@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/dist/helpers/integration/api.js

@@ -58,7 +58,20 @@ async function apiRequest(request, method, path, options) {
     Authorization: `Bearer ${options.token}`,
     "Content-Type": "application/json"
   };
-  return request.fetch(resolveUrl(path), { method, headers, data: options.data });
+  const timeout = options.timeout ?? 3e4;
+  let lastError = null;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });
+    } catch (error) {
+      lastError = error;
+      const message = error instanceof Error ? error.message : "";
+      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);
+      if (!retryable || attempt === 1) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+  }
+  throw lastError;
 }
 async function postForm(request, path, data, options) {
   const form = new URLSearchParams();

package/dist/helpers/integration/api.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/api.ts"],
-  "sourcesContent": ["import { type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; data?: unknown },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n  };\n  return request.fetch(resolveUrl(path), { method, headers, data: options.data });\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n"],
-  "mappings": "AACA,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAE/B,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,EAClB;AACA,SAAO,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,CAAC;AAChF;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;",
+  "sourcesContent": ["import { type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; data?: unknown; timeout?: number },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n  };\n  const timeout = options.timeout ?? 30_000;\n  let lastError: unknown = null;\n  for (let attempt = 0; attempt < 2; attempt += 1) {\n    try {\n      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });\n    } catch (error) {\n      lastError = error;\n      const message = error instanceof Error ? error.message : '';\n      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);\n      if (!retryable || attempt === 1) throw error;\n      await new Promise((resolve) => setTimeout(resolve, 250));\n    }\n  }\n  throw lastError;\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n"],
+  "mappings": "AACA,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAE/B,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,EAClB;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAqB;AACzB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,QAAI;AACF,aAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/F,SAAS,OAAO;AACd,kBAAY;AACZ,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,YAAY,0FAA0F,KAAK,OAAO;AACxH,UAAI,CAAC,aAAa,YAAY,EAAG,OAAM;AACvC,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;",
   "names": []
 }

package/dist/helpers/integration/authFixtures.js

@@ -1,5 +1,5 @@
 import { expect } from "@playwright/test";
-import { apiRequest } from "./api.js";
+import { apiRequest, getAuthToken } from "./api.js";
 import { expectId, readJsonSafe } from "./generalFixtures.js";
 const BASE_URL = process.env.BASE_URL?.trim() || null;
 function resolveUrl(path) {
@@ -105,6 +105,7 @@ export {
   deleteOrganizationIfExists,
   deleteRoleIfExists,
   deleteUserIfExists,
+  getAuthToken,
   setRoleAclFeatures,
   setUserAclVisibility
 };

package/dist/helpers/integration/authFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/authFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n/**\n * Variant of {@link apiRequest} that sets the `om_selected_org` cookie so the\n * server resolves `ctx.selectedOrganizationId` to a specific organization.\n * Create routes scope new records to that organization, which lets a test place\n * a fixture in an organization other than the caller's home org.\n */\nexport async function apiRequestWithSelectedOrg(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; selectedOrgId: string; data?: unknown },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n    Cookie: `om_selected_org=${options.selectedOrgId}`,\n  };\n  return request.fetch(resolveUrl(path), { method, headers, data: options.data });\n}\n\nexport async function createRoleFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; tenantId?: string },\n): Promise<string> {\n  const payload: { name: string; tenantId?: string } = {\n    name: input.name,\n  };\n  if (typeof input.tenantId === 'string' && input.tenantId.length > 0) {\n    payload.tenantId = input.tenantId;\n  }\n  const response = await apiRequest(request, 'POST', '/api/auth/roles', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/auth/roles should return 201').toBe(201);\n  return expectId(body?.id, 'Role creation response should include id');\n}\n\nexport async function deleteRoleIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  roleId: string | null,\n): Promise<void> {\n  if (!token || !roleId) return;\n  await apiRequest(request, 'DELETE', `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => undefined);\n}\n\nexport async function createUserFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { email: string; password: string; organizationId: string; roles: string[]; name?: string },\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', '/api/auth/users', {\n    token,\n    data: input,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/auth/users should return 201').toBe(201);\n  return expectId(body?.id, 'User creation response should include id');\n}\n\nexport async function deleteUserIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  userId: string | null,\n): Promise<void> {\n  if (!token || !userId) return;\n  await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => undefined);\n}\n\nexport async function createOrganizationFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; tenantId?: string },\n): Promise<string> {\n  const payload: { name: string; tenantId?: string } = { name: input.name };\n  if (typeof input.tenantId === 'string' && input.tenantId.length > 0) {\n    payload.tenantId = input.tenantId;\n  }\n  const response = await apiRequest(request, 'POST', '/api/directory/organizations', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/directory/organizations should return 201').toBe(201);\n  return expectId(body?.id, 'Organization creation response should include id');\n}\n\nexport async function deleteOrganizationIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  organizationId: string | null,\n): Promise<void> {\n  if (!token || !organizationId) return;\n  await apiRequest(request, 'DELETE', '/api/directory/organizations', {\n    token,\n    data: { id: organizationId },\n  }).catch(() => undefined);\n}\n\nexport async function setRoleAclFeatures(\n  request: APIRequestContext,\n  token: string,\n  input: { roleId: string; features: string[]; organizations?: string[] | null },\n): Promise<void> {\n  const payload: { roleId: string; features: string[]; organizations?: string[] | null } = {\n    roleId: input.roleId,\n    features: input.features,\n  };\n  if (input.organizations !== undefined) {\n    payload.organizations = input.organizations;\n  }\n  const response = await apiRequest(request, 'PUT', '/api/auth/roles/acl', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ ok?: boolean }>(response);\n  expect(response.status(), 'PUT /api/auth/roles/acl should return 200').toBe(200);\n  expect(body?.ok, 'Role ACL update should report ok=true').toBe(true);\n}\n\nexport async function setUserAclVisibility(\n  request: APIRequestContext,\n  token: string,\n  input: { userId: string; organizations: string[] | null; features?: string[] },\n): Promise<void> {\n  const payload: { userId: string; organizations: string[] | null; features?: string[] } = {\n    userId: input.userId,\n    organizations: input.organizations,\n  };\n  if (input.features !== undefined) {\n    payload.features = input.features;\n  }\n  const response = await apiRequest(request, 'PUT', '/api/auth/users/acl', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ ok?: boolean }>(response);\n  expect(response.status(), 'PUT /api/auth/users/acl should return 200').toBe(200);\n  expect(body?.ok, 'User ACL update should report ok=true').toBe(true);\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAEvC,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAQA,eAAsB,0BACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ,mBAAmB,QAAQ,aAAa;AAAA,EAClD;AACA,SAAO,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,CAAC;AAChF;AAEA,eAAsB,kBACpB,SACA,OACA,OACiB;AACjB,QAAM,UAA+C;AAAA,IACnD,MAAM,MAAM;AAAA,EACd;AACA,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,mBAAmB;AAAA,IACpE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,wCAAwC,EAAE,KAAK,GAAG;AAC5E,SAAO,SAAS,MAAM,IAAI,0CAA0C;AACtE;AAEA,eAAsB,mBACpB,SACA,OACA,QACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,QAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1H;AAEA,eAAsB,kBACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,mBAAmB;AAAA,IACpE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,wCAAwC,EAAE,KAAK,GAAG;AAC5E,SAAO,SAAS,MAAM,IAAI,0CAA0C;AACtE;AAEA,eAAsB,mBACpB,SACA,OACA,QACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,QAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1H;AAEA,eAAsB,0BACpB,SACA,OACA,OACiB;AACjB,QAAM,UAA+C,EAAE,MAAM,MAAM,KAAK;AACxE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gCAAgC;AAAA,IACjF;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,qDAAqD,EAAE,KAAK,GAAG;AACzF,SAAO,SAAS,MAAM,IAAI,kDAAkD;AAC9E;AAEA,eAAsB,2BACpB,SACA,OACA,gBACe;AACf,MAAI,CAAC,SAAS,CAAC,eAAgB;AAC/B,QAAM,WAAW,SAAS,UAAU,gCAAgC;AAAA,IAClE;AAAA,IACA,MAAM,EAAE,IAAI,eAAe;AAAA,EAC7B,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAEA,eAAsB,mBACpB,SACA,OACA,OACe;AACf,QAAM,UAAmF;AAAA,IACvF,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,MAAM,kBAAkB,QAAW;AACrC,YAAQ,gBAAgB,MAAM;AAAA,EAChC;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,uBAAuB;AAAA,IACvE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA+B,QAAQ;AAC1D,SAAO,SAAS,OAAO,GAAG,2CAA2C,EAAE,KAAK,GAAG;AAC/E,SAAO,MAAM,IAAI,uCAAuC,EAAE,KAAK,IAAI;AACrE;AAEA,eAAsB,qBACpB,SACA,OACA,OACe;AACf,QAAM,UAAmF;AAAA,IACvF,QAAQ,MAAM;AAAA,IACd,eAAe,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,aAAa,QAAW;AAChC,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,uBAAuB;AAAA,IACvE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA+B,QAAQ;AAC1D,SAAO,SAAS,OAAO,GAAG,2CAA2C,EAAE,KAAK,GAAG;AAC/E,SAAO,MAAM,IAAI,uCAAuC,EAAE,KAAK,IAAI;AACrE;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest, getAuthToken } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n// Re-exported so tests can import auth helpers from a single fixtures module.\nexport { getAuthToken };\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n/**\n * Variant of {@link apiRequest} that sets the `om_selected_org` cookie so the\n * server resolves `ctx.selectedOrganizationId` to a specific organization.\n * Create routes scope new records to that organization, which lets a test place\n * a fixture in an organization other than the caller's home org.\n */\nexport async function apiRequestWithSelectedOrg(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; selectedOrgId: string; data?: unknown },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n    Cookie: `om_selected_org=${options.selectedOrgId}`,\n  };\n  return request.fetch(resolveUrl(path), { method, headers, data: options.data });\n}\n\nexport async function createRoleFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; tenantId?: string },\n): Promise<string> {\n  const payload: { name: string; tenantId?: string } = {\n    name: input.name,\n  };\n  if (typeof input.tenantId === 'string' && input.tenantId.length > 0) {\n    payload.tenantId = input.tenantId;\n  }\n  const response = await apiRequest(request, 'POST', '/api/auth/roles', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/auth/roles should return 201').toBe(201);\n  return expectId(body?.id, 'Role creation response should include id');\n}\n\nexport async function deleteRoleIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  roleId: string | null,\n): Promise<void> {\n  if (!token || !roleId) return;\n  await apiRequest(request, 'DELETE', `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => undefined);\n}\n\nexport async function createUserFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { email: string; password: string; organizationId: string; roles: string[]; name?: string },\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', '/api/auth/users', {\n    token,\n    data: input,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/auth/users should return 201').toBe(201);\n  return expectId(body?.id, 'User creation response should include id');\n}\n\nexport async function deleteUserIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  userId: string | null,\n): Promise<void> {\n  if (!token || !userId) return;\n  await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => undefined);\n}\n\nexport async function createOrganizationFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; tenantId?: string },\n): Promise<string> {\n  const payload: { name: string; tenantId?: string } = { name: input.name };\n  if (typeof input.tenantId === 'string' && input.tenantId.length > 0) {\n    payload.tenantId = input.tenantId;\n  }\n  const response = await apiRequest(request, 'POST', '/api/directory/organizations', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), 'POST /api/directory/organizations should return 201').toBe(201);\n  return expectId(body?.id, 'Organization creation response should include id');\n}\n\nexport async function deleteOrganizationIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  organizationId: string | null,\n): Promise<void> {\n  if (!token || !organizationId) return;\n  await apiRequest(request, 'DELETE', '/api/directory/organizations', {\n    token,\n    data: { id: organizationId },\n  }).catch(() => undefined);\n}\n\nexport async function setRoleAclFeatures(\n  request: APIRequestContext,\n  token: string,\n  input: { roleId: string; features: string[]; organizations?: string[] | null },\n): Promise<void> {\n  const payload: { roleId: string; features: string[]; organizations?: string[] | null } = {\n    roleId: input.roleId,\n    features: input.features,\n  };\n  if (input.organizations !== undefined) {\n    payload.organizations = input.organizations;\n  }\n  const response = await apiRequest(request, 'PUT', '/api/auth/roles/acl', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ ok?: boolean }>(response);\n  expect(response.status(), 'PUT /api/auth/roles/acl should return 200').toBe(200);\n  expect(body?.ok, 'Role ACL update should report ok=true').toBe(true);\n}\n\nexport async function setUserAclVisibility(\n  request: APIRequestContext,\n  token: string,\n  input: { userId: string; organizations: string[] | null; features?: string[] },\n): Promise<void> {\n  const payload: { userId: string; organizations: string[] | null; features?: string[] } = {\n    userId: input.userId,\n    organizations: input.organizations,\n  };\n  if (input.features !== undefined) {\n    payload.features = input.features;\n  }\n  const response = await apiRequest(request, 'PUT', '/api/auth/users/acl', {\n    token,\n    data: payload,\n  });\n  const body = await readJsonSafe<{ ok?: boolean }>(response);\n  expect(response.status(), 'PUT /api/auth/users/acl should return 200').toBe(200);\n  expect(body?.ok, 'User ACL update should report ok=true').toBe(true);\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,oBAAoB;AAKvC,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAQA,eAAsB,0BACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ,mBAAmB,QAAQ,aAAa;AAAA,EAClD;AACA,SAAO,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,CAAC;AAChF;AAEA,eAAsB,kBACpB,SACA,OACA,OACiB;AACjB,QAAM,UAA+C;AAAA,IACnD,MAAM,MAAM;AAAA,EACd;AACA,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,mBAAmB;AAAA,IACpE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,wCAAwC,EAAE,KAAK,GAAG;AAC5E,SAAO,SAAS,MAAM,IAAI,0CAA0C;AACtE;AAEA,eAAsB,mBACpB,SACA,OACA,QACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,QAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1H;AAEA,eAAsB,kBACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,mBAAmB;AAAA,IACpE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,wCAAwC,EAAE,KAAK,GAAG;AAC5E,SAAO,SAAS,MAAM,IAAI,0CAA0C;AACtE;AAEA,eAAsB,mBACpB,SACA,OACA,QACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,QAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1H;AAEA,eAAsB,0BACpB,SACA,OACA,OACiB;AACjB,QAAM,UAA+C,EAAE,MAAM,MAAM,KAAK;AACxE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gCAAgC;AAAA,IACjF;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,qDAAqD,EAAE,KAAK,GAAG;AACzF,SAAO,SAAS,MAAM,IAAI,kDAAkD;AAC9E;AAEA,eAAsB,2BACpB,SACA,OACA,gBACe;AACf,MAAI,CAAC,SAAS,CAAC,eAAgB;AAC/B,QAAM,WAAW,SAAS,UAAU,gCAAgC;AAAA,IAClE;AAAA,IACA,MAAM,EAAE,IAAI,eAAe;AAAA,EAC7B,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAEA,eAAsB,mBACpB,SACA,OACA,OACe;AACf,QAAM,UAAmF;AAAA,IACvF,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,MAAM,kBAAkB,QAAW;AACrC,YAAQ,gBAAgB,MAAM;AAAA,EAChC;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,uBAAuB;AAAA,IACvE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA+B,QAAQ;AAC1D,SAAO,SAAS,OAAO,GAAG,2CAA2C,EAAE,KAAK,GAAG;AAC/E,SAAO,MAAM,IAAI,uCAAuC,EAAE,KAAK,IAAI;AACrE;AAEA,eAAsB,qBACpB,SACA,OACA,OACe;AACf,QAAM,UAAmF;AAAA,IACvF,QAAQ,MAAM;AAAA,IACd,eAAe,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,aAAa,QAAW;AAChC,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,uBAAuB;AAAA,IACvE;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,OAAO,MAAM,aAA+B,QAAQ;AAC1D,SAAO,SAAS,OAAO,GAAG,2CAA2C,EAAE,KAAK,GAAG;AAC/E,SAAO,MAAM,IAAI,uCAAuC,EAAE,KAAK,IAAI;AACrE;",
   "names": []
 }

package/dist/helpers/integration/communicationChannelsFixtures.js

@@ -0,0 +1,58 @@
+import { expect } from "@playwright/test";
+import { apiRequest } from "./api.js";
+import { expectId, readJsonSafe } from "./generalFixtures.js";
+const TEST_SEED_PATH = "/api/communication_channels/test-seed";
+async function isChannelSeedingAvailable(request, token) {
+  const response = await apiRequest(request, "POST", TEST_SEED_PATH, {
+    token,
+    data: { action: "__probe__" }
+  });
+  return response.status() !== 404;
+}
+async function seedConnectedChannel(request, token, input = {}) {
+  const response = await apiRequest(request, "POST", TEST_SEED_PATH, {
+    token,
+    data: { action: "connect-channel", ...input }
+  });
+  expect(
+    response.status(),
+    "POST /api/communication_channels/test-seed (connect-channel) should return 201"
+  ).toBe(201);
+  const body = await readJsonSafe(response);
+  return expectId(body?.channelId, "connect-channel response should include channelId");
+}
+async function seedInboundMessage(request, token, input) {
+  const response = await apiRequest(request, "POST", TEST_SEED_PATH, {
+    token,
+    data: { action: "emit-inbound", ...input }
+  });
+  expect(
+    response.status(),
+    "POST /api/communication_channels/test-seed (emit-inbound) should return 201"
+  ).toBe(201);
+  const body = await readJsonSafe(response);
+  return {
+    channelLinkId: expectId(body?.channelLinkId, "emit-inbound response should include channelLinkId"),
+    messageId: expectId(body?.messageId, "emit-inbound response should include messageId"),
+    conversationId: expectId(
+      body?.conversationId,
+      "emit-inbound response should include conversationId"
+    )
+  };
+}
+async function deleteChannelIfExists(request, token, channelId) {
+  if (!token || !channelId) return;
+  await apiRequest(
+    request,
+    "DELETE",
+    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,
+    { token }
+  ).catch(() => void 0);
+}
+export {
+  deleteChannelIfExists,
+  isChannelSeedingAvailable,
+  seedConnectedChannel,
+  seedInboundMessage
+};
+//# sourceMappingURL=communicationChannelsFixtures.js.map

package/dist/helpers/integration/communicationChannelsFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/communicationChannelsFixtures.ts"],
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n/**\n * Communication-channels integration fixtures.\n *\n * These drive the TEST-ONLY seed endpoint `POST /api/communication_channels/test-seed`,\n * which is gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` (inert/404 in production). Use\n * {@link isChannelSeedingAvailable} to skip tests when the gate is off rather than\n * failing them.\n */\n\nexport type SeedAddressField =\n  | string\n  | { address: string; name?: string }\n  | Array<string | { address: string; name?: string }>;\n\nconst TEST_SEED_PATH = '/api/communication_channels/test-seed';\n\n/**\n * Probe whether the env-gated test-seed endpoint is enabled in the target app.\n * Returns false when the route answers 404 (flag off) so callers can `test.skip`.\n * The caller's token must hold `communication_channels.connect_user_channel`.\n */\nexport async function isChannelSeedingAvailable(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  // A malformed body returns 422 when the gate is ON and 404 when it is OFF.\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: '__probe__' },\n  });\n  return response.status() !== 404;\n}\n\n/**\n * Seed a connected, network-free `__test_seed__` channel owned by the caller.\n * Returns the new channel id. Tear down with {@link deleteChannelIfExists}.\n */\nexport async function seedConnectedChannel(\n  request: APIRequestContext,\n  token: string,\n  input: { displayName?: string; externalIdentifier?: string } = {},\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'connect-channel', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (connect-channel) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{ channelId?: string }>(response);\n  return expectId(body?.channelId, 'connect-channel response should include channelId');\n}\n\n/**\n * Seed an inbound `MessageChannelLink` for `channelId` and emit\n * `communication_channels.message.received` through the real event bus. The\n * persistent customers link-channel-message-received subscriber is enqueued to\n * the `events` queue \u2014 drain it with `drainIntegrationQueue('events')`.\n *\n * Returns the created link + message ids (the message id is the platform\n * `messages.message` id, usable as `messageThreadId` to thread a follow-up).\n *\n * Pass `createThreadMapping: true` to also seed a `ChannelThreadMapping` for the\n * thread \u2014 required before exercising the reaction (`/messages/[id]/reactions`)\n * and thread-assign (`/threads/[id]/assign`) routes, which resolve the owning\n * channel through that mapping.\n */\nexport async function seedInboundMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    from?: SeedAddressField;\n    to?: SeedAddressField;\n    cc?: SeedAddressField;\n    subject?: string;\n    bodyText?: string;\n    messageId?: string;\n    inReplyTo?: string;\n    references?: string[];\n    messageThreadId?: string;\n    providerKey?: string;\n    createThreadMapping?: boolean;\n  },\n): Promise<{ channelLinkId: string; messageId: string; conversationId: string }> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'emit-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (emit-inbound) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    channelLinkId?: string;\n    messageId?: string;\n    conversationId?: string;\n  }>(response);\n  return {\n    channelLinkId: expectId(body?.channelLinkId, 'emit-inbound response should include channelLinkId'),\n    messageId: expectId(body?.messageId, 'emit-inbound response should include messageId'),\n    conversationId: expectId(\n      body?.conversationId,\n      'emit-inbound response should include conversationId',\n    ),\n  };\n}\n\n/**\n * Best-effort delete of a seeded channel via the owner-scoped DELETE route.\n * Safe to call with a null id in `finally`.\n */\nexport async function deleteChannelIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  channelId: string | null,\n): Promise<void> {\n  if (!token || !channelId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,\n    { token },\n  ).catch(() => undefined);\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAgBvC,MAAM,iBAAiB;AAOvB,eAAsB,0BACpB,SACA,OACkB;AAElB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO,SAAS,OAAO,MAAM;AAC/B;AAMA,eAAsB,qBACpB,SACA,OACA,QAA+D,CAAC,GAC/C;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EAC9C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,mDAAmD;AACtF;AAgBA,eAAsB,mBACpB,SACA,OACA,OAc+E;AAC/E,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,gBAAgB,GAAG,MAAM;AAAA,EAC3C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAIhB,QAAQ;AACX,SAAO;AAAA,IACL,eAAe,SAAS,MAAM,eAAe,oDAAoD;AAAA,IACjG,WAAW,SAAS,MAAM,WAAW,gDAAgD;AAAA,IACrF,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,UAAW;AAC1B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wCAAwC,mBAAmB,SAAS,CAAC;AAAA,IACrE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;",
+  "names": []
+}

package/dist/helpers/integration/crudFormFields.js

@@ -0,0 +1,33 @@
+import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+const CRUDFORM_EXTENSION_TESTS_DISABLED_ENV = "OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED";
+function crudFormExtensionTestsDisabled(env = process.env) {
+  return parseBooleanWithDefault(env[CRUDFORM_EXTENSION_TESTS_DISABLED_ENV], false);
+}
+function getCustomFieldValue(record, fieldName) {
+  const customValues = record.customValues;
+  if (customValues && typeof customValues === "object" && fieldName in customValues) {
+    return customValues[fieldName];
+  }
+  const prefixedUnderscore = record[`cf_${fieldName}`];
+  if (prefixedUnderscore !== void 0) return prefixedUnderscore;
+  const prefixedColon = record[`cf:${fieldName}`];
+  if (prefixedColon !== void 0) return prefixedColon;
+  const customFields = record.customFields;
+  if (Array.isArray(customFields)) {
+    const match = customFields.find((entry) => {
+      if (!entry || typeof entry !== "object") return false;
+      const candidate = entry;
+      return candidate.key === fieldName || candidate.id === fieldName || candidate.name === fieldName;
+    });
+    if (match && typeof match === "object") {
+      return match.value;
+    }
+  }
+  return void 0;
+}
+export {
+  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,
+  crudFormExtensionTestsDisabled,
+  getCustomFieldValue
+};
+//# sourceMappingURL=crudFormFields.js.map

package/dist/helpers/integration/crudFormFields.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/crudFormFields.ts"],
+  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean';\n\n/**\n * Pure, runner-agnostic helpers for the CrudForm field-persistence sweep (umbrella #2466).\n *\n * Kept free of any `@playwright/test` import so this logic is unit-testable under jest.\n * The Playwright harness (`crudFormPersistence.ts`) re-exports everything here.\n */\n\nexport const CRUDFORM_EXTENSION_TESTS_DISABLED_ENV = 'OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED';\n\nexport type CrudRecord = Record<string, unknown>;\n\n/**\n * Reads the sweep disable flag. Default `false` so the sweep runs unless explicitly turned off\n * via `OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED=1` (or `true`/`yes`/`on`).\n */\nexport function crudFormExtensionTestsDisabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  return parseBooleanWithDefault(env[CRUDFORM_EXTENSION_TESTS_DISABLED_ENV], false);\n}\n\n/**\n * Resolves a custom-field value from a CRUD response record, tolerating every shape the\n * platform emits: bare keys under `customValues`, top-level `cf_<name>` / `cf:<name>`, or a\n * `customFields` definition array carrying `value`. Returns `undefined` when absent.\n */\nexport function getCustomFieldValue(record: CrudRecord, fieldName: string): unknown {\n  const customValues = record.customValues;\n  if (customValues && typeof customValues === 'object' && fieldName in (customValues as CrudRecord)) {\n    return (customValues as CrudRecord)[fieldName];\n  }\n  const prefixedUnderscore = record[`cf_${fieldName}`];\n  if (prefixedUnderscore !== undefined) return prefixedUnderscore;\n  const prefixedColon = record[`cf:${fieldName}`];\n  if (prefixedColon !== undefined) return prefixedColon;\n  const customFields = record.customFields;\n  if (Array.isArray(customFields)) {\n    const match = customFields.find((entry) => {\n      if (!entry || typeof entry !== 'object') return false;\n      const candidate = entry as CrudRecord;\n      return candidate.key === fieldName || candidate.id === fieldName || candidate.name === fieldName;\n    });\n    if (match && typeof match === 'object') {\n      return (match as CrudRecord).value;\n    }\n  }\n  return undefined;\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AASjC,MAAM,wCAAwC;AAQ9C,SAAS,+BAA+B,MAAyB,QAAQ,KAAc;AAC5F,SAAO,wBAAwB,IAAI,qCAAqC,GAAG,KAAK;AAClF;AAOO,SAAS,oBAAoB,QAAoB,WAA4B;AAClF,QAAM,eAAe,OAAO;AAC5B,MAAI,gBAAgB,OAAO,iBAAiB,YAAY,aAAc,cAA6B;AACjG,WAAQ,aAA4B,SAAS;AAAA,EAC/C;AACA,QAAM,qBAAqB,OAAO,MAAM,SAAS,EAAE;AACnD,MAAI,uBAAuB,OAAW,QAAO;AAC7C,QAAM,gBAAgB,OAAO,MAAM,SAAS,EAAE;AAC9C,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,eAAe,OAAO;AAC5B,MAAI,MAAM,QAAQ,YAAY,GAAG;AAC/B,UAAM,QAAQ,aAAa,KAAK,CAAC,UAAU;AACzC,UAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,YAAM,YAAY;AAClB,aAAO,UAAU,QAAQ,aAAa,UAAU,OAAO,aAAa,UAAU,SAAS;AAAA,IACzF,CAAC;AACD,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,aAAQ,MAAqB;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/helpers/integration/crudFormPersistence.js

@@ -0,0 +1,107 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest } from "./api.js";
+import { expectId, readJsonSafe } from "./generalFixtures.js";
+import {
+  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,
+  crudFormExtensionTestsDisabled,
+  getCustomFieldValue
+} from "./crudFormFields.js";
+function skipIfCrudFormExtensionTestsDisabled() {
+  test.skip(
+    crudFormExtensionTestsDisabled(),
+    `${CRUDFORM_EXTENSION_TESTS_DISABLED_ENV} is set \u2014 CrudForm field-persistence sweep skipped`
+  );
+}
+function assertScalarFieldsPersisted(record, expected, label = "record") {
+  for (const [key, value] of Object.entries(expected)) {
+    expect(record[key], `${label}.${key} should persist`).toEqual(value);
+  }
+}
+function assertCustomFieldsPersisted(record, expected, label = "record") {
+  for (const [name, value] of Object.entries(expected)) {
+    expect(getCustomFieldValue(record, name), `${label} custom field "${name}" should persist`).toEqual(value);
+  }
+}
+async function safeText(response) {
+  try {
+    return (await response.text()).slice(0, 500);
+  } catch {
+    return "<unreadable body>";
+  }
+}
+async function defaultReadById(request, token, collectionPath, id) {
+  const separator = collectionPath.includes("?") ? "&" : "?";
+  const response = await apiRequest(
+    request,
+    "GET",
+    `${collectionPath}${separator}id=${encodeURIComponent(id)}&page=1&pageSize=100`,
+    { token }
+  );
+  expect(response.status(), `read-back ${collectionPath} failed: ${response.status()}`).toBe(200);
+  const body = await readJsonSafe(response);
+  if (Array.isArray(body?.items)) {
+    return body.items.find((item) => item.id === id) ?? null;
+  }
+  return body && body.id === id ? body : null;
+}
+async function runCrudFormRoundTrip(config) {
+  const { request, token, collectionPath } = config;
+  const read = config.readById ?? ((id2) => defaultReadById(request, token, collectionPath, id2));
+  let id = null;
+  try {
+    const createResponse = await apiRequest(request, "POST", collectionPath, {
+      token,
+      data: config.create.payload
+    });
+    expect(
+      createResponse.status(),
+      `create ${collectionPath} failed (${createResponse.status()}): ${await safeText(createResponse)}`
+    ).toBe(config.create.expectedStatus ?? 201);
+    const createBody = await readJsonSafe(createResponse) ?? {};
+    const rawId = config.idFromCreate ? config.idFromCreate(createBody) : createBody.id ?? createBody.entityId;
+    id = expectId(rawId, `create response should include an id (${collectionPath})`);
+    const afterCreate = await read(id);
+    expect(afterCreate, `created record ${id} should be readable from ${collectionPath}`).toBeTruthy();
+    if (config.expectAfterCreate.scalars) {
+      assertScalarFieldsPersisted(afterCreate, config.expectAfterCreate.scalars, "after-create");
+    }
+    if (config.expectAfterCreate.customFields) {
+      assertCustomFieldsPersisted(afterCreate, config.expectAfterCreate.customFields, "after-create");
+    }
+    const updateUrl = config.recordPath ? config.recordPath(id) : collectionPath;
+    const updateResponse = await apiRequest(request, "PUT", updateUrl, {
+      token,
+      data: config.update.payload(id)
+    });
+    expect(
+      updateResponse.status(),
+      `update ${collectionPath} failed (${updateResponse.status()}): ${await safeText(updateResponse)}`
+    ).toBe(config.update.expectedStatus ?? 200);
+    const afterUpdate = await read(id);
+    expect(afterUpdate, `updated record ${id} should be readable from ${collectionPath}`).toBeTruthy();
+    if (config.expectAfterUpdate.scalars) {
+      assertScalarFieldsPersisted(afterUpdate, config.expectAfterUpdate.scalars, "after-update");
+    }
+    if (config.expectAfterUpdate.customFields) {
+      assertCustomFieldsPersisted(afterUpdate, config.expectAfterUpdate.customFields, "after-update");
+    }
+  } finally {
+    if (id && config.cleanup !== false) {
+      const separator = collectionPath.includes("?") ? "&" : "?";
+      const deleteUrl = config.recordPath ? config.recordPath(id) : `${collectionPath}${separator}id=${encodeURIComponent(id)}`;
+      await apiRequest(request, "DELETE", deleteUrl, {
+        token
+      }).catch(() => void 0);
+    }
+  }
+}
+export {
+  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,
+  assertCustomFieldsPersisted,
+  assertScalarFieldsPersisted,
+  crudFormExtensionTestsDisabled,
+  getCustomFieldValue,
+  runCrudFormRoundTrip,
+  skipIfCrudFormExtensionTestsDisabled
+};
+//# sourceMappingURL=crudFormPersistence.js.map

package/dist/helpers/integration/crudFormPersistence.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/crudFormPersistence.ts"],
+  "sourcesContent": ["import { expect, test, type APIRequestContext, type APIResponse } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\nimport {\n  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,\n  crudFormExtensionTestsDisabled,\n  getCustomFieldValue,\n  type CrudRecord,\n} from './crudFormFields';\n\n/**\n * Playwright harness for the CrudForm field-persistence sweep (umbrella #2466).\n *\n * Every spec proves a CrudForm surface saves AND reloads every field type \u2014 scalars,\n * dictionary references, multiselect/array values, and **custom fields** \u2014 on both create\n * and update.\n *\n * The whole sweep is gated by `OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED`\n * (default `false` \u2192 tests run). When set truthy the specs `test.skip()` themselves, so the\n * sweep can be disabled wholesale without deleting any spec.\n */\n\nexport {\n  CRUDFORM_EXTENSION_TESTS_DISABLED_ENV,\n  crudFormExtensionTestsDisabled,\n  getCustomFieldValue,\n  type CrudRecord,\n};\n\n/**\n * Call inside `test.beforeAll` (or a test body) to skip the spec when the sweep is disabled.\n * Uses Playwright's `test.skip(condition, reason)` so the spec is reported as skipped, not failed.\n */\nexport function skipIfCrudFormExtensionTestsDisabled(): void {\n  test.skip(\n    crudFormExtensionTestsDisabled(),\n    `${CRUDFORM_EXTENSION_TESTS_DISABLED_ENV} is set \u2014 CrudForm field-persistence sweep skipped`,\n  );\n}\n\n/** Asserts each expected scalar field round-tripped (deep equality so arrays/objects work). */\nexport function assertScalarFieldsPersisted(record: CrudRecord, expected: CrudRecord, label = 'record'): void {\n  for (const [key, value] of Object.entries(expected)) {\n    expect(record[key], `${label}.${key} should persist`).toEqual(value);\n  }\n}\n\n/** Asserts each expected custom field round-tripped, regardless of response shape. */\nexport function assertCustomFieldsPersisted(record: CrudRecord, expected: CrudRecord, label = 'record'): void {\n  for (const [name, value] of Object.entries(expected)) {\n    expect(getCustomFieldValue(record, name), `${label} custom field \"${name}\" should persist`).toEqual(value);\n  }\n}\n\nasync function safeText(response: APIResponse): Promise<string> {\n  try {\n    return (await response.text()).slice(0, 500);\n  } catch {\n    return '<unreadable body>';\n  }\n}\n\nexport type CrudFormExpectation = {\n  scalars?: CrudRecord;\n  customFields?: CrudRecord;\n};\n\nexport type CrudFormRoundTripConfig = {\n  request: APIRequestContext;\n  token: string;\n  /** Collection route handling POST (and, without `recordPath`, the collection-style PUT/DELETE and `?id=` list GET), e.g. `/api/currencies/currencies`. */\n  collectionPath: string;\n  create: { payload: CrudRecord; expectedStatus?: number };\n  /** Build the PUT body from the created id. For makeCrud collection routes include the id the route expects; for `recordPath` (detail) routes the id is taken from the path. */\n  update: { payload: (id: string) => CrudRecord; expectedStatus?: number };\n  expectAfterCreate: CrudFormExpectation;\n  expectAfterUpdate: CrudFormExpectation;\n  /** Override id extraction from the create response (default: `id` ?? `entityId`). */\n  idFromCreate?: (body: CrudRecord) => string;\n  /** Override read-back (default: list `?id=` and match on `id`). Useful for detail-GET routes. */\n  readById?: (id: string) => Promise<CrudRecord | null>;\n  /**\n   * For hand-written detail routes (Tier B) where update + delete target `<collection>/:id`\n   * (id in the path) instead of the makeCrud collection verbs (`PUT <collection>` with the id in\n   * the body, `DELETE <collection>?id=`). When provided, the update PUT and the cleanup DELETE both\n   * use `recordPath(id)` verbatim (no `?id=` is appended); read-back still goes through `readById`.\n   * Defaults to the makeCrud collection-verb behavior so existing specs are unaffected.\n   */\n  recordPath?: (id: string) => string;\n  /** Delete the fixture in `finally` (default true). */\n  cleanup?: boolean;\n};\n\nasync function defaultReadById(\n  request: APIRequestContext,\n  token: string,\n  collectionPath: string,\n  id: string,\n): Promise<CrudRecord | null> {\n  const separator = collectionPath.includes('?') ? '&' : '?';\n  const response = await apiRequest(\n    request,\n    'GET',\n    `${collectionPath}${separator}id=${encodeURIComponent(id)}&page=1&pageSize=100`,\n    { token },\n  );\n  expect(response.status(), `read-back ${collectionPath} failed: ${response.status()}`).toBe(200);\n  const body = await readJsonSafe<{ items?: CrudRecord[] } & CrudRecord>(response);\n  if (Array.isArray(body?.items)) {\n    return body!.items.find((item) => item.id === id) ?? null;\n  }\n  // Detail routes may return the record directly.\n  return body && body.id === id ? (body as CrudRecord) : null;\n}\n\n/**\n * Runs the canonical create \u2192 read-back \u2192 assert \u2192 update \u2192 read-back \u2192 assert \u2192 delete\n * cycle for a makeCrud collection route and asserts every declared field persisted.\n */\nexport async function runCrudFormRoundTrip(config: CrudFormRoundTripConfig): Promise<void> {\n  const { request, token, collectionPath } = config;\n  const read = config.readById ?? ((id: string) => defaultReadById(request, token, collectionPath, id));\n  let id: string | null = null;\n\n  try {\n    const createResponse = await apiRequest(request, 'POST', collectionPath, {\n      token,\n      data: config.create.payload,\n    });\n    expect(\n      createResponse.status(),\n      `create ${collectionPath} failed (${createResponse.status()}): ${await safeText(createResponse)}`,\n    ).toBe(config.create.expectedStatus ?? 201);\n    const createBody = (await readJsonSafe<CrudRecord>(createResponse)) ?? {};\n    const rawId = config.idFromCreate\n      ? config.idFromCreate(createBody)\n      : (createBody.id ?? createBody.entityId);\n    id = expectId(rawId, `create response should include an id (${collectionPath})`);\n\n    const afterCreate = await read(id);\n    expect(afterCreate, `created record ${id} should be readable from ${collectionPath}`).toBeTruthy();\n    if (config.expectAfterCreate.scalars) {\n      assertScalarFieldsPersisted(afterCreate as CrudRecord, config.expectAfterCreate.scalars, 'after-create');\n    }\n    if (config.expectAfterCreate.customFields) {\n      assertCustomFieldsPersisted(afterCreate as CrudRecord, config.expectAfterCreate.customFields, 'after-create');\n    }\n\n    const updateUrl = config.recordPath ? config.recordPath(id) : collectionPath;\n    const updateResponse = await apiRequest(request, 'PUT', updateUrl, {\n      token,\n      data: config.update.payload(id),\n    });\n    expect(\n      updateResponse.status(),\n      `update ${collectionPath} failed (${updateResponse.status()}): ${await safeText(updateResponse)}`,\n    ).toBe(config.update.expectedStatus ?? 200);\n\n    const afterUpdate = await read(id);\n    expect(afterUpdate, `updated record ${id} should be readable from ${collectionPath}`).toBeTruthy();\n    if (config.expectAfterUpdate.scalars) {\n      assertScalarFieldsPersisted(afterUpdate as CrudRecord, config.expectAfterUpdate.scalars, 'after-update');\n    }\n    if (config.expectAfterUpdate.customFields) {\n      assertCustomFieldsPersisted(afterUpdate as CrudRecord, config.expectAfterUpdate.customFields, 'after-update');\n    }\n  } finally {\n    if (id && config.cleanup !== false) {\n      const separator = collectionPath.includes('?') ? '&' : '?';\n      const deleteUrl = config.recordPath\n        ? config.recordPath(id)\n        : `${collectionPath}${separator}id=${encodeURIComponent(id)}`;\n      await apiRequest(request, 'DELETE', deleteUrl, {\n        token,\n      }).catch(() => undefined);\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAsD;AACvE,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAyBA,SAAS,uCAA6C;AAC3D,OAAK;AAAA,IACH,+BAA+B;AAAA,IAC/B,GAAG,qCAAqC;AAAA,EAC1C;AACF;AAGO,SAAS,4BAA4B,QAAoB,UAAsB,QAAQ,UAAgB;AAC5G,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,WAAO,OAAO,GAAG,GAAG,GAAG,KAAK,IAAI,GAAG,iBAAiB,EAAE,QAAQ,KAAK;AAAA,EACrE;AACF;AAGO,SAAS,4BAA4B,QAAoB,UAAsB,QAAQ,UAAgB;AAC5G,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACpD,WAAO,oBAAoB,QAAQ,IAAI,GAAG,GAAG,KAAK,kBAAkB,IAAI,kBAAkB,EAAE,QAAQ,KAAK;AAAA,EAC3G;AACF;AAEA,eAAe,SAAS,UAAwC;AAC9D,MAAI;AACF,YAAQ,MAAM,SAAS,KAAK,GAAG,MAAM,GAAG,GAAG;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiCA,eAAe,gBACb,SACA,OACA,gBACA,IAC4B;AAC5B,QAAM,YAAY,eAAe,SAAS,GAAG,IAAI,MAAM;AACvD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,GAAG,cAAc,GAAG,SAAS,MAAM,mBAAmB,EAAE,CAAC;AAAA,IACzD,EAAE,MAAM;AAAA,EACV;AACA,SAAO,SAAS,OAAO,GAAG,aAAa,cAAc,YAAY,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAC9F,QAAM,OAAO,MAAM,aAAoD,QAAQ;AAC/E,MAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AAC9B,WAAO,KAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,KAAK;AAAA,EACvD;AAEA,SAAO,QAAQ,KAAK,OAAO,KAAM,OAAsB;AACzD;AAMA,eAAsB,qBAAqB,QAAgD;AACzF,QAAM,EAAE,SAAS,OAAO,eAAe,IAAI;AAC3C,QAAM,OAAO,OAAO,aAAa,CAACA,QAAe,gBAAgB,SAAS,OAAO,gBAAgBA,GAAE;AACnG,MAAI,KAAoB;AAExB,MAAI;AACF,UAAM,iBAAiB,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,MACvE;AAAA,MACA,MAAM,OAAO,OAAO;AAAA,IACtB,CAAC;AACD;AAAA,MACE,eAAe,OAAO;AAAA,MACtB,UAAU,cAAc,YAAY,eAAe,OAAO,CAAC,MAAM,MAAM,SAAS,cAAc,CAAC;AAAA,IACjG,EAAE,KAAK,OAAO,OAAO,kBAAkB,GAAG;AAC1C,UAAM,aAAc,MAAM,aAAyB,cAAc,KAAM,CAAC;AACxE,UAAM,QAAQ,OAAO,eACjB,OAAO,aAAa,UAAU,IAC7B,WAAW,MAAM,WAAW;AACjC,SAAK,SAAS,OAAO,yCAAyC,cAAc,GAAG;AAE/E,UAAM,cAAc,MAAM,KAAK,EAAE;AACjC,WAAO,aAAa,kBAAkB,EAAE,4BAA4B,cAAc,EAAE,EAAE,WAAW;AACjG,QAAI,OAAO,kBAAkB,SAAS;AACpC,kCAA4B,aAA2B,OAAO,kBAAkB,SAAS,cAAc;AAAA,IACzG;AACA,QAAI,OAAO,kBAAkB,cAAc;AACzC,kCAA4B,aAA2B,OAAO,kBAAkB,cAAc,cAAc;AAAA,IAC9G;AAEA,UAAM,YAAY,OAAO,aAAa,OAAO,WAAW,EAAE,IAAI;AAC9D,UAAM,iBAAiB,MAAM,WAAW,SAAS,OAAO,WAAW;AAAA,MACjE;AAAA,MACA,MAAM,OAAO,OAAO,QAAQ,EAAE;AAAA,IAChC,CAAC;AACD;AAAA,MACE,eAAe,OAAO;AAAA,MACtB,UAAU,cAAc,YAAY,eAAe,OAAO,CAAC,MAAM,MAAM,SAAS,cAAc,CAAC;AAAA,IACjG,EAAE,KAAK,OAAO,OAAO,kBAAkB,GAAG;AAE1C,UAAM,cAAc,MAAM,KAAK,EAAE;AACjC,WAAO,aAAa,kBAAkB,EAAE,4BAA4B,cAAc,EAAE,EAAE,WAAW;AACjG,QAAI,OAAO,kBAAkB,SAAS;AACpC,kCAA4B,aAA2B,OAAO,kBAAkB,SAAS,cAAc;AAAA,IACzG;AACA,QAAI,OAAO,kBAAkB,cAAc;AACzC,kCAA4B,aAA2B,OAAO,kBAAkB,cAAc,cAAc;AAAA,IAC9G;AAAA,EACF,UAAE;AACA,QAAI,MAAM,OAAO,YAAY,OAAO;AAClC,YAAM,YAAY,eAAe,SAAS,GAAG,IAAI,MAAM;AACvD,YAAM,YAAY,OAAO,aACrB,OAAO,WAAW,EAAE,IACpB,GAAG,cAAc,GAAG,SAAS,MAAM,mBAAmB,EAAE,CAAC;AAC7D,YAAM,WAAW,SAAS,UAAU,WAAW;AAAA,QAC7C;AAAA,MACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AACF;",
+  "names": ["id"]
+}

package/dist/helpers/integration/currenciesFixtures.js

@@ -1,4 +1,5 @@
 import { expect } from "@playwright/test";
+import { randomInt } from "node:crypto";
 import { apiRequest } from "./api.js";
 import { getTokenContext } from "./generalFixtures.js";
 async function createCurrencyFixture(request, token, input) {
@@ -12,6 +13,54 @@ async function createCurrencyFixture(request, token, input) {
   expect(typeof body.id === "string" && body.id.length > 0).toBeTruthy();
   return body.id;
 }
+const SEEDED_CURRENCY_CODES = /* @__PURE__ */ new Set([
+  "USD",
+  "EUR",
+  "JPY",
+  "GBP",
+  "CHF",
+  "CAD",
+  "AUD",
+  "CNY",
+  "CNH",
+  "PLN"
+]);
+const reservedCurrencyCodes = /* @__PURE__ */ new Set();
+function generateUniqueCurrencyCode() {
+  const letter = () => String.fromCharCode(65 + randomInt(26));
+  for (let attempt = 0; attempt < 200; attempt += 1) {
+    const code = `${letter()}${letter()}${letter()}`;
+    if (!SEEDED_CURRENCY_CODES.has(code) && !reservedCurrencyCodes.has(code)) {
+      reservedCurrencyCodes.add(code);
+      return code;
+    }
+  }
+  throw new Error("[internal] exhausted unique currency code space");
+}
+async function createRandomCurrencyFixture(request, token, input) {
+  const { organizationId, tenantId } = getTokenContext(token);
+  let lastStatus = 0;
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    const code = generateUniqueCurrencyCode();
+    const data = {
+      organizationId,
+      tenantId,
+      code,
+      name: input.name,
+      symbol: input.symbol ?? null
+    };
+    if (typeof input.isActive === "boolean") data.isActive = input.isActive;
+    const response = await apiRequest(request, "POST", "/api/currencies/currencies", { token, data });
+    if (response.status() === 201) {
+      const body = await response.json();
+      if (typeof body.id === "string" && body.id.length > 0) {
+        return { id: body.id, code };
+      }
+    }
+    lastStatus = response.status();
+  }
+  throw new Error(`[internal] failed to create currency fixture after retries (last status ${lastStatus})`);
+}
 async function createFetchConfigFixture(request, token, input) {
   const response = await apiRequest(request, "POST", "/api/currencies/fetch-configs", {
     token,
@@ -34,6 +83,8 @@ async function deleteCurrenciesEntityIfExists(request, token, path, id) {
 export {
   createCurrencyFixture,
   createFetchConfigFixture,
-  deleteCurrenciesEntityIfExists
+  createRandomCurrencyFixture,
+  deleteCurrenciesEntityIfExists,
+  generateUniqueCurrencyCode
 };
 //# sourceMappingURL=currenciesFixtures.js.map

package/dist/helpers/integration/currenciesFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/currenciesFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { getTokenContext } from './generalFixtures';\n\nexport async function createCurrencyFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { code: string; name: string; symbol?: string },\n): Promise<string> {\n  const { organizationId, tenantId } = getTokenContext(token);\n  const response = await apiRequest(request, 'POST', '/api/currencies/currencies', {\n    token,\n    data: { organizationId, tenantId, code: input.code, name: input.name, symbol: input.symbol ?? null },\n  });\n  expect(response.ok(), `Failed to create currency fixture: ${response.status()}`).toBeTruthy();\n  const body = (await response.json()) as { id?: string };\n  expect(typeof body.id === 'string' && body.id.length > 0).toBeTruthy();\n  return body.id as string;\n}\n\nexport async function createFetchConfigFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { provider: string; isEnabled: boolean },\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', '/api/currencies/fetch-configs', {\n    token,\n    data: input,\n  });\n  expect(response.ok(), `Failed to create fetch config fixture: ${response.status()}`).toBeTruthy();\n  const body = (await response.json()) as { config?: { id?: string } };\n  const id = body.config?.id;\n  expect(typeof id === 'string' && id.length > 0).toBeTruthy();\n  return id as string;\n}\n\nexport async function deleteCurrenciesEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAEhC,eAAsB,sBACpB,SACA,OACA,OACiB;AACjB,QAAM,EAAE,gBAAgB,SAAS,IAAI,gBAAgB,KAAK;AAC1D,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,8BAA8B;AAAA,IAC/E;AAAA,IACA,MAAM,EAAE,gBAAgB,UAAU,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,KAAK;AAAA,EACrG,CAAC;AACD,SAAO,SAAS,GAAG,GAAG,sCAAsC,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC5F,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW;AACrE,SAAO,KAAK;AACd;AAEA,eAAsB,yBACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iCAAiC;AAAA,IAClF;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,SAAO,SAAS,GAAG,GAAG,0CAA0C,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAChG,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,QAAM,KAAK,KAAK,QAAQ;AACxB,SAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,EAAE,WAAW;AAC3D,SAAO;AACT;AAEA,eAAsB,+BACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { randomInt } from 'node:crypto';\nimport { apiRequest } from './api';\nimport { getTokenContext } from './generalFixtures';\n\nexport async function createCurrencyFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { code: string; name: string; symbol?: string },\n): Promise<string> {\n  const { organizationId, tenantId } = getTokenContext(token);\n  const response = await apiRequest(request, 'POST', '/api/currencies/currencies', {\n    token,\n    data: { organizationId, tenantId, code: input.code, name: input.name, symbol: input.symbol ?? null },\n  });\n  expect(response.ok(), `Failed to create currency fixture: ${response.status()}`).toBeTruthy();\n  const body = (await response.json()) as { id?: string };\n  expect(typeof body.id === 'string' && body.id.length > 0).toBeTruthy();\n  return body.id as string;\n}\n\n// Codes seeded by the currencies module (seedExampleCurrencies). Generated test\n// codes avoid these so fixtures never collide with seeded rows.\nconst SEEDED_CURRENCY_CODES = new Set([\n  'USD', 'EUR', 'JPY', 'GBP', 'CHF', 'CAD', 'AUD', 'CNY', 'CNH', 'PLN',\n]);\n// Reserved across the worker so two fixtures never draw the same code in one run.\nconst reservedCurrencyCodes = new Set<string>();\n\n/** Draws an ISO-style three-letter code unused by seeds or earlier fixtures. */\nexport function generateUniqueCurrencyCode(): string {\n  const letter = () => String.fromCharCode(65 + randomInt(26));\n  for (let attempt = 0; attempt < 200; attempt += 1) {\n    const code = `${letter()}${letter()}${letter()}`;\n    if (!SEEDED_CURRENCY_CODES.has(code) && !reservedCurrencyCodes.has(code)) {\n      reservedCurrencyCodes.add(code);\n      return code;\n    }\n  }\n  throw new Error('[internal] exhausted unique currency code space');\n}\n\n/**\n * Creates a currency with a generated unique code and returns its id and code.\n *\n * Currency DELETE is a soft delete, but the (organization, tenant, code) unique\n * constraint still counts soft-deleted rows \u2014 re-using a code an earlier test\n * soft-deleted makes the create fail. Drawing from the full three-letter space\n * (minus seeds) and retrying with a fresh code on an accidental collision keeps\n * fixture setup deterministic across runs that share a database.\n */\nexport async function createRandomCurrencyFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; symbol?: string; isActive?: boolean },\n): Promise<{ id: string; code: string }> {\n  const { organizationId, tenantId } = getTokenContext(token);\n  let lastStatus = 0;\n  for (let attempt = 0; attempt < 8; attempt += 1) {\n    const code = generateUniqueCurrencyCode();\n    const data: Record<string, unknown> = {\n      organizationId,\n      tenantId,\n      code,\n      name: input.name,\n      symbol: input.symbol ?? null,\n    };\n    if (typeof input.isActive === 'boolean') data.isActive = input.isActive;\n    const response = await apiRequest(request, 'POST', '/api/currencies/currencies', { token, data });\n    if (response.status() === 201) {\n      const body = (await response.json()) as { id?: string };\n      if (typeof body.id === 'string' && body.id.length > 0) {\n        return { id: body.id, code };\n      }\n    }\n    lastStatus = response.status();\n  }\n  throw new Error(`[internal] failed to create currency fixture after retries (last status ${lastStatus})`);\n}\n\nexport async function createFetchConfigFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { provider: string; isEnabled: boolean },\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', '/api/currencies/fetch-configs', {\n    token,\n    data: input,\n  });\n  expect(response.ok(), `Failed to create fetch config fixture: ${response.status()}`).toBeTruthy();\n  const body = (await response.json()) as { config?: { id?: string } };\n  const id = body.config?.id;\n  expect(typeof id === 'string' && id.length > 0).toBeTruthy();\n  return id as string;\n}\n\nexport async function deleteCurrenciesEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAEhC,eAAsB,sBACpB,SACA,OACA,OACiB;AACjB,QAAM,EAAE,gBAAgB,SAAS,IAAI,gBAAgB,KAAK;AAC1D,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,8BAA8B;AAAA,IAC/E;AAAA,IACA,MAAM,EAAE,gBAAgB,UAAU,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,KAAK;AAAA,EACrG,CAAC;AACD,SAAO,SAAS,GAAG,GAAG,sCAAsC,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC5F,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW;AACrE,SAAO,KAAK;AACd;AAIA,MAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AACjE,CAAC;AAED,MAAM,wBAAwB,oBAAI,IAAY;AAGvC,SAAS,6BAAqC;AACnD,QAAM,SAAS,MAAM,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;AAC3D,WAAS,UAAU,GAAG,UAAU,KAAK,WAAW,GAAG;AACjD,UAAM,OAAO,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC;AAC9C,QAAI,CAAC,sBAAsB,IAAI,IAAI,KAAK,CAAC,sBAAsB,IAAI,IAAI,GAAG;AACxE,4BAAsB,IAAI,IAAI;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAWA,eAAsB,4BACpB,SACA,OACA,OACuC;AACvC,QAAM,EAAE,gBAAgB,SAAS,IAAI,gBAAgB,KAAK;AAC1D,MAAI,aAAa;AACjB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,OAAO,2BAA2B;AACxC,UAAM,OAAgC;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,QAAQ,MAAM,UAAU;AAAA,IAC1B;AACA,QAAI,OAAO,MAAM,aAAa,UAAW,MAAK,WAAW,MAAM;AAC/D,UAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,8BAA8B,EAAE,OAAO,KAAK,CAAC;AAChG,QAAI,SAAS,OAAO,MAAM,KAAK;AAC7B,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,UAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,SAAS,GAAG;AACrD,eAAO,EAAE,IAAI,KAAK,IAAI,KAAK;AAAA,MAC7B;AAAA,IACF;AACA,iBAAa,SAAS,OAAO;AAAA,EAC/B;AACA,QAAM,IAAI,MAAM,2EAA2E,UAAU,GAAG;AAC1G;AAEA,eAAsB,yBACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iCAAiC;AAAA,IAClF;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,SAAO,SAAS,GAAG,GAAG,0CAA0C,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAChG,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,QAAM,KAAK,KAAK,QAAQ;AACxB,SAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,EAAE,WAAW;AAC3D,SAAO;AACT;AAEA,eAAsB,+BACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/helpers/integration/customerAccountsFixtures.js

@@ -0,0 +1,124 @@
+import { expect } from "@playwright/test";
+import { randomUUID } from "node:crypto";
+import { apiRequest } from "./api.js";
+import { expectId, readJsonSafe } from "./generalFixtures.js";
+function uniqueSuffix() {
+  return randomUUID().replace(/-/g, "").slice(0, 12);
+}
+function customerTestPassword() {
+  return `Aa1!${uniqueSuffix()}`;
+}
+async function createCustomerRoleFixture(request, adminToken, input = {}) {
+  const suffix = uniqueSuffix();
+  const name = input.name ?? `QA Portal Role ${suffix}`;
+  const slug = input.slug ?? `qa-portal-role-${suffix}`;
+  const createRes = await apiRequest(request, "POST", "/api/customer_accounts/admin/roles", {
+    token: adminToken,
+    data: {
+      name,
+      slug,
+      description: "Integration fixture role",
+      customerAssignable: input.customerAssignable ?? false
+    }
+  });
+  expect(createRes.status(), "POST /admin/roles should return 201").toBe(201);
+  const body = await readJsonSafe(createRes);
+  const id = expectId(body?.role?.id, "Role creation response should include role.id");
+  if (input.features || typeof input.isPortalAdmin === "boolean") {
+    await setCustomerRoleAcl(request, adminToken, id, {
+      features: input.features ?? [],
+      isPortalAdmin: input.isPortalAdmin
+    });
+  }
+  return { id, name, slug };
+}
+async function setCustomerRoleAcl(request, adminToken, roleId, input) {
+  const data = { features: input.features };
+  if (typeof input.isPortalAdmin === "boolean") data.isPortalAdmin = input.isPortalAdmin;
+  const res = await apiRequest(request, "PUT", `/api/customer_accounts/admin/roles/${roleId}/acl`, {
+    token: adminToken,
+    data
+  });
+  expect(res.status(), "PUT /admin/roles/[id]/acl should return 200").toBe(200);
+}
+async function createCustomerCompanyFixture(request, adminToken, displayName) {
+  const name = displayName ?? `QA Portal Company ${uniqueSuffix()}`;
+  const res = await apiRequest(request, "POST", "/api/customers/companies", {
+    token: adminToken,
+    data: { displayName: name }
+  });
+  expect(res.status(), "POST /customers/companies should return 201").toBe(201);
+  const body = await readJsonSafe(res);
+  return expectId(body?.id ?? body?.entityId, "Company creation response should include the entity id");
+}
+async function deleteCustomerCompanyFixture(request, adminToken, companyEntityId) {
+  if (!adminToken || !companyEntityId) return;
+  await apiRequest(request, "DELETE", `/api/customers/companies?id=${companyEntityId}`, {
+    token: adminToken
+  }).catch(() => void 0);
+}
+async function createCustomerUserFixture(request, adminToken, input = {}) {
+  const suffix = uniqueSuffix();
+  const email = input.email ?? `qa-portal-${suffix}@test.local`;
+  const password = input.password ?? customerTestPassword();
+  const displayName = input.displayName ?? `QA Portal User ${suffix}`;
+  const data = { email, password, displayName };
+  if (input.roleIds && input.roleIds.length > 0) data.roleIds = input.roleIds;
+  if (input.customerEntityId) data.customerEntityId = input.customerEntityId;
+  const res = await apiRequest(request, "POST", "/api/customer_accounts/admin/users", {
+    token: adminToken,
+    data
+  });
+  expect(res.status(), "POST /admin/users should return 201").toBe(201);
+  const body = await readJsonSafe(res);
+  const id = expectId(body?.user?.id, "User creation response should include user.id");
+  return { id, email, password, displayName, customerEntityId: input.customerEntityId ?? null };
+}
+function portalCookieHeaders(session, extra) {
+  return { Cookie: session.cookieHeader, ...extra ?? {} };
+}
+async function portalLogin(request, input) {
+  const res = await request.post("/api/customer_accounts/login", {
+    data: { email: input.email, password: input.password, tenantId: input.tenantId },
+    headers: { "Content-Type": "application/json" }
+  });
+  expect(res.ok(), `portal login should succeed (status ${res.status()})`).toBeTruthy();
+  const setCookie = res.headers()["set-cookie"] ?? "";
+  const authMatch = setCookie.match(/customer_auth_token=([^;]+)/);
+  const sessionMatch = setCookie.match(/customer_session_token=([^;]+)/);
+  expect(authMatch, "login must set customer_auth_token").toBeTruthy();
+  expect(sessionMatch, "login must set customer_session_token").toBeTruthy();
+  const authToken = authMatch[1];
+  const sessionToken = sessionMatch[1];
+  return {
+    authToken,
+    sessionToken,
+    cookieHeader: `customer_auth_token=${authToken}; customer_session_token=${sessionToken}`
+  };
+}
+async function deleteCustomerUserFixture(request, adminToken, userId) {
+  if (!adminToken || !userId) return;
+  await apiRequest(request, "DELETE", `/api/customer_accounts/admin/users/${userId}`, {
+    token: adminToken
+  }).catch(() => void 0);
+}
+async function deleteCustomerRoleFixture(request, adminToken, roleId) {
+  if (!adminToken || !roleId) return;
+  await apiRequest(request, "DELETE", `/api/customer_accounts/admin/roles/${roleId}`, {
+    token: adminToken
+  }).catch(() => void 0);
+}
+export {
+  createCustomerCompanyFixture,
+  createCustomerRoleFixture,
+  createCustomerUserFixture,
+  customerTestPassword,
+  deleteCustomerCompanyFixture,
+  deleteCustomerRoleFixture,
+  deleteCustomerUserFixture,
+  portalCookieHeaders,
+  portalLogin,
+  setCustomerRoleAcl,
+  uniqueSuffix
+};
+//# sourceMappingURL=customerAccountsFixtures.js.map