@o3co/create-auth-provider 0.5.1 → 0.5.2

package/templates/standalone/src/modules.mts

@@ -24,17 +24,26 @@ import {
 	createKeyStoreFactory,
 	createRepositoryFactories,
 	defineModule,
+	type LifecycleRegistrar,
 	type Module,
 	registerBuiltinFederationTokenStores,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
 import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
 import { registerBuiltinAdapters } from "@o3co/auth-provider-foundation";
-import {
-	redisCodeRepositoryBuilder,
-	redisFederationTokenStoreBuilder,
-} from "@o3co/auth-provider-redis";
+import { redisFederationTokenStoreBuilder } from "@o3co/auth-provider-redis";
+import { makeIoredisClients } from "@o3co/auth-provider-redis/ioredis";
 import { extractFederationSection } from "@o3co/auth-provider-session";
+// Named import is required here, not default. Under `module: "nodenext"`
+// with esModuleInterop, the default import resolves to the entire ioredis
+// CJS module-exports namespace object (because ioredis 5.x ships
+// `export = Redis`), so `new Redis(...)` raises TS2351 "not constructable".
+// The 11 default-import sites elsewhere in the repo all live under
+// `packages/redis/__tests__/` which `packages/redis/tsconfig.json`
+// explicitly excludes from strict tsc build (vitest's vue-tsc is more
+// permissive about CJS interop). Standalone production source is built
+// with strict nodenext, so the named import is the right shape here.
+import { Redis } from "ioredis";
 
 /**
  * Helper: turn a v0.4.x { type, [type]: {...} } adapter-config slice into the
@@ -79,15 +88,27 @@ export const keyStoreModule: Module = defineModule({
 });
 
 /**
- * Repositories module — provides client / user / code repositories from
+ * Repositories module — provides client / user repositories from
  * `config.repositories.*` slices using the built-in adapter factories.
+ *
+ * Pre-OR-9 this module also provided `codeRepository` — split out into
+ * `inMemoryCodeRepositoryModule` (memory branch) / `redisCodeRepositoryModule`
+ * (redis branch, from `@o3co/auth-provider-redis`) so the
+ * `oauth.code.adapter` switch can wire mutually-exclusive providers without
+ * a slot collision. Same pattern as the Wave-5d userSessionStores split.
  */
 export const repositoriesModule: Module = defineModule({
 	name: "standalone:repositories",
 	requires: ["config"] as const,
+	// D-5 / OR-2 / IH-11: forward `lifecycleRegistrar` into the repository
+	// factories so client/user adapters can register disposal callbacks
+	// (e.g. file-watch closers). Without this, builders' `ctx.lifecycle?.register`
+	// is a no-op and the leaks remain.
+	optional: ["lifecycleRegistrar"] as const,
 	provides: {
-		clientRepository: async ({ config }) => {
-			const { clientFactory, userFactory } = createRepositoryFactories();
+		clientRepository: async ({ config, lifecycleRegistrar }) => {
+			const ctx = { lifecycle: lifecycleRegistrar };
+			const { clientFactory, userFactory } = createRepositoryFactories(ctx);
 			registerBuiltinAdapters({ userFactory });
 			const slice = flattenAdapterConfig(
 				(config as AppConfig).repositories.client as { type: string } & Record<string, unknown>,
@@ -97,8 +118,9 @@ export const repositoriesModule: Module = defineModule({
 			}
 			return clientFactory.create(slice);
 		},
-		userRepository: async ({ config }) => {
-			const { userFactory } = createRepositoryFactories();
+		userRepository: async ({ config, lifecycleRegistrar }) => {
+			const ctx = { lifecycle: lifecycleRegistrar };
+			const { userFactory } = createRepositoryFactories(ctx);
 			registerBuiltinAdapters({ userFactory });
 			return userFactory.create(
 				flattenAdapterConfig(
@@ -106,33 +128,82 @@ export const repositoriesModule: Module = defineModule({
 				),
 			);
 		},
-		codeRepository: async ({ config }) => {
-			const { userFactory, codeFactory } = createRepositoryFactories();
-			registerBuiltinAdapters({ userFactory });
-			codeFactory.register("redis", redisCodeRepositoryBuilder);
-			return codeFactory.create(
-				flattenAdapterConfig(
-					(config as AppConfig).repositories.code as { type: string } & Record<string, unknown>,
-				),
+	},
+});
+
+/**
+ * In-memory CodeRepository module — wired by `buildModules` only when
+ * `oauth.code.adapter = "memory"`. The redis branch swaps in
+ * `redisCodeRepositoryModule` from `@o3co/auth-provider-redis` (mutually
+ * exclusive — both modules provide the same `codeRepository` slot).
+ *
+ * Per OR-9 (Wave 5d) split: pre-OR-9 the codeRepository slot was provided
+ * inside `repositoriesModule` via the AdapterFactory pattern; that path
+ * coupled the slot to `repositories.code.type` which is now superseded by
+ * `oauth.code.adapter`.
+ */
+export const inMemoryCodeRepositoryModule: Module = defineModule({
+	name: "standalone:in-memory-code-repository",
+	requires: ["config"] as const,
+	optional: ["lifecycleRegistrar"] as const,
+	provides: {
+		codeRepository: async ({ config, lifecycleRegistrar }) => {
+			const ctx = { lifecycle: lifecycleRegistrar };
+			const { codeFactory } = createRepositoryFactories(ctx);
+			// `codeFactory.register("memory", ...)` is wired automatically by
+			// `createRepositoryFactories` itself (see core/repositories/RepositoryFactory.mts).
+			// `registerBuiltinAdapters` from `@o3co/auth-provider-foundation` only
+			// registers the HTTP user adapter on `userFactory`; it does NOT touch
+			// `codeFactory`, so calling it here would be misleading and unnecessary.
+			//
+			// The flattened slice MAY still have `type = "redis"` when only the
+			// legacy `repositories.code.type` is set — `buildModules`' adapter
+			// resolution already chose memory by the time we get here, so
+			// override the type explicitly to keep this module robust against
+			// legacy HOCON shapes.
+			const slice = flattenAdapterConfig(
+				(config as AppConfig).repositories.code as { type: string } & Record<string, unknown>,
 			);
+			return codeFactory.create({ ...slice, type: "memory" });
 		},
 	},
 });
 
 /**
- * Stores module — provides the four-store user-session split + federation
- * token store. The standalone template uses in-memory stores by default; a
- * redis-backed deployment swaps this module for `@o3co/auth-provider-redis`'s
- * equivalent (per A4 §10 / Phase 5).
+ * In-memory user-session stores module — provides the four-store
+ * user-session split (userSessionStore, sessionRPRegistry,
+ * sessionFamilyIndex, sessionFederationIndex). This module is wired by
+ * `buildModules` only when `userSessionStores.adapter = "memory"`. The
+ * Redis branch swaps in `redisSessionStoresModule` from
+ * `@o3co/auth-provider-redis`.
+ *
+ * Pre-Wave-5d this module also provided `federationTokenStore` (now
+ * extracted into a separate always-wired module so the redis session
+ * branch doesn't drop the federation-token-store provider — Copilot
+ * review on PR #121).
  */
-export const storesModule: Module = defineModule({
-	name: "standalone:stores",
-	requires: ["config"] as const,
+export const inMemorySessionStoresModule: Module = defineModule({
+	name: "standalone:in-memory-session-stores",
 	provides: {
 		userSessionStore: () => createInMemoryUserSessionStore(),
 		sessionRPRegistry: () => createInMemorySessionRPRegistry(),
 		sessionFamilyIndex: () => createInMemorySessionFamilyIndex(),
 		sessionFederationIndex: () => createInMemorySessionFederationIndex(),
+	},
+});
+
+/**
+ * Federation token store module — always wired (independent of the
+ * `userSessionStores.adapter` switch). Pre-Wave-5d this slot was bundled
+ * into the larger `storesModule`; that meant the redis session-stores
+ * branch dropped the federation-token-store provider entirely and boot
+ * failed on the missing component (Copilot review on PR #121). Splitting
+ * the slot out lets both adapters reuse it unchanged.
+ */
+export const federationTokenStoreModule: Module = defineModule({
+	name: "standalone:federation-token-store",
+	requires: ["config"] as const,
+	provides: {
 		federationTokenStore: async ({ config }) => {
 			const factory = createFederationTokenStoreFactory();
 			registerBuiltinFederationTokenStores(factory);
@@ -147,6 +218,150 @@ export const storesModule: Module = defineModule({
 	},
 });
 
+/**
+ * @deprecated since Wave 5d (F4 PR2): split into `inMemorySessionStoresModule`
+ * + `federationTokenStoreModule`. Re-exported for backward compatibility
+ * with consumers that imported `storesModule` from this file. New code
+ * should use the two split modules directly.
+ */
+export const storesModule: Module = defineModule({
+	name: "standalone:stores",
+	requires: ["config"] as const,
+	provides: {
+		...inMemorySessionStoresModule.provides,
+		...federationTokenStoreModule.provides,
+	},
+});
+
+/**
+ * Shared ioredis clients module — opens ONE long-lived ioredis connection
+ * per replica, wraps it via `makeIoredisClients()` (returns 9 typed
+ * per-purpose clients), and exposes the slots consumed by the standalone's
+ * Redis-backed adapters (refresh-token-family + 4 user-session stores +
+ * rate limiter).
+ *
+ * Per F4 PR1 (D-2 v2) + Wave 5d unification: the previous design opened a
+ * separate ioredis socket per Redis-backed module (3+ sockets per replica).
+ * This module consolidates them — `makeIoredisClients(io)` was always
+ * designed to derive multiple per-purpose typed clients from a single
+ * connection; using one socket realises that intent and minimises
+ * connection-pool pressure on the upstream Redis.
+ *
+ * Connection-config: reuses `refreshTokenFamilyStore.redis.{url, password}`
+ * (declared in `fullSectionsSchema` by D-2 v2 §1). No new top-level config
+ * key is introduced — the connection is shared so its config is too. Future
+ * splits (per-store distinct Redis instances) are operator-side via custom
+ * composition roots, not standalone configuration.
+ *
+ * Fails fast (throws) when the Redis URL is absent. The HOCON default in
+ * `application.conf` covers single-instance / dev scenarios; an operator
+ * who deliberately removes the section in production sees an explicit
+ * error instead of a silent localhost fallback (the multi-replica failure
+ * mode OR-1 was supposed to close).
+ *
+ * Lifecycle: registers `io.quit()` once with the boot-planner-pre-seeded
+ * `lifecycleRegistrar` (D-5 ComponentMap slot) so `handle.dispose()` quits
+ * the single connection cleanly.
+ *
+ * Conditional inclusion: `buildModules` only adds this module to the
+ * manifest when at least one Redis-backed adapter is selected
+ * (`userSessionStores.adapter = "redis"` OR `rateLimiter.adapter = "redis"`
+ * — refresh-token-family is always Redis-backed in production). Adding the
+ * module unconditionally would open an ioredis socket for memory-only
+ * deployments.
+ */
+export const standaloneRedisClientsModule: Module = defineModule({
+	name: "standalone:redis-clients",
+	requires: ["config"] as const,
+	optional: ["lifecycleRegistrar"] as const,
+	provides: {
+		refreshTokenFamilyClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).refreshTokenFamilyClient;
+		},
+		userSessionStoreClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).userSessionStoreClient;
+		},
+		sessionRPRegistryClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).sessionRPRegistryClient;
+		},
+		sessionFamilyIndexClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).sessionFamilyIndexClient;
+		},
+		sessionFederationIndexClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar)
+				.sessionFederationIndexClient;
+		},
+		rateLimiterClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).rateLimiterClient;
+		},
+		// OR-9: code-repository client wired off the same shared ioredis
+		// socket. `redisCodeRepositoryModule` consumes this slot when
+		// `oauth.code.adapter = "redis"`. Codes are short-TTL (60-600s)
+		// high-volume — sharing the connection avoids opening a separate
+		// socket while the per-purpose typed wrapper keeps the Redis
+		// command surface consumed by RedisCodeRepository explicit.
+		codeRepositoryClient: async ({ config, lifecycleRegistrar }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar).codeRepositoryClient;
+		},
+	},
+});
+
+// Module-scoped cache so each `provides.*` factory invocation reuses the
+// same `Redis` instance (and its `makeIoredisClients()` derivation) within
+// a single createApp() invocation. The boot planner calls each `provides`
+// in dependency order; without this, every consumed slot would create its
+// own Redis socket, defeating the unification purpose.
+//
+// Cache key: the `lifecycleRegistrar` IDENTITY (which is per-boot — each
+// `createApp()` invocation seeds a fresh registrar via the boot planner).
+// Keying solely on `config` would incorrectly share connections across
+// boots when the same config object is reused with a new registrar (and
+// only the FIRST boot's registrar would receive disposal — Copilot review
+// on PR #121). When `lifecycleRegistrar` is undefined (test scenarios
+// that don't seed it), each call creates a fresh client; tests are
+// isolated and don't need cross-slot sharing.
+const clientsCache = new WeakMap<LifecycleRegistrar, ReturnType<typeof makeIoredisClients>>();
+function getOrCreateClients(
+	config: AppConfig,
+	lifecycleRegistrar: LifecycleRegistrar | undefined,
+): ReturnType<typeof makeIoredisClients> {
+	const cached = lifecycleRegistrar ? clientsCache.get(lifecycleRegistrar) : undefined;
+	if (cached) return cached;
+
+	const cfg = config.refreshTokenFamilyStore?.redis;
+	if (typeof cfg?.url !== "string" || cfg.url.length === 0) {
+		throw new Error(
+			"standaloneRedisClientsModule: `refreshTokenFamilyStore.redis.url` is required when any " +
+				"Redis-backed adapter is selected. Set REFRESH_TOKEN_FAMILY_STORE_REDIS_URL or " +
+				"restore the `refreshTokenFamilyStore.redis` block in application.conf. Multi-replica " +
+				"deployments require a shared Redis 7.2+ instance.",
+		);
+	}
+	const password = typeof cfg.password === "string" ? cfg.password : undefined;
+
+	// `lazyConnect: false` is the ioredis 5.x default; the explicit option
+	// documents the boot-time-connect contract so a future ioredis version
+	// flip does not silently change the failure mode.
+	const io = new Redis(cfg.url, { password, lazyConnect: false });
+
+	// Attach error handler so unhandled "error" events from ioredis 5.x do
+	// not crash the Node.js process. Initial connection failures surface
+	// here; downstream adapter operations then fail visibly. TODO(D-4):
+	// swap `console.error` for the Logger interface once a v0.5.2 polish
+	// PR lands.
+	io.on("error", (err: unknown) => {
+		console.error("[standalone:redis-clients] ioredis error", err);
+	});
+
+	lifecycleRegistrar?.register(async () => {
+		await io.quit();
+	});
+
+	const clients = makeIoredisClients(io);
+	if (lifecycleRegistrar) clientsCache.set(lifecycleRegistrar, clients);
+	return clients;
+}
+
 /**
  * Google federation config bridge — supplies the typed `googleFederationConfig`
  * ComponentMap slot from the `config.federations.google` slice.

package/templates/versions.json

@@ -1,10 +1,10 @@
 {
-	"@o3co/auth-provider-core": "0.5.1",
-	"@o3co/auth-provider-federation-google": "0.5.1",
-	"@o3co/auth-provider-federation-github": "0.5.1",
-	"@o3co/auth-provider-oauth": "0.5.1",
-	"@o3co/auth-provider-oauth-token-exchange": "0.5.1",
-	"@o3co/auth-provider-session": "0.5.1",
-	"@o3co/auth-provider-foundation": "0.5.1",
-	"@o3co/auth-provider-redis": "0.5.1"
+	"@o3co/auth-provider-core": "0.5.2",
+	"@o3co/auth-provider-federation-google": "0.5.2",
+	"@o3co/auth-provider-federation-github": "0.5.2",
+	"@o3co/auth-provider-oauth": "0.5.2",
+	"@o3co/auth-provider-oauth-token-exchange": "0.5.2",
+	"@o3co/auth-provider-session": "0.5.2",
+	"@o3co/auth-provider-foundation": "0.5.2",
+	"@o3co/auth-provider-redis": "0.5.2"
 }

package/dist/__tests__/index.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.test.d.mts.map

package/dist/__tests__/index.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.d.mts","sourceRoot":"","sources":["../../src/__tests__/index.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/index.test.mjs

@@ -1,281 +0,0 @@
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, posix, win32 } from "node:path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { isValidDirName, isValidProjectName, main, scaffold } from "../index.mjs";
-import { shouldCopyTemplateEntry } from "../internal/template-filter.mjs";
-// Both POSIX and Windows separators are exercised explicitly so the suite
-// validates the separator-relative segment logic regardless of the host
-// platform. (`path.sep` is the production default; tests pass it explicitly.)
-const platforms = [
-    {
-        name: "POSIX-style paths",
-        sep: posix.sep,
-        installRoot: "/Users/x/.npm/_npx/abc/node_modules/@o3co/create-auth-provider/templates/standalone",
-        localRoot: "/repo/templates/standalone",
-    },
-    {
-        name: "Windows-style paths",
-        sep: win32.sep,
-        installRoot: "C:\\Users\\x\\AppData\\Roaming\\npm-cache\\_npx\\abc\\node_modules\\@o3co\\create-auth-provider\\templates\\standalone",
-        localRoot: "C:\\repo\\templates\\standalone",
-    },
-];
-describe.each(platforms)("shouldCopyTemplateEntry on $name", ({ sep, installRoot, localRoot }) => {
-    const joinSegments = (base, ...rest) => [base, ...rest].join(sep);
-    it("includes the template root itself", () => {
-        expect(shouldCopyTemplateEntry(installRoot, installRoot, sep)).toBe(true);
-    });
-    it("includes a file directly under the template root even when ancestor path contains 'node_modules'", () => {
-        // Regression for v0.5.0 npx install bug: when the package is installed
-        // at .../node_modules/@o3co/create-auth-provider/..., the previous filter
-        // checked every segment of the absolute source path and excluded
-        // everything, so cpSync copied no files.
-        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "package.json"), installRoot, sep)).toBe(true);
-    });
-    it("includes nested template files even when ancestor path contains 'node_modules' or 'dist'", () => {
-        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "src", "app.mts"), installRoot, sep)).toBe(true);
-        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "config", "application.conf"), installRoot, sep)).toBe(true);
-    });
-    it("excludes node_modules subdirectories that live INSIDE the template root", () => {
-        expect(shouldCopyTemplateEntry(joinSegments(localRoot, "node_modules", "foo", "index.js"), localRoot, sep)).toBe(false);
-    });
-    it("excludes dist subdirectories that live INSIDE the template root", () => {
-        expect(shouldCopyTemplateEntry(joinSegments(localRoot, "dist", "index.mjs"), localRoot, sep)).toBe(false);
-    });
-});
-describe("scaffold", () => {
-    let tempDir;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "create-auth-provider-test-"));
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("copies template files to target directory", () => {
-        const targetDir = join(tempDir, "my-auth");
-        scaffold(targetDir, "my-auth");
-        expect(existsSync(join(targetDir, "package.json"))).toBe(true);
-        expect(existsSync(join(targetDir, "tsconfig.json"))).toBe(true);
-        expect(existsSync(join(targetDir, "src", "app.mts"))).toBe(true);
-        expect(existsSync(join(targetDir, "config", "application.conf"))).toBe(true);
-        expect(existsSync(join(targetDir, "config", "development.conf"))).toBe(true);
-        expect(existsSync(join(targetDir, "config", "production.conf"))).toBe(true);
-    });
-    it("rewrites package.json name to project name", () => {
-        const targetDir = join(tempDir, "my-auth");
-        scaffold(targetDir, "my-auth");
-        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
-        expect(pkg.name).toBe("my-auth");
-    });
-    it("replaces all workspace:* dependencies with caret versions", () => {
-        const targetDir = join(tempDir, "my-auth");
-        scaffold(targetDir, "my-auth");
-        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
-        // No workspace:* should remain anywhere
-        for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
-            const deps = pkg[section];
-            if (!deps)
-                continue;
-            for (const [name, version] of Object.entries(deps)) {
-                expect(version, `${section}.${name} should not be workspace:*`).not.toBe("workspace:*");
-            }
-        }
-        // Specific checks
-        expect(pkg.dependencies["@o3co/auth-provider-core"]).toMatch(/^\^/);
-        expect(pkg.dependencies["@o3co/auth-provider-federation-google"]).toMatch(/^\^/);
-        expect(pkg.dependencies["@o3co/auth-provider-federation-github"]).toBeUndefined();
-        expect(pkg.dependencies["@o3co/auth-provider-foundation"]).toMatch(/^\^/);
-    });
-    it("removes private field from package.json", () => {
-        const targetDir = join(tempDir, "my-auth");
-        scaffold(targetDir, "my-auth");
-        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
-        expect(pkg.private).toBeUndefined();
-    });
-    it("writes scoped project name verbatim into package.json", () => {
-        const targetDir = join(tempDir, "auth.provider");
-        scaffold(targetDir, "@piratis-blossoms/auth.provider");
-        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
-        expect(pkg.name).toBe("@piratis-blossoms/auth.provider");
-    });
-    it("ships versions for every workspace auth-provider package, in sync with each package.json", () => {
-        const versions = JSON.parse(readFileSync(join("templates", "versions.json"), "utf-8"));
-        const expectedPackages = {
-            "@o3co/auth-provider-core": "../packages/core/package.json",
-            "@o3co/auth-provider-federation-github": "../packages/federation-github/package.json",
-            "@o3co/auth-provider-federation-google": "../packages/federation-google/package.json",
-            "@o3co/auth-provider-foundation": "../packages/foundation/package.json",
-            "@o3co/auth-provider-oauth": "../packages/oauth/package.json",
-            "@o3co/auth-provider-oauth-token-exchange": "../packages/oauth-token-exchange/package.json",
-            "@o3co/auth-provider-redis": "../packages/redis/package.json",
-            "@o3co/auth-provider-session": "../packages/session/package.json",
-        };
-        for (const [name, pkgPath] of Object.entries(expectedPackages)) {
-            const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-            expect(versions[name], `versions.json missing entry for ${name}`).toBeDefined();
-            expect(versions[name], `versions.json[${name}] out of sync with ${pkgPath}`).toBe(pkg.version);
-        }
-        expect(Object.keys(versions).sort()).toEqual(Object.keys(expectedPackages).sort());
-    });
-});
-describe("isValidProjectName", () => {
-    it.each([
-        ["my-auth"],
-        ["auth.provider"],
-        ["a"],
-        ["foo_bar~baz.1"],
-        ["@piratis-blossoms/auth.provider"],
-        ["@foo-bar/baz_qux~1"],
-    ])("accepts %s", (name) => {
-        expect(isValidProjectName(name)).toBe(true);
-    });
-    it.each([
-        [""],
-        ["."],
-        [".."],
-        ["UPPER"],
-        ["with space"],
-        ["with/slash"],
-        ["with\\back"],
-        ["@"],
-        ["@/"],
-        ["@scope"],
-        ["@/pkg"],
-        ["@scope/"],
-        ["@scope//pkg"],
-        ["@SCOPE/pkg"],
-        ["a".repeat(215)],
-    ])("rejects %s", (name) => {
-        expect(isValidProjectName(name)).toBe(false);
-    });
-});
-describe("isValidDirName", () => {
-    it.each([["my-auth"], ["auth.provider"], ["a"], ["foo_bar~baz.1"]])("accepts %s", (name) => {
-        expect(isValidDirName(name)).toBe(true);
-    });
-    it.each([
-        [""],
-        ["."],
-        [".."],
-        ["@scope/pkg"],
-        ["with/slash"],
-        ["with\\back"],
-        ["@piratis-blossoms"],
-        ["UPPER"],
-        ["a".repeat(215)],
-    ])("rejects %s", (name) => {
-        expect(isValidDirName(name)).toBe(false);
-    });
-});
-describe("main (argv parsing and directory derivation)", () => {
-    let cwdBackup;
-    let workdir;
-    let argvBackup;
-    beforeEach(() => {
-        cwdBackup = process.cwd();
-        workdir = mkdtempSync(join(tmpdir(), "create-auth-provider-main-"));
-        process.chdir(workdir);
-        argvBackup = process.argv;
-    });
-    afterEach(() => {
-        process.chdir(cwdBackup);
-        process.argv = argvBackup;
-        rmSync(workdir, { recursive: true, force: true });
-    });
-    const runMain = (args) => {
-        process.argv = ["node", "cli", ...args];
-        const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code) => {
-            throw new Error(`__exit__:${code ?? 0}`);
-        }));
-        const errSpy = vi.spyOn(console, "error").mockImplementation(() => { });
-        const logSpy = vi.spyOn(console, "log").mockImplementation(() => { });
-        let exitCode = 0;
-        try {
-            main();
-        }
-        catch (e) {
-            const m = /__exit__:(\d+)/.exec(e.message);
-            exitCode = m ? Number(m[1]) : null;
-        }
-        const stderr = errSpy.mock.calls.map((c) => c.join(" ")).join("\n");
-        exitSpy.mockRestore();
-        errSpy.mockRestore();
-        logSpy.mockRestore();
-        return { exitCode, stderr };
-    };
-    // Positive: unscoped, no --dir
-    it("unscoped name: dir = name, pkg.name = name", () => {
-        const r = runMain(["my-auth"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "my-auth", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("my-auth");
-    });
-    // Positive: scoped, no --dir
-    it("scoped name: dir = pkg part, pkg.name = full scoped", () => {
-        const r = runMain(["@piratis-blossoms/auth.provider"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "auth.provider", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("@piratis-blossoms/auth.provider");
-    });
-    // Positive: scoped + --dir space
-    it("scoped name with --dir <val>: dir = val, pkg.name = full scoped", () => {
-        const r = runMain(["@piratis-blossoms/auth.provider", "--dir", "provider"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "provider", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("@piratis-blossoms/auth.provider");
-    });
-    // Positive: scoped + --dir= equals form
-    it("scoped name with --dir=<val>: dir = val, pkg.name = full scoped", () => {
-        const r = runMain(["@piratis-blossoms/auth.provider", "--dir=provider2"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "provider2", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("@piratis-blossoms/auth.provider");
-    });
-    // Positive: unscoped + --dir
-    it("unscoped name with --dir <val>: dir = val, pkg.name = unscoped", () => {
-        const r = runMain(["my-auth", "--dir", "custom"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "custom", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("my-auth");
-    });
-    // Positive: flags may come before the positional
-    it("flags before positional: --dir custom my-auth", () => {
-        const r = runMain(["--dir", "custom", "my-auth"]);
-        expect(r.exitCode).toBe(0);
-        const pkg = JSON.parse(readFileSync(join(workdir, "custom", "package.json"), "utf-8"));
-        expect(pkg.name).toBe("my-auth");
-    });
-    // Negative cases
-    it.each([
-        { case: "no args", args: [] },
-        { case: "two positionals", args: ["foo", "bar"] },
-        { case: "dot", args: ["."] },
-        { case: "dotdot", args: [".."] },
-        { case: "backslash in name", args: ["back\\slash"] },
-        { case: "empty scope", args: ["@/pkg"] },
-        { case: "empty pkg", args: ["@scope/"] },
-        { case: "double slash", args: ["@scope//pkg"] },
-        { case: "name too long", args: ["a".repeat(215)] },
-        { case: "--dir invalid (dot)", args: ["foo", "--dir", "."] },
-        { case: "--dir invalid (slash)", args: ["foo", "--dir", "a/b"] },
-        { case: "--dir invalid (at)", args: ["foo", "--dir", "@foo"] },
-        { case: "--dir invalid (back)", args: ["foo", "--dir", "a\\b"] },
-        { case: "--dir empty space form", args: ["foo", "--dir", ""] },
-        { case: "--dir empty equals form", args: ["foo", "--dir="] },
-        { case: "--dir missing value", args: ["foo", "--dir"] },
-        { case: "--dir duplicated", args: ["foo", "--dir", "a", "--dir", "b"] },
-        { case: "unknown flag", args: ["foo", "--unknown"] },
-        { case: "literal double-dash", args: ["foo", "--"] },
-    ])("rejects: $case", ({ args }) => {
-        const r = runMain(args);
-        expect(r.exitCode).toBe(1);
-        expect(r.stderr.length).toBeGreaterThan(0);
-    });
-    it("target directory already exists", () => {
-        mkdirSync(join(workdir, "foo"));
-        const r = runMain(["foo"]);
-        expect(r.exitCode).toBe(1);
-        expect(r.stderr.length).toBeGreaterThan(0);
-    });
-});

package/dist/__tests__/published-package.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=published-package.test.d.mts.map

package/dist/__tests__/published-package.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"published-package.test.d.mts","sourceRoot":"","sources":["../../src/__tests__/published-package.test.mts"],"names":[],"mappings":""}