@selvajs/server 1.2.0 → 1.3.0

package/dist/testing/harness.js

@@ -0,0 +1,314 @@
+/**
+ * A host-agnostic harness for testing API handlers.
+ *
+ * Handlers are transport-free, but the tests around them were not: they built
+ * a SvelteKit `RequestEvent` and imported the Selva app's fixtures, so a second
+ * host could run the handlers and inherit none of the tests proving they work.
+ * That is the duplication this removes — a host wires a `TestHarness` once and
+ * gets the shared suites.
+ *
+ * Two things stay injected because no interface supplies them:
+ *   - {@link SeedAuthAdapter}, since identity has no portable creation method.
+ *   - `mapError`, since folding a host's own domain errors into the envelope is
+ *     by definition host-specific. Omitting it is not neutral: a host whose
+ *     guards throw something `runHandler` does not recognize gets a 500 where
+ *     production returns 403, and every status assertion silently weakens.
+ */
+import { randomUUID } from 'node:crypto';
+import { SYSTEM_CONTEXT, DEFAULT_ORG_PERMISSIONS, DEFAULT_SHARE_LINK_MAX_SOLVES, emptyProfile } from '@selvajs/platform';
+import { depsFromConfig, runHandler } from '../api/index.js';
+/**
+ * Swallows output unless `LOUD=1`.
+ *
+ * `runHandler` logs through `req.log` on the 500 path. Without a logger a test
+ * that trips an unexpected 500 dies inside the error handler itself, which
+ * hides the error that caused it.
+ */
+export const silentLog = {
+    error: (...args) => {
+        if (process.env.LOUD)
+            console.error('[test log]', ...args);
+    },
+    warn: () => { },
+    info: () => { },
+    debug: () => { },
+    child: () => silentLog
+};
+export async function seedUser(h, email, platformPermissions = []) {
+    // Identity row then data-layer row, in that order — the sequence production
+    // runs through its auth hook. Reversing it leaves a data row keyed to an id
+    // no identity claims.
+    const u = await h.auth.createUser(email);
+    await h.config.data.ensureUser(SYSTEM_CONTEXT, u.id);
+    if (platformPermissions.length > 0) {
+        await h.config.data.permissions.set(SYSTEM_CONTEXT, u.id, platformPermissions);
+    }
+    // `AuthUser.email` is optional — a header-auth provider need not report one.
+    // The seeded email is the caller's own input, so hand that back rather than
+    // widening every test's `email` to `string | undefined`.
+    return { id: u.id, email };
+}
+export async function seedOrg(h, opts) {
+    const now = new Date().toISOString();
+    const org = {
+        id: randomUUID(),
+        name: opts.name,
+        slug: opts.slug,
+        ownerId: opts.ownerId,
+        createdBy: opts.ownerId,
+        updatedBy: opts.ownerId,
+        createdAt: now,
+        updatedAt: now,
+        deletedAt: null
+    };
+    await h.config.data.orgs.createOrg(SYSTEM_CONTEXT, org);
+    return org;
+}
+export async function seedOrgMember(h, opts) {
+    const now = new Date().toISOString();
+    const member = {
+        orgId: opts.orgId,
+        userId: opts.userId,
+        role: opts.role,
+        permissions: opts.permissions ?? [...DEFAULT_ORG_PERMISSIONS[opts.role]],
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: opts.userId,
+        deletedAt: null
+    };
+    await h.config.data.orgs.addOrgMember(SYSTEM_CONTEXT, member);
+    return member;
+}
+export async function seedProject(h, opts) {
+    const now = new Date().toISOString();
+    const project = {
+        id: randomUUID(),
+        orgId: opts.orgId,
+        name: opts.name,
+        slug: opts.slug,
+        visibility: opts.visibility ?? 'private',
+        ownerId: opts.ownerId,
+        createdBy: opts.ownerId,
+        updatedBy: opts.ownerId,
+        autoJoinOnUpload: opts.autoJoinOnUpload ?? false,
+        createdAt: now,
+        updatedAt: now,
+        deletedAt: null
+    };
+    await h.config.data.projects.createProject(SYSTEM_CONTEXT, project);
+    await h.config.data.projects.addProjectMember(SYSTEM_CONTEXT, {
+        projectId: project.id,
+        userId: opts.ownerId,
+        role: 'owner',
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: opts.ownerId,
+        deletedAt: null
+    });
+    return project;
+}
+export async function seedProjectMember(h, opts) {
+    const now = new Date().toISOString();
+    const member = {
+        projectId: opts.projectId,
+        userId: opts.userId,
+        role: opts.role,
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: opts.userId,
+        deletedAt: null
+    };
+    await h.config.data.projects.addProjectMember(SYSTEM_CONTEXT, member);
+    return member;
+}
+/**
+ * Grant platform-wide permissions to a seeded user.
+ *
+ * Replaces the whole set rather than adding to it, matching
+ * `IPermissionStore.set` — a test that means to add has to pass the existing
+ * permissions back in.
+ */
+export async function grantPlatformPermissions(h, userId, perms) {
+    await h.config.data.permissions.set(SYSTEM_CONTEXT, userId, perms);
+}
+/**
+ * A definition with one version, written through the host's `DefinitionService`
+ * rather than straight into the store.
+ *
+ * Going through the service is what makes the fixture match production: it is
+ * what allocates the version, writes the blob, and moves the channel pointer,
+ * and a test that seeded the record alone would exercise a definition no solve
+ * path can load.
+ */
+export async function seedDefinition(h, opts) {
+    const service = h.deps?.services?.definitions;
+    if (!service)
+        throw new Error('TestHarness.deps.services.definitions is required to seed one');
+    const input = {
+        guid: opts.guid ?? randomUUID(),
+        projectId: opts.projectId,
+        ownerId: opts.ownerId,
+        fileExt: 'gh',
+        displayName: opts.displayName ?? 'Test Definition',
+        originalFilename: 'test.gh'
+    };
+    const file = new TextEncoder().encode('FAKE_GH_BYTES');
+    // Admin-shaped ctx so the service's own tenancy checks don't refuse a seed.
+    const ctx = {
+        userId: opts.ownerId,
+        actingOrgId: undefined,
+        platformPermissions: ['instance_admin'],
+        orgPermissions: []
+    };
+    const schema = { name: 'Test', inputs: [], outputs: [] };
+    return service.create(ctx, input, file, schema);
+}
+/**
+ * A share link plus the plaintext token behind it.
+ *
+ * Minted through the harness's own codec, so the stored hash verifies against
+ * the same secret a handler resolves from `deps.tokens.shareLinks` — a second
+ * codec would hash to something no handler could ever match.
+ */
+export async function seedShareLink(h, opts) {
+    const codec = h.deps?.tokens?.shareLinks;
+    if (!codec)
+        throw new Error('TestHarness.deps.tokens.shareLinks is required to seed a link');
+    const rawToken = codec.mintRawToken();
+    const link = {
+        id: randomUUID(),
+        definitionId: opts.definitionId,
+        channel: opts.channel ?? 'live',
+        tokenHash: codec.hashToken(rawToken),
+        createdBy: opts.createdBy,
+        createdAt: new Date().toISOString(),
+        expiresAt: opts.expiresAt ?? null,
+        revokedAt: null,
+        allowSolve: opts.allowSolve ?? true,
+        maxSolves: opts.maxSolves === undefined ? DEFAULT_SHARE_LINK_MAX_SOLVES : opts.maxSolves,
+        solveCount: 0
+    };
+    await h.config.data.shareLinks.create({
+        userId: opts.createdBy,
+        actingOrgId: undefined,
+        platformPermissions: ['instance_admin'],
+        orgPermissions: []
+    }, link);
+    return { link, rawToken };
+}
+// ============================================================================
+// Acting identity
+// ============================================================================
+/**
+ * The harness a `callHandler` call should build its deps from, carried on the
+ * locals rather than passed alongside them.
+ *
+ * A test already threads `locals` from `actAs` into every call; making the
+ * harness a second argument would mean passing the same two values everywhere
+ * and would let them disagree — locals from one stack, deps from another, which
+ * type-checks and silently tests nothing.
+ */
+const HARNESS = Symbol.for('@selvajs/server/testing.harness');
+/**
+ * Build the per-request identity a handler sees.
+ *
+ * Mirrors what a host's auth hook produces: one membership lookup, plus the
+ * instance-admin fallback to the first listed org for an admin who belongs to
+ * none. Keeping this aligned with the host is the point of testing against real
+ * stores rather than mocks — a fixture that invented its own `ctx` would prove
+ * the handler works under scope no request ever has.
+ */
+export async function actAs(h, userId) {
+    const user = await h.auth.findById(userId);
+    if (!user)
+        throw new Error(`actAs: user not found: ${userId}`);
+    const platformPermissions = await h.config.data.permissions.getFor(SYSTEM_CONTEXT, user.id);
+    const membership = await h.config.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id);
+    let actingOrgId = membership?.org.id;
+    const orgPermissions = membership ? [...membership.member.permissions] : [];
+    if (!actingOrgId && platformPermissions.includes('instance_admin')) {
+        const firstOrgPage = await h.config.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });
+        actingOrgId = firstOrgPage.items[0]?.id;
+    }
+    const profile = (await h.config.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id)) ?? emptyProfile(user.id);
+    return {
+        user,
+        ctx: { userId: user.id, actingOrgId, platformPermissions, orgPermissions },
+        profile,
+        providers: h.config,
+        log: h.log ?? silentLog,
+        [HARNESS]: h
+    };
+}
+export function anon(h) {
+    return { providers: h.config, [HARNESS]: h };
+}
+/**
+ * Invoke an `ApiHandler` with no host framework in the loop.
+ *
+ * Still goes through `runHandler`, because that is the contract: it is what
+ * turns a thrown `ApiError` — or a host error `mapError` recognizes — into a
+ * status. Calling the handler bare would make every failure an exception and
+ * every status assertion untestable.
+ */
+export async function callHandler(handler, opts) {
+    const url = new URL(opts.url ?? 'http://test.local/');
+    const init = {
+        method: opts.body !== undefined ? 'POST' : 'GET',
+        headers: opts.headers ?? {}
+    };
+    if (opts.body !== undefined) {
+        // FormData carries its own multipart content-type with a generated
+        // boundary; forcing JSON onto it makes `request.formData()` throw.
+        if (opts.body instanceof FormData) {
+            init.body = opts.body;
+        }
+        else {
+            init.headers['content-type'] ??= 'application/json';
+            init.body = typeof opts.body === 'string' ? opts.body : JSON.stringify(opts.body);
+        }
+    }
+    const locals = opts.locals;
+    const h = locals[HARNESS];
+    if (!h) {
+        // Without the harness there is no `mapError`, so every guard rejection
+        // would fall through to a 500 and each expected 403 would read as a
+        // passing-but-meaningless assertion. Fail loudly instead.
+        throw new Error('callHandler: locals carry no harness — build them with `actAs()` or `anon()`.');
+    }
+    const req = {
+        ctx: locals.ctx,
+        user: locals.user,
+        profile: locals.profile,
+        log: locals.log ?? h.log ?? silentLog,
+        params: opts.params ?? {},
+        url,
+        request: new Request(url.toString(), init),
+        deps: depsFromConfig(locals.providers, h.deps?.services ?? {}, {
+            tokens: h.deps?.tokens,
+            uploadLimits: h.deps?.uploadLimits
+        })
+    };
+    return readResponse(await runHandler(handler, req, { fallback: 'Test', mapError: h.mapError }));
+}
+async function readResponse(res) {
+    const contentType = res.headers.get('content-type') ?? '';
+    const out = { status: res.status, headers: res.headers };
+    if (res.headers.has('location'))
+        out.location = res.headers.get('location');
+    if (contentType.includes('application/json')) {
+        const text = await res.text();
+        out.text = text;
+        try {
+            out.json = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            // Leave it as text — a malformed body is the assertion's problem.
+        }
+    }
+    else {
+        out.text = await res.text();
+    }
+    return out;
+}
+//# sourceMappingURL=harness.js.map

package/dist/testing/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/testing/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,cAAc,EACd,uBAAuB,EACvB,6BAA6B,EAC7B,YAAY,EAiBZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAc7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAY;IACjC,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACA,CAAC;AAWxB,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,CAAc,EACd,KAAa,EACb,sBAA4C,EAAE;IAE9C,4EAA4E;IAC5E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAChF,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,CAAc,EACd,IAAqD;IAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAiB;QACzB,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,CAAc,EACd,IAAqF;IAErF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAc;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,CAAc,EACd,IAOC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAY;QACxB,EAAE,EAAE,UAAU,EAAE;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;QACxC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK;QAChD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc,EAAE;QAC7D,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,SAAS,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,CAAc,EACd,IAA8D;IAE9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,CAAc,EACd,MAAc,EACd,KAA2B;IAE3B,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,CAAc,EACd,IAKC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAE/F,MAAM,KAAK,GAA2B;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,iBAAiB;QAClD,gBAAgB,EAAE,SAAS;KAC3B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,4EAA4E;IAC5E,MAAM,GAAG,GAAmB;QAC3B,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,WAAW,EAAE,SAAS;QACtB,mBAAmB,EAAE,CAAC,gBAAgB,CAAC;QACvC,cAAc,EAAE,EAAE;KAClB,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAElD,CAAC;IACL,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,CAAc,EACd,IAOC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,IAAI,GAAc;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;QACxF,UAAU,EAAE,CAAC;KACb,CAAC;IACF,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CACpC;QACC,MAAM,EAAE,IAAI,CAAC,SAAS;QACtB,WAAW,EAAE,SAAS;QACtB,mBAAmB,EAAE,CAAC,gBAAgB,CAAC;QACvC,cAAc,EAAE,EAAE;KAClB,EACD,IAAI,CACJ,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAW9D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,CAAc,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IAE/D,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,IAAI,WAAW,GAAuB,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IACzD,MAAM,cAAc,GAAoB,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACrF,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GACZ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhG,OAAO;QACN,IAAI;QACJ,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE;QAC1E,OAAO;QACP,SAAS,EAAE,CAAC,CAAC,MAAM;QACnB,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,SAAS;QACvB,CAAC,OAAO,CAAC,EAAE,CAAC;KACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,CAAc;IAClC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAmB,EAAE,IAAqB;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAgB;QACzB,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAChD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC3B,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,mEAAmE;QACnE,mEAAmE;QACnE,IAAI,IAAI,CAAC,IAAI,YAAY,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC,KAAK,kBAAkB,CAAC;YAChF,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4D,CAAC;IACjF,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACR,uEAAuE;QACvE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,IAAI,KAAK,CACd,+EAA+E,CAC/E,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAe;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,SAAS;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,GAAG;QACH,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;QAC1C,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE;YAC9D,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM;YACtB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY;SAClC,CAAC;KACF,CAAC;IAEF,OAAO,YAAY,CAAC,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAa;IACxC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACrE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;IAC7E,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACJ,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC;SAAM,CAAC;QACP,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Test harness for the transport-free API handlers.
+ *
+ * A host builds a {@link TestHarness} around its own provider stack and gets
+ * the seeders, `actAs`, and `callHandler` that the handler tests are written
+ * against — so the tests travel with the handlers instead of being rewritten
+ * per host.
+ *
+ * This entry point constructs no provider. Which stack a test runs on is the
+ * host's decision, and a package that picked one would drag that provider into
+ * every consumer's dependency tree.
+ */
+export type { SeedAuthAdapter } from './seed-adapter.js';
+export { seedUser, seedOrg, seedOrgMember, seedProject, seedProjectMember, seedDefinition, seedShareLink, grantPlatformPermissions, actAs, anon, callHandler, silentLog } from './harness.js';
+export type { TestHarness, SeededUser, SeededDefinition, SeededShareLink, ActingLocals, CallHandlerOpts, CallResult } from './harness.js';
+export { seedAcme, seedBigClient, seedThirdOrg, seedCommons } from './scenarios.js';
+export type { AcmeFixture, BigClientFixture, ThirdOrgFixture, CommonsFixture } from './scenarios.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACN,QAAQ,EACR,OAAO,EACP,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,wBAAwB,EACxB,KAAK,EACL,IAAI,EACJ,WAAW,EACX,SAAS,EACT,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpF,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,MAAM,gBAAgB,CAAC"}

package/dist/testing/index.js

@@ -0,0 +1,15 @@
+/**
+ * Test harness for the transport-free API handlers.
+ *
+ * A host builds a {@link TestHarness} around its own provider stack and gets
+ * the seeders, `actAs`, and `callHandler` that the handler tests are written
+ * against — so the tests travel with the handlers instead of being rewritten
+ * per host.
+ *
+ * This entry point constructs no provider. Which stack a test runs on is the
+ * host's decision, and a package that picked one would drag that provider into
+ * every consumer's dependency tree.
+ */
+export { seedUser, seedOrg, seedOrgMember, seedProject, seedProjectMember, seedDefinition, seedShareLink, grantPlatformPermissions, actAs, anon, callHandler, silentLog } from './harness.js';
+export { seedAcme, seedBigClient, seedThirdOrg, seedCommons } from './scenarios.js';
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACN,QAAQ,EACR,OAAO,EACP,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,wBAAwB,EACxB,KAAK,EACL,IAAI,EACJ,WAAW,EACX,SAAS,EACT,MAAM,cAAc,CAAC;AAUtB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/testing/scenarios.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The shared cast the handler tests are written against.
+ *
+ * These compose only the seeders in `./harness.ts`, so they run on whatever
+ * provider stack the host built its {@link TestHarness} around. They live here
+ * rather than in a host's fixtures because a handler test that travels with its
+ * handler needs the same two tenants wherever it runs — a host that reseeds its
+ * own Acme with different roles gets different results from the same test.
+ */
+import type { Organization, Project } from '@selvajs/platform';
+import type { SeededDefinition, SeededUser, TestHarness } from './harness.js';
+export interface AcmeFixture {
+    acme: Organization;
+    alice: SeededUser;
+    bob: SeededUser;
+    alicesPrivate: Project;
+    acmeOrg: Project;
+    acmePublic: Project;
+}
+/**
+ * The primary tenant.
+ *
+ * **Alice is the org's `ownerId` but her membership row is `admin`.** Those are
+ * separate fields and this fixture deliberately makes them disagree, because
+ * production can too. Every org-role gate reads the **membership row**, so a
+ * test that treats `alice` as "the owner" will invert its own result and pass
+ * for the wrong reason — seed an explicit `role: 'owner'` member instead.
+ */
+export declare function seedAcme(h: TestHarness): Promise<AcmeFixture>;
+export interface BigClientFixture {
+    bigClient: Organization;
+    carol: SeededUser;
+}
+/**
+ * Second tenant. Carol is a member of BigClient — used for cross-org rejection
+ * scenarios (Carol acting in BigClient context cannot view Acme data).
+ */
+export declare function seedBigClient(h: TestHarness): Promise<BigClientFixture>;
+export interface ThirdOrgFixture {
+    initech: Organization;
+    dave: SeededUser;
+}
+/**
+ * Third tenant. Dave is a member of Initech — used for cross-org public-visibility
+ * scenarios (any authenticated user from any org can view a public project when
+ * cross-org public access is enabled).
+ */
+export declare function seedThirdOrg(h: TestHarness): Promise<ThirdOrgFixture>;
+export interface CommonsFixture {
+    commonsProject: Project;
+    alicesCommonsDef: SeededDefinition;
+    peter: SeededUser;
+}
+/**
+ * Commons-mode project (`autoJoinOnUpload=true`) inside Acme with Alice's
+ * pre-existing definition. Peter is a separate authenticated user — *not* a
+ * project member — who is allowed to upload his own new definitions but cannot
+ * touch Alice's existing one.
+ *
+ * Requires {@link seedAcme} to have run first (uses Alice as project owner +
+ * existing-def owner).
+ */
+export declare function seedCommons(h: TestHarness, opts: {
+    acmeId: string;
+    aliceId: string;
+}): Promise<CommonsFixture>;
+//# sourceMappingURL=scenarios.d.ts.map

package/dist/testing/scenarios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios.d.ts","sourceRoot":"","sources":["../../src/testing/scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BnE;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,UAAU,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS7E;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAS3E;AAED,MAAM,WAAW,cAAc;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,KAAK,EAAE,UAAU,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAChC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,cAAc,CAAC,CAgBzB"}

package/dist/testing/scenarios.js

@@ -0,0 +1,104 @@
+/**
+ * The shared cast the handler tests are written against.
+ *
+ * These compose only the seeders in `./harness.ts`, so they run on whatever
+ * provider stack the host built its {@link TestHarness} around. They live here
+ * rather than in a host's fixtures because a handler test that travels with its
+ * handler needs the same two tenants wherever it runs — a host that reseeds its
+ * own Acme with different roles gets different results from the same test.
+ */
+import { seedDefinition, seedOrg, seedOrgMember, seedProject, seedUser } from './harness.js';
+/**
+ * The primary tenant.
+ *
+ * **Alice is the org's `ownerId` but her membership row is `admin`.** Those are
+ * separate fields and this fixture deliberately makes them disagree, because
+ * production can too. Every org-role gate reads the **membership row**, so a
+ * test that treats `alice` as "the owner" will invert its own result and pass
+ * for the wrong reason — seed an explicit `role: 'owner'` member instead.
+ */
+export async function seedAcme(h) {
+    const alice = await seedUser(h, 'alice@acme.test');
+    const bob = await seedUser(h, 'bob@acme.test');
+    const acme = await seedOrg(h, { name: 'Acme', slug: 'acme', ownerId: alice.id });
+    await seedOrgMember(h, { orgId: acme.id, userId: alice.id, role: 'admin' });
+    await seedOrgMember(h, { orgId: acme.id, userId: bob.id, role: 'member' });
+    const alicesPrivate = await seedProject(h, {
+        orgId: acme.id,
+        name: 'Alice Private',
+        slug: 'alice-private',
+        ownerId: alice.id,
+        visibility: 'private'
+    });
+    const acmeOrg = await seedProject(h, {
+        orgId: acme.id,
+        name: 'Acme Org Project',
+        slug: 'acme-org',
+        ownerId: alice.id,
+        visibility: 'org'
+    });
+    const acmePublic = await seedProject(h, {
+        orgId: acme.id,
+        name: 'Acme Public',
+        slug: 'acme-public',
+        ownerId: alice.id,
+        visibility: 'public'
+    });
+    return { acme, alice, bob, alicesPrivate, acmeOrg, acmePublic };
+}
+/**
+ * Second tenant. Carol is a member of BigClient — used for cross-org rejection
+ * scenarios (Carol acting in BigClient context cannot view Acme data).
+ */
+export async function seedBigClient(h) {
+    const carol = await seedUser(h, 'carol@bigclient.test');
+    const bigClient = await seedOrg(h, {
+        name: 'BigClient',
+        slug: 'bigclient',
+        ownerId: carol.id
+    });
+    await seedOrgMember(h, { orgId: bigClient.id, userId: carol.id, role: 'member' });
+    return { bigClient, carol };
+}
+/**
+ * Third tenant. Dave is a member of Initech — used for cross-org public-visibility
+ * scenarios (any authenticated user from any org can view a public project when
+ * cross-org public access is enabled).
+ */
+export async function seedThirdOrg(h) {
+    const dave = await seedUser(h, 'dave@initech.test');
+    const initech = await seedOrg(h, {
+        name: 'Initech',
+        slug: 'initech',
+        ownerId: dave.id
+    });
+    await seedOrgMember(h, { orgId: initech.id, userId: dave.id, role: 'member' });
+    return { initech, dave };
+}
+/**
+ * Commons-mode project (`autoJoinOnUpload=true`) inside Acme with Alice's
+ * pre-existing definition. Peter is a separate authenticated user — *not* a
+ * project member — who is allowed to upload his own new definitions but cannot
+ * touch Alice's existing one.
+ *
+ * Requires {@link seedAcme} to have run first (uses Alice as project owner +
+ * existing-def owner).
+ */
+export async function seedCommons(h, opts) {
+    const peter = await seedUser(h, 'peter@elsewhere.test');
+    const commonsProject = await seedProject(h, {
+        orgId: opts.acmeId,
+        name: 'Acme Commons',
+        slug: 'acme-commons',
+        ownerId: opts.aliceId,
+        visibility: 'public',
+        autoJoinOnUpload: true
+    });
+    const alicesCommonsDef = await seedDefinition(h, {
+        projectId: commonsProject.id,
+        ownerId: opts.aliceId,
+        displayName: "Alice's Commons Def"
+    });
+    return { commonsProject, alicesCommonsDef, peter };
+}
+//# sourceMappingURL=scenarios.js.map

package/dist/testing/scenarios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios.js","sourceRoot":"","sources":["../../src/testing/scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAY7F;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE;QAC1C,KAAK,EAAE,IAAI,CAAC,EAAE;QACd,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,UAAU,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE;QACpC,KAAK,EAAE,IAAI,CAAC,EAAE;QACd,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,UAAU,EAAE,KAAK;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE;QACvC,KAAK,EAAE,IAAI,CAAC,EAAE;QACd,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,UAAU,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjE,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAc;IACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE;QAClC,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,KAAK,CAAC,EAAE;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAc;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE;QAChC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI,CAAC,EAAE;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,CAAc,EACd,IAAyC;IAEzC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,QAAQ;QACpB,gBAAgB,EAAE,IAAI;KACtB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE;QAChD,SAAS,EAAE,cAAc,CAAC,EAAE;QAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,qBAAqB;KAClC,CAAC,CAAC;IACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}

package/dist/testing/seed-adapter.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The one thing test fixtures cannot get from `SelvaConfig`: creating and
+ * reading identities.
+ *
+ * Everything else a fixture needs — orgs, projects, definitions, invites —
+ * lives behind `IDataProvider` and is portable as-is. Identity is not.
+ * `IAuthProvider` exposes user *creation* only through the optional
+ * `passwordAuth.createUserWithPassword`, and a provider that authenticates by
+ * OAuth or forwarded headers implements none of it, so there is no interface
+ * method every provider answers. Each provider also stores identity its own
+ * way — the local one in `auth-users.json`, Supabase in its own `auth.users`
+ * table — and seeding has to reach that store directly, not through a login
+ * flow no test wants to perform.
+ *
+ * So the host supplies this. Two methods, because that is all the shared
+ * fixtures use: `seedUser` creates, `actAs` reads back.
+ */
+import type { AuthUser } from '@selvajs/platform';
+export interface SeedAuthAdapter {
+    /**
+     * Create an identity and return it. Called before the data-layer row exists,
+     * so implementations must not assume `ensureUser` has run.
+     *
+     * The returned `id` is what every other seeder keys off, so it has to be the
+     * id the auth provider will report for this user later — not a fresh one.
+     */
+    createUser(email: string): Promise<AuthUser>;
+    /** Read an identity back. `null` when absent, so `actAs` can fail loudly. */
+    findById(id: string): Promise<AuthUser | null>;
+}
+//# sourceMappingURL=seed-adapter.d.ts.map

package/dist/testing/seed-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-adapter.d.ts","sourceRoot":"","sources":["../../src/testing/seed-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC/C"}

package/dist/testing/seed-adapter.js

@@ -0,0 +1,19 @@
+/**
+ * The one thing test fixtures cannot get from `SelvaConfig`: creating and
+ * reading identities.
+ *
+ * Everything else a fixture needs — orgs, projects, definitions, invites —
+ * lives behind `IDataProvider` and is portable as-is. Identity is not.
+ * `IAuthProvider` exposes user *creation* only through the optional
+ * `passwordAuth.createUserWithPassword`, and a provider that authenticates by
+ * OAuth or forwarded headers implements none of it, so there is no interface
+ * method every provider answers. Each provider also stores identity its own
+ * way — the local one in `auth-users.json`, Supabase in its own `auth.users`
+ * table — and seeding has to reach that store directly, not through a login
+ * flow no test wants to perform.
+ *
+ * So the host supplies this. Two methods, because that is all the shared
+ * fixtures use: `seedUser` creates, `actAs` reads back.
+ */
+export {};
+//# sourceMappingURL=seed-adapter.js.map

package/dist/testing/seed-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-adapter.js","sourceRoot":"","sources":["../../src/testing/seed-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}