@oaiz/sdk 0.0.0-stage → 0.1.4131

package/dist/test.mjs

@@ -0,0 +1,2495 @@
+import { join, resolve } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+import { createHash, randomBytes } from "node:crypto";
+
+// src/app/testmode/auth.ts
+const accessTokenLifetimeSeconds = 3600;
+const noStore = { "cache-control": "no-store" };
+const pageTitle = "Sign in as a test member";
+function createTestAuth(members) {
+	const codes = /* @__PURE__ */ new Map();
+	const accessTokens = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	function newSession(member, clientId, scope) {
+		return {
+			member,
+			clientId,
+			scope,
+			accessTokens: /* @__PURE__ */ new Set(),
+			refreshToken: ""
+		};
+	}
+	function rotate(session) {
+		refreshTokens.delete(session.refreshToken);
+		const accessToken = randomToken();
+		session.accessTokens.add(accessToken);
+		accessTokens.set(accessToken, session);
+		session.refreshToken = randomToken();
+		refreshTokens.set(session.refreshToken, session);
+		return accessToken;
+	}
+	function end(session) {
+		for (const token of session.accessTokens) accessTokens.delete(token);
+		session.accessTokens.clear();
+		refreshTokens.delete(session.refreshToken);
+	}
+	function tokenAnswer(session, accessToken) {
+		return json$1(200, {
+			access_token: accessToken,
+			token_type: "Bearer",
+			expires_in: accessTokenLifetimeSeconds,
+			refresh_token: session.refreshToken,
+			scope: session.scope
+		}, noStore);
+	}
+	function discovery(request) {
+		const issuer = `${new URL(request.url).origin}/__oaiz-test/oauth`;
+		return json$1(200, {
+			issuer,
+			authorization_endpoint: `${issuer}/authorize`,
+			token_endpoint: `${issuer}/token`,
+			userinfo_endpoint: `${issuer}/userinfo`,
+			revocation_endpoint: `${issuer}/revoke`,
+			response_types_supported: ["code"],
+			grant_types_supported: ["authorization_code", "refresh_token"],
+			code_challenge_methods_supported: ["S256"]
+		});
+	}
+	function authorizePage(request) {
+		const parameters = new URL(request.url).searchParams;
+		const read = readAuthorizationRequest(parameters, new URL(request.url).origin);
+		if (read instanceof Response) return read;
+		const hidden = [
+			["response_type", "code"],
+			["client_id", read.clientId],
+			["redirect_uri", read.redirectUri],
+			["scope", read.scope],
+			["code_challenge", read.challenge],
+			["code_challenge_method", "S256"],
+			...read.state === null ? [] : [["state", read.state]]
+		].map(([name, value]) => `<input type="hidden" name="${name}" value="${escapeHTML(value)}">`).join("");
+		const seeded = members();
+		const forms = seeded.length === 0 ? "<p>No members can sign in. Add them to tests/members.json.</p>" : seeded.map((member) => `<form method="post" action="/__oaiz-test/oauth/authorize">${hidden}<button type="submit" name="member" value="${escapeHTML(member.id)}">${escapeHTML(member.name)}</button></form>`).join("\n");
+		const body = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>${pageTitle}</title></head>
+<body><main><h1>${pageTitle}</h1>
+${forms}
+</main></body>
+</html>
+`;
+		return new Response(body, {
+			status: 200,
+			headers: {
+				"content-type": "text/html; charset=utf-8",
+				...noStore
+			}
+		});
+	}
+	async function approve(request) {
+		const form = new URLSearchParams(await request.text());
+		const read = readAuthorizationRequest(form, new URL(request.url).origin);
+		if (read instanceof Response) return read;
+		const member = members().find((candidate) => candidate.id === form.get("member"));
+		if (member === void 0) return oauthError(400, "invalid_request", "member is not in tests/members.json");
+		const code = randomToken();
+		codes.set(code, {
+			member,
+			clientId: read.clientId,
+			redirectUri: read.redirectUri,
+			challenge: read.challenge,
+			scope: read.scope
+		});
+		const target = new URL(read.redirectUri);
+		target.searchParams.set("code", code);
+		if (read.state !== null) target.searchParams.set("state", read.state);
+		target.searchParams.set("iss", `${new URL(request.url).origin}/__oaiz-test/oauth`);
+		return new Response(null, {
+			status: 303,
+			headers: { location: target.toString() }
+		});
+	}
+	async function token(request) {
+		const form = new URLSearchParams(await request.text());
+		const clientId = form.get("client_id") ?? "";
+		switch (form.get("grant_type")) {
+			case "authorization_code": {
+				const code = form.get("code") ?? "";
+				const grant = codes.get(code);
+				if (grant === void 0 || grant.clientId !== clientId || grant.redirectUri !== form.get("redirect_uri") || s256(form.get("code_verifier") ?? "") !== grant.challenge) return oauthError(400, "invalid_grant", "the code is unknown, used, or not this request's");
+				codes.delete(code);
+				const session = newSession(grant.member, grant.clientId, grant.scope);
+				return tokenAnswer(session, rotate(session));
+			}
+			case "refresh_token": {
+				const session = refreshTokens.get(form.get("refresh_token") ?? "");
+				if (session === void 0 || session.clientId !== clientId) return oauthError(400, "invalid_grant", "the refresh token is unknown, rotated, or revoked");
+				return tokenAnswer(session, rotate(session));
+			}
+			default: return oauthError(400, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token");
+		}
+	}
+	function authenticate(request) {
+		const presented = bearerToken(request.headers.get("authorization"));
+		if (presented === void 0) return json$1(401, {
+			message: "Authorization header not provided",
+			slug: "no-authorization-header"
+		}, { "www-authenticate": "Bearer" });
+		const session = accessTokens.get(presented);
+		if (session === void 0) return json$1(401, {
+			message: "authentication: Invalid token",
+			slug: "invalid-token"
+		}, { "www-authenticate": "Bearer error=\"invalid_token\"" });
+		return session;
+	}
+	function userinfo(request) {
+		const session = authenticate(request);
+		if (session instanceof Response) return session;
+		const { member } = session;
+		return json$1(200, {
+			sub: member.id,
+			name: member.name,
+			email: member.email,
+			email_verified: true
+		});
+	}
+	async function revoke(request) {
+		const form = new URLSearchParams(await request.text());
+		const presented = form.get("token") ?? "";
+		if (presented === "") return oauthError(400, "invalid_request", "token is required");
+		const session = refreshTokens.get(presented) ?? accessTokens.get(presented);
+		if (session !== void 0 && session.clientId === form.get("client_id")) end(session);
+		return new Response(null, {
+			status: 200,
+			headers: noStore
+		});
+	}
+	return {
+		async handle(request, route) {
+			const method = request.method;
+			if (route === ".well-known/openid-configuration" && method === "GET") return discovery(request);
+			if (route === "authorize" && method === "GET") return authorizePage(request);
+			if (route === "authorize" && method === "POST") return approve(request);
+			if (route === "token" && method === "POST") return token(request);
+			if (route === "userinfo" && (method === "GET" || method === "POST")) return userinfo(request);
+			if (route === "revoke" && method === "POST") return revoke(request);
+		},
+		issueToken(memberId, clientId) {
+			const member = members().find((candidate) => candidate.id === memberId);
+			if (member === void 0) throw new Error(`tests/members.json has no member ${memberId}`);
+			return rotate(newSession(member, clientId, "openid email profile"));
+		},
+		authenticate
+	};
+}
+function readAuthorizationRequest(parameters, origin) {
+	if (parameters.get("response_type") !== "code") return oauthError(400, "invalid_request", "response_type must be code");
+	const clientId = parameters.get("client_id") ?? "";
+	if (clientId === "") return oauthError(400, "invalid_request", "client_id is required");
+	const redirectUri = parameters.get("redirect_uri") ?? "";
+	if (!URL.canParse(redirectUri) || new URL(redirectUri).origin !== origin) return oauthError(400, "invalid_request", `redirect_uri must be a page on ${origin}`);
+	const challenge = parameters.get("code_challenge") ?? "";
+	if (challenge === "" || parameters.get("code_challenge_method") !== "S256") return oauthError(400, "invalid_request", "an S256 code_challenge is required");
+	return {
+		clientId,
+		redirectUri,
+		state: parameters.get("state"),
+		challenge,
+		scope: parameters.get("scope") ?? "openid"
+	};
+}
+function bearerToken(header) {
+	const separator = header?.indexOf(" ") ?? -1;
+	if (header === null || separator < 0) return void 0;
+	const token = header.slice(separator + 1);
+	return header.slice(0, separator).toLowerCase() === "bearer" && token !== "" ? token : void 0;
+}
+function s256(verifier) {
+	return createHash("sha256").update(verifier).digest("base64url");
+}
+function randomToken() {
+	return randomBytes(32).toString("base64url");
+}
+function oauthError(status, error, description) {
+	return json$1(status, {
+		error,
+		error_description: description
+	}, noStore);
+}
+function json$1(status, body, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json; charset=utf-8",
+			...headers
+		}
+	});
+}
+function escapeHTML(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+
+// src/app/testmode/rows/errors.ts
+const slugTableRequestInvalid = "storage-table-request-invalid";
+const slugTableNotFound = "storage-table-not-found";
+const slugStatementTimeout = "storage-statement-timeout";
+const slugCustomerSQLFailed = "storage-customer-sql-failed";
+const slugCustomerSQLPermissionDenied = "storage-customer-sql-permission-denied";
+const slugBoundedTransactionFailed = "storage-bounded-transaction-failed";
+const slugFunctionNotFound = "storage-function-not-found";
+const slugFunctionCallInvalid = "storage-function-call-invalid";
+const slugFunctionResultTooLarge = "storage-function-result-too-large";
+const slugDatabaseEditRequired = "storage-database-edit-required";
+var RowsRefusal = class extends Error {
+	constructor(status, slug, message, errors) {
+		super(message);
+		this.status = status;
+		this.slug = slug;
+		this.errors = errors;
+	}
+	body() {
+		return this.errors ? {
+			message: this.message,
+			slug: this.slug,
+			errors: this.errors
+		} : {
+			message: this.message,
+			slug: this.slug
+		};
+	}
+};
+function incorrectInput(message, slug) {
+	return new RowsRefusal(400, slug, `incorrect-input: ${message}`);
+}
+function forbidden(message, slug) {
+	return new RowsRefusal(403, slug, `forbidden: ${message}`);
+}
+function notFound(message, slug) {
+	return new RowsRefusal(404, slug, `not-found: ${message}`);
+}
+function externalService(message, slug) {
+	return new RowsRefusal(500, slug, `external-service: ${message}`);
+}
+function tableRequestError(kind, message) {
+	return new RowsRefusal(400, kind === "table-not-found" ? slugTableNotFound : slugTableRequestInvalid, `incorrect-input: ${message}`);
+}
+function tableNotFoundError(table) {
+	return tableRequestError("table-not-found", `the table ${table} does not exist`);
+}
+function columnNotFoundError(table, column) {
+	return tableRequestError("column-not-found", `column ${table}.${column} does not exist`);
+}
+function embedPathNotFoundError(path) {
+	return tableRequestError("embed-path-not-found", `${path} is not an embedded table of this request; embed it in the select`);
+}
+function invalidBodyError(message) {
+	return tableRequestError("invalid-body", message);
+}
+function payloadColumnNotFoundError(table, column) {
+	return tableRequestError("payload-column-not-found", `the table ${table} has no column ${column}`);
+}
+function filterRequiredError(kind) {
+	return tableRequestError("filter-required", `${kind.toUpperCase()} requires a WHERE clause`);
+}
+function limitError(message) {
+	return tableRequestError("limit-exceeded", message);
+}
+function singularMismatchError(rows) {
+	return tableRequestError("singular-mismatch", `single requires exactly one row, and the result has ${rows}`);
+}
+function statementFailure(sqlState, message, hint) {
+	let text = `${message} (sqlstate ${sqlState})`;
+	if (hint) text += `\nHint: ${hint}`;
+	if (sqlState === "42501") return forbidden(text, slugCustomerSQLPermissionDenied);
+	return incorrectInput(text, slugCustomerSQLFailed);
+}
+const statementTimeoutLimit = "30s";
+function statementTimeoutError() {
+	return new RowsRefusal(503, slugStatementTimeout, `statement-timeout: the statement exceeded the statement timeout of ${"30s"}`);
+}
+function boundedTxFailure(message, sqlState) {
+	return externalService(`${message} (sqlstate ${sqlState})`, slugBoundedTransactionFailed);
+}
+function functionNotFoundError(name) {
+	return notFound(`the function ${name} does not exist in the database`, slugFunctionNotFound);
+}
+function functionCallInvalidError(message) {
+	return incorrectInput(message, slugFunctionCallInvalid);
+}
+function functionResultTooLargeError(maxRows) {
+	return incorrectInput(`the function returned more than ${maxRows} rows; return fewer rows`, slugFunctionResultTooLarge);
+}
+function databaseEditRequiredError() {
+	return forbidden("editing this database requires edit access", slugDatabaseEditRequired);
+}
+
+// src/app/testmode/database.ts
+const emptyDatabaseSQL = `CREATE ROLE "oaiz_test_read" NOLOGIN;
+CREATE ROLE "oaiz_test_write" NOLOGIN;
+CREATE ROLE "oaiz_test_owner" NOLOGIN;
+CREATE SCHEMA "data";
+CREATE SCHEMA "oaiz_private";
+GRANT USAGE ON SCHEMA "data" TO "oaiz_test_read", "oaiz_test_write", "oaiz_test_owner";
+GRANT USAGE ON SCHEMA "oaiz_private" TO "oaiz_test_read", "oaiz_test_write", "oaiz_test_owner";`;
+const int8 = 20;
+const vectorIndexesSQL = `SELECT 1 FROM pg_catalog.pg_class c
+  JOIN pg_catalog.pg_am a ON a.oid = c.relam
+  JOIN pg_catalog.pg_proc p ON p.oid = a.amhandler
+  WHERE a.amtype = 'i'
+    AND p.prosrc NOT IN ('bthandler', 'hashhandler', 'gisthandler', 'ginhandler', 'spghandler', 'brinhandler', 'hnswhandler')
+  LIMIT 1`;
+function requireSupportedIndexes(indexes) {
+	if (indexes.length > 0) throw incorrectInput("IVFFlat indexes are refused; use HNSW for a supported vector index", "storage-vector-index-refused");
+}
+async function managedExtensions() {
+	const [{ btree_gin }, { btree_gist }, { citext }, { fuzzystrmatch }, { hstore }, { intarray }, { ltree }, { pg_trgm }, { pgcrypto }, { unaccent }, { uuid_ossp }, { vector }] = await Promise.all([
+		import("@electric-sql/pglite/contrib/btree_gin"),
+		import("@electric-sql/pglite/contrib/btree_gist"),
+		import("@electric-sql/pglite/contrib/citext"),
+		import("@electric-sql/pglite/contrib/fuzzystrmatch"),
+		import("@electric-sql/pglite/contrib/hstore"),
+		import("@electric-sql/pglite/contrib/intarray"),
+		import("@electric-sql/pglite/contrib/ltree"),
+		import("@electric-sql/pglite/contrib/pg_trgm"),
+		import("@electric-sql/pglite/contrib/pgcrypto"),
+		import("@electric-sql/pglite/contrib/unaccent"),
+		import("@electric-sql/pglite/contrib/uuid_ossp"),
+		import("@electric-sql/pglite-pgvector")
+	]);
+	return {
+		btree_gin,
+		btree_gist,
+		citext,
+		fuzzystrmatch,
+		hstore,
+		intarray,
+		ltree,
+		pg_trgm,
+		pgcrypto,
+		unaccent,
+		uuid_ossp,
+		vector
+	};
+}
+async function openTestDatabase(schemaSQL, what) {
+	const { PGlite } = await import("@electric-sql/pglite");
+	const pg = await PGlite.create({ extensions: await managedExtensions() });
+	await pg.exec("SET TimeZone TO 'UTC'");
+	try {
+		await pg.exec(schemaSQL.trim() === "" ? emptyDatabaseSQL : schemaSQL);
+		requireSupportedIndexes((await pg.query(vectorIndexesSQL)).rows);
+	} catch (error) {
+		await pg.close();
+		if (error instanceof RowsRefusal) throw error;
+		const reason = error.message;
+		throw new Error(`${what} does not run on the test database: ${reason}`, { cause: error });
+	}
+	const roles = (await pg.query("SELECT rolname FROM pg_catalog.pg_roles WHERE rolname IN ('oaiz_test_read', 'oaiz_test_write')")).rows.map((row) => row.rolname);
+	const missing = ["oaiz_test_read", "oaiz_test_write"].find((role) => !roles.includes(role));
+	if (missing !== void 0) {
+		await pg.close();
+		throw new Error(`${what} creates no role ${missing}, so it is not the output of \`oaiz db test-schema\`. Write the file with \`oaiz db test-schema <database-id> -o ${what}\`; a hand-written CREATE TABLE file does not work.`);
+	}
+	const asText = (value) => value;
+	const serializers = Object.fromEntries(Object.keys(pg.serializers).map((type) => [type, asText]));
+	const session = {
+		async query(sql, args) {
+			return (await pg.query(sql, args, {
+				rowMode: "array",
+				parsers: { [int8]: (value) => value },
+				serializers
+			})).rows;
+		},
+		async exec(sql) {
+			await pg.exec(sql);
+		}
+	};
+	let queue = Promise.resolve();
+	let failedReset;
+	const serialized = (fn) => {
+		const run = queue.then(fn);
+		queue = run.catch(() => void 0);
+		return run;
+	};
+	const exclusive = (fn) => serialized(() => {
+		if (failedReset !== void 0) throw failedReset;
+		return fn(session);
+	});
+	return {
+		exclusive,
+		reset: (seedSQL) => exclusive(async (session) => {
+			await session.exec("BEGIN");
+			try {
+				await resetRows(session, seedSQL);
+				requireSupportedIndexes(await session.query(vectorIndexesSQL, []));
+				await session.exec("COMMIT");
+			} catch (error) {
+				failedReset = new Error("the test database was discarded because its reset failed", { cause: error });
+				await session.exec("ROLLBACK");
+				throw error;
+			}
+		}),
+		close: () => serialized(() => pg.close())
+	};
+}
+async function resetRows(session, seedSQL) {
+	const every = await session.query("SELECT format('data.%I', tablename) FROM pg_catalog.pg_tables WHERE schemaname = 'data' ORDER BY tablename", []);
+	if (every.length > 0) await session.query(`TRUNCATE ${every.map(([name]) => name).join(", ")} RESTART IDENTITY CASCADE`, []);
+	if (seedSQL.trim() !== "") await session.exec(seedSQL);
+}
+
+// src/app/testmode/json.ts
+var JsonNumber = class {
+	constructor(text) {
+		this.text = text;
+	}
+};
+var JsonSyntaxError = class extends Error {};
+function parseJson(text) {
+	const reader = new JsonReader(text);
+	const value = reader.value();
+	reader.space();
+	if (!reader.atEnd()) throw reader.unexpected("after top-level value");
+	return value;
+}
+function parseFirstJson(text) {
+	const reader = new JsonReader(text);
+	reader.space();
+	if (reader.atEnd()) throw new JsonSyntaxError("EOF");
+	return reader.value();
+}
+var JsonReader = class {
+	constructor(text) {
+		this.text = text;
+		this.position = 0;
+	}
+	atEnd() {
+		return this.position >= this.text.length;
+	}
+	space() {
+		while (!this.atEnd() && " 	\r\n".includes(this.text[this.position])) this.position++;
+	}
+	unexpected(context) {
+		if (this.atEnd()) return new JsonSyntaxError("unexpected EOF");
+		return new JsonSyntaxError(`invalid character '${this.text[this.position]}' ${context}`);
+	}
+	value() {
+		this.space();
+		const char = this.text[this.position];
+		if (char === "{") return this.object();
+		if (char === "[") return this.array();
+		if (char === "\"") return this.string();
+		if (char === "-" || char >= "0" && char <= "9") return this.number();
+		for (const [word, value] of [
+			["true", true],
+			["false", false],
+			["null", null]
+		]) if (this.text.startsWith(word, this.position)) {
+			this.position += word.length;
+			return value;
+		}
+		throw this.unexpected("looking for beginning of value");
+	}
+	object() {
+		this.position++;
+		const object = /* @__PURE__ */ new Map();
+		this.space();
+		if (this.text[this.position] === "}") {
+			this.position++;
+			return object;
+		}
+		for (;;) {
+			this.space();
+			if (this.text[this.position] !== "\"") throw this.unexpected("looking for beginning of object key string");
+			const key = this.string();
+			this.space();
+			if (this.text[this.position] !== ":") throw this.unexpected("after object key");
+			this.position++;
+			object.set(key, this.value());
+			this.space();
+			const next = this.text[this.position];
+			this.position++;
+			if (next === "}") return object;
+			if (next !== ",") {
+				this.position--;
+				throw this.unexpected("after object key:value pair");
+			}
+		}
+	}
+	array() {
+		this.position++;
+		const array = [];
+		this.space();
+		if (this.text[this.position] === "]") {
+			this.position++;
+			return array;
+		}
+		for (;;) {
+			array.push(this.value());
+			this.space();
+			const next = this.text[this.position];
+			this.position++;
+			if (next === "]") return array;
+			if (next !== ",") {
+				this.position--;
+				throw this.unexpected("after array element");
+			}
+		}
+	}
+	string() {
+		const start = this.position;
+		this.position++;
+		for (;;) {
+			if (this.atEnd()) throw new JsonSyntaxError("unexpected EOF");
+			const char = this.text[this.position];
+			if (char === "\"") break;
+			if (char < " ") throw this.unexpected("in string literal");
+			this.position += char === "\\" ? 2 : 1;
+		}
+		this.position++;
+		try {
+			return JSON.parse(this.text.slice(start, this.position));
+		} catch {
+			this.position = start;
+			throw this.unexpected("in string escape code");
+		}
+	}
+	number() {
+		const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(this.text.slice(this.position));
+		if (!match) {
+			this.position++;
+			throw this.unexpected("in numeric literal");
+		}
+		this.position += match[0].length;
+		return new JsonNumber(match[0]);
+	}
+};
+function stringifyJson(value) {
+	if (value === null || value === void 0) return "null";
+	if (value instanceof JsonNumber) return value.text;
+	switch (typeof value) {
+		case "boolean": return value ? "true" : "false";
+		case "bigint": return value.toString();
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${value} is not a JSON number`);
+			return JSON.stringify(value);
+		case "string": return stringifyString(value);
+	}
+	if (value instanceof Date) return stringifyString(value.toISOString());
+	if (Array.isArray(value)) return `[${value.map((element) => stringifyJson(element)).join(",")}]`;
+	return `{${(value instanceof Map ? [...value.entries()] : Object.entries(value)).filter(([, member]) => member !== void 0).sort(([a], [b]) => compareCodePoints(a, b)).map(([key, member]) => `${stringifyString(key)}:${stringifyJson(member)}`).join(",")}}`;
+}
+function stringifyString(value) {
+	return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (char) => {
+		return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	});
+}
+function compareCodePoints(a, b) {
+	const left = Array.from(a);
+	const right = Array.from(b);
+	for (let index = 0; index < Math.min(left.length, right.length); index++) {
+		const difference = left[index].codePointAt(0) - right[index].codePointAt(0);
+		if (difference !== 0) return difference;
+	}
+	return left.length - right.length;
+}
+
+// src/app/testmode/members.ts
+const defaultGrant = "edit";
+function parseMembers(text, what) {
+	let document;
+	try {
+		document = JSON.parse(text);
+	} catch (error) {
+		throw new Error(`${what} is not JSON: ${error.message}`, { cause: error });
+	}
+	const root = object(document, what, membersShape, [
+		"teams",
+		"members",
+		"grants"
+	]);
+	const teams = array(root.teams ?? [], `${what} teams`).map((team, index) => {
+		const fields = object(team, `${what} teams[${index}]`, teamShape, ["id", "name"]);
+		return {
+			id: nonEmpty(fields.id, `${what} teams[${index}].id`),
+			name: nonEmpty(fields.name, `${what} teams[${index}].name`)
+		};
+	});
+	const members = array(root.members ?? [], `${what} members`).map((member, index) => {
+		const where = `${what} members[${index}]`;
+		const fields = object(member, where, memberShape, [
+			"id",
+			"name",
+			"email",
+			"teams",
+			"role"
+		]);
+		const read = {
+			id: nonEmpty(fields.id, `${where}.id`),
+			name: nonEmpty(fields.name, `${where}.name`),
+			email: nonEmpty(fields.email, `${where}.email`)
+		};
+		if (fields.teams !== void 0) read.teams = array(fields.teams, `${where}.teams`).map((team, at) => nonEmpty(team, `${where}.teams[${at}]`));
+		if (fields.role !== void 0) {
+			if (fields.role !== "member" && fields.role !== "administrator") throw new Error(`${where}.role is "member" or "administrator"`);
+			read.role = fields.role;
+		}
+		return read;
+	});
+	const grants = {};
+	for (const [database, grant] of Object.entries(object(root.grants ?? {}, `${what} grants`, grantsShape))) {
+		if (grant !== "view" && grant !== "edit") throw new Error(`${what} grants.${database} is "view" or "edit"`);
+		grants[database.toLowerCase()] = grant;
+	}
+	return {
+		teams,
+		members,
+		grants
+	};
+}
+const teamShape = "{ \"id\": \"<uuid>\", \"name\": \"Sales\" }";
+const memberShape = "{ \"id\": \"<uuid>\", \"name\": \"Ada Lovelace\", \"email\": \"ada@example.test\", \"teams\": [\"<team uuid>\"], \"role\": \"member\" }";
+const grantsShape = "{ \"<database-id>\": \"view\" }";
+const membersShape = `{ "teams": [${teamShape}], "members": [${memberShape}], "grants": ${grantsShape} }`;
+function object(value, what, shape, fields) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${what} is not an object such as ${shape}`);
+	for (const key of Object.keys(value)) if (fields !== void 0 && !fields.includes(key)) throw new Error(`${what} has the unknown field ${key}`);
+	return value;
+}
+function array(value, what) {
+	if (!Array.isArray(value)) throw new Error(`${what} is not an array`);
+	return value;
+}
+function nonEmpty(value, what) {
+	if (typeof value !== "string" || value === "") throw new Error(`${what} is not a text`);
+	return value;
+}
+
+// src/app/testmode/rows/table.ts
+const maxTableInValues = 1e3;
+const maxTableNodeRows = 1e3;
+const maxTableDocumentRows = maxTableNodeRows * maxTableNodeRows;
+const maxTableAliasBytes = 63;
+function emptyFilter() {
+	return {
+		or: false,
+		negated: false,
+		terms: []
+	};
+}
+function validateTableAlias(alias) {
+	if (new TextEncoder().encode(alias).length > maxTableAliasBytes || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(alias)) throw tableRequestError("invalid", "the alias must be a letter or underscore followed by letters, digits or underscores, at most 63 bytes");
+}
+
+// src/app/testmode/rows/catalog.ts
+const tableCatalogQuery = `WITH RECURSIVE reached(oid, steps) AS (
+  SELECT c.oid, 0
+  FROM pg_class c
+  WHERE c.relname = $1::text AND c.relnamespace = to_regnamespace('data') AND c.relkind IN ('r', 'p', 'v')
+  UNION
+  SELECT other.oid, r.steps + 1
+  FROM reached r
+  JOIN pg_constraint con ON con.contype = 'f' AND con.conparentid = 0 AND r.oid IN (con.conrelid, con.confrelid)
+  JOIN pg_class other ON other.oid = CASE WHEN con.conrelid = r.oid THEN con.confrelid ELSE con.conrelid END
+  WHERE r.steps < $2::integer
+    AND other.relnamespace = to_regnamespace('data') AND other.relkind IN ('r', 'p')
+)
+SELECT coalesce(json_agg(json_build_object(
+  'name', c.relname,
+  'kind', CASE WHEN c.relkind = 'v' THEN 'view' ELSE 'table' END,
+  'columns', (
+    SELECT coalesce(json_agg(json_build_object(
+      'name', a.attname,
+      'type', format_type(a.atttypid, a.atttypmod)
+    ) ORDER BY a.attnum), '[]')
+    FROM pg_attribute a
+    WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+  ),
+  'constraints', (
+    SELECT coalesce(json_agg(json_build_object(
+      'name', con.conname,
+      'kind', con.contype,
+      'columns', (
+        SELECT json_agg(ka.attname ORDER BY k.ord)
+        FROM unnest(con.conkey) WITH ORDINALITY AS k(attnum, ord)
+        JOIN pg_attribute ka ON ka.attrelid = con.conrelid AND ka.attnum = k.attnum
+      ),
+      'referencedTable', rc.relname,
+      'referencedColumns', (
+        SELECT json_agg(fa.attname ORDER BY f.ord)
+        FROM unnest(con.confkey) WITH ORDINALITY AS f(attnum, ord)
+        JOIN pg_attribute fa ON fa.attrelid = con.confrelid AND fa.attnum = f.attnum
+      )
+    ) ORDER BY con.conname), '[]')
+    FROM pg_constraint con
+    LEFT JOIN pg_class rc ON rc.oid = con.confrelid
+    WHERE con.conrelid = c.oid
+      AND con.contype IN ('p', 'u', 'f')
+      AND (con.contype <> 'f' OR (rc.relnamespace = c.relnamespace AND con.conparentid = 0))
+  )
+) ORDER BY c.relname), '[]')::text
+FROM pg_class c
+WHERE c.oid IN (SELECT oid FROM reached)`;
+function tableCatalogArguments(table, depth) {
+	return [table.includes("\0") ? "" : table.replace(/\p{Cs}/gu, "�"), String(depth)];
+}
+function catalogDepth(select, depth = 0) {
+	if (depth === 3) return depth;
+	let deepest = depth;
+	for (const item of select) if (item.embed !== void 0) deepest = Math.max(deepest, catalogDepth(item.embed.select, depth + 1));
+	return deepest;
+}
+function decodeTableCatalog(document) {
+	const rows = JSON.parse(document);
+	return new TableCatalog(rows.map((row) => {
+		const table = {
+			name: row.name,
+			kind: row.kind === "view" ? "view" : "table",
+			columns: row.columns,
+			primaryKey: [],
+			uniqueKeys: [],
+			foreignKeys: []
+		};
+		for (const constraint of row.constraints) {
+			if (constraint.kind === "p") table.primaryKey = constraint.columns ?? [];
+			if (constraint.kind === "u") table.uniqueKeys.push(constraint.columns ?? []);
+			if (constraint.kind === "f") table.foreignKeys.push({
+				name: constraint.name,
+				columns: constraint.columns ?? [],
+				referencedTable: constraint.referencedTable ?? "",
+				referencedColumns: constraint.referencedColumns ?? []
+			});
+		}
+		return table;
+	}));
+}
+var TableCatalog = class {
+	constructor(tables) {
+		this.tables = tables;
+	}
+	table(name) {
+		return this.tables.find((table) => table.name === name);
+	}
+	relationship(origin, target, hint) {
+		const matches = this.relationshipsFrom(origin).filter((relationship) => relationshipMatches(relationship, target, hint));
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw tableRequestError("relationship-not-found", `no foreign key relates the tables ${origin} and ${target}`);
+		const choices = matches.map((match) => `${match.foreignTable}!${match.constraint}`);
+		throw tableRequestError("relationship-ambiguous", `more than one foreign key relates the tables ${origin} and ${target}; name one in the select as ${choices.join(" or ")}`);
+	}
+	relationshipsFrom(origin) {
+		const relationships = [];
+		for (const holder of this.tables) for (const foreignKey of holder.foreignKeys) {
+			const oneToOne = uniqueSet(holder, foreignKey.columns);
+			if (holder.name === origin) relationships.push({
+				table: origin,
+				foreignTable: foreignKey.referencedTable,
+				constraint: foreignKey.name,
+				cardinality: oneToOne ? "one-to-one" : "many-to-one",
+				columns: foreignKey.columns,
+				foreignColumns: foreignKey.referencedColumns
+			});
+			if (foreignKey.referencedTable === origin) relationships.push({
+				table: origin,
+				foreignTable: holder.name,
+				constraint: foreignKey.name,
+				cardinality: oneToOne ? "one-to-one" : "one-to-many",
+				columns: foreignKey.referencedColumns,
+				foreignColumns: foreignKey.columns
+			});
+		}
+		return relationships;
+	}
+};
+function toOne(relationship) {
+	return relationship.cardinality !== "one-to-many";
+}
+function catalogColumn(table, name) {
+	return table.columns.find((column) => column.name === name);
+}
+function uniqueSet(table, columns) {
+	return [table.primaryKey, ...table.uniqueKeys].some((key) => sameColumnSet(key, columns));
+}
+function sameColumnSet(a, b) {
+	if (a.length === 0 || a.length !== b.length) return false;
+	const sortedB = [...b].sort();
+	return [...a].sort().every((column, index) => column === sortedB[index]);
+}
+function relationshipMatches(relationship, target, hint) {
+	const singleColumn = (name) => relationship.columns.length === 1 && relationship.columns[0] === name;
+	const singleForeignColumn = (name) => relationship.foreignColumns.length === 1 && relationship.foreignColumns[0] === name;
+	if (relationship.table === relationship.foreignTable) {
+		if (hint === "") return target === relationship.foreignTable && relationship.cardinality === "one-to-many" || singleColumn(target) && relationship.cardinality === "many-to-one";
+		return target === relationship.foreignTable && relationship.cardinality === "one-to-many" && singleForeignColumn(hint);
+	}
+	if (hint === "") return target === relationship.foreignTable || target === relationship.constraint || singleColumn(target);
+	return target === relationship.foreignTable && (hint === relationship.constraint || singleColumn(hint) || singleForeignColumn(hint));
+}
+
+// src/app/testmode/rows/resolve.ts
+function isAggregated(node) {
+	return node.columns.some((column) => column.aggregate !== void 0);
+}
+function groupColumns(node) {
+	const columns = node.columns.filter((column) => column.aggregate === void 0);
+	return [...new Set(columns.map((column) => column.name))];
+}
+function resolveTableRead(read, catalog) {
+	if (read.limit !== void 0 && read.limit < 0) throw tableRequestError("invalid", "the limit must not be negative");
+	if (read.offset < BigInt(0)) throw tableRequestError("invalid", "the offset must not be negative");
+	if (read.select.some((item) => item.aggregate !== void 0)) {
+		if (read.select.some((item) => item.star === true || item.embed !== void 0)) throw tableRequestError("unsupported", "an aggregate cannot be read beside * or an embed");
+	}
+	const table = catalog.table(read.table);
+	if (table === void 0) throw tableNotFoundError(read.table);
+	const resolver = new TableReadResolver(catalog, true);
+	const root = resolver.node(table, read.select, 0);
+	root.filter = resolver.filter(table, read.filter);
+	for (const embedFilter of read.embedFilters) resolver.attachEmbedFilter(root, embedFilter);
+	requireUniqueAggregatedKeys(root);
+	const order = isAggregated(root) ? resolveAggregatedOrder(table, read.order, groupColumns(root)) : resolveTableOrder(table, read.order);
+	const limit = read.limit === void 0 ? maxTableNodeRows : Math.min(read.limit, maxTableNodeRows);
+	requireBoundedFanOut(root, limit);
+	return {
+		root,
+		order,
+		limit,
+		offset: read.offset,
+		count: read.count,
+		singular: read.singular
+	};
+}
+function requireBoundedFanOut(root, rows) {
+	let repeatedRows = 0;
+	const visit = (node, path, rows, repeated) => {
+		for (const embed of node.embeds) {
+			if (!embed.projected) continue;
+			const embedPath = path === "" ? embed.name : `${path}.${embed.name}`;
+			let childRows = rows;
+			let childRepeated = repeated;
+			if (embed.relationship.cardinality === "many-to-one") childRepeated = true;
+			if (embed.relationship.cardinality === "one-to-many") {
+				childRows = rows * maxTableNodeRows;
+				if (repeated) {
+					repeatedRows += childRows;
+					if (repeatedRows > 1e6) throw limitError(`the embeds under repeated rows can return more than ${maxTableDocumentRows} rows, at ${embedPath}`);
+				}
+			}
+			visit(embed.node, embedPath, childRows, childRepeated);
+		}
+	};
+	visit(root, "", rows, false);
+}
+var TableReadResolver = class {
+	constructor(catalog, aggregates) {
+		this.catalog = catalog;
+		this.aggregates = aggregates;
+		this.embeds = 0;
+		this.conditions = 0;
+	}
+	node(table, items, depth) {
+		const node = {
+			table: table.name,
+			columns: [],
+			embeds: [],
+			filter: emptyFilter()
+		};
+		for (const item of items.length === 0 ? [{ star: true }] : items) {
+			requireOneSelectForm(item);
+			if (item.star) for (const column of table.columns) node.columns.push({
+				name: column.name,
+				alias: ""
+			});
+			else if (item.embed) node.embeds.push(this.embed(table, item.embed, depth + 1));
+			else if (item.aggregate !== void 0) node.columns.push(this.aggregate(table, item, depth));
+			else {
+				const column = item.column ?? "";
+				if (catalogColumn(table, column) === void 0) throw columnNotFoundError(table.name, column);
+				if (item.alias) validateTableAlias(item.alias);
+				node.columns.push({
+					name: column,
+					alias: item.alias ?? ""
+				});
+			}
+		}
+		return node;
+	}
+	aggregate(table, item, depth) {
+		if (!this.aggregates) throw tableRequestError("unsupported", "a write cannot return an aggregate");
+		if (depth > 0) throw tableRequestError("unsupported", "an embed cannot read an aggregate");
+		const column = item.column ?? "";
+		if (column !== "" && catalogColumn(table, column) === void 0) throw columnNotFoundError(table.name, column);
+		const aggregate = item.aggregate;
+		const alias = item.alias || aggregate;
+		validateTableAlias(alias);
+		return {
+			name: column,
+			alias,
+			aggregate
+		};
+	}
+	embed(parent, embed, depth) {
+		if (depth > 3) throw limitError(`embeds nest deeper than ${3} levels`);
+		this.embeds++;
+		if (this.embeds > 12) throw limitError(`the request embeds more than ${12} relations`);
+		if (embed.relation === "") throw tableRequestError("invalid", "an embed must name a relation");
+		if (embed.alias !== "") validateTableAlias(embed.alias);
+		const relationship = this.catalog.relationship(parent.name, embed.relation, embed.hint);
+		const table = this.catalog.table(relationship.foreignTable);
+		if (table === void 0) throw tableNotFoundError(relationship.foreignTable);
+		const projected = embed.select.length > 0;
+		return {
+			name: embed.alias !== "" ? embed.alias : embed.relation,
+			relationship,
+			inner: embed.inner,
+			projected,
+			node: projected ? this.node(table, embed.select, depth) : {
+				table: table.name,
+				columns: [],
+				embeds: [],
+				filter: emptyFilter()
+			},
+			relation: embed.relation
+		};
+	}
+	attachEmbedFilter(root, embedFilter) {
+		if (embedFilter.path.length === 0) throw tableRequestError("invalid", "an embedded filter must name an embed");
+		let node = root;
+		for (const name of embedFilter.path) {
+			const embed = node.embeds.find((candidate) => candidate.name === name) ?? node.embeds.find((candidate) => candidate.relation === name);
+			if (embed === void 0) throw embedPathNotFoundError(name);
+			node = embed.node;
+		}
+		const table = this.catalog.table(node.table);
+		if (table === void 0) throw tableNotFoundError(node.table);
+		this.condition(table, embedFilter.condition);
+		node.filter.terms.push({ condition: embedFilter.condition });
+	}
+	filter(table, filter) {
+		this.group(table, filter, 0);
+		return filter;
+	}
+	group(table, group, depth) {
+		if (depth > 64) throw limitError(`logic groups nest deeper than ${64} levels`);
+		if (group.terms.length === 0 && depth > 0) throw tableRequestError("invalid", "a logic group must hold at least one condition");
+		for (const term of group.terms) if (term.condition && !term.group) this.condition(table, term.condition);
+		else if (term.group && !term.condition) this.group(table, term.group, depth + 1);
+		else throw tableRequestError("invalid", "a filter term must be one condition or one group");
+	}
+	condition(table, condition) {
+		this.conditions++;
+		if (this.conditions > 64) throw limitError(`the request has more than ${64} filter conditions`);
+		if (catalogColumn(table, condition.column) === void 0) throw columnNotFoundError(table.name, condition.column);
+		if (condition.operator === "in" && condition.values.length > 1e3) throw limitError(`an in list holds more than ${maxTableInValues} values`);
+	}
+};
+function requireOneSelectForm(item) {
+	const named = (item.column ?? "") !== "" || item.aggregate === "count";
+	if ([
+		item.star === true,
+		named,
+		item.embed !== void 0
+	].filter(Boolean).length !== 1 || ((item.alias ?? "") !== "" || item.aggregate !== void 0) && !named) throw tableRequestError("invalid", "a select item must be *, one column, one aggregate or one embed");
+}
+function requireUniqueAggregatedKeys(node) {
+	if (!isAggregated(node)) return;
+	const keys = /* @__PURE__ */ new Set();
+	for (const column of node.columns) {
+		const key = column.alias || column.name;
+		if (keys.has(key)) throw tableRequestError("invalid", `the select reads more than one value into ${JSON.stringify(key)}; give one an alias`);
+		keys.add(key);
+	}
+}
+function resolveAggregatedOrder(table, order, groups) {
+	const resolved = resolveTableOrder({
+		...table,
+		primaryKey: []
+	}, order);
+	if (resolved.some((term) => !groups.includes(term.column))) throw tableRequestError("unsupported", "an aggregated read can order only by a column it groups by");
+	for (const column of groups) if (!resolved.some((term) => term.column === column)) resolved.push({
+		column,
+		descending: false,
+		nulls: ""
+	});
+	return resolved;
+}
+function resolveTableOrder(table, order) {
+	if (order.length > 16) throw limitError(`the order has more than ${16} terms`);
+	const resolved = [];
+	for (const term of order) {
+		if (catalogColumn(table, term.column) === void 0) throw columnNotFoundError(table.name, term.column);
+		resolved.push(term);
+	}
+	for (const column of table.primaryKey) if (!resolved.some((term) => term.column === column)) resolved.push({
+		column,
+		descending: false,
+		nulls: ""
+	});
+	return resolved;
+}
+function resolveTableWrite(write, catalog) {
+	const table = catalog.table(write.table);
+	if (table === void 0) throw tableNotFoundError(write.table);
+	if (table.kind === "view") throw tableRequestError("unsupported", `data.${table.name} is a view, and views are read only`);
+	const resolved = {
+		table: table.name,
+		kind: write.kind,
+		groups: [],
+		conflictColumns: [],
+		resolution: "",
+		mergeColumns: [],
+		filter: emptyFilter(),
+		representation: void 0,
+		count: write.count,
+		singular: write.singular
+	};
+	let representationRows = maxTableDocumentRows;
+	if (write.kind === "insert") {
+		const payload = resolveTableInsertPayload(write, table);
+		resolved.groups = payload.groups;
+		resolved.mergeColumns = payload.merged;
+		representationRows = payload.objects;
+		[resolved.conflictColumns, resolved.resolution] = resolveTableConflict(write, table);
+	} else if (write.kind === "update") resolved.groups = resolveTableUpdatePayload(write, table);
+	const resolver = new TableReadResolver(catalog, false);
+	if (write.kind !== "insert") {
+		if (write.filter.terms.length === 0) throw filterRequiredError(write.kind);
+		resolved.filter = resolver.filter(table, write.filter);
+	}
+	const representation = resolver.node(table, write.select, 0);
+	for (const embedFilter of write.embedFilters) resolver.attachEmbedFilter(representation, embedFilter);
+	if (write.representation) {
+		requireBoundedFanOut(representation, representationRows);
+		resolved.representation = representation;
+	}
+	return resolved;
+}
+function writeObjects(body) {
+	return body.map((object) => {
+		if (object === null) throw invalidBodyError("Empty or invalid json");
+		return {
+			keys: [...object.keys()],
+			raw: stringifyJson(object)
+		};
+	});
+}
+function sharedKeys(objects) {
+	const first = new Set(objects[0]?.keys ?? []);
+	for (const object of objects.slice(1)) {
+		const keys = new Set(object.keys);
+		if (keys.size !== first.size || [...keys].some((key) => !first.has(key))) throw invalidBodyError("All object keys must match");
+	}
+	return first;
+}
+function resolveTablePayloadColumns(write, table, shared) {
+	const payload = /* @__PURE__ */ new Set();
+	const names = write.columns ?? [...shared].sort();
+	for (const name of names) {
+		if (catalogColumn(table, name) === void 0) throw payloadColumnNotFoundError(table.name, name);
+		payload.add(name);
+	}
+	return payload;
+}
+function catalogColumnsIn(table, names) {
+	return table.columns.filter((column) => names(column.name));
+}
+function resolveTableInsertPayload(write, table) {
+	const objects = writeObjects(write.body ?? []);
+	const grouped = write.missingDefault && write.columns !== void 0;
+	const payload = resolveTablePayloadColumns(write, table, write.columns === void 0 ? sharedKeys(objects) : /* @__PURE__ */ new Set());
+	const columns = catalogColumnsIn(table, (name) => payload.has(name));
+	const merged = columns.map((column) => column.name);
+	if (!grouped || objects.length === 0) return {
+		groups: [{
+			columns,
+			rows: `[${objects.map((object) => object.raw).join(",")}]`
+		}],
+		merged,
+		objects: objects.length
+	};
+	const listed = write.columns;
+	const sets = /* @__PURE__ */ new Map();
+	for (const object of objects) {
+		const signature = listed.map((name) => object.keys.includes(name) ? "1" : "0").join("");
+		if (!sets.has(signature)) {
+			if (sets.size === 16) throw limitError(`the rows have more than ${16} different key sets`);
+			sets.set(signature, []);
+		}
+		sets.get(signature).push(object);
+	}
+	return {
+		groups: [...sets].map(([signature, members]) => ({
+			columns: catalogColumnsIn(table, (name) => {
+				const position = listed.indexOf(name);
+				return position >= 0 && signature[position] === "1";
+			}),
+			rows: `[${members.map((object) => object.raw).join(",")}]`
+		})),
+		merged,
+		objects: objects.length
+	};
+}
+function resolveTableUpdatePayload(write, table) {
+	const [object] = writeObjects([write.body ?? null]);
+	const payload = resolveTablePayloadColumns(write, table, new Set(object.keys));
+	const columns = catalogColumnsIn(table, (name) => payload.has(name));
+	if (columns.length === 0) throw invalidBodyError("the payload sets no column");
+	return [{
+		columns,
+		rows: object.raw
+	}];
+}
+function resolveTableConflict(write, table) {
+	for (const name of write.onConflict) if (catalogColumn(table, name) === void 0) throw columnNotFoundError(table.name, name);
+	if (write.resolution === "") return [[], ""];
+	const target = write.onConflict.length > 0 ? write.onConflict : table.primaryKey;
+	if (target.length === 0) return [[], ""];
+	return [[...target], write.resolution];
+}
+
+// src/app/testmode/rows/compile.ts
+const tableSourceName = `"oaiz_source"`;
+const tableMutationName = `"oaiz_mutation"`;
+const tablePayloadAlias = `"r"`;
+function compileRead(read) {
+	const builder = new TableStatementBuilder();
+	const root = builder.node(read.root);
+	const where = whereOf(root);
+	const page = builder.page(root, read);
+	let total = "NULL::bigint";
+	if (read.count === "exact") {
+		const rows = where === "" ? root.from : `${root.from} WHERE ${where}`;
+		if (!isAggregated(read.root)) total = `(SELECT count(*) FROM ${rows})`;
+		else if (root.groups.length === 0) total = "1::bigint";
+		else total = `(SELECT count(*) FROM (SELECT 1 FROM ${rows} GROUP BY ${root.groups.join(", ")}) AS "g")`;
+	}
+	return builder.statement(`WITH ${tableSourceName} AS (${page}) SELECT ${total}, count(*), ${documentBody(read.singular)} FROM ${tableSourceName}`);
+}
+function compileWrite(write) {
+	const builder = new TableStatementBuilder();
+	const target = builder.nextAlias();
+	const table = `${quoteQualified("data", write.table)} AS ${target}`;
+	const expressions = [];
+	if (write.kind === "insert") {
+		const returning = ` RETURNING ${target}.*`;
+		if (write.groups.length === 1) expressions.push(`${tableMutationName} AS (${builder.insert(table, write, write.groups[0])}${returning})`);
+		else {
+			const parts = write.groups.map((group, index) => {
+				const name = quoteTableIdentifier(`oaiz_write${index}`);
+				expressions.push(`${name} AS (${builder.insert(table, write, group)}${returning})`);
+				return `SELECT * FROM ${name}`;
+			});
+			expressions.push(`${tableMutationName} AS (${parts.join(" UNION ALL ")})`);
+		}
+	} else {
+		const statement = write.kind === "update" ? builder.update(table, write) : `DELETE FROM ${table}`;
+		const where = builder.filter(target, write.filter);
+		expressions.push(`${tableMutationName} AS (${statement} WHERE ${where} RETURNING ${target}.*)`);
+	}
+	if (write.representation === void 0) {
+		const total = write.count === "exact" ? "count(*)" : "NULL::bigint";
+		return builder.statement(`WITH ${expressions.join(", ")} SELECT ${total}, count(*), NULL::text FROM ${tableMutationName}`);
+	}
+	const root = builder.node(write.representation);
+	root.from = `${tableMutationName} AS ${root.alias}`;
+	expressions.push(`${tableSourceName} AS (${selectSQL(root)})`);
+	const changed = `(SELECT count(*) FROM ${tableMutationName})`;
+	const total = write.count === "exact" ? changed : "NULL::bigint";
+	return builder.statement(`WITH ${expressions.join(", ")} SELECT ${total}, ${changed}, ${documentBody(write.singular)} FROM ${tableSourceName}`);
+}
+function documentBody(singular) {
+	if (singular) return `coalesce(json_agg(${tableSourceName}.*)->0, 'null')::text`;
+	return `coalesce(json_agg(${tableSourceName}.*), '[]')::text`;
+}
+function payloadRecord(columns) {
+	const definitions = columns.map((column) => `${quoteTableIdentifier(column.name)} ${column.type}`);
+	return `${tablePayloadAlias}(${definitions.join(", ")})`;
+}
+function whereOf(node) {
+	return [...node.conditions, ...node.exists].join(" AND ");
+}
+function selectSQL(node) {
+	let rows = `SELECT ${node.items.join(", ")} FROM ${node.from}`;
+	for (const join of node.joins) rows += ` ${join}`;
+	const where = whereOf(node);
+	if (where !== "") rows += ` WHERE ${where}`;
+	if (node.groups.length > 0) rows += ` GROUP BY ${node.groups.join(", ")}`;
+	return rows;
+}
+const comparisonOperators = {
+	eq: "=",
+	neq: "<>",
+	gt: ">",
+	gte: ">=",
+	lt: "<",
+	lte: "<=",
+	like: "LIKE",
+	ilike: "ILIKE"
+};
+const isTests = {
+	null: "IS NULL",
+	true: "IS TRUE",
+	false: "IS FALSE"
+};
+const aggregateFunctions = {
+	avg: "avg",
+	count: "count",
+	max: "max",
+	min: "min",
+	sum: "sum"
+};
+function columnItem(alias, column) {
+	let item = `${alias}.${quoteTableIdentifier(column.name)}`;
+	if (column.aggregate !== void 0) {
+		const argument = column.name === "" ? "*" : item;
+		item = `${aggregateFunctions[column.aggregate]}(${argument})`;
+	}
+	return column.alias !== "" ? `${item} AS ${quoteTableIdentifier(column.alias)}` : item;
+}
+var TableStatementBuilder = class {
+	constructor() {
+		this.args = [];
+		this.aliases = 0;
+	}
+	statement(sql) {
+		return {
+			sql,
+			args: this.args
+		};
+	}
+	nextAlias() {
+		return quoteTableIdentifier(`t${this.aliases++}`);
+	}
+	param(value) {
+		this.args.push(String(value));
+		return `$${this.args.length}`;
+	}
+	page(root, read) {
+		let page = selectSQL(root);
+		if (read.order.length > 0) page += ` ORDER BY ${read.order.map((term) => orderTerm(root.alias, term)).join(", ")}`;
+		page += ` LIMIT ${this.param(read.limit)}`;
+		page += ` OFFSET ${this.param(read.offset)}`;
+		return page;
+	}
+	node(node) {
+		const index = this.aliases;
+		const alias = this.nextAlias();
+		const compiled = {
+			index,
+			alias,
+			from: `${quoteQualified("data", node.table)} AS ${alias}`,
+			items: node.columns.map((column) => columnItem(alias, column)),
+			joins: [],
+			conditions: [],
+			exists: [],
+			groups: isAggregated(node) ? groupColumns(node).map((column) => `${alias}.${quoteTableIdentifier(column)}`) : []
+		};
+		const filter = this.filter(alias, node.filter);
+		if (filter !== "") compiled.conditions.push(filter);
+		for (const embed of node.embeds) this.embed(compiled, embed);
+		return compiled;
+	}
+	embed(parent, embed) {
+		if (!embed.inner && !embed.projected) return;
+		const child = this.node(embed.node);
+		const relationship = embed.relationship;
+		child.conditions = [...relationship.columns.map((column, index) => `${child.alias}.${quoteTableIdentifier(relationship.foreignColumns[index])} = ${parent.alias}.${quoteTableIdentifier(column)}`), ...child.conditions];
+		const where = whereOf(child);
+		if (embed.inner) parent.exists.push(`EXISTS (SELECT 1 FROM ${child.from} WHERE ${where})`);
+		if (!embed.projected) return;
+		const row = quoteTableIdentifier(`s${child.index}`);
+		const joined = quoteTableIdentifier(`e${child.index}`);
+		let rows = `SELECT ${child.items.join(", ")} FROM ${child.from}`;
+		for (const join of child.joins) rows += ` ${join}`;
+		rows += ` WHERE ${where}`;
+		const name = quoteTableIdentifier(embed.name);
+		if (toOne(relationship)) {
+			parent.joins.push(`LEFT JOIN LATERAL (SELECT to_json(${row}.*) AS "j" FROM (${rows}) AS ${row}) AS ${joined} ON TRUE`);
+			parent.items.push(`${joined}."j" AS ${name}`);
+			return;
+		}
+		rows += ` LIMIT ${maxTableNodeRows}`;
+		parent.joins.push(`LEFT JOIN LATERAL (SELECT json_agg(${row}.*) AS "j" FROM (${rows}) AS ${row}) AS ${joined} ON TRUE`);
+		parent.items.push(`coalesce(${joined}."j", '[]') AS ${name}`);
+	}
+	filter(alias, group) {
+		if (group.terms.length === 0) return "";
+		const parts = group.terms.map((term) => term.group ? this.filter(alias, term.group) : this.condition(alias, term.condition));
+		const body = parts.join(group.or ? " OR " : " AND ");
+		if (group.negated) return `NOT (${body})`;
+		return parts.length > 1 ? `(${body})` : body;
+	}
+	condition(alias, condition) {
+		const column = `${alias}.${quoteTableIdentifier(condition.column)}`;
+		let expression;
+		if (condition.operator === "is") expression = `${column} ${isTests[condition.is]}`;
+		else if (condition.operator === "in") expression = `${column} = ANY(${this.param(tableArrayLiteral(condition.values))})`;
+		else expression = `${column} ${comparisonOperators[condition.operator]} ${this.param(condition.value)}`;
+		return condition.negated ? `NOT (${expression})` : expression;
+	}
+	insert(table, write, group) {
+		let statement = `INSERT INTO ${table}`;
+		if (group.columns.length === 0) statement += ` SELECT FROM json_array_elements(${this.param(group.rows)}::json)`;
+		else {
+			const names = group.columns.map((column) => quoteTableIdentifier(column.name));
+			const values = group.columns.map((column) => `${tablePayloadAlias}.${quoteTableIdentifier(column.name)}`);
+			statement += ` (${names.join(", ")}) SELECT ${values.join(", ")} FROM json_to_recordset(${this.param(group.rows)}::json) AS ${payloadRecord(group.columns)}`;
+		}
+		if (write.resolution !== "") {
+			statement += ` ON CONFLICT (${write.conflictColumns.map(quoteTableIdentifier).join(", ")})`;
+			const assignments = write.resolution === "merge" ? write.mergeColumns.map((column) => `${quoteTableIdentifier(column)} = EXCLUDED.${quoteTableIdentifier(column)}`) : [];
+			statement += assignments.length > 0 ? ` DO UPDATE SET ${assignments.join(", ")}` : " DO NOTHING";
+		}
+		return statement;
+	}
+	update(table, write) {
+		const group = write.groups[0];
+		const assignments = group.columns.map((column) => {
+			const name = quoteTableIdentifier(column.name);
+			return `${name} = ${tablePayloadAlias}.${name}`;
+		});
+		const from = ` FROM json_to_record(${this.param(group.rows)}::json) AS ${payloadRecord(group.columns)}`;
+		return `UPDATE ${table} SET ${assignments.join(", ")}${from}`;
+	}
+};
+function orderTerm(alias, term) {
+	let rendered = `${alias}.${quoteTableIdentifier(term.column)} ${term.descending ? "DESC" : "ASC"}`;
+	if (term.nulls === "first") rendered += " NULLS FIRST";
+	if (term.nulls === "last") rendered += " NULLS LAST";
+	return rendered;
+}
+function tableArrayLiteral(values) {
+	return `{${values.map((value) => `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`).join(",")}}`;
+}
+function quoteTableIdentifier(name) {
+	return `"${name.replaceAll("\0", "").replaceAll("\"", "\"\"")}"`;
+}
+function quoteQualified(schema, name) {
+	return `${quoteTableIdentifier(schema)}.${quoteTableIdentifier(name)}`;
+}
+
+// src/app/testmode/rows/execute.ts
+const testOrganisation = "7e570000-0000-4000-8000-00000000000a";
+const testPhysicalDatabase = "oaiz_test";
+const customerStatementClasses = /* @__PURE__ */ new Set([
+	"0A",
+	"20",
+	"21",
+	"22",
+	"23",
+	"25",
+	"2D",
+	"2F",
+	"42",
+	"44",
+	"54",
+	"P0"
+]);
+const singularGuardSQL = `SELECT 1 / CASE
+ WHEN pg_catalog.current_setting('oaiz.table_singular_guard', true) = 'ok' THEN 1
+ ELSE 0 END`;
+function runRowsRequest(database, caller, request) {
+	const readOnly = request.read !== void 0;
+	return database.exclusive(async (session) => {
+		await step(session, `begin isolation level read committed ${readOnly ? "read only" : "read write"}`, [], "failed to prepare the bounded transaction");
+		try {
+			await prelude(session, caller);
+			const scope = request.read ? request.read : request.write;
+			const [[document]] = await step(session, tableCatalogQuery, tableCatalogArguments(scope.table, catalogDepth(scope.select)), "query failed");
+			const catalog = decodeTableCatalog(document);
+			const result = request.read ? await readDocument(session, compileRead(resolveTableRead(request.read, catalog)), request.read.singular) : await writeDocument(session, compileWrite(resolveTableWrite(request.write, catalog)), request.write.singular);
+			await step(session, "COMMIT", [], readOnly ? "failed to commit the bounded transaction" : "failed to complete the bounded transaction");
+			return result;
+		} catch (error) {
+			await session.query("ROLLBACK", []).catch(() => void 0);
+			throw error;
+		}
+	});
+}
+async function prelude(session, caller) {
+	await step(session, "SELECT set_config('client_encoding', 'UTF8', true), set_config('standard_conforming_strings', 'on', true), set_config('hnsw.iterative_scan', 'strict_order', true)", [], "failed to pin the transaction's parser settings");
+	const claims = [
+		["oaiz.organisation_id", testOrganisation],
+		["oaiz.storage_database", testPhysicalDatabase],
+		["oaiz.subject", caller.subject],
+		["oaiz.organisation_role", caller.organisationRole],
+		["oaiz.teams", caller.teams.join(",")],
+		["oaiz.capability", caller.capability],
+		["oaiz.app", caller.app]
+	];
+	await step(session, `SELECT ${claims.map((_, index) => `set_config($${2 * index + 1}, $${2 * index + 2}, true)`).join(", ")}`, claims.flat(), "failed to publish the identity claims");
+	await step(session, `SET LOCAL ROLE "${caller.capability === "view" ? "oaiz_test_read" : "oaiz_test_write"}"`, [], "failed to assume the managed data role");
+	await step(session, "SELECT set_config('statement_timeout', $1, true)", ["30s"], "statement failed");
+	await step(session, "SET LOCAL search_path TO pg_catalog, extensions, pg_temp", [], "statement failed");
+}
+async function readDocument(session, statement, singular) {
+	let sql = statement.sql;
+	if (singular) sql = `SELECT document.total, document.returned, document.body, pg_catalog.set_config('oaiz.table_singular_guard', CASE WHEN document.returned = 1 THEN 'ok' ELSE 'mismatch' END, true) FROM (\n${sql}\n) AS document(total, returned, body)`;
+	const result = await documentStatement(session, sql, statement.args);
+	if (singular) try {
+		await session.query(singularGuardSQL, []);
+	} catch (error) {
+		if (sqlStateOf(error) === "22012" && result.returned !== 1) throw singularMismatchError(result.returned);
+		throw documentFailure(error);
+	}
+	return result;
+}
+async function writeDocument(session, statement, singular) {
+	const result = await documentStatement(session, statement.sql, statement.args);
+	if (singular && result.returned !== 1) throw singularMismatchError(result.returned);
+	return result;
+}
+async function documentStatement(session, sql, args) {
+	let rows;
+	try {
+		rows = await session.query(sql, args);
+	} catch (error) {
+		throw documentFailure(error);
+	}
+	const [total, returned, body] = rows[0];
+	return {
+		total,
+		returned: Number(returned),
+		body
+	};
+}
+function documentFailure(error) {
+	const sqlState = sqlStateOf(error);
+	if (sqlState === void 0) return error;
+	if (sqlState === "57014") return statementTimeoutError();
+	const failure = error;
+	if (customerStatementClasses.has(sqlState.slice(0, 2))) return statementFailure(sqlState, failure.message, failure.hint);
+	return boundedTxFailure("query failed", sqlState);
+}
+async function step(session, sql, args, message) {
+	try {
+		return await session.query(sql, args);
+	} catch (error) {
+		const sqlState = sqlStateOf(error);
+		if (sqlState === void 0) throw error;
+		throw boundedTxFailure(message, sqlState);
+	}
+}
+function sqlStateOf(error) {
+	if (!(error instanceof Error) || !("severity" in error)) return void 0;
+	const code = error.code;
+	return typeof code === "string" && code.length === 5 ? code : void 0;
+}
+
+// src/app/testmode/rows/functions.ts
+const maxFunctionCallRows = 1e3;
+const maxFunctionCallArgs = 100;
+const maxObjectNameBytes = 63;
+const functionNamePattern = /^[A-Za-z][A-Za-z0-9_]*$/;
+const reservedPrefixes = ["oaiz_", "pg_"];
+const functionCatalogQuery = `SELECT coalesce(pg_catalog.json_agg(pg_catalog.json_build_object(
+  'name', p.proname,
+  'volatility', p.provolatile,
+  'returnsSet', p.proretset,
+  'returns', CASE
+    WHEN p.prorettype IN ('pg_catalog.trigger'::pg_catalog.regtype, 'pg_catalog.event_trigger'::pg_catalog.regtype) THEN 'trigger'
+    WHEN p.prorettype = 'pg_catalog.void'::pg_catalog.regtype THEN 'void'
+    WHEN p.proargmodes && ARRAY['o', 'b', 't']::pg_catalog."char"[] THEN 'row'
+    WHEN base.typtype = 'c' THEN 'row'
+    WHEN base.typtype = 'p' THEN 'unsupported'
+    ELSE 'scalar' END,
+  'inputs', coalesce((
+    SELECT pg_catalog.json_agg(pg_catalog.json_build_object(
+      'name', coalesce(i.name, ''),
+      'mode', i.mode,
+      'type', pg_catalog.format_type(i.type, NULL),
+      'pseudo', t.typtype = 'p',
+      'hasDefault', i.position > p.pronargs - p.pronargdefaults) ORDER BY i.position)
+    FROM (
+      SELECT a.type, p.proargnames[a.ordinality] AS name, coalesce(p.proargmodes[a.ordinality], 'i') AS mode,
+             pg_catalog.row_number() OVER (ORDER BY a.ordinality) AS position
+      FROM pg_catalog.unnest(coalesce(p.proallargtypes, p.proargtypes::pg_catalog.oid[])) WITH ORDINALITY AS a(type, ordinality)
+      WHERE coalesce(p.proargmodes[a.ordinality], 'i') IN ('i', 'b', 'v')
+    ) AS i
+    JOIN pg_catalog.pg_type t ON t.oid = i.type), '[]'::pg_catalog.json)) ORDER BY p.oid), '[]'::pg_catalog.json)::pg_catalog.text
+FROM pg_catalog.pg_proc p
+CROSS JOIN LATERAL (
+  WITH RECURSIVE chain(typtype, typbasetype, depth) AS (
+    SELECT t.typtype, t.typbasetype, 0 FROM pg_catalog.pg_type t WHERE t.oid = p.prorettype
+    UNION ALL
+    SELECT t.typtype, t.typbasetype, chain.depth + 1
+    FROM chain JOIN pg_catalog.pg_type t ON t.oid = chain.typbasetype
+    WHERE chain.typtype = 'd'
+  )
+  SELECT chain.typtype FROM chain ORDER BY chain.depth DESC LIMIT 1
+) AS base
+WHERE p.pronamespace = 'data'::pg_catalog.regnamespace AND p.proname = $1 AND p.prokind = 'f'`;
+async function runFunctionCall(database, caller, call) {
+	const args = call.args ?? /* @__PURE__ */ new Map();
+	return database.exclusive(async (session) => {
+		await step(session, "begin isolation level read committed read write", [], "failed to prepare the bounded transaction");
+		try {
+			await prelude(session, caller);
+			const [[document]] = await step(session, functionCatalogQuery, [call.name], "query failed");
+			const resolved = resolveFunctionCall(call.name, args, JSON.parse(document), caller);
+			if (resolved.readOnly) await step(session, "SET TRANSACTION READ ONLY", [], "statement failed");
+			const statement = compileFunctionCall(resolved);
+			const result = await documentStatement(session, statement.sql, statement.args);
+			if (result.returned > maxFunctionCallRows) throw functionResultTooLargeError(maxFunctionCallRows);
+			await step(session, "COMMIT", [], resolved.readOnly ? "failed to commit the bounded transaction" : "failed to complete the bounded transaction");
+			return result.body;
+		} catch (error) {
+			await session.query("ROLLBACK", []).catch(() => void 0);
+			throw error;
+		}
+	});
+}
+function validateFunctionCall(call) {
+	if (new TextEncoder().encode(call.name).length > maxObjectNameBytes) throw functionCallInvalidError("the function name is longer than a PostgreSQL identifier");
+	const folded = call.name.toLowerCase();
+	if (!functionNamePattern.test(call.name) || reservedPrefixes.some((prefix) => folded.startsWith(prefix))) throw functionNotFoundError(call.name);
+	if ((call.args?.size ?? 0) > maxFunctionCallArgs) throw functionCallInvalidError(`a function call passes at most ${maxFunctionCallArgs} arguments`);
+}
+function resolveFunctionCall(name, args, entries, caller) {
+	if (entries.length === 0) throw functionNotFoundError(name);
+	if (entries.length > 1) throw functionCallInvalidError(`the database holds more than one function named ${name}`);
+	const [entry] = entries;
+	if (entry.returns === "trigger") throw functionNotFoundError(name);
+	if (entry.returns === "unsupported") throw functionCallInvalidError(`the function ${name} returns a type a call cannot read`);
+	const resolved = {
+		name: entry.name,
+		args: [],
+		argValues: "",
+		returnsSet: entry.returnsSet,
+		returns: entry.returns,
+		readOnly: entry.volatility !== "v"
+	};
+	const taken = /* @__PURE__ */ new Set();
+	for (const input of entry.inputs) {
+		if (input.name === "") throw functionCallInvalidError(`the function ${name} has an input without a name`);
+		if (input.mode === "v") throw functionCallInvalidError(`the function ${name} takes VARIADIC input ${input.name}`);
+		if (input.pseudo) throw functionCallInvalidError(`the function ${name} takes input ${input.name} of pseudo-type ${input.type}`);
+		taken.add(input.name);
+		if (args.has(input.name)) resolved.args.push({
+			name: input.name,
+			type: input.type
+		});
+		else if (!input.hasDefault) throw functionCallInvalidError(`the function ${name} requires argument ${input.name}`);
+	}
+	const unknown = [...args.keys()].filter((arg) => !taken.has(arg)).sort(compareCodePoints);
+	if (unknown.length !== 0) throw functionCallInvalidError(`the function ${name} has no argument ${unknown[0]}`);
+	if (!resolved.readOnly && caller.capability !== "edit") throw databaseEditRequiredError();
+	if (resolved.args.length !== 0) resolved.argValues = stringifyJson(new Map(resolved.args.map((arg) => [arg.name, args.get(arg.name)])));
+	return resolved;
+}
+function compileFunctionCall(call) {
+	const fn = `${quoteIdentifier("data")}.${quoteIdentifier(call.name)}`;
+	let source;
+	let args = [];
+	if (call.args.length !== 0) {
+		const columns = call.args.map((arg) => `${quoteIdentifier(arg.name)} ${arg.type}`);
+		const named = call.args.map((arg) => `${quoteIdentifier(arg.name)} => r.${quoteIdentifier(arg.name)}`);
+		source = `pg_catalog.json_to_record($1::pg_catalog.json) AS r(${columns.join(", ")}), LATERAL ${fn}(${named.join(", ")})`;
+		args = [call.argValues];
+	} else source = `${fn}()`;
+	let item;
+	let inner;
+	switch (call.returns) {
+		case "row":
+			[item, inner] = ["pg_catalog.to_json(o.*)", `SELECT f.* FROM ${source} AS f`];
+			break;
+		case "void":
+			[item, inner] = ["NULL::pg_catalog.json", `SELECT FROM ${source} AS f`];
+			break;
+		default: [item, inner] = ["pg_catalog.to_json(o.v)", `SELECT f.v FROM ${source} AS f(v)`];
+	}
+	return {
+		sql: `SELECT NULL::pg_catalog.int8, pg_catalog.count(*), ${call.returnsSet ? "coalesce(pg_catalog.json_agg(result.v), '[]'::pg_catalog.json)" : "(pg_catalog.json_agg(result.v) -> 0)"}::pg_catalog.text FROM (\nSELECT ${item} AS v FROM (\n${inner}\nLIMIT 1001\n) AS o\n) AS result`,
+		args
+	};
+}
+function quoteIdentifier(name) {
+	return `"${name.replaceAll("\0", "").replaceAll("\"", "\"\"")}"`;
+}
+
+// src/app/testmode/rows/request.ts
+function decodeRowsRequest(operation, body) {
+	const value = readBody(body);
+	switch (operation) {
+		case "select": return { read: selectRowsRead(decodeSelect(value)) };
+		case "insert": {
+			const input = decodeInsert(value);
+			return { write: insertRowsWrite(input.table, input.rows, input.defaultToNull, input.select, input.count, input.single) };
+		}
+		case "upsert": return { write: upsertRowsWrite(decodeUpsert(value)) };
+		case "update": return { write: updateRowsWrite(decodeUpdate(value)) };
+		case "delete": return { write: deleteRowsWrite(decodeDelete(value)) };
+	}
+}
+function readBody(body) {
+	try {
+		return parseFirstJson(body);
+	} catch (error) {
+		if (!(error instanceof JsonSyntaxError)) throw error;
+		throw new RowsRefusal(400, "invalid-input", error.message);
+	}
+}
+function invalidJson(field, message) {
+	return new RowsRefusal(400, "invalid-input", "Invalid JSON input", [{
+		field,
+		message
+	}]);
+}
+function kindOf(value) {
+	if (typeof value === "boolean") return "bool";
+	if (typeof value === "string") return "string";
+	if (value instanceof JsonNumber) return "number";
+	if (Array.isArray(value)) return "array";
+	return "object";
+}
+function typeError(goType, value, path, found = kindOf(value)) {
+	if (path === "") return invalidJson("json", `Invalid JSON format: json: cannot unmarshal ${found} into Go value of type ${goType}`);
+	const field = path.toLowerCase();
+	return invalidJson(field, `Expected ${goType} for field ${field}, but got ${found}`);
+}
+function decodeStruct(value, path, goType, fields, target) {
+	if (value === null) return;
+	if (!(value instanceof Map)) throw typeError(goType, value, path);
+	const names = Object.keys(fields);
+	for (const [key, member] of value) {
+		const name = names.includes(key) ? key : names.find((field) => field.toLowerCase() === key.toLowerCase());
+		if (name === void 0) throw invalidJson("json", `Invalid JSON format: json: unknown field ${JSON.stringify(key)}`);
+		const spec = fields[name];
+		const memberPath = path === "" ? name : `${path}.${name}`;
+		if (member === null) {
+			if (spec.nilable) target[name] = void 0;
+			continue;
+		}
+		target[name] = spec.decode(member, memberPath);
+	}
+}
+const field = (decode, nilable = false) => ({
+	decode,
+	nilable
+});
+function decodeString(goType = "string") {
+	return (value, path) => {
+		if (typeof value !== "string") throw typeError(goType, value, path);
+		return value;
+	};
+}
+const decodeBool = (value, path) => {
+	if (typeof value !== "boolean") throw typeError("bool", value, path);
+	return value;
+};
+const int64Min = BigInt("-9223372036854775808");
+const int64Max = BigInt("9223372036854775807");
+const decodeInt = (value, path) => {
+	if (!(value instanceof JsonNumber)) throw typeError("int", value, path);
+	if (!/^-?\d+$/.test(value.text)) throw typeError("int", value, path, `number ${value.text}`);
+	const parsed = BigInt(value.text);
+	if (parsed < int64Min || parsed > int64Max) throw typeError("int", value, path, `number ${value.text}`);
+	return parsed;
+};
+function decodeSlice(goType, element, zero) {
+	return (value, path) => {
+		if (!Array.isArray(value)) throw typeError(goType, value, path);
+		return value.map((item) => item === null ? zero : element(item, path));
+	};
+}
+const decodeObject = (value, path) => {
+	if (!(value instanceof Map)) throw typeError("map[string]interface {}", value, path);
+	return value;
+};
+const decodeFilter = (value, path) => {
+	const filter = {
+		column: "",
+		operator: "",
+		not: false
+	};
+	decodeStruct(value, path, "dto.StorageRowFilter", filterFields, filter);
+	return filter;
+};
+const decodeFilters = decodeSlice("[]dto.StorageRowFilter", decodeFilter, void 0);
+const filterFields = {
+	column: field(decodeString()),
+	operator: field(decodeString("dto.StorageRowFilterOperator")),
+	value: field(decodeString(), true),
+	values: field(decodeSlice("[]string", decodeString(), ""), true),
+	not: field(decodeBool),
+	or: field((value, path) => decodeFilters(value, path), true),
+	and: field((value, path) => decodeFilters(value, path), true)
+};
+const decodeOrder = (value, path) => {
+	const order = { column: "" };
+	decodeStruct(value, path, "dto.StorageRowOrder", {
+		column: field(decodeString()),
+		ascending: field(decodeBool, true),
+		nullsFirst: field(decodeBool, true)
+	}, order);
+	return order;
+};
+function filterList(filters) {
+	return filters?.map((filter) => filter ?? {
+		column: "",
+		operator: "",
+		not: false
+	});
+}
+const countField = field(decodeString("dto.StorageRowCount"));
+const bodyType = "dto.wire";
+function decodeSelect(value) {
+	const input = {
+		table: "",
+		select: "",
+		offset: BigInt(0),
+		count: "",
+		single: false
+	};
+	decodeStruct(value, "", bodyType, {
+		table: field(decodeString()),
+		select: field(decodeString()),
+		filters: field(decodeFilters, true),
+		order: field(decodeSlice("[]dto.StorageRowOrder", decodeOrder, { column: "" }), true),
+		limit: field(decodeInt, true),
+		offset: field(decodeInt),
+		count: countField,
+		single: field(decodeBool)
+	}, input);
+	input.filters = filterList(input.filters);
+	requireFields("selectstoragedatabaserowsinput", [["table", input.table !== ""]]);
+	return input;
+}
+const writeFields = {
+	table: field(decodeString()),
+	select: field(decodeString(), true),
+	count: countField,
+	single: field(decodeBool)
+};
+const rowsField = field(decodeSlice("[]map[string]interface {}", decodeObject, null), true);
+function decodeInsert(value) {
+	const input = {
+		table: "",
+		count: "",
+		single: false
+	};
+	decodeStruct(value, "", bodyType, {
+		...writeFields,
+		rows: rowsField,
+		defaultToNull: field(decodeBool, true)
+	}, input);
+	requireFields("insertstoragedatabaserowsinput", [["table", input.table !== ""], ["rows", input.rows !== void 0]]);
+	return input;
+}
+function decodeUpsert(value) {
+	const input = {
+		table: "",
+		count: "",
+		single: false,
+		ignoreDuplicates: false
+	};
+	decodeStruct(value, "", bodyType, {
+		...writeFields,
+		rows: rowsField,
+		onConflict: field(decodeSlice("[]string", decodeString(), ""), true),
+		ignoreDuplicates: field(decodeBool),
+		defaultToNull: field(decodeBool, true)
+	}, input);
+	requireFields("upsertstoragedatabaserowsinput", [["table", input.table !== ""], ["rows", input.rows !== void 0]]);
+	return input;
+}
+function decodeUpdate(value) {
+	const input = {
+		table: "",
+		count: "",
+		single: false
+	};
+	decodeStruct(value, "", bodyType, {
+		...writeFields,
+		values: field(decodeObject, true),
+		filters: field(decodeFilters, true)
+	}, input);
+	input.filters = filterList(input.filters);
+	requireFields("updatestoragedatabaserowsinput", [
+		["table", input.table !== ""],
+		["values", input.values !== void 0],
+		["filters", input.filters !== void 0]
+	]);
+	return input;
+}
+function decodeDelete(value) {
+	const input = {
+		table: "",
+		count: "",
+		single: false
+	};
+	decodeStruct(value, "", bodyType, {
+		...writeFields,
+		filters: field(decodeFilters, true)
+	}, input);
+	input.filters = filterList(input.filters);
+	requireFields("deletestoragedatabaserowsinput", [["table", input.table !== ""], ["filters", input.filters !== void 0]]);
+	return input;
+}
+function decodeFunctionCall(body) {
+	const input = { name: "" };
+	decodeStruct(readBody(body), "", bodyType, {
+		name: field(decodeString()),
+		args: field(decodeObject, true)
+	}, input);
+	requireFields("callstoragedatabasefunctioninput", [["name", input.name !== ""]]);
+	validateFunctionCall(input);
+	return input;
+}
+function requireFields(type, checks) {
+	const errors = checks.filter(([, present]) => !present).map(([name]) => ({
+		field: `${type}.${name}`,
+		message: `${type}.${name} is required`
+	}));
+	if (errors.length > 0) throw new RowsRefusal(400, "validation-error", "Validation failed", errors);
+}
+const rowOperators = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"like",
+	"ilike",
+	"in",
+	"is"
+];
+const rowIsValues = [
+	"null",
+	"true",
+	"false"
+];
+function invalidRowsRequest(message) {
+	return incorrectInput(message, slugTableRequestInvalid);
+}
+function selectRowsRead(input) {
+	const selection = parseRowSelect(input.select);
+	const [filter, embedFilters] = rowFilters(input.filters ?? []);
+	return {
+		table: input.table,
+		select: selection,
+		filter,
+		embedFilters,
+		order: rowOrder(input.order ?? []),
+		limit: input.limit === void 0 ? void 0 : Number(input.limit),
+		offset: input.offset,
+		count: rowCount(input.count),
+		singular: input.single
+	};
+}
+function insertRowsWrite(table, rows, defaultToNull, returning, count, single) {
+	let columns;
+	for (const row of rows) for (const name of row?.keys() ?? []) {
+		columns ??= [];
+		if (!columns.includes(name)) columns.push(name);
+	}
+	columns?.sort(compareCodePoints);
+	return withRowsReturning({
+		table,
+		kind: "insert",
+		body: rows,
+		columns,
+		onConflict: [],
+		resolution: "",
+		missingDefault: defaultToNull === false,
+		filter: emptyFilter(),
+		embedFilters: [],
+		representation: false,
+		select: [],
+		count: "",
+		singular: single
+	}, returning, count);
+}
+function upsertRowsWrite(input) {
+	const write = insertRowsWrite(input.table, input.rows, input.defaultToNull, input.select, input.count, input.single);
+	write.onConflict = input.onConflict ?? [];
+	write.resolution = input.ignoreDuplicates ? "ignore" : "merge";
+	return write;
+}
+function updateRowsWrite(input) {
+	const [filter, embedFilters] = rowFilters(input.filters);
+	return withRowsReturning({
+		table: input.table,
+		kind: "update",
+		body: input.values,
+		columns: void 0,
+		onConflict: [],
+		resolution: "",
+		missingDefault: false,
+		filter,
+		embedFilters,
+		representation: false,
+		select: [],
+		count: "",
+		singular: input.single
+	}, input.select, input.count);
+}
+function deleteRowsWrite(input) {
+	const [filter, embedFilters] = rowFilters(input.filters);
+	return withRowsReturning({
+		table: input.table,
+		kind: "delete",
+		body: void 0,
+		columns: void 0,
+		onConflict: [],
+		resolution: "",
+		missingDefault: false,
+		filter,
+		embedFilters,
+		representation: false,
+		select: [],
+		count: "",
+		singular: input.single
+	}, input.select, input.count);
+}
+function withRowsReturning(write, returning, count) {
+	write.count = rowCount(count);
+	if (returning === void 0) return write;
+	write.representation = true;
+	write.select = parseRowSelect(returning);
+	return write;
+}
+function rowCount(count) {
+	if (count === "" || count === "exact") return count;
+	throw invalidRowsRequest("count must be exact");
+}
+function rowOrder(order) {
+	return order.map((requested) => ({
+		column: requested.column,
+		descending: requested.ascending === false,
+		nulls: requested.nullsFirst === void 0 ? "" : requested.nullsFirst ? "first" : "last"
+	}));
+}
+function rowFilters(filters) {
+	const group = emptyFilter();
+	const embedFilters = [];
+	for (const filter of filters) {
+		if (filter.or !== void 0 || filter.and !== void 0) {
+			group.terms.push(rowFilterGroup(filter, 1));
+			continue;
+		}
+		const path = parseRowColumnPath(filter.column);
+		const condition = rowCondition(filter, path[path.length - 1]);
+		if (path.length > 1) {
+			embedFilters.push({
+				path: path.slice(0, -1),
+				condition
+			});
+			continue;
+		}
+		group.terms.push({ condition });
+	}
+	return [group, embedFilters];
+}
+function rowFilterGroup(filter, depth) {
+	if (depth > 64) throw invalidRowsRequest(`filter groups nest deeper than ${64} levels`);
+	if (filter.or !== void 0 === (filter.and !== void 0) || filter.column !== "" || filter.operator !== "" || filter.value !== void 0 || filter.values !== void 0) throw invalidRowsRequest("a filter group sets or or and, and nothing else but not");
+	const members = filterList(filter.or ?? filter.and);
+	const group = {
+		or: filter.or !== void 0,
+		negated: filter.not,
+		terms: []
+	};
+	if (members.length === 0) throw invalidRowsRequest("a filter group needs at least one filter");
+	for (const member of members) {
+		if (member.or !== void 0 || member.and !== void 0) {
+			group.terms.push(rowFilterGroup(member, depth + 1));
+			continue;
+		}
+		group.terms.push({ condition: rowCondition(member, member.column) });
+	}
+	return { group };
+}
+function rowCondition(filter, column) {
+	if (column === "") throw invalidRowsRequest("a filter needs a column");
+	const operator = rowOperators.find((candidate) => candidate === filter.operator);
+	if (operator === void 0) throw invalidRowsRequest(`the filter on ${column} needs an operator`);
+	const condition = {
+		column,
+		operator,
+		negated: filter.not,
+		value: "",
+		values: [],
+		is: ""
+	};
+	if (operator === "in") {
+		if (filter.values === void 0 || filter.value !== void 0) throw invalidRowsRequest(`in on ${column} takes values and no value`);
+		condition.values = filter.values;
+		return condition;
+	}
+	if (filter.values !== void 0) throw invalidRowsRequest("only in takes values");
+	if (operator === "is") {
+		const test = rowIsValues.find((candidate) => candidate === (filter.value ?? "null"));
+		if (test === void 0) throw invalidRowsRequest(`is on ${column} takes null, true or false`);
+		condition.is = test;
+		return condition;
+	}
+	if (filter.value === void 0) throw invalidRowsRequest(`the filter on ${column} needs a value`);
+	condition.value = filter.value;
+	return condition;
+}
+function parseRowColumnPath(column) {
+	const parser = new RowSelectParser(column, "filter column");
+	const path = [];
+	for (;;) {
+		path.push(parser.fieldName());
+		if (parser.atEnd()) return path;
+		if (!parser.consume(".")) throw parser.fail("expecting '.' or end of input");
+	}
+}
+function parseRowSelect(value) {
+	if (value.trim() === "") return [];
+	const parser = new RowSelectParser(value, "select");
+	const items = parser.selectList();
+	if (!parser.atEnd()) throw parser.fail("expecting ',' or end of input");
+	return items;
+}
+const rowAggregates = /* @__PURE__ */ new Map([
+	["avg", "avg"],
+	["count", "count"],
+	["max", "max"],
+	["min", "min"],
+	["sum", "sum"]
+]);
+const identifierRune = /^[\p{L}\p{Nd}_$ ]$/u;
+var RowSelectParser = class {
+	constructor(text, what) {
+		this.text = text;
+		this.what = what;
+		this.position = 0;
+		this.depth = 0;
+		this.input = Array.from(text);
+	}
+	atEnd() {
+		return this.position >= this.input.length;
+	}
+	peek() {
+		return this.atEnd() ? "" : this.input[this.position];
+	}
+	hasPrefix(prefix) {
+		return this.prefixEnd(prefix) >= 0;
+	}
+	consume(prefix) {
+		const end = this.prefixEnd(prefix);
+		if (end >= 0) this.position = end;
+		return end >= 0;
+	}
+	prefixEnd(prefix) {
+		let position = this.position;
+		for (const char of Array.from(prefix)) {
+			if (position >= this.input.length || this.input[position] !== char) return -1;
+			position++;
+		}
+		return position;
+	}
+	skipSpace() {
+		while (this.peek() === " " || this.peek() === "	") this.position++;
+	}
+	fail(reason) {
+		const found = this.atEnd() ? "end of input" : `'${this.peek()}'`;
+		return invalidRowsRequest(`the ${this.what} ${JSON.stringify(this.text)} has an unexpected ${found} at position ${this.position + 1}, ${reason}`);
+	}
+	fieldName() {
+		if (this.peek() === "\"") return this.quoted();
+		const parts = [];
+		for (;;) {
+			const start = this.position;
+			while (!this.atEnd() && identifierRune.test(this.peek())) this.position++;
+			const part = this.input.slice(start, this.position).join("").trim();
+			if (part === "") throw this.fail("expecting a name");
+			parts.push(part);
+			if (!this.hasPrefix("-") || this.hasPrefix("->")) return parts.join("-");
+			this.position++;
+		}
+	}
+	quoted() {
+		this.position++;
+		let value = "";
+		while (!this.atEnd()) {
+			const char = this.peek();
+			this.position++;
+			if (char === "\"") return value;
+			if (char === "\\") {
+				if (this.atEnd()) throw this.fail("expecting a character after '\\'");
+				value += this.peek();
+				this.position++;
+			} else value += char;
+		}
+		throw this.fail("expecting a closing '\"'");
+	}
+	selectList() {
+		const items = [];
+		this.skipSpace();
+		if (this.atEnd() || this.peek() === ")") return items;
+		for (;;) {
+			items.push(this.selectItem());
+			this.skipSpace();
+			if (!this.consume(",")) return items;
+			this.skipSpace();
+		}
+	}
+	selectItem() {
+		if (this.hasPrefix("...")) throw invalidRowsRequest("spreading an embedded table is not supported");
+		if (this.consume("*")) {
+			if (!this.atItemEnd()) throw this.fail("expecting ',', ')' or end of input");
+			return { star: true };
+		}
+		const start = this.position;
+		const aggregate = this.aggregate();
+		if (aggregate !== void 0) return aggregate;
+		this.position = start;
+		const embed = this.embed();
+		if (embed !== void 0) return { embed };
+		this.position = start;
+		return this.columnItem();
+	}
+	aggregate() {
+		const alias = this.alias();
+		const quoted = this.peek() === "\"";
+		if (!quoted && !identifierRune.test(this.peek())) return void 0;
+		const name = this.fieldName();
+		const item = { alias };
+		if (!quoted && name === "count" && this.consume("()")) item.aggregate = "count";
+		else if (this.consume(".")) {
+			const quotedFunction = this.peek() === "\"";
+			const aggregate = rowAggregates.get(this.fieldName());
+			if (quotedFunction || aggregate === void 0 || !this.consume("()")) throw invalidRowsRequest("only the aggregates avg(), count(), max(), min() and sum() are supported");
+			item.column = name;
+			item.aggregate = aggregate;
+		} else return;
+		if (this.hasPrefix("::")) throw invalidRowsRequest("casts are not supported");
+		if (!this.atItemEnd()) throw this.fail("expecting ',', ')' or end of input");
+		return item;
+	}
+	atItemEnd() {
+		this.skipSpace();
+		return this.atEnd() || this.peek() === "," || this.peek() === ")";
+	}
+	alias() {
+		const start = this.position;
+		try {
+			const name = this.fieldName();
+			if (this.hasPrefix(":") && !this.hasPrefix("::")) {
+				this.position++;
+				return name;
+			}
+		} catch (error) {
+			if (!(error instanceof RowsRefusal)) throw error;
+		}
+		this.position = start;
+		return "";
+	}
+	embed() {
+		const alias = this.alias();
+		if (this.peek() !== "\"" && !identifierRune.test(this.peek())) return void 0;
+		const embed = {
+			relation: this.fieldName(),
+			alias,
+			hint: "",
+			inner: false,
+			select: []
+		};
+		let hinted = false;
+		let joined = false;
+		while (this.consume("!")) {
+			const parameter = this.fieldName();
+			if ((parameter === "inner" || parameter === "left") && !joined) {
+				embed.inner = parameter === "inner";
+				joined = true;
+			} else if (parameter !== "inner" && parameter !== "left" && !hinted) {
+				embed.hint = parameter;
+				hinted = true;
+			}
+		}
+		if (!this.consume("(")) return void 0;
+		this.depth++;
+		if (this.depth > 3) throw invalidRowsRequest(`embeds nest deeper than ${3} levels`);
+		const items = this.selectList();
+		if (!this.consume(")")) throw this.fail("expecting ',' or ')'");
+		this.depth--;
+		embed.select = items;
+		return embed;
+	}
+	columnItem() {
+		const alias = this.alias();
+		const column = this.fieldName();
+		if (this.hasPrefix("->")) throw invalidRowsRequest("JSON paths are not supported");
+		if (this.hasPrefix("::")) throw invalidRowsRequest("casts are not supported");
+		if (!this.atItemEnd()) throw this.fail("expecting ',', ')' or end of input");
+		return {
+			column,
+			alias
+		};
+	}
+};
+
+// src/app/testmode/server.ts
+const oauthPrefix = `/__oaiz-test/oauth/`;
+const rowsRoute = /^\/__oaiz-test\/storage\/databases\/([^/]+)\/rows\/(select|insert|upsert|update|delete)$/;
+const functionCallRoute = /^\/__oaiz-test\/storage\/databases\/([^/]+)\/functions\/call$/;
+const unsupported = {
+	slug: "test-mode-unsupported",
+	message: "OAIZ test mode runs sign-in, row requests and function calls only. Tools, events, workflow runs, model calls, embeddings and chat need OAIZ."
+};
+const databaseNotFound = {
+	message: "the managed database was not found",
+	slug: "storage-database-access-denied"
+};
+async function createTestServer(options) {
+	let files = await readTestFiles(options.directory);
+	const open = /* @__PURE__ */ new Map();
+	const build = (id, database) => {
+		const built = (async () => {
+			const opened = await openTestDatabase(database.schemaSQL, databaseFile(id, ".sql"));
+			try {
+				await seed(opened, id, database.seedSQL);
+			} catch (error) {
+				await opened.close();
+				throw error;
+			}
+			return opened;
+		})();
+		const entry = {
+			schemaSQL: database.schemaSQL,
+			database: built
+		};
+		built.catch(() => {
+			if (open.get(id) === entry) open.delete(id);
+		});
+		open.set(id, entry);
+		return entry;
+	};
+	const databaseFor = (id) => {
+		const database = files.databases.get(id);
+		if (database === void 0) return void 0;
+		return (open.get(id) ?? build(id, database)).database;
+	};
+	const auth = createTestAuth(() => files.members.members);
+	async function storageRequest(request, id, decode, run) {
+		const signedIn = auth.authenticate(request);
+		if (signedIn instanceof Response) return signedIn;
+		const caller = {
+			subject: signedIn.member.id,
+			organisationRole: signedIn.member.role ?? "member",
+			teams: signedIn.member.teams ?? [],
+			capability: files.members.grants[id] ?? "edit",
+			app: signedIn.clientId
+		};
+		try {
+			const decoded = decode(await request.text());
+			const database = databaseFor(id);
+			if (database === void 0) return json(404, databaseNotFound);
+			return new Response(await run(await database, caller, decoded), {
+				status: 200,
+				headers: { "content-type": "application/json; charset=utf-8" }
+			});
+		} catch (error) {
+			if (error instanceof RowsRefusal) return json(error.status, error.body());
+			throw error;
+		}
+	}
+	const rows = (request, id, operation) => storageRequest(request, id, (body) => decodeRowsRequest(operation, body), async (database, caller, decoded) => rowsBody(await runRowsRequest(database, caller, decoded), (decoded.read ?? decoded.write).singular));
+	const callFunction = (request, id) => storageRequest(request, id, decodeFunctionCall, async (database, caller, call) => functionCallBody(await runFunctionCall(database, caller, call)));
+	async function reset() {
+		files = await readTestFiles(options.directory);
+		const waiting = [];
+		for (const [id, entry] of [...open]) {
+			const database = files.databases.get(id);
+			if (database !== void 0 && database.schemaSQL === entry.schemaSQL) {
+				waiting.push(entry.database.then((opened) => seed(opened, id, database.seedSQL)).catch(async (error) => {
+					if (open.get(id) === entry) open.delete(id);
+					await closeQuietly(entry);
+					throw error;
+				}));
+				continue;
+			}
+			open.delete(id);
+			waiting.push(closeQuietly(entry));
+			if (database !== void 0) waiting.push(build(id, database).database);
+		}
+		await Promise.all(waiting);
+	}
+	return {
+		async handle(request) {
+			const path = new URL(request.url).pathname;
+			const route = rowsRoute.exec(path);
+			const functionRoute = route ? null : functionCallRoute.exec(path);
+			if (route || functionRoute) {
+				if (request.method !== "POST") return new Response("404 page not found", {
+					status: 404,
+					headers: { "content-type": "text/plain" }
+				});
+				if (route) return rows(request, databaseId(route[1]), route[2]);
+				return callFunction(request, databaseId(functionRoute[1]));
+			}
+			if (path.startsWith(oauthPrefix)) {
+				const answer = await auth.handle(request, path.slice(oauthPrefix.length));
+				if (answer !== void 0) return answer;
+			}
+			return json(501, unsupported);
+		},
+		issueToken: (memberId, clientId) => auth.issueToken(memberId, clientId),
+		reset,
+		async close() {
+			const entries = [...open.values()];
+			open.clear();
+			await Promise.all(entries.map(closeQuietly));
+		}
+	};
+}
+function databaseId(segment) {
+	return decodeURIComponent(segment).toLowerCase();
+}
+function closeQuietly(entry) {
+	return entry.database.then((opened) => opened.close(), () => void 0);
+}
+function databaseFile(id, suffix) {
+	return `tests/databases/${id}${suffix}`;
+}
+async function seed(database, id, seedSQL) {
+	try {
+		await database.reset(seedSQL);
+	} catch (error) {
+		if (error instanceof RowsRefusal) throw error;
+		throw new Error(`${databaseFile(id, ".seed.sql")} does not run on its test database: ${error.message}`, { cause: error });
+	}
+}
+async function readTestFiles(directory) {
+	const membersText = await readOptional(join(directory, "members.json"));
+	const members = membersText === void 0 ? {
+		teams: [],
+		members: [],
+		grants: {}
+	} : parseMembers(membersText, "tests/members.json");
+	const folder = join(directory, "databases");
+	let names;
+	try {
+		names = await readdir(folder);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		names = [];
+	}
+	const schemas = /* @__PURE__ */ new Map();
+	const seeds = /* @__PURE__ */ new Map();
+	for (const name of names.sort()) {
+		const lower = name.toLowerCase();
+		if (lower.endsWith(".seed.sql")) seeds.set(lower.slice(0, -9), await readFile(join(folder, name), "utf8"));
+		else if (lower.endsWith(".sql")) schemas.set(lower.slice(0, -4), await readFile(join(folder, name), "utf8"));
+	}
+	const databases = /* @__PURE__ */ new Map();
+	for (const [id, schemaSQL] of schemas) databases.set(id, {
+		schemaSQL,
+		seedSQL: seeds.get(id) ?? ""
+	});
+	for (const id of seeds.keys()) if (!schemas.has(id)) throw new Error(`${databaseFile(id, ".seed.sql")} has no schema file ${databaseFile(id, ".sql")}`);
+	return {
+		members,
+		databases
+	};
+}
+async function readOptional(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+function rowsBody(result, single) {
+	let rows = [];
+	if (result.body !== null) {
+		const document = parseJson(result.body);
+		if (single) rows = document === null ? [] : [document];
+		else rows = document;
+	}
+	const count = result.total === null ? "" : `,"count":${result.total}`;
+	return `{"rows":${stringifyJson(rows)}${count}}`;
+}
+function functionCallBody(body) {
+	return `{"data":${body === null ? "null" : stringifyJson(parseJson(body))}}`;
+}
+function json(status, body, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json; charset=utf-8",
+			...headers
+		}
+	});
+}
+
+// src/app/testmode/plugin.ts
+const testMode = "oaiz-test";
+const prefix = "/__oaiz-test/";
+const resetPath = `${prefix}test/reset`;
+function oaizTest({ directory = "tests" } = {}) {
+	return {
+		name: "oaiz-test",
+		apply: (_, env) => env.command === "serve" && env.mode === testMode,
+		configureServer(server) {
+			const folder = resolve(server.config.root, directory);
+			let started;
+			server.httpServer?.once("close", () => {
+				started?.then((test) => test.close(), () => void 0);
+			});
+			server.middlewares.use((req, res, next) => {
+				if (!(req.url ?? "").startsWith(prefix)) {
+					next();
+					return;
+				}
+				(async () => {
+					if (started === void 0) {
+						started = createTestServer({ directory: folder });
+						started.catch(() => {
+							started = void 0;
+						});
+					}
+					const test = await started;
+					const request = await fetchRequest(req, server);
+					if (request.method === "POST" && new URL(request.url).pathname === resetPath) {
+						await test.reset();
+						res.statusCode = 204;
+						res.end();
+						return;
+					}
+					await writeResponse(res, await test.handle(request));
+				})().catch((error) => {
+					if (res.headersSent) return next(error);
+					const message = error instanceof Error ? error.message : String(error);
+					server.config.logger.error(`[oaiz-test] ${message}`, { timestamp: true });
+					res.statusCode = 500;
+					res.setHeader("content-type", "application/json");
+					res.end(JSON.stringify({
+						message,
+						slug: "test-mode-setup"
+					}));
+				});
+			});
+		}
+	};
+}
+async function fetchRequest(req, server) {
+	const protocol = server.config.server.https ? "https" : "http";
+	const url = new URL(req.url ?? "/", `${protocol}://${req.headers.host}`);
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(req.headers)) {
+		if (value === void 0) continue;
+		for (const item of Array.isArray(value) ? value : [value]) headers.append(name, item);
+	}
+	const method = req.method ?? "GET";
+	const chunks = [];
+	if (method !== "GET" && method !== "HEAD") for await (const chunk of req) chunks.push(chunk);
+	return new Request(url, {
+		method,
+		headers,
+		body: chunks.length === 0 ? void 0 : Buffer.concat(chunks)
+	});
+}
+async function writeResponse(res, response) {
+	res.statusCode = response.status;
+	response.headers.forEach((value, name) => res.setHeader(name, value));
+	res.end(Buffer.from(await response.arrayBuffer()));
+}
+
+export { createTestServer, oaizTest };