@zitadel/testing 0.0.0 → 0.1.0-alpha.18

package/README.md

@@ -1,7 +1,7 @@
 # @zitadel/testing
 
 Test-kit for **seeded ephemeral local Zitadel instances**: boot the real server
-(binary runtime + embedded Postgres, no Docker) from test code, create a
+(binary runtime + SQLite by default, no Docker) from test code, create a
 project with the default login flow, and mint password users that can complete
 the real login journey immediately.
 
@@ -54,15 +54,12 @@ export default defineConfig({
 
 ```ts
 // my-login.spec.ts
-import { expect, test } from "@zitadel/testing/playwright";
+import { expect, loginWithPassword, test } from "@zitadel/testing/playwright";
 
 test("user signs in with password", async ({ page, seed }) => {
   const user = await seed.user(); // unique email + password, loginable now
   await page.goto("/login");
-  await page.getByLabel(/email/i).fill(user.email);
-  await page.getByRole("button", { name: "Sign in", exact: true }).click();
-  await page.getByLabel(/password/i).fill(user.password);
-  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await loginWithPassword(page, user); // drives the identifier → password steps
   await expect(page).toHaveURL(/\/admin/);
 });
 ```
@@ -96,6 +93,65 @@ log in through the UI for those. `seed.identity()` complements registration
 specs: an unused email+password that creates nothing, so the flow under test
 must create the user.
 
+### Drive the login flow
+
+Four ceremony helpers complete whole auth journeys against the
+`<zitadel-login>` widget. They are built on the widget's documented
+automation hooks (`zitadel-action-*`, `zitadel-field-*` / `zitadel-input-*`),
+not on translated button texts, so they survive locale and copy changes:
+
+```ts
+import {
+  loginWithPassword, // identifier → password (handles combined steps too)
+  loginWithPasskey, // identifier-first; or one-tap without an email
+  registerWithPassword, // unknown identifier → registration → password path
+  registerWithPasskey, // unknown identifier → registration → passkey ceremony
+} from "@zitadel/testing/playwright";
+
+await page.goto("/login");
+await registerWithPassword(page, { email, password });
+// assert your app's signed-in surface — the helpers never assert app state
+```
+
+They assume the default flow vocabulary (`submit` / `passkey` /
+`passkey_register` actions, `email` and password fields) and branch only on
+what the flow renders: flows that require extra registration fields get them
+via `profile: [{ field, value }]`, filled when present — a boolean value
+drives a checkbox, a string matches a select option or fills a text-like
+input. For custom flows or single steps, `flowAction(page, name)` /
+`flowField(page, name)` return plain locators for the same hooks, with
+`clickFlowAction` / `fillFlowField` as one-line wrappers. Broad fallbacks
+(accessible names via `{ name }` / `{ label }`, the generic `data-action`
+attribute) are scoped to the `<zitadel-login>` host element — so they never
+match same-named controls in your app's own chrome, and they keep working
+for custom templates that render no automation hooks.
+
+### Test passkey flows
+
+`enableVirtualPasskey(page)` — also available as the on-demand `passkey`
+fixture — attaches a CDP virtual authenticator to the page (a platform
+authenticator with discoverable credentials and automatic user presence), so
+the real registration and login ceremonies complete without an OS dialog:
+
+```ts
+test("registers and signs in with a passkey", async ({ page, seed, passkey }) => {
+  const who = seed.identity();
+  await page.goto("/login");
+  await registerWithPasskey(page, { email: who.email });
+  await expect.poll(() => passkey.credentialCount()).toBe(1);
+});
+```
+
+Constraints, all inherent to WebAuthn/CDP: Chromium projects only (the CDP
+WebAuthn domain exists nowhere else); the authenticator is bound to the page,
+so register and sign back in on the same page (sign out by clearing cookies
+instead of opening a fresh context); and serve the app on an origin WebAuthn
+accepts as a relying-party ID — HTTPS on a real domain, or `http://localhost`
+for local tests; raw IP origins like `127.0.0.1` are invalid. The default
+`password-first` flow offers passkey registration at the registration-choice
+step; boot `preset: "passkey-first"` for one-tap discoverable-credential
+login flows.
+
 The two in-repo consumers are `apps/demo-next-e2e/playwright.real.config.mts`
 and `apps/console-e2e/playwright.real.config.mts` — run them with
 `moon run demo-next-e2e:e2e-real` / `moon run console-e2e:e2e-real`.
@@ -122,7 +178,7 @@ import {
 const z = await startLocalZitadel({
   port,          // default: free port
   dir,           // default: temp dir, removed on stop (caller dirs are kept)
-  appOrigins,    // registered as the project's previewOrigins
+  appOrigins,    // registered as the project's preview_origins
   useCase,       // "minimal" (default) | "consumer" | "business"
   preset,        // "password-first" (default)
   serverBinary,  // ZITADEL_SERVER_BINARY override (in-repo: dist/server/nextgen)
@@ -136,7 +192,7 @@ await z.seedUser({ email?, password?, attributes? }); // → { id, email, passwo
 await z.seedUsers(8, { email?, password?, attributes? }); // per-index templates
 z.identity(); // unused { email, password } — creates nothing
 await z.seedSession({ user? }); // → { user, sessionToken, expiresAt, cookie }
-await z.stop(); // stop server, reap embedded Postgres, remove owned temp dir
+await z.stop(); // stop server and remove owned temp dir
 ```
 
 `connectZitadel(handle)` returns the same surface minus lifecycle — this is
@@ -144,23 +200,27 @@ what the Playwright fixtures use, and what a future remote-instance mode would
 build on.
 
 From `@zitadel/testing/playwright`: the `test`/`expect` fixtures (`seed.user()`
-per test, `zitadel` per worker), plus `withZitadel(options)` returning
-`{ webServer }` for the config, and `nextAppEnv`/`applyAppEnvTemplate` for the
-env-template mechanism described above.
+per test, `zitadel` per worker, `passkey` on demand), the flow ceremonies
+(`loginWithPassword`, `loginWithPasskey`, `registerWithPassword`,
+`registerWithPasskey`) with their locator-level escape hatches
+(`flowAction`/`flowField`, `clickFlowAction`/`fillFlowField`), plus
+`withZitadel(options)` returning `{ webServer }` for the config,
+`enableVirtualPasskey(page)` for non-fixture pages, and
+`nextAppEnv`/`applyAppEnvTemplate` for the env-template mechanism described
+above.
 
 ## How it works
 
 - **Lifecycle** shells out to `zitadel start/stop --json` (the CLI owns port
-  preflight, the health wait, process-group stop, and embedded-Postgres
-  reaping). Swapping this for direct library calls later will not change the
-  public API.
+  preflight, the health wait, and process-group stop). Swapping this for direct
+  library calls later will not change the public API.
 - **Bootstrap** is the server-side half of `zitadel setup`, no files:
-  `POST /projects` (unauthenticated; returns the `projectSecret` used as
+  `POST /projects` (unauthenticated; returns the `project_secret` used as
   bearer for everything else) → `POST /schemas` (server assigns the schema id)
   → `POST /flow_definitions` (default login flow pinned to that schema id).
   Templates come from `@zitadel/config/defaults`.
 - **Seeding** is `POST /users` (the body carries `$schema: <schema id>`) +
-  `PUT /users/{id}/password` with `isChangeRequired: false`.
+  `PUT /users/{id}/password` with `is_change_required: false`.
 
 ## Parallelism model
 
@@ -169,13 +229,13 @@ project, so per-test `seed.user()` calls are isolation enough for login-flow
 tests, and tests run fully parallel against the shared instance
 (demonstrated by `demo-next-e2e:e2e-real`, 2 workers).
 
-Measured on an arm64 macBook (dev build, July 2026):
+Typical timings with the SQLite local default (dev build, July 2026 — estimates, not a fresh remeasure):
 
 | Operation | Time |
 | --- | --- |
-| Cold boot (fresh data dir: initdb + migrations + health) | ~20–27s |
-| Warm restart (existing data dir) | ~15s |
-| Stop incl. embedded-Postgres reap | ~12s |
+| Cold boot (fresh data dir: SQLite migrate + health) | typically under a few seconds |
+| Warm restart (existing data dir) | typically under a second |
+| Stop | typically under a second |
 | Bootstrap (project + schema + flow) | ~100ms |
 | Seed one user (create + password) | ~50ms |
 | Full `e2e-real` suite (boot + Next dev + 2 browser tests) | ~25s |
@@ -211,8 +271,8 @@ Customer installs need none of this.
   processes (Playwright workers) are unaffected.
 - macOS/Linux only for now. Not because of the port preflight (it degrades
   gracefully where `lsof` is missing) — the untested surface on Windows is the
-  process-group stop and embedded-Postgres lifecycle. Revisit once the local
-  runtime's SQLite default removes the Postgres component.
+  process-group stop for the local binary runtime. Revisit when Windows local
+  runtime support is a goal.
 
 ## Roadmap
 
@@ -238,19 +298,20 @@ on top, in intended order:
    `bootstrapProject({ baseUrl })` + `connectZitadel(handle)` already compose
    into this today; formalizing it means cleanup semantics and docs.
 5. **Vercel Sandbox runtime.** A publicly reachable ephemeral instance per
-   preview deployment (e.g. `@zitadel/testing/vercel`), returning the same
-   `InstanceHandle` so fixtures don't change. Gated on a spike: embedded
-   Postgres on the Sandbox image, forwarded proto/host handling, secure
-   cookies + issuer + handoff verification through `sandbox.domain()`,
-   registering the preview URL as an allowed origin post-deploy
-   (`PATCH /projects`), and cleanup that survives failed runs.
+  preview deployment (e.g. `@zitadel/testing/vercel`), returning the same
+  `InstanceHandle` so fixtures don't change. Gated on a spike: SQLite (or
+  another Sandbox-friendly store) on the Sandbox image, forwarded proto/host
+  handling, secure cookies + issuer + handoff verification through
+  `sandbox.domain()`, registering the preview URL as an allowed origin
+  post-deploy (`PATCH /projects`), and cleanup that survives failed runs.
 6. **Publishing.** Landed: the consumer journey installs the kit the way a
-   customer would in CI, and the kit ships on the release train (release
-   manifest + changeset `fixed` group), versioned in lockstep with
-   `@zitadel/cli`. Remaining: the Windows decision (deferred until the SQLite
-   local default removes the embedded-Postgres lifecycle) and the stability
-   commitment when the train leaves alpha.
-
-Parked until server support exists: passkey seeding (pre-registered WebAuthn
-credentials). Independent refactor: extract `apps/cli/src/lib/local-server`
-into a shared package and swap the lifecycle shell-out for imports.
+  customer would in CI, and the kit ships on the release train (release
+  manifest + changeset `fixed` group), versioned in lockstep with
+  `@zitadel/cli`. Remaining: the Windows decision for the local binary
+  runtime and the stability commitment when the train leaves alpha.
+
+Parked until server support exists: passkey *seeding* (pre-registered WebAuthn
+credentials) — UI-driven passkey ceremonies are covered today by
+`enableVirtualPasskey`. Independent refactor: extract
+`apps/cli/src/lib/local-server` into a shared package and swap the lifecycle
+shell-out for imports.

package/dist/app-runner.cjs

@@ -1,4 +1,4 @@
-const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_handshake = require("./handshake-CRKcgkfN.cjs");
 const require_orchestration = require("./orchestration-D7QBgQ0l.cjs");
 let node_child_process = require("node:child_process");
 //#region src/app-runner.ts

package/dist/app-runner.mjs

@@ -1,4 +1,4 @@
-import { i as applyAppEnvTemplate, n as waitForHandshake } from "./handshake-BPtWruO8.mjs";
+import { i as applyAppEnvTemplate, n as waitForHandshake } from "./handshake-ClzWvG8z.mjs";
 import { i as parseAppRunnerConfig, o as requireHandshakePath, t as APP_RUNNER_CONFIG_ENV } from "./orchestration-C640_1Lg.mjs";
 import { spawn } from "node:child_process";
 //#region src/app-runner.ts

package/dist/{handshake-CggSIoxF.cjs → handshake-CRKcgkfN.cjs}

@@ -53,13 +53,14 @@ async function waitForHandshake(path, timeoutMs = 6e4) {
 	}
 }
 function validateHandle(value, source) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`handshake file ${source} is not an object`);
 	const handle = value;
 	for (const field of [
 		"baseUrl",
 		"projectId",
 		"projectSecret",
 		"schemaId"
-	]) if (typeof handle?.[field] !== "string" || handle[field].length === 0) throw new Error(`handshake file ${source} is missing "${field}"`);
+	]) if (typeof handle[field] !== "string" || handle[field].length === 0) throw new Error(`handshake file ${source} is missing "${field}"`);
 	if (!URL.canParse(handle.baseUrl)) throw new Error(`handshake file ${source} has a malformed "baseUrl": ${handle.baseUrl}`);
 	return handle;
 }
@@ -95,4 +96,4 @@ Object.defineProperty(exports, "writeHandshake", {
 	}
 });
 
-//# sourceMappingURL=handshake-CggSIoxF.cjs.map
+//# sourceMappingURL=handshake-CRKcgkfN.cjs.map

package/dist/{handshake-CggSIoxF.cjs.map → handshake-CRKcgkfN.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"handshake-CggSIoxF.cjs","names":[],"sources":["../src/app-env.ts","../src/handshake.ts"],"sourcesContent":["import type { InstanceHandle } from \"./types\";\n\n/**\n * Declarative mapping from an app's env var names to InstanceHandle fields.\n * A template (not a function) so it can cross process boundaries: the\n * Playwright config serializes it into the app-runner's environment, where it\n * is applied to the handle read from the handshake file.\n */\nexport type AppEnvTemplate = Record<string, keyof InstanceHandle>;\n\n/**\n * The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own\n * template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`\n * names, for example.\n */\nexport const nextAppEnv: AppEnvTemplate = {\n  ZITADEL_URL: \"baseUrl\",\n  NEXT_PUBLIC_ZITADEL_PROJECT_ID: \"projectId\",\n  ZITADEL_PROJECT_SECRET: \"projectSecret\",\n};\n\nexport function applyAppEnvTemplate(\n  template: AppEnvTemplate,\n  handle: InstanceHandle,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [name, field] of Object.entries(template)) {\n    const value = handle[field];\n    if (typeof value !== \"string\" || value.length === 0) {\n      // Fail instead of silently dropping the var: an app booted without one\n      // of its env vars produces a much harder-to-read failure downstream.\n      throw new Error(\n        `app env template maps \"${name}\" to handle field \"${field}\", which the instance handle does not carry`,\n      );\n    }\n    env[name] = value;\n  }\n  return env;\n}\n","import { readFileSync } from \"node:fs\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\n\nimport type { InstanceHandle } from \"./types\";\n\n/**\n * The handshake file carries an InstanceHandle across process boundaries:\n * written by the script that boots + bootstraps the instance, read by\n * Playwright workers (fixtures) and the app dev-server wrapper.\n */\nexport async function writeHandshake(path: string, handle: InstanceHandle): Promise<void> {\n  await mkdir(dirname(path), { recursive: true });\n  await writeFile(path, `${JSON.stringify(handle, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function readHandshakeSync(path: string): InstanceHandle {\n  const contents = readFileSync(path, \"utf8\");\n  let value: unknown;\n  try {\n    value = JSON.parse(contents);\n  } catch (error) {\n    throw new Error(`handshake file ${path} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n  return validateHandle(value, path);\n}\n\nexport async function waitForHandshake(path: string, timeoutMs = 60_000): Promise<InstanceHandle> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    try {\n      return validateHandle(JSON.parse(await readFile(path, \"utf8\")), path);\n    } catch (error) {\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `handshake file not readable within ${timeoutMs}ms: ${path} (${(error as Error).message})`,\n          { cause: error },\n        );\n      }\n      await sleep(250);\n    }\n  }\n}\n\nfunction validateHandle(value: unknown, source: string): InstanceHandle {\n  const handle = value as Partial<InstanceHandle> | null;\n  for (const field of [\"baseUrl\", \"projectId\", \"projectSecret\", \"schemaId\"] as const) {\n    if (typeof handle?.[field] !== \"string\" || handle[field].length === 0) {\n      throw new Error(`handshake file ${source} is missing \"${field}\"`);\n    }\n  }\n  if (!URL.canParse(handle.baseUrl as string)) {\n    throw new Error(`handshake file ${source} has a malformed \"baseUrl\": ${handle.baseUrl}`);\n  }\n  return handle as InstanceHandle;\n}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,aAA6B;CACxC,aAAa;CACb,gCAAgC;CAChC,wBAAwB;CACzB;AAED,SAAgB,oBACd,UACA,QACwB;CACxB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;EACpD,MAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAGhD,OAAM,IAAI,MACR,0BAA0B,KAAK,qBAAqB,MAAM,6CAC3D;AAEH,MAAI,QAAQ;;AAEd,QAAO;;;;;;;;;ACzBT,eAAsB,eAAe,MAAc,QAAuC;AACxF,QAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,QAAA,GAAA,iBAAA,WAAgB,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAGhF,SAAgB,kBAAkB,MAA8B;CAC9D,MAAM,YAAA,GAAA,QAAA,cAAwB,MAAM,OAAO;CAC3C,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,SAAS;UACrB,OAAO;AACd,QAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA2B,MAAgB,WAAW,EAC3F,OAAO,OACR,CAAC;;AAEJ,QAAO,eAAe,OAAO,KAAK;;AAGpC,eAAsB,iBAAiB,MAAc,YAAY,KAAiC;CAChG,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,SACE,KAAI;AACF,SAAO,eAAe,KAAK,MAAM,OAAA,GAAA,iBAAA,UAAe,MAAM,OAAO,CAAC,EAAE,KAAK;UAC9D,OAAO;AACd,MAAI,KAAK,KAAK,IAAI,SAChB,OAAM,IAAI,MACR,sCAAsC,UAAU,MAAM,KAAK,IAAK,MAAgB,QAAQ,IACxF,EAAE,OAAO,OAAO,CACjB;AAEH,SAAA,GAAA,qBAAA,YAAY,IAAI;;;AAKtB,SAAS,eAAe,OAAgB,QAAgC;CACtE,MAAM,SAAS;AACf,MAAK,MAAM,SAAS;EAAC;EAAW;EAAa;EAAiB;EAAW,CACvE,KAAI,OAAO,SAAS,WAAW,YAAY,OAAO,OAAO,WAAW,EAClE,OAAM,IAAI,MAAM,kBAAkB,OAAO,eAAe,MAAM,GAAG;AAGrE,KAAI,CAAC,IAAI,SAAS,OAAO,QAAkB,CACzC,OAAM,IAAI,MAAM,kBAAkB,OAAO,8BAA8B,OAAO,UAAU;AAE1F,QAAO"}
+{"version":3,"file":"handshake-CRKcgkfN.cjs","names":[],"sources":["../src/app-env.ts","../src/handshake.ts"],"sourcesContent":["import type { InstanceHandle } from \"./types\";\n\n/**\n * Declarative mapping from an app's env var names to InstanceHandle fields.\n * A template (not a function) so it can cross process boundaries: the\n * Playwright config serializes it into the app-runner's environment, where it\n * is applied to the handle read from the handshake file.\n */\nexport type AppEnvTemplate = Record<string, keyof InstanceHandle>;\n\n/**\n * The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own\n * template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`\n * names, for example.\n */\nexport const nextAppEnv: AppEnvTemplate = {\n  ZITADEL_URL: \"baseUrl\",\n  NEXT_PUBLIC_ZITADEL_PROJECT_ID: \"projectId\",\n  ZITADEL_PROJECT_SECRET: \"projectSecret\",\n};\n\nexport function applyAppEnvTemplate(\n  template: AppEnvTemplate,\n  handle: InstanceHandle,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [name, field] of Object.entries(template)) {\n    const value = handle[field];\n    if (typeof value !== \"string\" || value.length === 0) {\n      // Fail instead of silently dropping the var: an app booted without one\n      // of its env vars produces a much harder-to-read failure downstream.\n      throw new Error(\n        `app env template maps \"${name}\" to handle field \"${field}\", which the instance handle does not carry`,\n      );\n    }\n    env[name] = value;\n  }\n  return env;\n}\n","import { readFileSync } from \"node:fs\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\n\nimport type { InstanceHandle } from \"./types\";\n\n/**\n * The handshake file carries an InstanceHandle across process boundaries:\n * written by the script that boots + bootstraps the instance, read by\n * Playwright workers (fixtures) and the app dev-server wrapper.\n */\nexport async function writeHandshake(path: string, handle: InstanceHandle): Promise<void> {\n  await mkdir(dirname(path), { recursive: true });\n  await writeFile(path, `${JSON.stringify(handle, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function readHandshakeSync(path: string): InstanceHandle {\n  const contents = readFileSync(path, \"utf8\");\n  let value: unknown;\n  try {\n    value = JSON.parse(contents);\n  } catch (error) {\n    throw new Error(`handshake file ${path} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n  return validateHandle(value, path);\n}\n\nexport async function waitForHandshake(path: string, timeoutMs = 60_000): Promise<InstanceHandle> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    try {\n      return validateHandle(JSON.parse(await readFile(path, \"utf8\")), path);\n    } catch (error) {\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `handshake file not readable within ${timeoutMs}ms: ${path} (${(error as Error).message})`,\n          { cause: error },\n        );\n      }\n      await sleep(250);\n    }\n  }\n}\n\nfunction validateHandle(value: unknown, source: string): InstanceHandle {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new Error(`handshake file ${source} is not an object`);\n  }\n  const handle = value as Partial<InstanceHandle>;\n  for (const field of [\"baseUrl\", \"projectId\", \"projectSecret\", \"schemaId\"] as const) {\n    if (typeof handle[field] !== \"string\" || handle[field].length === 0) {\n      throw new Error(`handshake file ${source} is missing \"${field}\"`);\n    }\n  }\n  if (!URL.canParse(handle.baseUrl as string)) {\n    throw new Error(`handshake file ${source} has a malformed \"baseUrl\": ${handle.baseUrl}`);\n  }\n  return handle as InstanceHandle;\n}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,aAA6B;CACxC,aAAa;CACb,gCAAgC;CAChC,wBAAwB;CACzB;AAED,SAAgB,oBACd,UACA,QACwB;CACxB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;EACpD,MAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAGhD,OAAM,IAAI,MACR,0BAA0B,KAAK,qBAAqB,MAAM,6CAC3D;AAEH,MAAI,QAAQ;;AAEd,QAAO;;;;;;;;;ACzBT,eAAsB,eAAe,MAAc,QAAuC;AACxF,QAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,QAAA,GAAA,iBAAA,WAAgB,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAGhF,SAAgB,kBAAkB,MAA8B;CAC9D,MAAM,YAAA,GAAA,QAAA,cAAwB,MAAM,OAAO;CAC3C,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,SAAS;UACrB,OAAO;AACd,QAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA2B,MAAgB,WAAW,EAC3F,OAAO,OACR,CAAC;;AAEJ,QAAO,eAAe,OAAO,KAAK;;AAGpC,eAAsB,iBAAiB,MAAc,YAAY,KAAiC;CAChG,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,SACE,KAAI;AACF,SAAO,eAAe,KAAK,MAAM,OAAA,GAAA,iBAAA,UAAe,MAAM,OAAO,CAAC,EAAE,KAAK;UAC9D,OAAO;AACd,MAAI,KAAK,KAAK,IAAI,SAChB,OAAM,IAAI,MACR,sCAAsC,UAAU,MAAM,KAAK,IAAK,MAAgB,QAAQ,IACxF,EAAE,OAAO,OAAO,CACjB;AAEH,SAAA,GAAA,qBAAA,YAAY,IAAI;;;AAKtB,SAAS,eAAe,OAAgB,QAAgC;AACtE,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,OAAM,IAAI,MAAM,kBAAkB,OAAO,mBAAmB;CAE9D,MAAM,SAAS;AACf,MAAK,MAAM,SAAS;EAAC;EAAW;EAAa;EAAiB;EAAW,CACvE,KAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,WAAW,EAChE,OAAM,IAAI,MAAM,kBAAkB,OAAO,eAAe,MAAM,GAAG;AAGrE,KAAI,CAAC,IAAI,SAAS,OAAO,QAAkB,CACzC,OAAM,IAAI,MAAM,kBAAkB,OAAO,8BAA8B,OAAO,UAAU;AAE1F,QAAO"}

package/dist/{handshake-BPtWruO8.mjs → handshake-ClzWvG8z.mjs}

@@ -53,17 +53,18 @@ async function waitForHandshake(path, timeoutMs = 6e4) {
 	}
 }
 function validateHandle(value, source) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`handshake file ${source} is not an object`);
 	const handle = value;
 	for (const field of [
 		"baseUrl",
 		"projectId",
 		"projectSecret",
 		"schemaId"
-	]) if (typeof handle?.[field] !== "string" || handle[field].length === 0) throw new Error(`handshake file ${source} is missing "${field}"`);
+	]) if (typeof handle[field] !== "string" || handle[field].length === 0) throw new Error(`handshake file ${source} is missing "${field}"`);
 	if (!URL.canParse(handle.baseUrl)) throw new Error(`handshake file ${source} has a malformed "baseUrl": ${handle.baseUrl}`);
 	return handle;
 }
 //#endregion
 export { nextAppEnv as a, applyAppEnvTemplate as i, waitForHandshake as n, writeHandshake as r, readHandshakeSync as t };
 
-//# sourceMappingURL=handshake-BPtWruO8.mjs.map
+//# sourceMappingURL=handshake-ClzWvG8z.mjs.map

package/dist/{handshake-BPtWruO8.mjs.map → handshake-ClzWvG8z.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"handshake-BPtWruO8.mjs","names":["sleep"],"sources":["../src/app-env.ts","../src/handshake.ts"],"sourcesContent":["import type { InstanceHandle } from \"./types\";\n\n/**\n * Declarative mapping from an app's env var names to InstanceHandle fields.\n * A template (not a function) so it can cross process boundaries: the\n * Playwright config serializes it into the app-runner's environment, where it\n * is applied to the handle read from the handshake file.\n */\nexport type AppEnvTemplate = Record<string, keyof InstanceHandle>;\n\n/**\n * The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own\n * template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`\n * names, for example.\n */\nexport const nextAppEnv: AppEnvTemplate = {\n  ZITADEL_URL: \"baseUrl\",\n  NEXT_PUBLIC_ZITADEL_PROJECT_ID: \"projectId\",\n  ZITADEL_PROJECT_SECRET: \"projectSecret\",\n};\n\nexport function applyAppEnvTemplate(\n  template: AppEnvTemplate,\n  handle: InstanceHandle,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [name, field] of Object.entries(template)) {\n    const value = handle[field];\n    if (typeof value !== \"string\" || value.length === 0) {\n      // Fail instead of silently dropping the var: an app booted without one\n      // of its env vars produces a much harder-to-read failure downstream.\n      throw new Error(\n        `app env template maps \"${name}\" to handle field \"${field}\", which the instance handle does not carry`,\n      );\n    }\n    env[name] = value;\n  }\n  return env;\n}\n","import { readFileSync } from \"node:fs\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\n\nimport type { InstanceHandle } from \"./types\";\n\n/**\n * The handshake file carries an InstanceHandle across process boundaries:\n * written by the script that boots + bootstraps the instance, read by\n * Playwright workers (fixtures) and the app dev-server wrapper.\n */\nexport async function writeHandshake(path: string, handle: InstanceHandle): Promise<void> {\n  await mkdir(dirname(path), { recursive: true });\n  await writeFile(path, `${JSON.stringify(handle, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function readHandshakeSync(path: string): InstanceHandle {\n  const contents = readFileSync(path, \"utf8\");\n  let value: unknown;\n  try {\n    value = JSON.parse(contents);\n  } catch (error) {\n    throw new Error(`handshake file ${path} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n  return validateHandle(value, path);\n}\n\nexport async function waitForHandshake(path: string, timeoutMs = 60_000): Promise<InstanceHandle> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    try {\n      return validateHandle(JSON.parse(await readFile(path, \"utf8\")), path);\n    } catch (error) {\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `handshake file not readable within ${timeoutMs}ms: ${path} (${(error as Error).message})`,\n          { cause: error },\n        );\n      }\n      await sleep(250);\n    }\n  }\n}\n\nfunction validateHandle(value: unknown, source: string): InstanceHandle {\n  const handle = value as Partial<InstanceHandle> | null;\n  for (const field of [\"baseUrl\", \"projectId\", \"projectSecret\", \"schemaId\"] as const) {\n    if (typeof handle?.[field] !== \"string\" || handle[field].length === 0) {\n      throw new Error(`handshake file ${source} is missing \"${field}\"`);\n    }\n  }\n  if (!URL.canParse(handle.baseUrl as string)) {\n    throw new Error(`handshake file ${source} has a malformed \"baseUrl\": ${handle.baseUrl}`);\n  }\n  return handle as InstanceHandle;\n}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,aAA6B;CACxC,aAAa;CACb,gCAAgC;CAChC,wBAAwB;CACzB;AAED,SAAgB,oBACd,UACA,QACwB;CACxB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;EACpD,MAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAGhD,OAAM,IAAI,MACR,0BAA0B,KAAK,qBAAqB,MAAM,6CAC3D;AAEH,MAAI,QAAQ;;AAEd,QAAO;;;;;;;;;ACzBT,eAAsB,eAAe,MAAc,QAAuC;AACxF,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,OAAM,UAAU,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAGhF,SAAgB,kBAAkB,MAA8B;CAC9D,MAAM,WAAW,aAAa,MAAM,OAAO;CAC3C,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,SAAS;UACrB,OAAO;AACd,QAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA2B,MAAgB,WAAW,EAC3F,OAAO,OACR,CAAC;;AAEJ,QAAO,eAAe,OAAO,KAAK;;AAGpC,eAAsB,iBAAiB,MAAc,YAAY,KAAiC;CAChG,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,SACE,KAAI;AACF,SAAO,eAAe,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC,EAAE,KAAK;UAC9D,OAAO;AACd,MAAI,KAAK,KAAK,IAAI,SAChB,OAAM,IAAI,MACR,sCAAsC,UAAU,MAAM,KAAK,IAAK,MAAgB,QAAQ,IACxF,EAAE,OAAO,OAAO,CACjB;AAEH,QAAMA,WAAM,IAAI;;;AAKtB,SAAS,eAAe,OAAgB,QAAgC;CACtE,MAAM,SAAS;AACf,MAAK,MAAM,SAAS;EAAC;EAAW;EAAa;EAAiB;EAAW,CACvE,KAAI,OAAO,SAAS,WAAW,YAAY,OAAO,OAAO,WAAW,EAClE,OAAM,IAAI,MAAM,kBAAkB,OAAO,eAAe,MAAM,GAAG;AAGrE,KAAI,CAAC,IAAI,SAAS,OAAO,QAAkB,CACzC,OAAM,IAAI,MAAM,kBAAkB,OAAO,8BAA8B,OAAO,UAAU;AAE1F,QAAO"}
+{"version":3,"file":"handshake-ClzWvG8z.mjs","names":["sleep"],"sources":["../src/app-env.ts","../src/handshake.ts"],"sourcesContent":["import type { InstanceHandle } from \"./types\";\n\n/**\n * Declarative mapping from an app's env var names to InstanceHandle fields.\n * A template (not a function) so it can cross process boundaries: the\n * Playwright config serializes it into the app-runner's environment, where it\n * is applied to the handle read from the handshake file.\n */\nexport type AppEnvTemplate = Record<string, keyof InstanceHandle>;\n\n/**\n * The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own\n * template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`\n * names, for example.\n */\nexport const nextAppEnv: AppEnvTemplate = {\n  ZITADEL_URL: \"baseUrl\",\n  NEXT_PUBLIC_ZITADEL_PROJECT_ID: \"projectId\",\n  ZITADEL_PROJECT_SECRET: \"projectSecret\",\n};\n\nexport function applyAppEnvTemplate(\n  template: AppEnvTemplate,\n  handle: InstanceHandle,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [name, field] of Object.entries(template)) {\n    const value = handle[field];\n    if (typeof value !== \"string\" || value.length === 0) {\n      // Fail instead of silently dropping the var: an app booted without one\n      // of its env vars produces a much harder-to-read failure downstream.\n      throw new Error(\n        `app env template maps \"${name}\" to handle field \"${field}\", which the instance handle does not carry`,\n      );\n    }\n    env[name] = value;\n  }\n  return env;\n}\n","import { readFileSync } from \"node:fs\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\n\nimport type { InstanceHandle } from \"./types\";\n\n/**\n * The handshake file carries an InstanceHandle across process boundaries:\n * written by the script that boots + bootstraps the instance, read by\n * Playwright workers (fixtures) and the app dev-server wrapper.\n */\nexport async function writeHandshake(path: string, handle: InstanceHandle): Promise<void> {\n  await mkdir(dirname(path), { recursive: true });\n  await writeFile(path, `${JSON.stringify(handle, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function readHandshakeSync(path: string): InstanceHandle {\n  const contents = readFileSync(path, \"utf8\");\n  let value: unknown;\n  try {\n    value = JSON.parse(contents);\n  } catch (error) {\n    throw new Error(`handshake file ${path} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n  return validateHandle(value, path);\n}\n\nexport async function waitForHandshake(path: string, timeoutMs = 60_000): Promise<InstanceHandle> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    try {\n      return validateHandle(JSON.parse(await readFile(path, \"utf8\")), path);\n    } catch (error) {\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `handshake file not readable within ${timeoutMs}ms: ${path} (${(error as Error).message})`,\n          { cause: error },\n        );\n      }\n      await sleep(250);\n    }\n  }\n}\n\nfunction validateHandle(value: unknown, source: string): InstanceHandle {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new Error(`handshake file ${source} is not an object`);\n  }\n  const handle = value as Partial<InstanceHandle>;\n  for (const field of [\"baseUrl\", \"projectId\", \"projectSecret\", \"schemaId\"] as const) {\n    if (typeof handle[field] !== \"string\" || handle[field].length === 0) {\n      throw new Error(`handshake file ${source} is missing \"${field}\"`);\n    }\n  }\n  if (!URL.canParse(handle.baseUrl as string)) {\n    throw new Error(`handshake file ${source} has a malformed \"baseUrl\": ${handle.baseUrl}`);\n  }\n  return handle as InstanceHandle;\n}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,aAA6B;CACxC,aAAa;CACb,gCAAgC;CAChC,wBAAwB;CACzB;AAED,SAAgB,oBACd,UACA,QACwB;CACxB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;EACpD,MAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAGhD,OAAM,IAAI,MACR,0BAA0B,KAAK,qBAAqB,MAAM,6CAC3D;AAEH,MAAI,QAAQ;;AAEd,QAAO;;;;;;;;;ACzBT,eAAsB,eAAe,MAAc,QAAuC;AACxF,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,OAAM,UAAU,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAGhF,SAAgB,kBAAkB,MAA8B;CAC9D,MAAM,WAAW,aAAa,MAAM,OAAO;CAC3C,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,SAAS;UACrB,OAAO;AACd,QAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA2B,MAAgB,WAAW,EAC3F,OAAO,OACR,CAAC;;AAEJ,QAAO,eAAe,OAAO,KAAK;;AAGpC,eAAsB,iBAAiB,MAAc,YAAY,KAAiC;CAChG,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,SACE,KAAI;AACF,SAAO,eAAe,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC,EAAE,KAAK;UAC9D,OAAO;AACd,MAAI,KAAK,KAAK,IAAI,SAChB,OAAM,IAAI,MACR,sCAAsC,UAAU,MAAM,KAAK,IAAK,MAAgB,QAAQ,IACxF,EAAE,OAAO,OAAO,CACjB;AAEH,QAAMA,WAAM,IAAI;;;AAKtB,SAAS,eAAe,OAAgB,QAAgC;AACtE,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,OAAM,IAAI,MAAM,kBAAkB,OAAO,mBAAmB;CAE9D,MAAM,SAAS;AACf,MAAK,MAAM,SAAS;EAAC;EAAW;EAAa;EAAiB;EAAW,CACvE,KAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,WAAW,EAChE,OAAM,IAAI,MAAM,kBAAkB,OAAO,eAAe,MAAM,GAAG;AAGrE,KAAI,CAAC,IAAI,SAAS,OAAO,QAAkB,CACzC,OAAM,IAAI,MAAM,kBAAkB,OAAO,8BAA8B,OAAO,UAAU;AAE1F,QAAO"}

package/dist/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("./src-BIL0PdSd.cjs");
-const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_src = require("./src-DirKLqi4.cjs");
+const require_handshake = require("./handshake-CRKcgkfN.cjs");
 exports.SESSION_COOKIE_NAME = require_src.SESSION_COOKIE_NAME;
 exports.applyAppEnvTemplate = require_handshake.applyAppEnvTemplate;
 exports.bootLocalServer = require_src.bootLocalServer;

package/dist/index.d.mts

@@ -54,9 +54,8 @@ interface BootedServer {
 /**
  * Boot an ephemeral local server by shelling out to `zitadel start` and parse
  * its JSON envelope. The CLI owns the subtle parts (port preflight, health
- * wait, process-group stop, embedded-Postgres reaping), so this module stays a
- * thin adapter; swapping it for direct library calls later must not change the
- * shape returned here.
+ * wait, process-group stop), so this module stays a thin adapter; swapping it
+ * for direct library calls later must not change the shape returned here.
  */
 declare function bootLocalServer(options?: BootServerOptions): Promise<BootedServer>;
 //#endregion
@@ -83,7 +82,7 @@ type StartLocalZitadelOptions = BootServerOptions & Omit<BootstrapProjectOptions
  */
 declare function connectZitadel(handle: InstanceHandle): ConnectedZitadel;
 /**
- * Boot an ephemeral local instance (binary runtime + embedded Postgres, no
+ * Boot an ephemeral local instance (binary runtime + SQLite by default, no
  * Docker) and bootstrap a project + default schema + login flow on it. The
  * result can seed loginable password users immediately.
  */

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/bootstrap.ts","../src/lifecycle.ts","../src/handshake.ts","../src/session.ts","../src/index.ts"],"mappings":";;;;;UASiB,uBAAA;EACf,OAAA;EACA,WAAA;;AAFF;;;EAOE,UAAA;EACA,MAAA,GAAS,WAAA;EACT,OAAA,GAAU,YAAA;AAAA;AAAA,UAGK,mBAAA;EACf,SAAA;EACA,aAAA;EACA,aAAA;EACA,QAAA;EACA,MAAA;AAAA;;;;;;;iBAWoB,gBAAA,CACpB,OAAA,EAAS,uBAAA,GACR,OAAA,CAAQ,mBAAA;;;UCzBM,iBAAA;;EAEf,IAAA;;ADPF;;;ECYE,GAAA;EDXA;ECaA,YAAA;EDPA;ECSA,IAAA;EDRS;ECUT,MAAA;EACA,SAAA;AAAA;AAAA,UAGe,YAAA;EACf,OAAA;EACA,OAAA,EAAS,mBAAA;EACT,IAAA,IAAQ,OAAA;AAAA;;;;;;;;iBAUY,eAAA,CAAgB,OAAA,GAAS,iBAAA,GAAyB,OAAA,CAAQ,YAAA;;;;;;;ADnChF;iBEGsB,cAAA,CAAe,IAAA,UAAc,MAAA,EAAQ,cAAA,GAAiB,OAAA;AAAA,iBAK5D,iBAAA,CAAkB,IAAA,WAAe,cAAA;AAAA,iBAa3B,gBAAA,CAAiB,IAAA,UAAc,SAAA,YAAqB,OAAA,CAAQ,cAAA;;;;cCvBrE,mBAAA;;;KCED,wBAAA,GAA2B,iBAAA,GACrC,IAAA,CAAK,uBAAA;;AJDP;;;;iBIQgB,cAAA,CAAe,MAAA,EAAQ,cAAA,GAAiB,gBAAA;;;;;;iBA6BlC,iBAAA,CACpB,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,YAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/bootstrap.ts","../src/lifecycle.ts","../src/handshake.ts","../src/session.ts","../src/index.ts"],"mappings":";;;;;UASiB,uBAAA;EACf,OAAA;EACA,WAAA;;AAFF;;;EAOE,UAAA;EACA,MAAA,GAAS,WAAA;EACT,OAAA,GAAU,YAAA;AAAA;AAAA,UAGK,mBAAA;EACf,SAAA;EACA,aAAA;EACA,aAAA;EACA,QAAA;EACA,MAAA;AAAA;;;;;;;iBAWoB,gBAAA,CACpB,OAAA,EAAS,uBAAA,GACR,OAAA,CAAQ,mBAAA;;;UCzBM,iBAAA;;EAEf,IAAA;;ADPF;;;ECYE,GAAA;EDXA;ECaA,YAAA;EDPA;ECSA,IAAA;EDRS;ECUT,MAAA;EACA,SAAA;AAAA;AAAA,UAGe,YAAA;EACf,OAAA;EACA,OAAA,EAAS,mBAAA;EACT,IAAA,IAAQ,OAAA;AAAA;;;;;;;iBASY,eAAA,CAAgB,OAAA,GAAS,iBAAA,GAAyB,OAAA,CAAQ,YAAA;;;;;;;ADlChF;iBEGsB,cAAA,CAAe,IAAA,UAAc,MAAA,EAAQ,cAAA,GAAiB,OAAA;AAAA,iBAK5D,iBAAA,CAAkB,IAAA,WAAe,cAAA;AAAA,iBAa3B,gBAAA,CAAiB,IAAA,UAAc,SAAA,YAAqB,OAAA,CAAQ,cAAA;;;;cCvBrE,mBAAA;;;KCED,wBAAA,GAA2B,iBAAA,GACrC,IAAA,CAAK,uBAAA;;AJDP;;;;iBIQgB,cAAA,CAAe,MAAA,EAAQ,cAAA,GAAiB,gBAAA;;;;;;iBA6BlC,iBAAA,CACpB,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,YAAA"}

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { a as nextAppEnv, i as applyAppEnvTemplate, n as waitForHandshake, r as writeHandshake, t as readHandshakeSync } from "./handshake-BPtWruO8.mjs";
-import { a as bootstrapProject, i as bootLocalServer, n as startLocalZitadel, r as SESSION_COOKIE_NAME, t as connectZitadel } from "./src-DkG0V4A6.mjs";
+import { a as nextAppEnv, i as applyAppEnvTemplate, n as waitForHandshake, r as writeHandshake, t as readHandshakeSync } from "./handshake-ClzWvG8z.mjs";
+import { a as bootstrapProject, i as bootLocalServer, n as startLocalZitadel, r as SESSION_COOKIE_NAME, t as connectZitadel } from "./src-eTcdx-ZS.mjs";
 export { SESSION_COOKIE_NAME, applyAppEnvTemplate, bootLocalServer, bootstrapProject, connectZitadel, nextAppEnv, readHandshakeSync, startLocalZitadel, waitForHandshake, writeHandshake };

package/dist/playwright.cjs

@@ -1,11 +1,237 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("./src-BIL0PdSd.cjs");
-const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_src = require("./src-DirKLqi4.cjs");
+const require_handshake = require("./handshake-CRKcgkfN.cjs");
 const require_orchestration = require("./orchestration-D7QBgQ0l.cjs");
 let node_fs = require("node:fs");
 let node_url = require("node:url");
 let node_path = require("node:path");
 let _playwright_test = require("@playwright/test");
+//#region src/passkey.ts
+/**
+* Attach a virtual passkey authenticator to the page via the Chrome DevTools
+* Protocol. The options mirror a platform authenticator with discoverable
+* credentials and automatic user presence — the profile the consumer journey
+* has run in CI since passkey coverage became mandatory there.
+*
+* Chromium only: the CDP WebAuthn domain does not exist in WebKit or Firefox.
+* The authenticator is bound to this page — drive registration and the later
+* login from the same page, or the credential is gone. Serve the app under
+* test on an origin WebAuthn accepts as a relying-party ID: HTTPS on a real
+* domain, or `http://localhost` for local runs — raw IP origins such as
+* `http://127.0.0.1` are invalid RP IDs.
+*/
+async function enableVirtualPasskey(page) {
+	let client;
+	try {
+		client = await page.context().newCDPSession(page);
+	} catch (error) {
+		throw new Error("enableVirtualPasskey: could not open a CDP session — passkey testing needs Chromium's virtual authenticator, so run passkey specs in a Chromium project.", { cause: error });
+	}
+	let authenticatorId;
+	try {
+		await client.send("WebAuthn.enable");
+		({authenticatorId} = await client.send("WebAuthn.addVirtualAuthenticator", { options: {
+			protocol: "ctap2",
+			transport: "internal",
+			hasResidentKey: true,
+			hasUserVerification: true,
+			isUserVerified: true,
+			automaticPresenceSimulation: true
+		} }));
+	} catch (error) {
+		await client.detach().catch(() => void 0);
+		throw error;
+	}
+	return {
+		authenticatorId,
+		async credentialCount() {
+			const { credentials } = await client.send("WebAuthn.getCredentials", { authenticatorId });
+			return credentials.length;
+		},
+		async dispose() {
+			try {
+				await client.send("WebAuthn.removeVirtualAuthenticator", { authenticatorId });
+			} catch {} finally {
+				await client.detach().catch(() => void 0);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/flows.ts
+/**
+* A union locator resolves in DOM order across the whole page, so every
+* candidate built from a broad selector — accessible names, labels, the
+* generic `data-action` attribute — is scoped to the `<zitadel-login>`
+* host; otherwise a same-named control in the app's own chrome (header
+* nav, footer forms) could win the union. The host element exists no
+* matter what the tenant's template renders, so these fallbacks keep
+* working for custom templates that emit no automation hooks — the case
+* they exist for. The `zitadel-*` testid hooks and the `zl-button` atom
+* are namespaced and stay page-global.
+*/
+function widgetRoot(page) {
+	return page.locator("zitadel-login");
+}
+/**
+* Escape a value for use inside a double-quoted CSS attribute selector,
+* per the CSSOM "serialize a string" rules: NUL becomes U+FFFD, control
+* characters become hex code-point escapes, quote and backslash are
+* backslash-escaped. C1 controls (U+0080–U+009F) are escaped too — CSSOM
+* itself leaves them literal, but the escaped form is equivalent and
+* survives stricter-than-spec selector parsers. Anything the flow schema
+* accepts as an action name yields a parseable selector.
+*/
+function cssAttributeValue(value) {
+	let out = "";
+	for (const ch of value) {
+		const code = ch.codePointAt(0) ?? 0;
+		if (code === 0) out += "�";
+		else if (code <= 31 || code >= 127 && code <= 159) out += `\\${code.toString(16)} `;
+		else if (ch === "\"" || ch === "\\") out += `\\${ch}`;
+		else out += ch;
+	}
+	return out;
+}
+/**
+* Locator for a flow action control by its declared action name. Matches
+* every hook shape the default template emits — host testid, native
+* shadow button/link testids, and the raw `action`/`data-action`
+* attributes (the recover link carries only `data-action`).
+*/
+function flowAction(page, action, options = {}) {
+	const attributeSafe = cssAttributeValue(action);
+	let candidates = page.getByTestId(`zitadel-action-${action}`).or(page.getByTestId(`zitadel-action-${action}-button`)).or(page.getByTestId(`zitadel-action-${action}-link`)).or(page.locator(`zl-button[action="${attributeSafe}"]`)).or(widgetRoot(page).locator(`[data-action="${attributeSafe}"]`));
+	if (options.name) candidates = candidates.or(widgetRoot(page).getByRole("button", { name: options.name })).or(widgetRoot(page).getByRole("link", { name: options.name }));
+	return candidates.first();
+}
+/**
+* Locator for a flow field's input by its normalised hook token
+* (`email`, `password`, a user-schema property name).
+*/
+function flowField(page, field, options = {}) {
+	let candidates = page.getByTestId(`zitadel-input-${field}`).or(page.getByTestId(`zitadel-field-${field}`).locator("input"));
+	if (options.label) candidates = candidates.or(widgetRoot(page).getByLabel(options.label));
+	return candidates.first();
+}
+/** Click a flow action (auto-waits like any locator click). */
+async function clickFlowAction(page, action, options) {
+	await flowAction(page, action, options).click();
+}
+/** Fill a flow field (auto-waits like any locator fill). */
+async function fillFlowField(page, field, value, options) {
+	await flowField(page, field, options).fill(value);
+}
+/**
+* Sign in with email and password from the flow's entry step. Handles both
+* the default split shape (identifier → password) and flows that render
+* the password field on the entry step.
+*/
+async function loginWithPassword(page, { email, password }) {
+	await emailField(page).fill(email);
+	const password_ = passwordField(page);
+	if (!await password_.isVisible().catch(() => false)) await flowAction(page, "submit").click();
+	await password_.fill(password);
+	await flowAction(page, "submit").click();
+}
+/**
+* Sign in with a passkey. With `email`, fills the identifier and takes the
+* step's passkey action; without, taps the entry step's passkey action
+* directly (discoverable-credential one-tap, e.g. the passkey-first
+* preset). Pair with `enableVirtualPasskey` / the `passkey` fixture in
+* headless runs — the ceremony completes automatically once the widget
+* issues the WebAuthn challenge.
+*/
+async function loginWithPasskey(page, options = {}) {
+	if (options.email !== void 0) await emailField(page).fill(options.email);
+	await flowAction(page, "passkey").click();
+}
+/**
+* Register a new user with a password: enter the (unknown) identifier,
+* advance into the registration step, continue on the password path, and
+* submit the password. Ends when the final submit is clicked — assert your
+* app's signed-in surface afterwards. Flows that route through steps the
+* default flow does not (e.g. a passkey upsell) need caller-side handling
+* after this returns.
+*/
+async function registerWithPassword(page, { email, password, profile }) {
+	await advanceToRegistration(page, email, profile);
+	const password_ = passwordField(page);
+	if (!await password_.isVisible().catch(() => false)) await flowAction(page, "submit").click();
+	await password_.fill(password);
+	await flowAction(page, "submit").click();
+}
+/**
+* Register a new user with a passkey: enter the (unknown) identifier,
+* advance into the registration step, and take its `passkey_register`
+* action. Requires an authenticator (see `loginWithPasskey`). The default
+* flow completes registration from the ceremony directly.
+*/
+async function registerWithPasskey(page, { email, profile }) {
+	await advanceToRegistration(page, email, profile);
+	await flowAction(page, "passkey_register").click();
+}
+function emailField(page) {
+	return flowField(page, "email", { label: /email/i });
+}
+function passwordField(page) {
+	return flowField(page, "password", { label: /password/i });
+}
+/**
+* From the entry step: submit the unknown identifier (the default flow's
+* `user_not_found` transition routes to registration), or take an explicit
+* `register` navigate action when the entry step is a combined
+* email+password step — there, submitting would attempt a password sign-in
+* instead. Then wait for the registration step and fill what it renders.
+*/
+async function advanceToRegistration(page, email, profile) {
+	await emailField(page).fill(email);
+	if (await passwordField(page).isVisible().catch(() => false)) await flowAction(page, "register").click();
+	else await flowAction(page, "submit").click();
+	await expectRegistrationStep(page);
+	await fillIfVisible(emailField(page), email);
+	for (const entry of profile ?? []) await fillProfileEntry(page, entry);
+}
+/**
+* Fill one registration field with the verb its control needs: booleans
+* check the `zl-checkbox` native input, strings prefer the `zl-select`
+* native select (option matched by value, falling back to label) and
+* otherwise fill a text-like input. The select/checkbox natives carry the
+* name-first testids the atoms document (`zitadel-select-*`,
+* `zitadel-checkbox-*`); templates without those hooks drive such fields
+* via their own locators.
+*/
+async function fillProfileEntry(page, entry) {
+	if (typeof entry.value === "boolean") {
+		const checkbox = page.getByTestId(`zitadel-checkbox-${entry.field}`).first();
+		if (await checkbox.isVisible().catch(() => false)) await checkbox.setChecked(entry.value);
+		return;
+	}
+	const select = page.getByTestId(`zitadel-select-${entry.field}`).first();
+	if (await select.isVisible().catch(() => false)) {
+		await select.selectOption(entry.value);
+		return;
+	}
+	await fillIfVisible(flowField(page, entry.field, { label: entry.label }), entry.value);
+}
+/**
+* Barrier between the entry submit and probing the registration step's
+* fields: without it, optional-field probes race the re-render and read
+* the outgoing step. The default flow's registration step declares
+* `passkey_register` — a structural, locale-independent signal; the
+* heading regex covers password-only flows on the default English
+* template.
+*/
+async function expectRegistrationStep(page) {
+	await flowAction(page, "passkey_register").or(widgetRoot(page).getByRole("heading", { name: /create|register|sign up|no-account/i })).first().waitFor({
+		state: "visible",
+		timeout: 3e4
+	});
+}
+async function fillIfVisible(field, value) {
+	if (await field.isVisible().catch(() => false)) await field.fill(value);
+}
+//#endregion
 //#region src/playwright-config.ts
 /**
 * Generate the Playwright `webServer` entries that boot an ephemeral seeded
@@ -124,6 +350,11 @@ const test = _playwright_test.test.extend({
 			})
 		});
 	},
+	passkey: async ({ page }, use) => {
+		const passkey = await enableVirtualPasskey(page);
+		await use(passkey);
+		await passkey.dispose();
+	},
 	authenticatedPage: async ({ browser, zitadel, baseURL }, use) => {
 		if (!baseURL) throw new Error("authenticatedPage requires `use.baseURL` so the session cookie can be scoped to the app under test.");
 		const session = await zitadel.seedSession({ origin: baseURL });
@@ -143,13 +374,22 @@ const test = _playwright_test.test.extend({
 });
 //#endregion
 exports.applyAppEnvTemplate = require_handshake.applyAppEnvTemplate;
+exports.clickFlowAction = clickFlowAction;
+exports.enableVirtualPasskey = enableVirtualPasskey;
 Object.defineProperty(exports, "expect", {
 	enumerable: true,
 	get: function() {
 		return _playwright_test.expect;
 	}
 });
+exports.fillFlowField = fillFlowField;
+exports.flowAction = flowAction;
+exports.flowField = flowField;
+exports.loginWithPasskey = loginWithPasskey;
+exports.loginWithPassword = loginWithPassword;
 exports.nextAppEnv = require_handshake.nextAppEnv;
+exports.registerWithPasskey = registerWithPasskey;
+exports.registerWithPassword = registerWithPassword;
 exports.test = test;
 exports.withZitadel = withZitadel;