@venturekit/testing 0.0.0-dev.20260701100017

package/README.md

@@ -0,0 +1,146 @@
+# @venturekit/testing
+
+Integration & end-to-end test harness for VentureKit apps. It owns the
+hard, framework-specific plumbing so your project only has to write the
+actual test scenarios:
+
+- **Launch a real local stack** — `startTestStack()` runs `vk migrate`
+  then `vk dev`, and waits until the server is ready.
+- **Gate on readiness** — `waitForReady()` polls the dev server's
+  `/_dev/health` probe (the same liveness endpoint `vk` tooling uses).
+- **Seed auth** — `createTestUser()` provisions a cognito-local user with a
+  permanent password over the `vk dev` admin API (no AWS SDK needed);
+  `loginAs()` additionally mints real JWTs for API-level tests.
+- **Reset the database** — `truncateAllTables()` clears app tables between
+  specs while preserving the VentureKit migration/seed bookkeeping.
+- **Drive the API** — `createApiClient()` is a typed `fetch` wrapper that
+  understands VentureKit's `{ data }` / `{ error }` envelope.
+
+It's UI-framework agnostic: pair it with Playwright, Cypress, or plain
+vitest. The scenarios (selectors, flows, assertions) stay in your project.
+
+> Requires Docker (for the local Postgres / MinIO / cognito-local stack),
+> so run these on macOS / Linux / CI — not over a Windows UNC share.
+
+## Install
+
+```bash
+pnpm add -D @venturekit/testing
+# Optional peers (only if you use the matching helpers):
+#   @venturekit/data                              -> truncate* DB helpers
+#   @aws-sdk/client-cognito-identity-provider     -> signInWithPassword / loginAs
+```
+
+## Playwright: `globalSetup` pattern
+
+Let Playwright's `webServer` own the `vk dev` process and use the harness
+for migration, auth seeding, and readiness:
+
+```ts
+// playwright.config.ts
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './e2e',
+  globalSetup: './e2e/global-setup.ts',
+  use: { baseURL: 'http://localhost:3005' }, // your UI
+  webServer: [
+    {
+      command: 'vk dev --stage test --port 4001 --no-watch',
+      url: 'http://localhost:4001/_dev/health',
+      reuseExistingServer: !process.env.CI,
+      timeout: 120_000,
+    },
+    {
+      command: 'pnpm --filter @your/admin dev',
+      url: 'http://localhost:3005',
+      reuseExistingServer: !process.env.CI,
+    },
+  ],
+});
+```
+
+```ts
+// e2e/global-setup.ts
+import { createTestUser, truncateAllTables, waitForReady } from '@venturekit/testing';
+
+const API = 'http://localhost:4001';
+
+export default async function globalSetup() {
+  await waitForReady({ baseUrl: API });
+  await truncateAllTables();            // needs DATABASE_URL / DB_* in env
+  await createTestUser({
+    baseUrl: API,
+    email: 'admin@example.com',
+    password: 'Passw0rd!',
+    attributes: { tenantId: 'global' },
+  });
+}
+```
+
+Your specs then log in through the real UI (the most faithful E2E):
+
+```ts
+// e2e/login.spec.ts
+import { test, expect } from '@playwright/test';
+
+test('logs in and lands on the dashboard', async ({ page }) => {
+  await page.goto('/login');
+  await page.getByLabel('Email').fill('admin@example.com');
+  await page.getByLabel('Password').fill('Passw0rd!');
+  await page.getByRole('button', { name: 'Sign in' }).click();
+  await expect(page).toHaveURL(/\/(inbox|dashboard)/);
+});
+```
+
+## API-level integration tests (vitest)
+
+No browser — boot the stack, mint a token, and hit the API directly:
+
+```ts
+import { afterAll, beforeAll, expect, test } from 'vitest';
+import { startTestStack, loginAs, createApiClient, type TestStack } from '@venturekit/testing';
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await startTestStack({ port: 4100, seed: true });
+}, 180_000);
+
+afterAll(async () => {
+  await stack?.stop();
+});
+
+test('GET /tenant returns the current tenant', async () => {
+  const { idToken } = await loginAs({
+    baseUrl: stack.baseUrl,
+    email: 'admin@example.com',
+    password: 'Passw0rd!',
+  });
+  const api = createApiClient({ baseUrl: stack.baseUrl, token: idToken });
+  const res = await api.get<{ slug: string }>('/tenant');
+  expect(res.status).toBe(200);
+  expect(res.data.slug).toBeDefined();
+});
+```
+
+## API reference
+
+| Export | Purpose |
+| --- | --- |
+| `startTestStack(opts)` | Migrate + boot `vk dev`; returns `{ baseUrl, port, stop() }`. |
+| `waitForReady(opts)` | Poll until ready (default `/_dev/health`). `vkDevServerReady` asserts the `vk` discriminator. |
+| `createApiClient(opts)` | Typed `fetch` client; unwraps `{ data }`, throws `ApiError` on non-2xx. |
+| `createTestUser(opts)` | Idempotently create a cognito-local user with a permanent password. |
+| `setTestUserAttributes` / `deleteTestUser` / `getDevPools` | Manage cognito-local users / inspect pools. |
+| `signInWithPassword(opts)` / `loginAs(opts)` | Mint real JWTs for a user (needs the Cognito SDK peer). |
+| `truncateAllTables(opts)` / `truncateTables` / `listTables` | Reset the DB between specs (needs `@venturekit/data`). |
+| `buildTruncateSql` / `filterTruncatableTables` / `quoteIdent` | Pure SQL builders (reusable / testable). |
+
+## Notes
+
+- `startTestStack` defaults to stage `test`, which targets a separate local
+  database (`<dbname>_test`) so your tests never clobber `vk dev` data.
+- `vk dev` does **not** auto-migrate — `startTestStack` runs `vk migrate`
+  for you (pass `migrate: false` to skip, `seed: true` to also seed).
+- DB helpers read the same `DATABASE_URL` / `DB_*` env the app uses.

package/dist/auth-tokens.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Mint real Cognito JWTs for a seeded cognito-local user, for API-level
+ * integration tests that need a bearer token (no browser).
+ *
+ * Uses the AWS Cognito SDK (`USER_PASSWORD_AUTH`) pointed at the local
+ * cognito-local mock. The SDK is an OPTIONAL peer dependency, lazy-imported
+ * so projects that don't need token minting never pull it in.
+ */
+import type { FetchImpl } from './types.js';
+/** Default cognito-local endpoint (matches `@venturekit/cli`'s docker-compose). */
+export declare const DEFAULT_COGNITO_ENDPOINT = "http://localhost:9229";
+export declare const DEFAULT_COGNITO_REGION = "local";
+export interface TokenSet {
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    tokenType?: string;
+}
+export interface SignInInput {
+    /** App client id (from `getDevPools`). */
+    clientId: string;
+    username: string;
+    password: string;
+    /** cognito-local endpoint. Defaults to `COGNITO_ENDPOINT` env or localhost:9229. */
+    endpoint?: string;
+    /** Region label. Defaults to `COGNITO_REGION` env or `local`. */
+    region?: string;
+}
+/** Sign in with username + password against cognito-local and return the tokens. */
+export declare function signInWithPassword(input: SignInInput): Promise<TokenSet>;
+export interface LoginAsInput {
+    /** Base URL of the running `vk dev` server (for pool lookup + user creation). */
+    baseUrl: string;
+    /** Auth intent id. Defaults to the server's first pool. */
+    intent?: string;
+    email: string;
+    password: string;
+    /** Attributes to set when creating the user (e.g. `{ tenantId: 'global' }`). */
+    attributes?: Record<string, string>;
+    /** Create the user first (idempotent). Default `true`. */
+    ensureUser?: boolean;
+    /** Override the cognito-local endpoint / region for the token call. */
+    endpoint?: string;
+    region?: string;
+    /** `fetch` implementation for the dev-server HTTP calls. */
+    fetch?: FetchImpl;
+}
+/**
+ * One-shot helper for API tests: ensure a cognito-local user exists, then
+ * sign in and return its tokens. Resolves the app client id from the dev
+ * server's provisioned pools automatically.
+ */
+export declare function loginAs(input: LoginAsInput): Promise<TokenSet>;
+//# sourceMappingURL=auth-tokens.d.ts.map

package/dist/auth-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tokens.d.ts","sourceRoot":"","sources":["../src/auth-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD,oFAAoF;AACpF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiC9E;AAED,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6BpE"}

package/dist/auth-tokens.js

@@ -0,0 +1,81 @@
+/**
+ * Mint real Cognito JWTs for a seeded cognito-local user, for API-level
+ * integration tests that need a bearer token (no browser).
+ *
+ * Uses the AWS Cognito SDK (`USER_PASSWORD_AUTH`) pointed at the local
+ * cognito-local mock. The SDK is an OPTIONAL peer dependency, lazy-imported
+ * so projects that don't need token minting never pull it in.
+ */
+import { createTestUser, getDevPools } from './cognito.js';
+/** Default cognito-local endpoint (matches `@venturekit/cli`'s docker-compose). */
+export const DEFAULT_COGNITO_ENDPOINT = 'http://localhost:9229';
+export const DEFAULT_COGNITO_REGION = 'local';
+async function loadSdk() {
+    try {
+        return await import('@aws-sdk/client-cognito-identity-provider');
+    }
+    catch {
+        throw new Error("@venturekit/testing: token minting requires '@aws-sdk/client-cognito-identity-provider'. " +
+            'Install it as a dev dependency.');
+    }
+}
+/** Sign in with username + password against cognito-local and return the tokens. */
+export async function signInWithPassword(input) {
+    const sdk = await loadSdk();
+    const endpoint = input.endpoint ?? process.env.COGNITO_ENDPOINT ?? DEFAULT_COGNITO_ENDPOINT;
+    const region = input.region ?? process.env.COGNITO_REGION ?? DEFAULT_COGNITO_REGION;
+    const client = new sdk.CognitoIdentityProviderClient({
+        region,
+        endpoint,
+        credentials: { accessKeyId: 'local-dev', secretAccessKey: 'local-dev' },
+    });
+    const res = await client.send(new sdk.InitiateAuthCommand({
+        AuthFlow: 'USER_PASSWORD_AUTH',
+        ClientId: input.clientId,
+        AuthParameters: { USERNAME: input.username, PASSWORD: input.password },
+    }));
+    const auth = res.AuthenticationResult;
+    if (!auth?.IdToken || !auth.AccessToken) {
+        throw new Error(`signInWithPassword: no tokens returned for ${input.username}` +
+            (res.ChallengeName ? ` (challenge: ${res.ChallengeName})` : ''));
+    }
+    return {
+        idToken: auth.IdToken,
+        accessToken: auth.AccessToken,
+        refreshToken: auth.RefreshToken,
+        expiresIn: auth.ExpiresIn,
+        tokenType: auth.TokenType,
+    };
+}
+/**
+ * One-shot helper for API tests: ensure a cognito-local user exists, then
+ * sign in and return its tokens. Resolves the app client id from the dev
+ * server's provisioned pools automatically.
+ */
+export async function loginAs(input) {
+    if (input.ensureUser !== false) {
+        await createTestUser({
+            baseUrl: input.baseUrl,
+            intent: input.intent,
+            email: input.email,
+            password: input.password,
+            attributes: input.attributes,
+            fetch: input.fetch,
+        });
+    }
+    const pools = await getDevPools({ baseUrl: input.baseUrl, intent: input.intent, fetch: input.fetch });
+    const intentId = input.intent ?? Object.keys(pools.pools)[0];
+    const pool = intentId ? pools.pools[intentId] : undefined;
+    if (!pool) {
+        throw new Error(`loginAs: no cognito-local pool found${intentId ? ` for intent '${intentId}'` : ''}. ` +
+            'Has `vk dev` started with an `auth` intent?');
+    }
+    return signInWithPassword({
+        clientId: pool.clientId,
+        username: input.email,
+        password: input.password,
+        endpoint: input.endpoint,
+        region: input.region,
+    });
+}
+//# sourceMappingURL=auth-tokens.js.map

package/dist/auth-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tokens.js","sourceRoot":"","sources":["../src/auth-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAK3D,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAqB9C,KAAK,UAAU,OAAO;IACpB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2FAA2F;YACzF,iCAAiC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;IAEpF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC;QACnD,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE;KACxE,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,GAAG,CAAC,mBAAmB,CAAC;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACvE,CAAC,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8CAA8C,KAAK,CAAC,QAAQ,EAAE;YAC5D,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;YACpF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC;QACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,68 @@
+/**
+ * A small, typed HTTP client for driving a running VentureKit API in
+ * integration / end-to-end tests.
+ *
+ * It understands VentureKit's response envelope:
+ *   - success → `{ data, meta }` (status 2xx); `.data` is unwrapped for you.
+ *   - error   → `{ error: { code, message, details? } }`; thrown as `ApiError`.
+ *
+ * Everything is plain `fetch`, so it works against `vk dev`, a deployed
+ * API, or any HTTP base URL. Inject a `fetch` to stub it in unit tests.
+ */
+import type { FetchImpl, QueryValue } from './types.js';
+export interface ApiClientOptions {
+    /** Base URL of the API, e.g. `http://localhost:4001`. */
+    baseUrl: string;
+    /** Default bearer token applied to every request (overridable per call). */
+    token?: string;
+    /** Default `Cookie` header applied to every request (overridable per call). */
+    cookie?: string;
+    /** Default headers merged into every request. */
+    headers?: Record<string, string>;
+    /** `fetch` implementation. Defaults to the global `fetch`. */
+    fetch?: FetchImpl;
+}
+export interface RequestOptions {
+    /** Request body. Objects are JSON-encoded; strings are sent verbatim. */
+    body?: unknown;
+    /** Per-request headers (override client defaults). */
+    headers?: Record<string, string>;
+    /** Query-string params. `undefined` / `null` values are dropped. */
+    query?: Record<string, QueryValue>;
+    /** Per-request bearer token (overrides the client default). */
+    token?: string;
+    /** Per-request `Cookie` header (overrides the client default). */
+    cookie?: string;
+    /**
+     * When `false`, a non-2xx response resolves with `ok: false` instead of
+     * throwing `ApiError`. Useful for asserting error responses. Default `true`.
+     */
+    throwOnError?: boolean;
+}
+export interface ApiResponse<T = unknown> {
+    status: number;
+    ok: boolean;
+    headers: Headers;
+    /**
+     * The unwrapped payload. For a VentureKit success envelope this is the
+     * `data` field; otherwise it's the full parsed JSON (or raw text).
+     */
+    data: T;
+    /** The full parsed JSON body (envelope included), or raw text if not JSON. */
+    raw: unknown;
+    /** The raw response text. */
+    text: string;
+}
+export interface ApiClient {
+    readonly baseUrl: string;
+    request<T = unknown>(method: string, path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+    get<T = unknown>(path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+    post<T = unknown>(path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+    put<T = unknown>(path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+    patch<T = unknown>(path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+    del<T = unknown>(path: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+}
+/** Join a base URL + path + query string into an absolute URL. */
+export declare function buildUrl(baseUrl: string, path: string, query?: Record<string, QueryValue>): string;
+export declare function createApiClient(options: ApiClientOptions): ApiClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC;IACR,8EAA8E;IAC9E,GAAG,EAAE,OAAO,CAAC;IACb,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CACnF;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GACjC,MAAM,CAcR;AAgBD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAgFpE"}

package/dist/client.js

@@ -0,0 +1,114 @@
+/**
+ * A small, typed HTTP client for driving a running VentureKit API in
+ * integration / end-to-end tests.
+ *
+ * It understands VentureKit's response envelope:
+ *   - success → `{ data, meta }` (status 2xx); `.data` is unwrapped for you.
+ *   - error   → `{ error: { code, message, details? } }`; thrown as `ApiError`.
+ *
+ * Everything is plain `fetch`, so it works against `vk dev`, a deployed
+ * API, or any HTTP base URL. Inject a `fetch` to stub it in unit tests.
+ */
+import { ApiError } from './errors.js';
+/** Join a base URL + path + query string into an absolute URL. */
+export function buildUrl(baseUrl, path, query) {
+    const base = baseUrl.replace(/\/+$/, '');
+    const suffix = path.startsWith('/') ? path : `/${path}`;
+    let url = `${base}${suffix}`;
+    if (query) {
+        const usp = new URLSearchParams();
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined || value === null)
+                continue;
+            usp.append(key, String(value));
+        }
+        const qs = usp.toString();
+        if (qs)
+            url += (url.includes('?') ? '&' : '?') + qs;
+    }
+    return url;
+}
+/** Case-insensitive header presence check. */
+function hasHeader(headers, name) {
+    const lower = name.toLowerCase();
+    return Object.keys(headers).some((k) => k.toLowerCase() === lower);
+}
+/** Pull the unwrapped `data` field out of a VentureKit success envelope. */
+function unwrapData(raw) {
+    if (raw && typeof raw === 'object' && !Array.isArray(raw) && 'data' in raw) {
+        return raw.data;
+    }
+    return raw;
+}
+export function createApiClient(options) {
+    const doFetch = options.fetch ?? fetch;
+    const defaultHeaders = options.headers ?? {};
+    async function request(method, path, reqOptions = {}) {
+        const url = buildUrl(options.baseUrl, path, reqOptions.query);
+        const headers = { ...defaultHeaders, ...(reqOptions.headers ?? {}) };
+        const token = reqOptions.token ?? options.token;
+        if (token && !hasHeader(headers, 'authorization')) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+        const cookie = reqOptions.cookie ?? options.cookie;
+        if (cookie && !hasHeader(headers, 'cookie')) {
+            headers['Cookie'] = cookie;
+        }
+        let body;
+        if (reqOptions.body !== undefined) {
+            if (typeof reqOptions.body === 'string') {
+                body = reqOptions.body;
+            }
+            else {
+                body = JSON.stringify(reqOptions.body);
+                if (!hasHeader(headers, 'content-type')) {
+                    headers['Content-Type'] = 'application/json';
+                }
+            }
+        }
+        const res = await doFetch(url, { method, headers, body });
+        const text = await res.text();
+        let raw;
+        if (text) {
+            try {
+                raw = JSON.parse(text);
+            }
+            catch {
+                raw = text;
+            }
+        }
+        const throwOnError = reqOptions.throwOnError ?? true;
+        if (!res.ok && throwOnError) {
+            const envelope = raw && typeof raw === 'object' && 'error' in raw
+                ? raw.error
+                : undefined;
+            throw new ApiError({
+                status: res.status,
+                method,
+                url,
+                message: envelope?.message ?? `HTTP ${res.status} for ${method} ${url}`,
+                code: envelope?.code,
+                details: envelope?.details,
+                body: raw ?? text,
+            });
+        }
+        return {
+            status: res.status,
+            ok: res.ok,
+            headers: res.headers,
+            data: unwrapData(raw),
+            raw,
+            text,
+        };
+    }
+    return {
+        baseUrl: options.baseUrl,
+        request,
+        get: (path, opts) => request('GET', path, opts),
+        post: (path, opts) => request('POST', path, opts),
+        put: (path, opts) => request('PUT', path, opts),
+        patch: (path, opts) => request('PATCH', path, opts),
+        del: (path, opts) => request('DELETE', path, opts),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA2DvC,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,IAAY,EACZ,KAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxD,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE;YAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8CAA8C;AAC9C,SAAS,SAAS,CAAC,OAA+B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3E,OAAQ,GAAyB,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,OAAO,GAAc,OAAO,CAAC,KAAK,IAAK,KAAmB,CAAC;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAE7C,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,aAA6B,EAAE;QAE/B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAE7F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;QAChD,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAC7B,CAAC;QAED,IAAI,IAAwB,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAY,CAAC;QACjB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,YAAY,EAAE,CAAC;YAC5B,MAAM,QAAQ,GACZ,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,GAAG;gBAC9C,CAAC,CAAE,GAA0E,CAAC,KAAK;gBACnF,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,QAAQ,CAAC;gBACjB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM;gBACN,GAAG;gBACH,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,QAAQ,MAAM,IAAI,GAAG,EAAE;gBACvE,IAAI,EAAE,QAAQ,EAAE,IAAI;gBACpB,OAAO,EAAE,QAAQ,EAAE,OAAO;gBAC1B,IAAI,EAAE,GAAG,IAAI,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAM;YAC1B,GAAG;YACH,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/cognito.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Create / manage cognito-local users over the `vk dev` server's
+ * `/_dev/cognito/*` admin API.
+ *
+ * `vk dev` provisions a cognito-local user pool for each `auth` intent
+ * and exposes a guarded admin API (loopback + `VENTURE_LOCAL=true` only)
+ * that the `/_dev/users` page uses. These helpers reuse that same API so
+ * tests can seed a known login WITHOUT importing the AWS SDK.
+ *
+ * To obtain an actual JWT for a seeded user (e.g. for API-level tests),
+ * see `signInWithPassword` in `auth-tokens.ts`.
+ */
+import type { FetchImpl } from './types.js';
+/** Identifies which `vk dev` server (and optionally which auth intent) to talk to. */
+export interface DevServerRef {
+    /** Base URL of the running `vk dev` server, e.g. `http://localhost:4001`. */
+    baseUrl: string;
+    /** Auth intent id. Defaults to the server's first declared intent. */
+    intent?: string;
+    /** `fetch` implementation. Defaults to the global `fetch`. */
+    fetch?: FetchImpl;
+}
+export interface CreateTestUserInput extends DevServerRef {
+    email: string;
+    password: string;
+    /**
+     * Extra attributes. Unprefixed custom attribute names get `custom:`
+     * added automatically by the dev server (e.g. `{ tenantId: 'global' }`
+     * → `custom:tenantId`). `email` + `email_verified=true` are always set.
+     */
+    attributes?: Record<string, string>;
+}
+export interface DevPool {
+    userPoolId: string;
+    clientId: string;
+    count: number | null;
+}
+export interface DevPoolsResult {
+    project: string;
+    endpoint: string | null;
+    intents: Array<{
+        id: string;
+        signInWith?: string[];
+        allowSignUp?: boolean;
+        customAttributes: string[];
+    }>;
+    pools: Record<string, DevPool>;
+}
+/**
+ * List the cognito-local pools `vk dev` has provisioned for this project,
+ * including each pool's `userPoolId` / `clientId` (needed to mint tokens).
+ */
+export declare function getDevPools(ref: DevServerRef): Promise<DevPoolsResult>;
+/**
+ * Create a cognito-local user with a PERMANENT password (ready to log in
+ * immediately — no FORCE_CHANGE_PASSWORD step). Idempotent: if the user
+ * already exists, its password is reset to the supplied value.
+ */
+export declare function createTestUser(input: CreateTestUserInput): Promise<void>;
+/** Set (or update) attributes on an existing cognito-local user. */
+export declare function setTestUserAttributes(input: DevServerRef & {
+    email: string;
+    attributes: Record<string, string>;
+}): Promise<void>;
+/** Delete a cognito-local user. A missing user (404) is treated as success. */
+export declare function deleteTestUser(input: DevServerRef & {
+    email: string;
+}): Promise<void>;
+//# sourceMappingURL=cognito.d.ts.map

package/dist/cognito.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.d.ts","sourceRoot":"","sources":["../src/cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9E;AAED,oEAAoE;AACpE,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,+EAA+E;AAC/E,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/cognito.js

@@ -0,0 +1,76 @@
+/**
+ * Create / manage cognito-local users over the `vk dev` server's
+ * `/_dev/cognito/*` admin API.
+ *
+ * `vk dev` provisions a cognito-local user pool for each `auth` intent
+ * and exposes a guarded admin API (loopback + `VENTURE_LOCAL=true` only)
+ * that the `/_dev/users` page uses. These helpers reuse that same API so
+ * tests can seed a known login WITHOUT importing the AWS SDK.
+ *
+ * To obtain an actual JWT for a seeded user (e.g. for API-level tests),
+ * see `signInWithPassword` in `auth-tokens.ts`.
+ */
+import { createApiClient } from './client.js';
+import { ApiError } from './errors.js';
+function queryFor(intent) {
+    return intent ? { intent } : undefined;
+}
+/**
+ * List the cognito-local pools `vk dev` has provisioned for this project,
+ * including each pool's `userPoolId` / `clientId` (needed to mint tokens).
+ */
+export async function getDevPools(ref) {
+    const api = createApiClient({ baseUrl: ref.baseUrl, fetch: ref.fetch });
+    const res = await api.get('/_dev/cognito/pools');
+    return res.data;
+}
+/**
+ * Create a cognito-local user with a PERMANENT password (ready to log in
+ * immediately — no FORCE_CHANGE_PASSWORD step). Idempotent: if the user
+ * already exists, its password is reset to the supplied value.
+ */
+export async function createTestUser(input) {
+    const { baseUrl, intent, email, password, attributes } = input;
+    const api = createApiClient({ baseUrl, fetch: input.fetch });
+    const query = queryFor(intent);
+    try {
+        await api.post('/_dev/cognito/users', {
+            body: { email, password, attributes },
+            query,
+        });
+        return;
+    }
+    catch (err) {
+        // 409 = user already exists; fall through to reset the password so the
+        // login is deterministic across repeated test runs. Anything else is fatal.
+        if (!(err instanceof ApiError) || err.status !== 409)
+            throw err;
+    }
+    await api.post(`/_dev/cognito/users/${encodeURIComponent(email)}/password`, {
+        body: { password, permanent: true },
+        query,
+    });
+}
+/** Set (or update) attributes on an existing cognito-local user. */
+export async function setTestUserAttributes(input) {
+    const api = createApiClient({ baseUrl: input.baseUrl, fetch: input.fetch });
+    await api.post(`/_dev/cognito/users/${encodeURIComponent(input.email)}/attributes`, {
+        body: { attributes: input.attributes },
+        query: queryFor(input.intent),
+    });
+}
+/** Delete a cognito-local user. A missing user (404) is treated as success. */
+export async function deleteTestUser(input) {
+    const api = createApiClient({ baseUrl: input.baseUrl, fetch: input.fetch });
+    try {
+        await api.del(`/_dev/cognito/users/${encodeURIComponent(input.email)}`, {
+            query: queryFor(input.intent),
+        });
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404)
+            return;
+        throw err;
+    }
+}
+//# sourceMappingURL=cognito.js.map

package/dist/cognito.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.js","sourceRoot":"","sources":["../src/cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA0CvC,SAAS,QAAQ,CAAC,MAAe;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAiB;IACjD,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAiB,qBAAqB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACpC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE;YACrC,KAAK;SACN,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE;QAC1E,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;QACnC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2E;IAE3E,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE;QAClF,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAuC;IAEvC,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE;YACtE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAC1D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}