }
+    async GetItem(key, category) {
+        this.GetItemCount++;
+        this.bump(category, 'Gets');
+        return this.inner.GetItem(key, category);
+    }
+    async GetItems(keys, category) {
+        this.GetItemsCount++;
+        this.bump(category, 'Gets');
+        return this.inner.GetItems(keys, category);
+    }
+    async SetItem(key, value, category) {
+        this.SetItemCount++;
+        this.bump(category, 'Sets');
+        return this.inner.SetItem(key, value, category);
+    }
+    async Remove(key, category) {
+        this.RemoveCount++;
+        return this.inner.Remove(key, category);
+    }
+    async ClearCategory(category) {
+        if (this.inner.ClearCategory) {
+            return this.inner.ClearCategory(category);
+        }
+    }
+    async GetCategoryKeys(category) {
+        if (this.inner.GetCategoryKeys) {
+            return this.inner.GetCategoryKeys(category);
+        }
+        return [];
+    }
+}
+/**
+ * Returns an always-true ExtraFilter that is textually unique per tag — every tag
+ * yields a distinct cache fingerprint (Filter is part of the fingerprint) while
+ * matching the same rows. This lets each check start from a guaranteed-cold cache
+ * entry without mutating any data.
+ */
+export function UniqueFilter(column, tag) {
+    return `${column} <> 'zzz-cache-test-${tag}'`;
+}
+//# sourceMappingURL=instrumented-cache.js.map

package/dist/instrumented-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumented-cache.js","sourceRoot":"","sources":["../src/instrumented-cache.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,MAAM,OAAO,gCAAgC;IAOzC,YAA6B,KAA4B;QAA5B,UAAK,GAAL,KAAK,CAAuB;QANlD,iBAAY,GAAG,CAAC,CAAC;QACjB,kBAAa,GAAG,CAAC,CAAC;QAClB,iBAAY,GAAG,CAAC,CAAC;QACjB,gBAAW,GAAG,CAAC,CAAC;QACf,gBAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IAEZ,CAAC;IAEtD,WAAW;QACd,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IACrD,CAAC;IAEM,QAAQ,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IACrD,CAAC;IAEO,IAAI,CAAC,QAA4B,EAAE,IAAqB;QAC5D,MAAM,GAAG,GAAG,QAAQ,IAAI,SAAS,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAc,GAAW,EAAE,QAAiB;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAc,IAAc,EAAE,QAAiB;QAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAI,GAAW,EAAE,KAAQ,EAAE,QAAiB;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,QAAiB;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,QAAgB;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,QAAgB;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACpD,OAAO,GAAG,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAClD,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,33 @@
+/**
+ * registry.ts — the SERVER-FREE entry point for check registration + execution.
+ *
+ * WHY THIS EXISTS (browser fidelity, B32):
+ * The root barrel (`./index`) re-exports `./bootstrap` (which imports
+ * `@memberjunction/server-bootstrap-lite` + `mssql`) and every check module, some of
+ * which import server-only packages. So a CLIENT dispatcher that reached for
+ * `TestRunner` / `IntegrationCheckRegistry` through the barrel transitively loaded
+ * `@memberjunction/core-entities-server` — and the ClassFactory then resolved entities
+ * to their SERVER subclasses. The symptom was visible but easy to miss: the process
+ * logged `MJRemoteOperationEntityServer is server/database-only …` and
+ * `GetEntityObject('MJ: Tag Scopes')` returned `MJTagScopeEntityServer` rather than the
+ * client class a browser would get.
+ *
+ * That silently defeated the point of client-first testing: the bundle claimed to prove
+ * the wire behaves correctly for a browser, while actually exercising server subclasses
+ * a browser never loads.
+ *
+ * This module therefore exports ONLY client-safe primitives — the runner, the registry,
+ * and the types. It imports NO bootstrap and NO check modules. A client dispatcher pairs
+ * it with `@memberjunction/testing-integration/client` (the server-free bootstrap) and a
+ * direct side-effect import of its OWN check bundle via the `./checks/*` subpath, so the
+ * only checks registered are the ones it intends to run.
+ *
+ * Keep this file dependency-light on purpose: anything added here is loaded by every
+ * client dispatcher, and a single server import would silently reintroduce B32.
+ */
+export * from './config.js';
+export * from './test-runner.js';
+export * from './check-registry.js';
+export * from './check.js';
+export * from './tiers.js';
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC"}

package/dist/registry.js

@@ -0,0 +1,37 @@
+/**
+ * registry.ts — the SERVER-FREE entry point for check registration + execution.
+ *
+ * WHY THIS EXISTS (browser fidelity, B32):
+ * The root barrel (`./index`) re-exports `./bootstrap` (which imports
+ * `@memberjunction/server-bootstrap-lite` + `mssql`) and every check module, some of
+ * which import server-only packages. So a CLIENT dispatcher that reached for
+ * `TestRunner` / `IntegrationCheckRegistry` through the barrel transitively loaded
+ * `@memberjunction/core-entities-server` — and the ClassFactory then resolved entities
+ * to their SERVER subclasses. The symptom was visible but easy to miss: the process
+ * logged `MJRemoteOperationEntityServer is server/database-only …` and
+ * `GetEntityObject('MJ: Tag Scopes')` returned `MJTagScopeEntityServer` rather than the
+ * client class a browser would get.
+ *
+ * That silently defeated the point of client-first testing: the bundle claimed to prove
+ * the wire behaves correctly for a browser, while actually exercising server subclasses
+ * a browser never loads.
+ *
+ * This module therefore exports ONLY client-safe primitives — the runner, the registry,
+ * and the types. It imports NO bootstrap and NO check modules. A client dispatcher pairs
+ * it with `@memberjunction/testing-integration/client` (the server-free bootstrap) and a
+ * direct side-effect import of its OWN check bundle via the `./checks/*` subpath, so the
+ * only checks registered are the ones it intends to run.
+ *
+ * Keep this file dependency-light on purpose: anything added here is loaded by every
+ * client dispatcher, and a single server import would silently reintroduce B32.
+ */
+// All four are verified server-free: `config` pulls only dotenv/path/cosmiconfig,
+// `test-runner` only node:fs/node:path, `tiers` nothing, and `check-registry` only
+// @memberjunction/global. `check`'s every import — including `mssql` and the
+// instrumented-cache provider — is `import type`, so all of it is erased at compile time.
+export * from './config.js';
+export * from './test-runner.js';
+export * from './check-registry.js';
+export * from './check.js';
+export * from './tiers.js';
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,kFAAkF;AAClF,mFAAmF;AACnF,6EAA6E;AAC7E,0FAA0F;AAC1F,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC"}

package/dist/rls-fixture.d.ts

@@ -0,0 +1,37 @@
+import type { UserInfo, IMetadataProvider, RowLevelSecurityFilterInfo } from '@memberjunction/core';
+import { RlsFixture } from './check.js';
+/**
+ * Emails of the purpose-built RLS test users seeded via version-controlled metadata. These
+ * principals (users + the "Integration Test: RLS Scoped Reader" role + its entity-permission grant)
+ * live in the SIBLING `metadata-optional/integration-test/` root — NOT the default-pushed `metadata/`
+ * tree — so they never land in a production DB that only syncs `metadata/`. A/B are each in
+ * ONLY that role → genuinely scoped (non-exempt) on SEEDED_RLS_ENTITY; the no-grant user has no
+ * roles. Kept in sync with the fixtures by convention (change both together).
+ */
+export declare const SEEDED_SCOPED_A_EMAIL = "it-rls-a@integration.test";
+export declare const SEEDED_SCOPED_B_EMAIL = "it-rls-b@integration.test";
+export declare const SEEDED_NOGRANT_EMAIL = "it-nogrant@integration.test";
+/** The entity the seeded scoped role grants read on (with the `{{UserID}}` RLS filter). */
+export declare const SEEDED_RLS_ENTITY = "MJ: AI Agent Runs";
+/** The exact command that seeds the RLS principals — printed in every skip-as-pass warning below. */
+export declare const SEED_FIXTURES_COMMAND = "npx mj sync push --dir=metadata-optional/integration-test";
+/** Case-insensitive user-by-email lookup for the seeded fixtures. */
+export declare function findUserByEmail(users: UserInfo[], email: string): UserInfo | undefined;
+/** Discover a `{{UserID}}`-scoped RLS filter from the provider (for the token-based checks). */
+export declare function discoverTokenFilter(provider: IMetadataProvider): RowLevelSecurityFilterInfo | undefined;
+/** Discover the first non-exempt (user, entity) pair — a user with a non-empty Read clause. */
+export declare function discoverLivePair(provider: IMetadataProvider, users: UserInfo[]): {
+    User: UserInfo;
+    EntityName: string;
+} | undefined;
+/**
+ * Discover the RLS fixture: a two-user divergent-clause pair PLUS the two independent
+ * single-user pieces (TokenFilter, LivePair). Pure (no singletons) so it is unit-testable
+ * with a mocked provider + synthetic users. The two-user discovery iterates entities,
+ * computes each user's clause once per entity (O(entities × users)), and returns the first
+ * entity where two distinct users get different non-empty clauses. TokenFilter/LivePair are
+ * attached to every returned fixture regardless of two-user usability, so the single-user
+ * checks (RLS1/RLS5) run even when the DB lacks two divergent users.
+ */
+export declare function discoverRlsFixture(provider: IMetadataProvider, users: UserInfo[]): RlsFixture;
+//# sourceMappingURL=rls-fixture.d.ts.map

package/dist/rls-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-fixture.d.ts","sourceRoot":"","sources":["../src/rls-fixture.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,qGAAqG;AACrG,eAAO,MAAM,qBAAqB,8DAA8D,CAAC;AAEjG,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEtF;AAED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,0BAA0B,GAAG,SAAS,CAGvG;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAUnI;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,UAAU,CAmC7F"}

package/dist/rls-fixture.js

@@ -0,0 +1,91 @@
+/**
+ * rls-fixture.ts — RLS fixture DISCOVERY (framework-side).
+ *
+ * Extracted from the rls-isolation check bundle when the bundles moved to the private
+ * @memberjunction/integration-test-suite package: IntegrationTestDriver provisions the
+ * suite-scoped RlsFixture itself (before dispatching bundles), so discovery must live in
+ * the FRAMEWORK, not in content the framework cannot depend on. Pure (no singletons):
+ * unit-testable with a mocked provider + synthetic users. The rls-isolation bundle imports
+ * these same helpers back from here.
+ */
+import { EntityPermissionType } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+/**
+ * Emails of the purpose-built RLS test users seeded via version-controlled metadata. These
+ * principals (users + the "Integration Test: RLS Scoped Reader" role + its entity-permission grant)
+ * live in the SIBLING `metadata-optional/integration-test/` root — NOT the default-pushed `metadata/`
+ * tree — so they never land in a production DB that only syncs `metadata/`. A/B are each in
+ * ONLY that role → genuinely scoped (non-exempt) on SEEDED_RLS_ENTITY; the no-grant user has no
+ * roles. Kept in sync with the fixtures by convention (change both together).
+ */
+export const SEEDED_SCOPED_A_EMAIL = 'it-rls-a@integration.test';
+export const SEEDED_SCOPED_B_EMAIL = 'it-rls-b@integration.test';
+export const SEEDED_NOGRANT_EMAIL = 'it-nogrant@integration.test';
+/** The entity the seeded scoped role grants read on (with the `{{UserID}}` RLS filter). */
+export const SEEDED_RLS_ENTITY = 'MJ: AI Agent Runs';
+/** The exact command that seeds the RLS principals — printed in every skip-as-pass warning below. */
+export const SEED_FIXTURES_COMMAND = 'npx mj sync push --dir=metadata-optional/integration-test';
+/** Case-insensitive user-by-email lookup for the seeded fixtures. */
+export function findUserByEmail(users, email) {
+    return users.find(u => u.Email?.toLowerCase() === email.toLowerCase());
+}
+/** Discover a `{{UserID}}`-scoped RLS filter from the provider (for the token-based checks). */
+export function discoverTokenFilter(provider) {
+    const filters = provider.RowLevelSecurityFilters ?? [];
+    return filters.find(f => f.FilterText?.includes('{{UserID}}'));
+}
+/** Discover the first non-exempt (user, entity) pair — a user with a non-empty Read clause. */
+export function discoverLivePair(provider, users) {
+    for (const u of users) {
+        for (const e of provider.Entities) {
+            const clause = e.GetUserRowLevelSecurityWhereClause(u, EntityPermissionType.Read, '');
+            if (clause && clause.trim() !== '') {
+                return { User: u, EntityName: e.Name };
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Discover the RLS fixture: a two-user divergent-clause pair PLUS the two independent
+ * single-user pieces (TokenFilter, LivePair). Pure (no singletons) so it is unit-testable
+ * with a mocked provider + synthetic users. The two-user discovery iterates entities,
+ * computes each user's clause once per entity (O(entities × users)), and returns the first
+ * entity where two distinct users get different non-empty clauses. TokenFilter/LivePair are
+ * attached to every returned fixture regardless of two-user usability, so the single-user
+ * checks (RLS1/RLS5) run even when the DB lacks two divergent users.
+ */
+export function discoverRlsFixture(provider, users) {
+    const distinct = users.filter((u, i) => users.findIndex(o => UUIDsEqual(o.ID, u.ID)) === i);
+    const tokenFilter = discoverTokenFilter(provider);
+    const livePair = discoverLivePair(provider, distinct);
+    const seededScopedA = findUserByEmail(users, SEEDED_SCOPED_A_EMAIL);
+    const seededScopedB = findUserByEmail(users, SEEDED_SCOPED_B_EMAIL);
+    const seededNoGrant = findUserByEmail(users, SEEDED_NOGRANT_EMAIL);
+    const attach = (fx) => ({ ...fx, TokenFilter: tokenFilter, LivePair: livePair, SeededScopedA: seededScopedA, SeededScopedB: seededScopedB, SeededNoGrant: seededNoGrant });
+    if (distinct.length < 2) {
+        return attach({ UserA: users[0], UserB: users[0], EntityName: '', Usable: false, Reason: 'fewer than two distinct users in the user cache' });
+    }
+    for (const entity of provider.Entities) {
+        // Compute each user's effective Read clause once for this entity; keep non-empty ones.
+        const withClause = [];
+        for (const u of distinct) {
+            const clause = entity.GetUserRowLevelSecurityWhereClause(u, EntityPermissionType.Read, '');
+            if (clause && clause.trim() !== '') {
+                withClause.push({ user: u, clause });
+            }
+        }
+        if (withClause.length < 2) {
+            continue;
+        }
+        for (let i = 0; i < withClause.length; i++) {
+            for (let j = i + 1; j < withClause.length; j++) {
+                if (withClause[i].clause !== withClause[j].clause) {
+                    return attach({ UserA: withClause[i].user, UserB: withClause[j].user, EntityName: entity.Name, Usable: true });
+                }
+            }
+        }
+    }
+    return attach({ UserA: distinct[0], UserB: distinct[1], EntityName: '', Usable: false, Reason: 'only RLS-exempt users (no entity yields two distinct non-empty clauses)' });
+}
+//# sourceMappingURL=rls-fixture.js.map

package/dist/rls-fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-fixture.js","sourceRoot":"","sources":["../src/rls-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,qGAAqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,2DAA2D,CAAC;AAEjG,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,KAAa;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACvD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,QAA2B,EAAE,KAAiB;IAC3E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAC,EAAE,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B,EAAE,KAAiB;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,EAAsG,EAAc,EAAE,CAClI,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;IAExJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC;IAClJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACrC,uFAAuF;QACvF,MAAM,UAAU,GAAyC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC,EAAE,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3F,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACb,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;oBAChD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnH,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC,CAAC;AAChL,CAAC"}