@terpjs/conformance 0.5.5 → 0.5.7

package/dist/index.d.ts

@@ -0,0 +1,43 @@
+import { type Page } from "@playwright/test";
+/**
+ * The administrator the base-profile flows sign in as. The default matches the bundled example
+ * workbench's seed; a generated repo points these at its own seeded admin via
+ * `TERP_E2E_ADMIN_EMAIL` / `TERP_E2E_ADMIN_PASSWORD` (or passes credentials to `login`)
+ * without editing the suite.
+ */
+export declare const ADMIN: {
+    email: string;
+    password: string;
+};
+/**
+ * A writer (rank at/above the write threshold) and a read-only user, for an app's RBAC flows that
+ * assert write-gated controls appear for a writer and hide for a viewer. The defaults match the
+ * bundled example workbench's seed and are overridable per app via the matching `TERP_E2E_*`
+ * variables.
+ */
+export declare const EDITOR: {
+    email: string;
+    password: string;
+};
+export declare const VIEWER: {
+    email: string;
+    password: string;
+};
+/**
+ * Sign in through the real login screen. App-agnostic: the login screen and session are
+ * base-profile (identical in every Terp app), so this is the reusable entry point any app's
+ * conformance suite composes. Success is the sign-in screen being replaced by the app shell;
+ * callers assert their own landing content afterwards.
+ */
+export declare function login(page: Page, credentials?: {
+    email: string;
+    password: string;
+}): Promise<void>;
+/**
+ * Sign out through the shell's account menu and assert the session is gone. Base-profile: the
+ * user menu (avatar at the bottom of every Terp app's sidebar) opens Settings and Sign out;
+ * sign-out revokes the token server-side (ADR 0031), so this is reusable across apps. Success
+ * is the app shell being replaced by the sign-in screen.
+ */
+export declare function logout(page: Page): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,KAAK;;;CAGjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;CAGlB,CAAC;AAEF,eAAO,MAAM,MAAM;;;CAGlB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,IAAI,EACV,WAAW,GAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAU,GACvD,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAItD"}

package/{src/index.ts → dist/index.js}

@@ -1,5 +1,4 @@
-import { expect, type Page } from "@playwright/test";
-
+import { expect } from "@playwright/test";
 /**
  * The administrator the base-profile flows sign in as. The default matches the bundled example
  * workbench's seed; a generated repo points these at its own seeded admin via
@@ -7,10 +6,9 @@ import { expect, type Page } from "@playwright/test";
  * without editing the suite.
  */
 export const ADMIN = {
-  email: process.env.TERP_E2E_ADMIN_EMAIL ?? "admin@acme.test",
-  password: process.env.TERP_E2E_ADMIN_PASSWORD ?? "correct horse battery staple",
+    email: process.env.TERP_E2E_ADMIN_EMAIL ?? "admin@acme.test",
+    password: process.env.TERP_E2E_ADMIN_PASSWORD ?? "correct horse battery staple",
 };
-
 /**
  * A writer (rank at/above the write threshold) and a read-only user, for an app's RBAC flows that
  * assert write-gated controls appear for a writer and hide for a viewer. The defaults match the
@@ -18,43 +16,38 @@ export const ADMIN = {
  * variables.
  */
 export const EDITOR = {
-  email: process.env.TERP_E2E_EDITOR_EMAIL ?? "editor@acme.test",
-  password: process.env.TERP_E2E_EDITOR_PASSWORD ?? "correct horse battery staple",
+    email: process.env.TERP_E2E_EDITOR_EMAIL ?? "editor@acme.test",
+    password: process.env.TERP_E2E_EDITOR_PASSWORD ?? "correct horse battery staple",
 };
-
 export const VIEWER = {
-  email: process.env.TERP_E2E_VIEWER_EMAIL ?? "viewer@acme.test",
-  password: process.env.TERP_E2E_VIEWER_PASSWORD ?? "correct horse battery staple",
+    email: process.env.TERP_E2E_VIEWER_EMAIL ?? "viewer@acme.test",
+    password: process.env.TERP_E2E_VIEWER_PASSWORD ?? "correct horse battery staple",
 };
-
 /**
  * Sign in through the real login screen. App-agnostic: the login screen and session are
  * base-profile (identical in every Terp app), so this is the reusable entry point any app's
  * conformance suite composes. Success is the sign-in screen being replaced by the app shell;
  * callers assert their own landing content afterwards.
  */
-export async function login(
-  page: Page,
-  credentials: { email: string; password: string } = ADMIN,
-): Promise<void> {
-  await page.goto("/");
-  await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
-  await page.getByPlaceholder("Email").fill(credentials.email);
-  await page.getByPlaceholder("Password").fill(credentials.password);
-  await page.getByRole("button", { name: "Sign in" }).click();
-  await expect(page.getByRole("heading", { name: "Sign in" })).toHaveCount(0, {
-    timeout: 15_000,
-  });
+export async function login(page, credentials = ADMIN) {
+    await page.goto("/");
+    await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
+    await page.getByPlaceholder("Email").fill(credentials.email);
+    await page.getByPlaceholder("Password").fill(credentials.password);
+    await page.getByRole("button", { name: "Sign in" }).click();
+    await expect(page.getByRole("heading", { name: "Sign in" })).toHaveCount(0, {
+        timeout: 15_000,
+    });
 }
-
 /**
  * Sign out through the shell's account menu and assert the session is gone. Base-profile: the
  * user menu (avatar at the bottom of every Terp app's sidebar) opens Settings and Sign out;
  * sign-out revokes the token server-side (ADR 0031), so this is reusable across apps. Success
  * is the app shell being replaced by the sign-in screen.
  */
-export async function logout(page: Page): Promise<void> {
-  await page.getByRole("button", { name: "Account menu" }).click();
-  await page.getByRole("menuitem", { name: "Sign out" }).click();
-  await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
+export async function logout(page) {
+    await page.getByRole("button", { name: "Account menu" }).click();
+    await page.getByRole("menuitem", { name: "Sign out" }).click();
+    await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
 }
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,iBAAiB;IAC5D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,8BAA8B;CAChF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,kBAAkB;IAC9D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,8BAA8B;CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,kBAAkB;IAC9D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,8BAA8B;CACjF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAU,EACV,cAAmD,KAAK;IAExD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;QAC1E,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAU;IACrC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACjE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7E,CAAC"}

package/package.json

@@ -1,20 +1,30 @@
 {
   "name": "@terpjs/conformance",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "type": "module",
   "description": "Terp conformance \u2014 app-agnostic Playwright end-to-end flows over a running Terp stack (base profile: auth gating + session lifecycle) plus the login/role helpers an app's own e2e suite composes.",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
   },
+  "files": [
+    "dist"
+  ],
   "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "typecheck": "tsc --noEmit",
     "test": "playwright test",
     "report": "playwright show-report"
   },
   "devDependencies": {
     "@playwright/test": "^1.50.0",
-    "@types/node": "^22.10.0"
+    "@types/node": "^22.10.0",
+    "typescript": "^5.9.3"
   },
   "license": "Apache-2.0",
   "repository": {

package/playwright.config.ts

@@ -1,19 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-// The suite runs against an ALREADY-RUNNING Terp stack — the Docker workbench
-// (`docker compose -f apps/example/docker-compose.yml up`) or `terp dev`. CI brings the stack
-// up first; locally, point TERP_E2E_BASE_URL at your running frontend (e.g. the workbench port).
-const baseURL = process.env.TERP_E2E_BASE_URL ?? "http://localhost:5173";
-
-export default defineConfig({
-  testDir: "./tests",
-  fullyParallel: true,
-  forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
-  reporter: process.env.CI ? [["list"], ["html", { open: "never" }]] : "list",
-  use: {
-    baseURL,
-    trace: "on-first-retry",
-  },
-  projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
-});

package/tests/auth.spec.ts

@@ -1,50 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-import { ADMIN, login, logout } from "../src/index";
-
-// Base-profile auth — reusable across ANY Terp app (the login screen + session are identical
-// everywhere): a signed-out visitor is gated to the login screen, the seeded admin can sign in
-// and reach the app shell, sign out again, and bad credentials are refused — all over the real
-// deny-by-default backend, not a mock.
-
-test("an unauthenticated visitor is gated to the sign-in screen", async ({ page }) => {
-  await page.goto("/");
-  await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
-  // The authenticated app shell (its primary navigation) is not reachable without a session.
-  await expect(page.getByRole("navigation", { name: "Primary" })).toHaveCount(0);
-});
-
-test("the seeded admin can sign in and reach the app shell", async ({ page }) => {
-  await login(page, ADMIN);
-  await expect(page.getByRole("navigation", { name: "Primary" })).toBeVisible();
-});
-
-test("a signed-in session survives a page reload", async ({ page }) => {
-  await login(page, ADMIN);
-  await expect(page.getByRole("navigation", { name: "Primary" })).toBeVisible();
-
-  await page.reload();
-
-  // ADR 0054: the access token is still memory-only, but the httpOnly refresh cookie restores
-  // a fresh access token on boot, so a normal reload keeps the user in the app shell.
-  await expect(page.getByRole("navigation", { name: "Primary" })).toBeVisible();
-  await expect(page.getByRole("heading", { name: "Sign in" })).toHaveCount(0);
-});
-
-test("a signed-in user can sign out and is returned to the sign-in screen", async ({ page }) => {
-  await login(page, ADMIN);
-  await expect(page.getByRole("navigation", { name: "Primary" })).toBeVisible();
-  await logout(page);
-  // The session is gone: the app shell is no longer reachable, only the login screen.
-  await expect(page.getByRole("navigation", { name: "Primary" })).toHaveCount(0);
-});
-
-test("bad credentials are refused", async ({ page }) => {
-  await page.goto("/");
-  // A non-existent account, so a failed attempt never locks out the seeded admin.
-  await page.getByPlaceholder("Email").fill("nobody@acme.test");
-  await page.getByPlaceholder("Password").fill("definitely-not-the-password");
-  await page.getByRole("button", { name: "Sign in" }).click();
-  await expect(page.getByText("Sign-in failed")).toBeVisible();
-  await expect(page.getByRole("navigation", { name: "Primary" })).toHaveCount(0);
-});

package/tests/standard.spec.ts

@@ -1,85 +0,0 @@
-import { expect, test, type APIRequestContext } from "@playwright/test";
-
-import { ADMIN } from "../src/index";
-
-// Terp Standard black-box probes (spec/catalog entries with layer "black-box"): these
-// invariants are observable on a RUNNING app with no source access, so they are portable to
-// any stack — this file is the reference realisation the catalog's `black-box` enforcement
-// entries point at. Like auth.spec.ts, the probes use only the base profile (auth + the
-// seeded admin) plus the `users` capability every generated app starts with, so they stay
-// app-agnostic. Each test title is the catalog entry's enforcement `ref`.
-
-async function bearer(request: APIRequestContext): Promise<{ Authorization: string }> {
-  const response = await request.post("/api/v1/auth/login", { data: ADMIN });
-  expect(response.ok()).toBe(true);
-  const { access_token } = (await response.json()) as { access_token: string };
-  return { Authorization: "Bearer " + access_token };
-}
-
-// spec/catalog/backend/list_routes_paginate.json
-test("standard: list routes return a capped Page envelope", async ({ request }) => {
-  const headers = await bearer(request);
-
-  // A collection GET is a uniform Page envelope, never a bare JSON array.
-  const page = await request.get("/api/v1/users/", { headers });
-  expect(page.ok()).toBe(true);
-  const body = (await page.json()) as Record<string, unknown>;
-  expect(Array.isArray(body)).toBe(false);
-  expect(body).toMatchObject({ items: expect.any(Array), total: expect.any(Number) });
-  expect(typeof body.limit).toBe("number");
-  expect(typeof body.skip).toBe("number");
-
-  // The page size is capped fail-closed: an oversized limit is refused, not honoured.
-  const oversized = await request.get("/api/v1/users/?limit=100000", { headers });
-  expect(oversized.status()).toBe(422);
-});
-
-// spec/catalog/backend/safe_methods_are_read_only.json
-test("standard: safe methods observably mutate nothing", async ({ request }) => {
-  const headers = await bearer(request);
-
-  // Reading a collection is repeatable: the GETs themselves change no state, so the
-  // second read reports exactly the population the first one saw.
-  const first = await request.get("/api/v1/users/", { headers });
-  expect(first.ok()).toBe(true);
-  const before = (await first.json()) as { total: number; items: unknown[] };
-
-  const second = await request.get("/api/v1/users/", { headers });
-  expect(second.ok()).toBe(true);
-  const after = (await second.json()) as { total: number; items: unknown[] };
-
-  expect(after.total).toBe(before.total);
-  expect(after.items.length).toBe(before.items.length);
-});
-
-// spec/catalog/backend/schemas_exclude_sensitive_fields.json
-const SENSITIVE_KEY = new RegExp(
-  "(?:^|_)(?:password|passwd|pwd|passphrase|secret|salt|api_key|apikey" +
-    "|private_key|privatekey|credentials?)(?:$|_)|(?:^|_)token$",
-);
-const SENSITIVE_KEY_EXCLUSIONS = new Set(["token_version", "version"]);
-
-function sensitiveKeys(value: unknown, found: string[] = []): string[] {
-  if (Array.isArray(value)) {
-    value.forEach((item) => sensitiveKeys(item, found));
-  } else if (value !== null && typeof value === "object") {
-    for (const [key, nested] of Object.entries(value)) {
-      if (!SENSITIVE_KEY_EXCLUSIONS.has(key.toLowerCase()) && SENSITIVE_KEY.test(key.toLowerCase())) {
-        found.push(key);
-      }
-      sensitiveKeys(nested, found);
-    }
-  }
-  return found;
-}
-
-test("standard: responses never expose credential-shaped fields", async ({ request }) => {
-  const headers = await bearer(request);
-  for (const path of ["/api/v1/users/", "/api/v1/me/"]) {
-    const response = await request.get(path, { headers });
-    expect(response.ok()).toBe(true);
-    expect(sensitiveKeys(await response.json()), `${path} leaked a credential-shaped field`).toEqual(
-      [],
-    );
-  }
-});

package/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "types": ["node"],
-    "strict": true,
-    "noEmit": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true
-  },
-  "include": ["src", "tests", "playwright.config.ts"]
-}