@motujs/runtime 0.0.0-stage → 0.1.1

package/dist/postgrest-fetch.js

@@ -0,0 +1,804 @@
+import { MotuError } from './index.js';
+import { beginCall, reachOwner, recordOutbound } from '@motujs/core';
+import { MockTransport } from './mock.js';
+/** Where unscoped requests accumulate for a check to read back after a run. Reset per fake instance. */
+const registryKey = '__motuUnscopedRequests';
+function recordUnscoped(entry) {
+    const g = globalThis;
+    (g[registryKey] ??= []).push(entry);
+}
+/** Read back (and optionally clear) everything recorded since the page loaded or the last read. */
+export function readUnscopedRequests(clear = true) {
+    const g = globalThis;
+    const found = g[registryKey] ?? [];
+    if (clear)
+        g[registryKey] = [];
+    return found;
+}
+/**
+ * How many requests the fake answered at all, scoped or not — what `readUnscopedRequests().length ===
+ * 0` needs alongside it before it can count as a pass. A check that examined nothing has not proven
+ * "every request was covered"; it has proven nothing ran. Reported as `seen` so the CLI's own
+ * "0 examined is a skip, not an ok" rule applies here automatically, same as everywhere else.
+ */
+const countKey = '__motuFakeFetchRequestCount';
+function recordSeen() {
+    const g = globalThis;
+    g[countKey] = (g[countKey] ?? 0) + 1;
+}
+/**
+ * Requests the fake DELEGATED that then failed — an app route nobody stubbed, most often.
+ *
+ * Read alongside the unscoped list: unscoped means "the fake saw it and had nothing for it", this
+ * means "the fake never claimed it and the real answer was an error". Both say the island is standing
+ * on something that is not there; they differ only in whether `appRoutes`/`baseUrl` reached it.
+ */
+export function readUnansweredRequests(clear = true) {
+    const g = globalThis;
+    const found = g.__motuUnansweredRequests ?? [];
+    if (clear)
+        g.__motuUnansweredRequests = [];
+    return found;
+}
+export function readFakeFetchRequestCount(clear = true) {
+    const g = globalThis;
+    const n = g[countKey] ?? 0;
+    if (clear)
+        g[countKey] = 0;
+    return n;
+}
+/**
+ * WHAT THIS ISLAND NEEDS FROM THE BACKEND, observed rather than declared.
+ *
+ * Mocking at the wire took something away. When each service module was stood down by name, an
+ * island's `ambient` said `@/lib/services/challenges` and you could read its data dependency off the
+ * contract. Now the service runs for real and only `@/lib/supabase/client` is stood down —
+ * transitively, several modules below the component — so `ambient` (which reads DIRECT imports) can
+ * no longer see it. The dependency did not disappear; it stopped being legible.
+ *
+ * This is the replacement, and it is strictly better than what it replaces: a table-and-RPC list is
+ * what the island actually needs, at the granularity assay's `.assay/operations.json` already speaks
+ * (tables read, tables written, functions called) — which is the seam a motu↔assay contract-drift
+ * check would compare across.
+ *
+ * Recorded for every request, INCLUDING ones no fixture answered: what the island reached for is the
+ * dependency, whether or not this lagoon happened to have data for it.
+ */
+const reachKey = '__motuDataReach';
+/**
+ * Who is reaching, right now.
+ *
+ * `reachOwner()` lives in @motujs/core beside the island window `traced` already uses, so a host-module
+ * call and a backend reach agree about who asked. Imported lazily-safe: this module is also loaded in
+ * plain node by the fixture tests, where no window is ever open and the answer is `unattributed`.
+ */
+function ownerNow() {
+    try {
+        return reachOwner() ?? 'unattributed';
+    }
+    catch {
+        return 'unattributed';
+    }
+}
+/** One reach, as a DECLARATION spells it — the string an `ambient` or `reaches` entry is compared to. */
+function reachEntry(kind, name, method) {
+    if (kind === 'table')
+        return method ? `table:${name}(${method})` : `table:${name}`;
+    if (kind === 'rpc')
+        return `rpc:${name}`;
+    if (kind === 'function')
+        return `fn:${name}`;
+    return `route:${method} ${name}`;
+}
+function recordReach(kind, name, method) {
+    const g = globalThis;
+    const reach = (g[reachKey] ??= { tables: {}, rpcs: [], functions: [], routes: [], by: {} });
+    // BACK-FILLED, because a reach recorded before this field existed (a page held open across a
+    // reload, an older bundle) would otherwise crash the split on `undefined`.
+    reach.by ??= {};
+    // AT REQUEST TIME, like `traced` reads its island: a fetch starts inside the owner's window and
+    // resolves long after it has closed, so asking afterwards attributes everything to nobody.
+    const owner = ownerNow();
+    const declaredForm = reachEntry(kind, name, method);
+    // The unified ledger gets the SAME string `data-reach` compares against declarations, so one readout
+    // can show a wire reach beside a contract call without translating between two vocabularies.
+    recordOutbound('wire', declaredForm);
+    const mine = (reach.by[owner] ??= []);
+    if (!mine.includes(declaredForm))
+        mine.push(declaredForm);
+    if (kind === 'rpc' || kind === 'function' || kind === 'route') {
+        const list = kind === 'rpc' ? reach.rpcs : kind === 'function' ? reach.functions : reach.routes;
+        const entry = kind === 'route' ? `${method} ${name}` : name;
+        if (!list.includes(entry))
+            list.push(entry);
+        return;
+    }
+    const methods = (reach.tables[name] ??= []);
+    if (method && !methods.includes(method))
+        methods.push(method);
+}
+const callsKey = '__motuWireCalls';
+/**
+ * A ring, because a lagoon left open re-fetches forever and an unbounded log is a leak. 200 is far
+ * more than any one interaction produces (the largest here was 22) and small enough to render.
+ */
+const MAX_CALLS = 200;
+let callSeq = 0;
+/**
+ * Bounded, and never the whole body.
+ *
+ * 20 kB rather than 2, because the panel EXPANDS these now: a row you can open to read the payload is
+ * only worth opening if the payload is there, and the largest real one here — a regenerated séance
+ * series — is about 21 kB. The ring above bounds the count; this bounds each entry, and the product
+ * is the worst case. It is a dev overlay in a page that already holds the application.
+ */
+function summarise(value, max = 20_000) {
+    if (value === undefined || value === null)
+        return value;
+    try {
+        const json = JSON.stringify(value);
+        if (json === undefined)
+            return String(value);
+        return json.length <= max ? JSON.parse(json) : `${json.slice(0, max)}… (${json.length} chars)`;
+    }
+    catch {
+        return String(value);
+    }
+}
+/**
+ * Told when a call lands.
+ *
+ * WITHOUT THIS THE PANEL IS A LIE OF OMISSION. The lens repaints on STORE WRITES, and a call that
+ * changes no region key writes nothing — so a save whose refetch returns identical data left the
+ * Network list showing the state before it, and the person who just pressed the button concluded
+ * nothing had been sent. Which is the exact confusion this section exists to end.
+ */
+const callListeners = new Set();
+/** Notified whenever an intercepted call is recorded. Returns an unsubscribe. */
+export function subscribeWireCalls(cb) {
+    callListeners.add(cb);
+    return () => callListeners.delete(cb);
+}
+const gestureKey = '__motuGesture';
+/**
+ * How long after a click a request still counts as ITS request.
+ *
+ * Generous on purpose. A save is a write, a refetch and everything the refetch fans out into — on a
+ * real region that was 22 requests over most of a second — and cutting the tail off would split one
+ * action across two groups, which is worse than occasionally adopting a stray poll.
+ */
+const GESTURE_WINDOW_MS = 2500;
+/** The gesture in force, if one is recent enough to own what happens next. */
+function gestureNow() {
+    const g = globalThis[gestureKey];
+    if (!g || typeof g.label !== 'string' || typeof g.at !== 'number')
+        return undefined;
+    if (Date.now() - g.at > GESTURE_WINDOW_MS)
+        return undefined;
+    return { label: g.label, id: typeof g.id === 'number' ? g.id : 0 };
+}
+let gestureSeq = 0;
+/**
+ * Say what the person just did, so the calls that follow can be grouped under it.
+ *
+ * Written through a global rather than an import because the DOCK sets it and the dock is a separate
+ * package that this one must not depend on — the same shape `reachOwner` and the request counter
+ * already use. Dev-only by construction: nothing sets it unless the overlay is mounted.
+ */
+export function noteGesture(label) {
+    globalThis[gestureKey] = { label, at: Date.now(), id: ++gestureSeq };
+}
+function recordCall(call) {
+    const g = globalThis;
+    const calls = (g[callsKey] ??= []);
+    const gesture = gestureNow();
+    calls.push({
+        ...call,
+        ...(gesture ? { gesture: gesture.label, gestureId: gesture.id } : {}),
+        seq: ++callSeq,
+        at: Date.now(),
+    });
+    if (calls.length > MAX_CALLS)
+        calls.splice(0, calls.length - MAX_CALLS);
+    // A listener that throws is a panel's bug, not this module's: one bad subscriber must not stop the
+    // fake from answering the request the application is waiting on.
+    callListeners.forEach((l) => {
+        try {
+            l();
+        }
+        catch {
+            /* the panel's problem */
+        }
+    });
+}
+/** Every intercepted call, oldest first. Does NOT clear: a panel polls it, and a flow may read it twice. */
+export function readWireCalls() {
+    const g = globalThis;
+    return [...(g[callsKey] ?? [])];
+}
+export function clearWireCalls() {
+    globalThis[callsKey] = [];
+}
+export function readDataReach(clear = true) {
+    const g = globalThis;
+    const found = g[reachKey] ?? { tables: {}, rpcs: [], functions: [], routes: [], by: {} };
+    if (clear)
+        g[reachKey] = { tables: {}, rpcs: [], functions: [], routes: [], by: {} };
+    return found;
+}
+function parseFilterValue(raw) {
+    const dot = raw.indexOf('.');
+    if (dot === -1)
+        return null;
+    return { op: raw.slice(0, dot), value: raw.slice(dot + 1) };
+}
+/** `col=in.(a,b,c)` → `['a','b','c']`; PostgREST's own list syntax, not JSON. */
+function parseInList(value) {
+    const inner = value.startsWith('(') && value.endsWith(')') ? value.slice(1, -1) : value;
+    return inner.length ? inner.split(',') : [];
+}
+function coerce(value) {
+    if (value === 'null')
+        return null;
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    return value;
+}
+function matchesOp(rowValue, op, rawValue) {
+    switch (op) {
+        case 'eq':
+            return rowValue === coerce(rawValue);
+        case 'is':
+            return rowValue === coerce(rawValue);
+        case 'neq':
+            return rowValue !== coerce(rawValue);
+        case 'gte':
+            return typeof rowValue === 'string' || typeof rowValue === 'number' ? rowValue >= coerceOrdered(rowValue, rawValue) : false;
+        case 'gt':
+            return typeof rowValue === 'string' || typeof rowValue === 'number' ? rowValue > coerceOrdered(rowValue, rawValue) : false;
+        case 'lte':
+            return typeof rowValue === 'string' || typeof rowValue === 'number' ? rowValue <= coerceOrdered(rowValue, rawValue) : false;
+        case 'lt':
+            return typeof rowValue === 'string' || typeof rowValue === 'number' ? rowValue < coerceOrdered(rowValue, rawValue) : false;
+        case 'in':
+            return parseInList(rawValue).some((v) => rowValue === coerce(v));
+        default:
+            return false;
+    }
+}
+/** Compare like-to-like: a numeric row value against a numeric literal, else lexical string compare. */
+function coerceOrdered(rowValue, rawValue) {
+    return typeof rowValue === 'number' ? Number(rawValue) : rawValue;
+}
+/**
+ * `not.<op>.<value>` — only the shape actually used (`not.is.null`) is supported; anything else is
+ * left unrecognized so the caller can report it rather than silently mis-evaluating.
+ */
+function parseNot(raw) {
+    if (raw === 'is.null')
+        return 'not.is.null';
+    return null;
+}
+/** One clause of `or=(a.is.null,b.gt.5)` — reuses the same operator vocabulary as a plain filter. */
+function evalOrClause(row, clause) {
+    const [column, ...rest] = clause.split('.');
+    const opValue = rest.join('.');
+    const parsed = parseFilterValue(opValue);
+    if (!parsed || !column)
+        return null;
+    return matchesOp(row[column], parsed.op, parsed.value);
+}
+const KNOWN_PARAMS = new Set(['select', 'order', 'limit', 'offset', 'or']);
+/**
+ * Apply every recognized filter param to a table's rows. Returns `null` (not an error) the moment an
+ * UNRECOGNIZED filter shows up, so the caller can report the request as unscoped instead of returning
+ * a silently-wrong subset — a filter this fake does not understand is exactly the "nothing was scoped
+ * for this" case the whole design exists to surface.
+ */
+function applyFilters(rows, params) {
+    let result = rows;
+    for (const [key, raw] of params.entries()) {
+        if (KNOWN_PARAMS.has(key))
+            continue;
+        if (key === 'not')
+            continue; // handled per-column below via the `col=not.is.null` form instead
+        if (raw.startsWith('not.')) {
+            const notOp = parseNot(raw.slice(4));
+            if (!notOp)
+                return null;
+            result = result.filter((r) => r[key] !== null);
+            continue;
+        }
+        const parsed = parseFilterValue(raw);
+        if (!parsed)
+            return null;
+        if (!['eq', 'is', 'neq', 'gte', 'gt', 'lte', 'lt', 'in'].includes(parsed.op))
+            return null;
+        result = result.filter((r) => matchesOp(r[key], parsed.op, parsed.value));
+    }
+    const or = params.get('or');
+    if (or !== null) {
+        const inner = or.startsWith('(') && or.endsWith(')') ? or.slice(1, -1) : or;
+        const clauses = inner.split(',');
+        const evaluated = clauses.map((c) => evalOrClause({}, c)); // shape check
+        if (evaluated.some((v) => v === null))
+            return null;
+        result = result.filter((r) => clauses.some((c) => evalOrClause(r, c) === true));
+    }
+    return result;
+}
+function applyOrder(rows, order) {
+    if (!order)
+        return rows;
+    const parts = order.split(',').map((p) => {
+        const [column, direction] = p.split('.');
+        return { column, desc: direction === 'desc' };
+    });
+    return [...rows].sort((a, b) => {
+        for (const { column, desc } of parts) {
+            const av = a[column];
+            const bv = b[column];
+            if (av === bv)
+                continue;
+            const cmp = av == null ? -1 : bv == null ? 1 : av < bv ? -1 : 1;
+            return desc ? -cmp : cmp;
+        }
+        return 0;
+    });
+}
+/** `select=` as this fake understands it: flat columns, `*`, or an embed passed through verbatim —
+ *  it does not JOIN, it trusts the fixture row already carries the embedded shape if one is selected. */
+function applySelect(rows, select) {
+    if (!select || select === '*')
+        return rows;
+    const cols = select.split(',').map((c) => c.trim());
+    if (cols.some((c) => c.includes('(')))
+        return rows; // an embed: trust the fixture's own shape
+    return rows.map((r) => Object.fromEntries(cols.map((c) => [c, r[c]])));
+}
+/** Where a RELATIVE url resolves from. A browser has `location`; node (the `--fast` lane, and this
+ *  module's own tests) does not, and `new Request('/api/x')` throws there rather than defaulting. */
+function originBase() {
+    return typeof location !== 'undefined' && location.href ? location.href : 'http://lagoon.local';
+}
+/**
+ * SYNCHRONOUS, and that is load-bearing rather than tidiness.
+ *
+ * A reach is attributed to whoever's window is open when the request is MADE (see `ownerNow`). This
+ * function does no awaiting — it never did — but being `async` meant the caller's `await` yielded a
+ * microtask before any `recordReach` ran, by which time `runWithIsland`/`runWithSource` had already
+ * restored the previous owner and every reach recorded as `unattributed`. Keep the whole path from
+ * the fake's entry to `recordReach` synchronous.
+ */
+function normalize(input, init) {
+    // Resolved against the origin BEFORE constructing the Request, because an app route is called with
+    // a relative path (`fetch('/api/…')`) and that is exactly the case this fake was extended for.
+    const absolute = input instanceof Request ? input : new URL(String(input), originBase()).href;
+    const req = absolute instanceof Request ? absolute : new Request(absolute, init);
+    const url = new URL(req.url);
+    let body = undefined;
+    if (init?.body !== undefined) {
+        try {
+            body = typeof init.body === 'string' ? JSON.parse(init.body) : init.body;
+        }
+        catch {
+            body = init.body;
+        }
+    }
+    return { method: (init?.method ?? req.method ?? 'GET').toUpperCase(), path: url.pathname, url, headers: req.headers, body };
+}
+function jsonResponse(body, status, headers = {}) {
+    return new Response(body === undefined ? null : JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json', ...headers },
+    });
+}
+function postgrestError(status, message) {
+    return jsonResponse({ message, details: null, hint: null, code: String(status) }, status);
+}
+/**
+ * Build a `fetch`-compatible function backed entirely by declared tables and fixtures. Anything it
+ * cannot resolve is recorded via `readUnscopedRequests()` and answered with a real-shaped 404 — the
+ * app's own error handling runs for real against it, same as it would against an actual gap in a real
+ * backend, rather than the harness hanging or throwing somewhere the app never catches.
+ */
+/**
+ * The target a request is ABOUT, spelled the way a declaration spells it.
+ *
+ * Derived from the path rather than reported by the handler, so the log records a call even when the
+ * handler never ran — an origin outside `baseUrl`, an unrecognised path. Those are exactly the
+ * requests worth seeing: they are the ones that silently answered 404.
+ */
+function targetOf(req, appRoutes) {
+    if (appRoutes.some((p) => req.path.startsWith(p)))
+        return `route:${req.method} ${req.path}`;
+    if (req.path.startsWith('/auth/v1/'))
+        return `auth:${req.path.slice('/auth/v1/'.length)}`;
+    if (req.path.startsWith('/functions/v1/'))
+        return `fn:${req.path.slice('/functions/v1/'.length)}`;
+    if (req.path.startsWith('/rest/v1/rpc/'))
+        return `rpc:${req.path.slice('/rest/v1/rpc/'.length)}`;
+    if (req.path.startsWith('/rest/v1/'))
+        return `table:${req.path.slice('/rest/v1/'.length).split('?')[0]}`;
+    return 'unparsed';
+}
+/** What was SENT: an RPC's arguments or a write's row, else the query that scoped a read. */
+function requestOf(req) {
+    if (req.body !== undefined && req.body !== null)
+        return req.body;
+    const query = req.url.search.replace(/^\?/, '');
+    return query === '' ? undefined : query;
+}
+/**
+ * What came BACK, as one line. Never the body: a read can answer with a whole table, and a log that
+ * holds every row it ever saw is a memory leak wearing a diagnostic's clothes.
+ */
+async function responseOf(res) {
+    if (res.status === 204)
+        return 'no content';
+    try {
+        const text = await res.clone().text();
+        if (text === '')
+            return undefined;
+        const parsed = JSON.parse(text);
+        if (Array.isArray(parsed))
+            return `${parsed.length} row(s)`;
+        if (parsed && typeof parsed === 'object') {
+            const obj = parsed;
+            // PostgREST spells an error `{ message }`; the app's own RPCs answer `{ success, error }`.
+            if (typeof obj.message === 'string')
+                return obj.message;
+            if (obj.success === false)
+                return `refused: ${String(obj.error ?? 'unknown')}`;
+            return Object.keys(obj).slice(0, 6).join(', ') || 'object';
+        }
+        return String(parsed);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createPostgrestFetch(options = {}) {
+    const tables = options.tables ?? {};
+    const transport = new MockTransport(options.fixtures ?? []);
+    const motuFakeFetch = async function motuFakeFetch(input, init) {
+        const req = normalize(input, init);
+        recordSeen();
+        // LOGGED HERE, not in each handler, and for the same reason the handlers do their own
+        // `recordReach`: this is the one place that sees both the request and the response it produced.
+        // Attribution is read BEFORE awaiting — a fetch starts inside an island's window and resolves
+        // long after it has closed, so asking afterwards credits everything to nobody.
+        const by = ownerNow();
+        const target = targetOf(req, options.appRoutes ?? []);
+        const url = req.url.pathname + req.url.search;
+        // BEFORE the await, like everything else attributed here: the owner window is open now and shut
+        // by the time the answer comes back.
+        const landed = beginCall({ via: 'wire', url, method: req.method, label: target });
+        const res = await dispatch(req);
+        const response = await responseOf(res);
+        landed({ status: res.status, ok: res.ok, ...(res.ok ? {} : { error: response ?? '' }), ...(declaredFailures.has(res) ? { declared: true } : {}) });
+        recordCall({
+            target,
+            method: req.method,
+            url,
+            by,
+            request: summarise(requestOf(req)),
+            status: res.status,
+            response,
+        });
+        return res;
+    };
+    const dispatch = async (req) => {
+        // BEFORE the baseUrl guard, deliberately: an application route is SAME-ORIGIN, so it never
+        // matches the database origin and would otherwise be rejected as "outside baseUrl".
+        if ((options.appRoutes ?? []).some((p) => req.path.startsWith(p)))
+            return handleAppRoute(req, transport);
+        if (options.baseUrl && !req.url.href.startsWith(options.baseUrl)) {
+            recordUnscoped({ method: req.method, path: req.path, target: 'unparsed', reason: `origin outside baseUrl (${req.url.origin})` });
+            return postgrestError(404, `motu: fake fetch has no baseUrl match for ${req.url.origin}`);
+        }
+        if (req.path.startsWith('/auth/v1/'))
+            return handleAuth(req, options.auth);
+        if (req.path.startsWith('/functions/v1/'))
+            return handleFunction(req, transport);
+        if (req.path.startsWith('/rest/v1/rpc/'))
+            return handleRpc(req, transport);
+        if (req.path.startsWith('/rest/v1/'))
+            return handleRest(req, tables, transport);
+        recordUnscoped({ method: req.method, path: req.path, target: 'unparsed', reason: 'path matches no known PostgREST/auth route' });
+        return postgrestError(404, `motu: fake fetch does not recognize path ${req.path}`);
+    };
+    // STAMPED WITH WHAT IT CLAIMS, so `installFakeFetch(fake)` does not have to be told again.
+    //
+    // The two took `appRoutes` separately and a caller wrote it twice — and a divergence was silent in
+    // both directions: a route the installer claimed but the fake did not fell into the `baseUrl` guard
+    // and 404'd as unscoped; a route the fake claimed but the installer did not never reached it at all,
+    // went to the dev server, and landed in `readUnansweredRequests()`. The fake is the one that KNOWS,
+    // so it is the one that says.
+    motuFakeFetch[WIRE_CLAIMS] = {
+        appRoutes: options.appRoutes,
+        baseUrl: options.baseUrl,
+    };
+    return motuFakeFetch;
+}
+const WIRE_CLAIMS = Symbol.for('motu.wire.claims');
+/** What `createPostgrestFetch` stamped on a fake — its own claim, not a second copy of it. */
+export function fakeFetchClaims(fake) {
+    return fake[WIRE_CLAIMS];
+}
+async function handleAuth(req, auth) {
+    if (req.path === '/auth/v1/user' && req.method === 'GET') {
+        if (auth?.user !== undefined)
+            return jsonResponse(auth.user, 200);
+        recordUnscoped({ method: req.method, path: req.path, target: 'auth:getUser', reason: 'no `auth.user` declared' });
+        return postgrestError(401, 'motu: fake fetch has no `auth.user` declared');
+    }
+    if (req.path === '/auth/v1/session' && req.method === 'GET') {
+        if (auth?.session !== undefined)
+            return jsonResponse(auth.session, 200);
+        recordUnscoped({ method: req.method, path: req.path, target: 'auth:getSession', reason: 'no `auth.session` declared' });
+        return postgrestError(401, 'motu: fake fetch has no `auth.session` declared');
+    }
+    recordUnscoped({ method: req.method, path: req.path, target: 'unparsed', reason: 'unrecognized auth route' });
+    return postgrestError(404, `motu: fake fetch does not recognize auth route ${req.path}`);
+}
+/**
+ * An EDGE FUNCTION (`supabase.functions.invoke`), which reaches here for free: the client hands its
+ * `customFetch` to the functions client too, so an invoke is already flowing through this fake — it
+ * was simply landing on an unrecognized path and being recorded as unscoped. A different protocol
+ * from PostgREST (an opaque POST with a JSON body), and a different one in the ledger's vocabulary,
+ * so it gets its own `data-reach` bucket rather than being folded in with `rpc`.
+ */
+async function handleFunction(req, transport) {
+    const fn = req.path.slice('/functions/v1/'.length);
+    recordReach('function', fn);
+    try {
+        return jsonResponse(await transport.call(fn, 'invoke', [req.body]), 200);
+    }
+    catch (err) {
+        return fromTransportError(err, { method: req.method, path: req.path, target: `function:${fn}` });
+    }
+}
+/**
+ * A SAME-ORIGIN APPLICATION ROUTE — a Next `app/api/**` handler and the like, called with a relative
+ * url by ordinary `fetch`, never by the database client.
+ *
+ * This closes a gap `network-sealed` structurally cannot see: a relative request goes to the lagoon's
+ * OWN origin, so it is loopback, so it is not an escape — it just 404s against the dev server, the
+ * caller catches it, and an empty state renders. acme's announcement banner did exactly that. Routed
+ * through the fixture layer, the same miss is an unscoped request and `fixture-coverage` says so.
+ */
+async function handleAppRoute(req, transport) {
+    recordReach('route', req.path, req.method);
+    try {
+        const result = await transport.call(req.path, req.method, [req.body, Object.fromEntries(req.url.searchParams)]);
+        return jsonResponse(result, 200);
+    }
+    catch (err) {
+        return fromTransportError(err, { method: req.method, path: req.path, target: `route:${req.path}` });
+    }
+}
+async function handleRpc(req, transport) {
+    const fn = req.path.slice('/rest/v1/rpc/'.length);
+    recordReach('rpc', fn);
+    try {
+        const result = await transport.call(fn, 'rpc', [req.body]);
+        return jsonResponse(result, 200);
+    }
+    catch (err) {
+        return fromTransportError(err, { method: req.method, path: req.path, target: `rpc:${fn}` });
+    }
+}
+async function handleRest(req, tables, transport) {
+    const table = req.path.slice('/rest/v1/'.length).split('?')[0];
+    const singular = (req.headers.get('accept') ?? '').includes('vnd.pgrst.object');
+    const wantsCount = (req.headers.get('prefer') ?? '').includes('count=');
+    // HEAD IS A READ WITHOUT ITS BODY. supabase-js sends one for every `{ count: 'exact', head: true }`
+    // — "how many unread notifications" — and reads the answer from Content-Range alone. Refusing it
+    // with a 405 made every badge count in a lagoon an error the app's own code had to swallow.
+    const head = req.method === 'HEAD';
+    const answer = (res) => (head ? new Response(null, { status: res.status, headers: res.headers }) : res);
+    const range = (offset, n, total) => 
+    // PostgREST says `*/0` for an empty range; `0--1/0` is not a range at all.
+    ({ 'Content-Range': n > 0 ? `${offset}-${offset + n - 1}/${total}` : `*/${total}` });
+    if (req.method === 'GET' || head) {
+        recordReach('table', table, 'select');
+        // A read failure can be declared as a fixture (`{service: table, method: 'select', status,
+        // after}`) WITHOUT needing a matching table row shape — checked first, same call-counting `after`
+        // documented on `MockTransport`.
+        try {
+            const overridden = await transport.call(table, 'select', [Object.fromEntries(req.url.searchParams)]);
+            if (overridden !== undefined) {
+                const n = Array.isArray(overridden) ? overridden.length : 1;
+                return answer(jsonResponse(overridden, 200, wantsCount ? range(0, n, n) : {}));
+            }
+        }
+        catch (err) {
+            if (!isNoFixture(err))
+                return fromTransportError(err, { method: req.method, path: req.path, target: `table:${table}` });
+            // no fixture override declared — fall through to the generic table engine below
+        }
+        const declared = tables[table];
+        if (!declared) {
+            recordUnscoped({ method: req.method, path: req.path, target: `table:${table}`, reason: 'no table declared and no read fixture' });
+            return postgrestError(404, `motu: fake fetch has no table "${table}" declared`);
+        }
+        const rows = typeof declared.rows === 'function' ? declared.rows() : declared.rows;
+        const filtered = applyFilters(rows, req.url.searchParams);
+        if (filtered === null) {
+            recordUnscoped({ method: req.method, path: req.path, target: `table:${table}`, reason: `unrecognized filter in ${req.url.search}` });
+            return postgrestError(404, `motu: fake fetch does not understand a filter in ${req.url.search}`);
+        }
+        const ordered = applyOrder(filtered, req.url.searchParams.get('order'));
+        const total = ordered.length;
+        const limit = req.url.searchParams.has('limit') ? Number(req.url.searchParams.get('limit')) : undefined;
+        const offset = Number(req.url.searchParams.get('offset') ?? '0');
+        const paged = limit !== undefined ? ordered.slice(offset, offset + limit) : ordered.slice(offset);
+        const projected = applySelect(paged, req.url.searchParams.get('select'));
+        if (singular) {
+            if (projected.length === 0)
+                return answer(jsonResponse(null, 200));
+            return answer(jsonResponse(projected[0], 200));
+        }
+        const headers = wantsCount ? range(offset, projected.length, total) : {};
+        return answer(jsonResponse(projected, 200, headers));
+    }
+    // Writes: insert (POST), update (PATCH), delete (DELETE), upsert (POST + Prefer: resolution=...).
+    const prefer = req.headers.get('prefer') ?? '';
+    const isUpsert = req.method === 'POST' && prefer.includes('resolution=');
+    const method = isUpsert ? 'upsert' : req.method === 'POST' ? 'insert' : req.method === 'PATCH' ? 'update' : req.method === 'DELETE' ? 'delete' : null;
+    if (!method) {
+        recordUnscoped({ method: req.method, path: req.path, target: `table:${table}`, reason: `unsupported HTTP method ${req.method}` });
+        return postgrestError(405, `motu: fake fetch does not support ${req.method} on ${req.path}`);
+    }
+    // The semantic verb, not the HTTP one — `insert`/`update`/`upsert`/`delete` is the vocabulary
+    // assay's ledger uses for a write, and the whole point of this record is to be comparable to it.
+    recordReach('table', table, method);
+    try {
+        const result = await transport.call(table, method, [req.body, Object.fromEntries(req.url.searchParams)]);
+        if (prefer.includes('return=minimal'))
+            return new Response(null, { status: 204 });
+        return jsonResponse(result, method === 'insert' ? 201 : 200);
+    }
+    catch (err) {
+        return fromTransportError(err, { method: req.method, path: req.path, target: `table:${table}` });
+    }
+}
+function isNoFixture(err) {
+    return err instanceof MotuError && err.status === 404 && err.message.startsWith('mock: no fixture for');
+}
+/**
+ * Responses a fixture asked to fail. Remembered BESIDE the response rather than written into it: a
+ * header would be one more thing the application could see that the real backend never sends.
+ */
+const declaredFailures = new WeakSet();
+function fromTransportError(err, ctx) {
+    if (err instanceof MotuError) {
+        if (isNoFixture(err))
+            recordUnscoped({ ...ctx, reason: err.message });
+        const res = postgrestError(err.status, err.message);
+        if (err.declared)
+            declaredFailures.add(res);
+        return res;
+    }
+    recordUnscoped({ ...ctx, reason: err instanceof Error ? err.message : String(err) });
+    return postgrestError(500, 'motu: fake fetch fixture threw an unexpected error');
+}
+/**
+ * Patch `globalThis.fetch` so requests the app makes DIRECTLY — not through the database client —
+ * reach the fake too.
+ *
+ * Injecting `global: { fetch }` into `createClient` covers everything that client issues, which is
+ * most of an app's backend traffic and all of its PostgREST and edge-function traffic. It does not
+ * cover a service that calls `fetch('/api/…')` itself, because that is `window.fetch` and the client
+ * was never involved. Those requests are same-origin, so they are invisible to `network-sealed` as
+ * well: they 404 against the dev server, the caller catches it, an empty state renders, and every
+ * check stays green.
+ *
+ * DELEGATES BY DEFAULT. Only paths the fake actually claims are intercepted; everything else — the
+ * dev server's modules, HMR, assets, source maps — goes to the original `fetch` untouched. A lagoon
+ * that cannot load its own bundle would be a far worse failure than an unanswered route, so the
+ * narrow rule is the safe one.
+ *
+ * ONE PATCH, MANY FAKES. This used to guard on a global boolean, so the FIRST caller won and every
+ * later one was a silent no-op — fine while a project had one region with a wire, and wrong the moment
+ * it had two: the second region's routes went to the dev server, 404'd, its islands rendered empty and
+ * nothing said why. Fakes now REGISTER, and the single patch asks each in turn what it claims.
+ *
+ * Idempotent per fake: installing the same one twice leaves one entry, so a hot reload does not build
+ * a chain of patches or a chain of registrations.
+ */
+export function installFakeFetch(fake, options) {
+    // The fake's OWN stamp is the default, so the routes are declared once, where they are implemented.
+    // An explicit `options` still wins — a caller wrapping someone else's fake has nowhere else to say.
+    const claims = options ?? fakeFetchClaims(fake) ?? {};
+    const registry = fakeRegistry();
+    if (registry.some((entry) => entry.fake === fake))
+        return;
+    registry.push({ fake, claims });
+    armFakeFetch();
+}
+function fakeRegistry() {
+    const g = globalThis;
+    return (g.__motuFakeFetches ??= []);
+}
+/** Every fake currently installed, in registration order — what a check reads to say who claimed what. */
+export function installedFakeFetches() {
+    return fakeRegistry().map((entry) => entry.claims);
+}
+/** Forget every installed fake and leave the patch in place. For a test, or a lagoon remount. */
+export function resetFakeFetches() {
+    fakeRegistry().length = 0;
+}
+function claimedBy(url) {
+    for (const { fake, claims } of fakeRegistry()) {
+        if (claims.baseUrl && url.href.startsWith(claims.baseUrl))
+            return fake;
+        if ((claims.appRoutes ?? []).some((prefix) => url.pathname.startsWith(prefix)))
+            return fake;
+    }
+    return undefined;
+}
+/**
+ * Patch `globalThis.fetch` NOW, with whatever is registered — and whatever registers later.
+ *
+ * Worth being separate from `installFakeFetch` for one reason: a client that captures `globalThis.fetch`
+ * at IMPORT time (`createClient(url, key, { global: { fetch } })` evaluated at module scope) keeps
+ * whatever `fetch` was when its module ran. If the fakes are declared rather than installed by a
+ * top-level side effect, that capture can happen first and the client talks past every fake, silently.
+ * Calling this at the top of the lagoon entry — before any application module is imported — closes it:
+ * the patch is in place from the start and the registry fills in behind it.
+ */
+export function armFakeFetch() {
+    const g = globalThis;
+    if (g.__motuFakeFetchArmed)
+        return;
+    const original = globalThis.fetch.bind(globalThis);
+    // MOTU'S OWN REQUESTS GO AROUND THE APPLICATION'S FAKE. An app that claims `/api/` (Peps does)
+    // also claimed the host's `/api/coverage`, so the lens asked the app's mock for the corpus, got a
+    // 404, and never showed production coverage even where the host had it.
+    g.__motuNativeFetch = original;
+    globalThis.fetch = async (input, init) => {
+        let url;
+        try {
+            const raw = input instanceof Request ? input.url : String(input);
+            url = new URL(raw, typeof location !== 'undefined' ? location.href : 'http://localhost');
+        }
+        catch {
+            return original(input, init);
+        }
+        const fake = claimedBy(url);
+        if (fake)
+            return fake(input, init);
+        // DELEGATED, AND THEN WATCHED. Everything no fake claims goes to the real fetch, which in a lagoon
+        // is the dev server — and that is right for the dev server's own traffic. It is also where an
+        // unstubbed APP route goes: it 404s, the caller catches it, an empty state renders, and nothing
+        // says so. `network-sealed` cannot see it either, because it only counts requests that left for a
+        // non-loopback host.
+        //
+        // The signal is not "a same-origin 404" — favicons and source maps 404 all day. It is a request
+        // the app made, that NO STUB CLAIMED, whose real answer was an error. Recorded, not blocked: the
+        // page still gets the response it would have got.
+        const res = await original(input, init);
+        // NOT JUST `!res.ok`. A Vite dev server answers an unknown path with its SPA fallback — 200, and
+        // `index.html` — so an unstubbed API route comes back "successful" and the caller fails later
+        // trying to read JSON out of a web page. That was this gap's real shape: the first attempt looked
+        // for a 404 and found none. An HTML answer to a request the app made with `fetch` is the
+        // signature, because the dev server's own traffic (modules, css, source maps) is never HTML.
+        const html = (res.headers.get('content-type') ?? '').includes('text/html');
+        if (!res.ok || html) {
+            const g2 = globalThis;
+            (g2.__motuUnansweredRequests ??= []).push({
+                method: (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase(),
+                url: url.pathname + url.search,
+                status: res.status,
+                why: html ? 'answered with the dev server\'s HTML fallback, not data' : `HTTP ${res.status}`,
+            });
+        }
+        return res;
+    };
+    g.__motuFakeFetchArmed = true;
+}
+//# sourceMappingURL=postgrest-fetch.js.map