@zitadel/testing 0.0.0

package/dist/handshake-CggSIoxF.cjs

@@ -0,0 +1,98 @@
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_timers_promises = require("node:timers/promises");
+//#region src/app-env.ts
+/**
+* The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own
+* template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`
+* names, for example.
+*/
+const nextAppEnv = {
+	ZITADEL_URL: "baseUrl",
+	NEXT_PUBLIC_ZITADEL_PROJECT_ID: "projectId",
+	ZITADEL_PROJECT_SECRET: "projectSecret"
+};
+function applyAppEnvTemplate(template, handle) {
+	const env = {};
+	for (const [name, field] of Object.entries(template)) {
+		const value = handle[field];
+		if (typeof value !== "string" || value.length === 0) throw new Error(`app env template maps "${name}" to handle field "${field}", which the instance handle does not carry`);
+		env[name] = value;
+	}
+	return env;
+}
+//#endregion
+//#region src/handshake.ts
+/**
+* The handshake file carries an InstanceHandle across process boundaries:
+* written by the script that boots + bootstraps the instance, read by
+* Playwright workers (fixtures) and the app dev-server wrapper.
+*/
+async function writeHandshake(path, handle) {
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+	await (0, node_fs_promises.writeFile)(path, `${JSON.stringify(handle, null, 2)}\n`, { mode: 384 });
+}
+function readHandshakeSync(path) {
+	const contents = (0, node_fs.readFileSync)(path, "utf8");
+	let value;
+	try {
+		value = JSON.parse(contents);
+	} catch (error) {
+		throw new Error(`handshake file ${path} contains invalid JSON: ${error.message}`, { cause: error });
+	}
+	return validateHandle(value, path);
+}
+async function waitForHandshake(path, timeoutMs = 6e4) {
+	const deadline = Date.now() + timeoutMs;
+	for (;;) try {
+		return validateHandle(JSON.parse(await (0, node_fs_promises.readFile)(path, "utf8")), path);
+	} catch (error) {
+		if (Date.now() >= deadline) throw new Error(`handshake file not readable within ${timeoutMs}ms: ${path} (${error.message})`, { cause: error });
+		await (0, node_timers_promises.setTimeout)(250);
+	}
+}
+function validateHandle(value, source) {
+	const handle = value;
+	for (const field of [
+		"baseUrl",
+		"projectId",
+		"projectSecret",
+		"schemaId"
+	]) if (typeof handle?.[field] !== "string" || handle[field].length === 0) throw new Error(`handshake file ${source} is missing "${field}"`);
+	if (!URL.canParse(handle.baseUrl)) throw new Error(`handshake file ${source} has a malformed "baseUrl": ${handle.baseUrl}`);
+	return handle;
+}
+//#endregion
+Object.defineProperty(exports, "applyAppEnvTemplate", {
+	enumerable: true,
+	get: function() {
+		return applyAppEnvTemplate;
+	}
+});
+Object.defineProperty(exports, "nextAppEnv", {
+	enumerable: true,
+	get: function() {
+		return nextAppEnv;
+	}
+});
+Object.defineProperty(exports, "readHandshakeSync", {
+	enumerable: true,
+	get: function() {
+		return readHandshakeSync;
+	}
+});
+Object.defineProperty(exports, "waitForHandshake", {
+	enumerable: true,
+	get: function() {
+		return waitForHandshake;
+	}
+});
+Object.defineProperty(exports, "writeHandshake", {
+	enumerable: true,
+	get: function() {
+		return writeHandshake;
+	}
+});
+
+//# sourceMappingURL=handshake-CggSIoxF.cjs.map

package/dist/handshake-CggSIoxF.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-CggSIoxF.cjs","names":[],"sources":["../src/app-env.ts","../src/handshake.ts"],"sourcesContent":["import type { InstanceHandle } from \"./types\";\n\n/**\n * Declarative mapping from an app's env var names to InstanceHandle fields.\n * A template (not a function) so it can cross process boundaries: the\n * Playwright config serializes it into the app-runner's environment, where it\n * is applied to the handle read from the handshake file.\n */\nexport type AppEnvTemplate = Record<string, keyof InstanceHandle>;\n\n/**\n * The env shape `@zitadel/sdk-next` apps read. Other frameworks pass their own\n * template — the console maps the same handle fields to `VITE_*`/`CONSOLE_*`\n * names, for example.\n */\nexport const nextAppEnv: AppEnvTemplate = {\n  ZITADEL_URL: \"baseUrl\",\n  NEXT_PUBLIC_ZITADEL_PROJECT_ID: \"projectId\",\n  ZITADEL_PROJECT_SECRET: \"projectSecret\",\n};\n\nexport function applyAppEnvTemplate(\n  template: AppEnvTemplate,\n  handle: InstanceHandle,\n): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const [name, field] of Object.entries(template)) {\n    const value = handle[field];\n    if (typeof value !== \"string\" || value.length === 0) {\n      // Fail instead of silently dropping the var: an app booted without one\n      // of its env vars produces a much harder-to-read failure downstream.\n      throw new Error(\n        `app env template maps \"${name}\" to handle field \"${field}\", which the instance handle does not carry`,\n      );\n    }\n    env[name] = value;\n  }\n  return env;\n}\n","import { readFileSync } from \"node:fs\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\n\nimport type { InstanceHandle } from \"./types\";\n\n/**\n * The handshake file carries an InstanceHandle across process boundaries:\n * written by the script that boots + bootstraps the instance, read by\n * Playwright workers (fixtures) and the app dev-server wrapper.\n */\nexport async function writeHandshake(path: string, handle: InstanceHandle): Promise<void> {\n  await mkdir(dirname(path), { recursive: true });\n  await writeFile(path, `${JSON.stringify(handle, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function readHandshakeSync(path: string): InstanceHandle {\n  const contents = readFileSync(path, \"utf8\");\n  let value: unknown;\n  try {\n    value = JSON.parse(contents);\n  } catch (error) {\n    throw new Error(`handshake file ${path} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n  return validateHandle(value, path);\n}\n\nexport async function waitForHandshake(path: string, timeoutMs = 60_000): Promise<InstanceHandle> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    try {\n      return validateHandle(JSON.parse(await readFile(path, \"utf8\")), path);\n    } catch (error) {\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `handshake file not readable within ${timeoutMs}ms: ${path} (${(error as Error).message})`,\n          { cause: error },\n        );\n      }\n      await sleep(250);\n    }\n  }\n}\n\nfunction validateHandle(value: unknown, source: string): InstanceHandle {\n  const handle = value as Partial<InstanceHandle> | null;\n  for (const field of [\"baseUrl\", \"projectId\", \"projectSecret\", \"schemaId\"] as const) {\n    if (typeof handle?.[field] !== \"string\" || handle[field].length === 0) {\n      throw new Error(`handshake file ${source} is missing \"${field}\"`);\n    }\n  }\n  if (!URL.canParse(handle.baseUrl as string)) {\n    throw new Error(`handshake file ${source} has a malformed \"baseUrl\": ${handle.baseUrl}`);\n  }\n  return handle as InstanceHandle;\n}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,aAA6B;CACxC,aAAa;CACb,gCAAgC;CAChC,wBAAwB;CACzB;AAED,SAAgB,oBACd,UACA,QACwB;CACxB,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;EACpD,MAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAGhD,OAAM,IAAI,MACR,0BAA0B,KAAK,qBAAqB,MAAM,6CAC3D;AAEH,MAAI,QAAQ;;AAEd,QAAO;;;;;;;;;ACzBT,eAAsB,eAAe,MAAc,QAAuC;AACxF,QAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,QAAA,GAAA,iBAAA,WAAgB,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAGhF,SAAgB,kBAAkB,MAA8B;CAC9D,MAAM,YAAA,GAAA,QAAA,cAAwB,MAAM,OAAO;CAC3C,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,SAAS;UACrB,OAAO;AACd,QAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA2B,MAAgB,WAAW,EAC3F,OAAO,OACR,CAAC;;AAEJ,QAAO,eAAe,OAAO,KAAK;;AAGpC,eAAsB,iBAAiB,MAAc,YAAY,KAAiC;CAChG,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,SACE,KAAI;AACF,SAAO,eAAe,KAAK,MAAM,OAAA,GAAA,iBAAA,UAAe,MAAM,OAAO,CAAC,EAAE,KAAK;UAC9D,OAAO;AACd,MAAI,KAAK,KAAK,IAAI,SAChB,OAAM,IAAI,MACR,sCAAsC,UAAU,MAAM,KAAK,IAAK,MAAgB,QAAQ,IACxF,EAAE,OAAO,OAAO,CACjB;AAEH,SAAA,GAAA,qBAAA,YAAY,IAAI;;;AAKtB,SAAS,eAAe,OAAgB,QAAgC;CACtE,MAAM,SAAS;AACf,MAAK,MAAM,SAAS;EAAC;EAAW;EAAa;EAAiB;EAAW,CACvE,KAAI,OAAO,SAAS,WAAW,YAAY,OAAO,OAAO,WAAW,EAClE,OAAM,IAAI,MAAM,kBAAkB,OAAO,eAAe,MAAM,GAAG;AAGrE,KAAI,CAAC,IAAI,SAAS,OAAO,QAAkB,CACzC,OAAM,IAAI,MAAM,kBAAkB,OAAO,8BAA8B,OAAO,UAAU;AAE1F,QAAO"}

package/dist/index.cjs

@@ -0,0 +1,13 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_src = require("./src-BIL0PdSd.cjs");
+const require_handshake = require("./handshake-CggSIoxF.cjs");
+exports.SESSION_COOKIE_NAME = require_src.SESSION_COOKIE_NAME;
+exports.applyAppEnvTemplate = require_handshake.applyAppEnvTemplate;
+exports.bootLocalServer = require_src.bootLocalServer;
+exports.bootstrapProject = require_src.bootstrapProject;
+exports.connectZitadel = require_src.connectZitadel;
+exports.nextAppEnv = require_handshake.nextAppEnv;
+exports.readHandshakeSync = require_handshake.readHandshakeSync;
+exports.startLocalZitadel = require_src.startLocalZitadel;
+exports.waitForHandshake = require_handshake.waitForHandshake;
+exports.writeHandshake = require_handshake.writeHandshake;

package/dist/index.d.mts

@@ -0,0 +1,93 @@
+import { a as Identity, c as LocalZitadelRuntime, d as SeedUserInput, f as SeedUsersTemplate, i as ConnectedZitadel, l as MintedSession, m as SessionCookie, n as applyAppEnvTemplate, o as InstanceHandle, p as SeededUser, r as nextAppEnv, s as LocalZitadel, t as AppEnvTemplate, u as SeedSessionInput } from "./app-env-D3W0GYhA.mjs";
+import { ZitadelClient } from "@zitadel/api/client";
+import { SetupPreset, SetupUseCase } from "@zitadel/config/defaults";
+
+//#region src/bootstrap.d.ts
+interface BootstrapProjectOptions {
+  baseUrl: string;
+  projectName?: string;
+  /**
+   * Origins of the apps that will proxy to this instance. The backend's
+   * origin check rejects forwarded requests from unregistered origins.
+   */
+  appOrigins?: string[];
+  preset?: SetupPreset;
+  useCase?: SetupUseCase;
+}
+interface BootstrappedProject {
+  projectId: string;
+  projectSecret: string;
+  previewSecret?: string;
+  schemaId: string;
+  flowId: string;
+}
+/**
+ * Server-side half of `zitadel setup`, without any file scaffolding:
+ * `POST /projects` is unauthenticated and mints the projectSecret used as the
+ * bearer for everything else; the schema is uploaded without `$id` so the
+ * server assigns an opaque id, which the flow must then reference.
+ */
+declare function bootstrapProject(options: BootstrapProjectOptions): Promise<BootstrappedProject>;
+//#endregion
+//#region src/lifecycle.d.ts
+interface BootServerOptions {
+  /** TCP port for the instance; defaults to an OS-assigned free port. */
+  port?: number;
+  /**
+   * State directory. Defaults to a fresh temp dir that is removed on stop;
+   * a caller-provided dir is never removed.
+   */
+  dir?: string;
+  /** Forwarded as ZITADEL_SERVER_BINARY (in-repo runs use dist/server/nextgen). */
+  serverBinary?: string;
+  /** Keep the owned temp dir after stop (debugging). */
+  keep?: boolean;
+  /** Test seam: alternative CLI entry script. */
+  cliBin?: string;
+  timeoutMs?: number;
+}
+interface BootedServer {
+  baseUrl: string;
+  runtime: LocalZitadelRuntime;
+  stop(): Promise<void>;
+}
+/**
+ * Boot an ephemeral local server by shelling out to `zitadel start` and parse
+ * its JSON envelope. The CLI owns the subtle parts (port preflight, health
+ * wait, process-group stop, embedded-Postgres reaping), so this module stays a
+ * thin adapter; swapping it for direct library calls later must not change the
+ * shape returned here.
+ */
+declare function bootLocalServer(options?: BootServerOptions): Promise<BootedServer>;
+//#endregion
+//#region src/handshake.d.ts
+/**
+ * The handshake file carries an InstanceHandle across process boundaries:
+ * written by the script that boots + bootstraps the instance, read by
+ * Playwright workers (fixtures) and the app dev-server wrapper.
+ */
+declare function writeHandshake(path: string, handle: InstanceHandle): Promise<void>;
+declare function readHandshakeSync(path: string): InstanceHandle;
+declare function waitForHandshake(path: string, timeoutMs?: number): Promise<InstanceHandle>;
+//#endregion
+//#region src/session.d.ts
+/** Mirrors the server's session cookie (internal/api/session.go). */
+declare const SESSION_COOKIE_NAME = "__nextgen_session";
+//#endregion
+//#region src/index.d.ts
+type StartLocalZitadelOptions = BootServerOptions & Omit<BootstrapProjectOptions, "baseUrl">;
+/**
+ * Attach to an already-bootstrapped instance/project. Lifecycle-free on
+ * purpose: this is the entry point for Playwright workers (via the handshake
+ * file) and, later, for seeding remote instances.
+ */
+declare function connectZitadel(handle: InstanceHandle): ConnectedZitadel;
+/**
+ * Boot an ephemeral local instance (binary runtime + embedded Postgres, no
+ * Docker) and bootstrap a project + default schema + login flow on it. The
+ * result can seed loginable password users immediately.
+ */
+declare function startLocalZitadel(options?: StartLocalZitadelOptions): Promise<LocalZitadel>;
+//#endregion
+export { type AppEnvTemplate, type BootServerOptions, type BootedServer, type BootstrapProjectOptions, type BootstrappedProject, type ConnectedZitadel, type Identity, type InstanceHandle, type LocalZitadel, type LocalZitadelRuntime, type MintedSession, SESSION_COOKIE_NAME, type SeedSessionInput, type SeedUserInput, type SeedUsersTemplate, type SeededUser, type SessionCookie, StartLocalZitadelOptions, applyAppEnvTemplate, bootLocalServer, bootstrapProject, connectZitadel, nextAppEnv, readHandshakeSync, startLocalZitadel, waitForHandshake, writeHandshake };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/bootstrap.ts","../src/lifecycle.ts","../src/handshake.ts","../src/session.ts","../src/index.ts"],"mappings":";;;;;UASiB,uBAAA;EACf,OAAA;EACA,WAAA;;AAFF;;;EAOE,UAAA;EACA,MAAA,GAAS,WAAA;EACT,OAAA,GAAU,YAAA;AAAA;AAAA,UAGK,mBAAA;EACf,SAAA;EACA,aAAA;EACA,aAAA;EACA,QAAA;EACA,MAAA;AAAA;;;;;;;iBAWoB,gBAAA,CACpB,OAAA,EAAS,uBAAA,GACR,OAAA,CAAQ,mBAAA;;;UCzBM,iBAAA;;EAEf,IAAA;;ADPF;;;ECYE,GAAA;EDXA;ECaA,YAAA;EDPA;ECSA,IAAA;EDRS;ECUT,MAAA;EACA,SAAA;AAAA;AAAA,UAGe,YAAA;EACf,OAAA;EACA,OAAA,EAAS,mBAAA;EACT,IAAA,IAAQ,OAAA;AAAA;;;;;;;;iBAUY,eAAA,CAAgB,OAAA,GAAS,iBAAA,GAAyB,OAAA,CAAQ,YAAA;;;;;;;ADnChF;iBEGsB,cAAA,CAAe,IAAA,UAAc,MAAA,EAAQ,cAAA,GAAiB,OAAA;AAAA,iBAK5D,iBAAA,CAAkB,IAAA,WAAe,cAAA;AAAA,iBAa3B,gBAAA,CAAiB,IAAA,UAAc,SAAA,YAAqB,OAAA,CAAQ,cAAA;;;;cCvBrE,mBAAA;;;KCED,wBAAA,GAA2B,iBAAA,GACrC,IAAA,CAAK,uBAAA;;AJDP;;;;iBIQgB,cAAA,CAAe,MAAA,EAAQ,cAAA,GAAiB,gBAAA;;;;;;iBA6BlC,iBAAA,CACpB,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,YAAA"}

package/dist/index.mjs

@@ -0,0 +1,3 @@
+import { a as nextAppEnv, i as applyAppEnvTemplate, n as waitForHandshake, r as writeHandshake, t as readHandshakeSync } from "./handshake-BPtWruO8.mjs";
+import { a as bootstrapProject, i as bootLocalServer, n as startLocalZitadel, r as SESSION_COOKIE_NAME, t as connectZitadel } from "./src-DkG0V4A6.mjs";
+export { SESSION_COOKIE_NAME, applyAppEnvTemplate, bootLocalServer, bootstrapProject, connectZitadel, nextAppEnv, readHandshakeSync, startLocalZitadel, waitForHandshake, writeHandshake };

package/dist/orchestration-C640_1Lg.mjs

@@ -0,0 +1,38 @@
+//#region src/orchestration.ts
+/**
+* The contract between `withZitadel()` (evaluated in the Playwright config
+* process) and the two executables it points webServer entries at. Options
+* travel as JSON in these env vars because a webServer command is a plain
+* string — there is no richer channel.
+*/
+const SUPERVISOR_CONFIG_ENV = "ZITADEL_TESTING_SUPERVISOR";
+const APP_RUNNER_CONFIG_ENV = "ZITADEL_TESTING_APP_RUNNER";
+/** Read by the executables and the Playwright fixtures alike. */
+const HANDSHAKE_ENV = "ZITADEL_TESTING_HANDSHAKE";
+function parseSupervisorConfig(raw) {
+	const value = parseJsonEnv(raw, SUPERVISOR_CONFIG_ENV);
+	if (typeof value.port !== "number" || !Number.isInteger(value.port) || value.port <= 0) throw new Error(`${SUPERVISOR_CONFIG_ENV} must carry a positive integer "port"`);
+	return value;
+}
+function parseAppRunnerConfig(raw) {
+	const value = parseJsonEnv(raw, APP_RUNNER_CONFIG_ENV);
+	if (!Array.isArray(value.command) || value.command.length === 0 || value.command.some((part) => typeof part !== "string" || part.length === 0)) throw new Error(`${APP_RUNNER_CONFIG_ENV} must carry a non-empty string[] "command"`);
+	return value;
+}
+function requireHandshakePath(env) {
+	const path = env[HANDSHAKE_ENV];
+	if (!path) throw new Error(`${HANDSHAKE_ENV} is not set. These entry points are meant to be launched by the webServer entries that withZitadel() generates.`);
+	return path;
+}
+function parseJsonEnv(raw, name) {
+	if (!raw) throw new Error(`${name} is not set. This entry point is meant to be launched by the webServer entries that withZitadel() generates.`);
+	try {
+		return JSON.parse(raw);
+	} catch (error) {
+		throw new Error(`${name} contains invalid JSON: ${error.message}`, { cause: error });
+	}
+}
+//#endregion
+export { parseSupervisorConfig as a, parseAppRunnerConfig as i, HANDSHAKE_ENV as n, requireHandshakePath as o, SUPERVISOR_CONFIG_ENV as r, APP_RUNNER_CONFIG_ENV as t };
+
+//# sourceMappingURL=orchestration-C640_1Lg.mjs.map

package/dist/orchestration-C640_1Lg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestration-C640_1Lg.mjs","names":[],"sources":["../src/orchestration.ts"],"sourcesContent":["import type { SetupPreset, SetupUseCase } from \"@zitadel/config/defaults\";\n\nimport type { AppEnvTemplate } from \"./app-env\";\n\n/**\n * The contract between `withZitadel()` (evaluated in the Playwright config\n * process) and the two executables it points webServer entries at. Options\n * travel as JSON in these env vars because a webServer command is a plain\n * string — there is no richer channel.\n */\nexport const SUPERVISOR_CONFIG_ENV = \"ZITADEL_TESTING_SUPERVISOR\";\nexport const APP_RUNNER_CONFIG_ENV = \"ZITADEL_TESTING_APP_RUNNER\";\n/** Read by the executables and the Playwright fixtures alike. */\nexport const HANDSHAKE_ENV = \"ZITADEL_TESTING_HANDSHAKE\";\n\nexport interface SupervisorConfig {\n  /** Fixed port: the config process must know the health URL up front. */\n  port: number;\n  appOrigins?: string[];\n  serverBinary?: string;\n  /** Appended to the missing-binary error, e.g. how to build it. */\n  serverBinaryHint?: string;\n  dir?: string;\n  keep?: boolean;\n  projectName?: string;\n  preset?: SetupPreset;\n  useCase?: SetupUseCase;\n  timeoutMs?: number;\n}\n\nexport interface AppRunnerConfig {\n  /** Spawn argv; executed without a shell. */\n  command: string[];\n  cwd?: string;\n  env?: AppEnvTemplate;\n  handshakeTimeoutMs?: number;\n}\n\nexport function parseSupervisorConfig(raw: string | undefined): SupervisorConfig {\n  const value = parseJsonEnv(raw, SUPERVISOR_CONFIG_ENV) as Partial<SupervisorConfig>;\n  if (typeof value.port !== \"number\" || !Number.isInteger(value.port) || value.port <= 0) {\n    throw new Error(`${SUPERVISOR_CONFIG_ENV} must carry a positive integer \"port\"`);\n  }\n  return value as SupervisorConfig;\n}\n\nexport function parseAppRunnerConfig(raw: string | undefined): AppRunnerConfig {\n  const value = parseJsonEnv(raw, APP_RUNNER_CONFIG_ENV) as Partial<AppRunnerConfig>;\n  if (\n    !Array.isArray(value.command) ||\n    value.command.length === 0 ||\n    value.command.some((part) => typeof part !== \"string\" || part.length === 0)\n  ) {\n    throw new Error(`${APP_RUNNER_CONFIG_ENV} must carry a non-empty string[] \"command\"`);\n  }\n  return value as AppRunnerConfig;\n}\n\nexport function requireHandshakePath(env: NodeJS.ProcessEnv): string {\n  const path = env[HANDSHAKE_ENV];\n  if (!path) {\n    throw new Error(\n      `${HANDSHAKE_ENV} is not set. These entry points are meant to be launched ` +\n        `by the webServer entries that withZitadel() generates.`,\n    );\n  }\n  return path;\n}\n\nfunction parseJsonEnv(raw: string | undefined, name: string): unknown {\n  if (!raw) {\n    throw new Error(\n      `${name} is not set. This entry point is meant to be launched by the ` +\n        `webServer entries that withZitadel() generates.`,\n    );\n  }\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`${name} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n}\n"],"mappings":";;;;;;;AAUA,MAAa,wBAAwB;AACrC,MAAa,wBAAwB;;AAErC,MAAa,gBAAgB;AAyB7B,SAAgB,sBAAsB,KAA2C;CAC/E,MAAM,QAAQ,aAAa,KAAK,sBAAsB;AACtD,KAAI,OAAO,MAAM,SAAS,YAAY,CAAC,OAAO,UAAU,MAAM,KAAK,IAAI,MAAM,QAAQ,EACnF,OAAM,IAAI,MAAM,GAAG,sBAAsB,uCAAuC;AAElF,QAAO;;AAGT,SAAgB,qBAAqB,KAA0C;CAC7E,MAAM,QAAQ,aAAa,KAAK,sBAAsB;AACtD,KACE,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAC7B,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,MAAM,SAAS,OAAO,SAAS,YAAY,KAAK,WAAW,EAAE,CAE3E,OAAM,IAAI,MAAM,GAAG,sBAAsB,4CAA4C;AAEvF,QAAO;;AAGT,SAAgB,qBAAqB,KAAgC;CACnE,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KACH,OAAM,IAAI,MACR,GAAG,cAAc,iHAElB;AAEH,QAAO;;AAGT,SAAS,aAAa,KAAyB,MAAuB;AACpE,KAAI,CAAC,IACH,OAAM,IAAI,MACR,GAAG,KAAK,8GAET;AAEH,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,OAAO;AACd,QAAM,IAAI,MAAM,GAAG,KAAK,0BAA2B,MAAgB,WAAW,EAC5E,OAAO,OACR,CAAC"}

package/dist/orchestration-D7QBgQ0l.cjs

@@ -0,0 +1,73 @@
+//#region src/orchestration.ts
+/**
+* The contract between `withZitadel()` (evaluated in the Playwright config
+* process) and the two executables it points webServer entries at. Options
+* travel as JSON in these env vars because a webServer command is a plain
+* string — there is no richer channel.
+*/
+const SUPERVISOR_CONFIG_ENV = "ZITADEL_TESTING_SUPERVISOR";
+const APP_RUNNER_CONFIG_ENV = "ZITADEL_TESTING_APP_RUNNER";
+/** Read by the executables and the Playwright fixtures alike. */
+const HANDSHAKE_ENV = "ZITADEL_TESTING_HANDSHAKE";
+function parseSupervisorConfig(raw) {
+	const value = parseJsonEnv(raw, SUPERVISOR_CONFIG_ENV);
+	if (typeof value.port !== "number" || !Number.isInteger(value.port) || value.port <= 0) throw new Error(`${SUPERVISOR_CONFIG_ENV} must carry a positive integer "port"`);
+	return value;
+}
+function parseAppRunnerConfig(raw) {
+	const value = parseJsonEnv(raw, APP_RUNNER_CONFIG_ENV);
+	if (!Array.isArray(value.command) || value.command.length === 0 || value.command.some((part) => typeof part !== "string" || part.length === 0)) throw new Error(`${APP_RUNNER_CONFIG_ENV} must carry a non-empty string[] "command"`);
+	return value;
+}
+function requireHandshakePath(env) {
+	const path = env[HANDSHAKE_ENV];
+	if (!path) throw new Error(`${HANDSHAKE_ENV} is not set. These entry points are meant to be launched by the webServer entries that withZitadel() generates.`);
+	return path;
+}
+function parseJsonEnv(raw, name) {
+	if (!raw) throw new Error(`${name} is not set. This entry point is meant to be launched by the webServer entries that withZitadel() generates.`);
+	try {
+		return JSON.parse(raw);
+	} catch (error) {
+		throw new Error(`${name} contains invalid JSON: ${error.message}`, { cause: error });
+	}
+}
+//#endregion
+Object.defineProperty(exports, "APP_RUNNER_CONFIG_ENV", {
+	enumerable: true,
+	get: function() {
+		return APP_RUNNER_CONFIG_ENV;
+	}
+});
+Object.defineProperty(exports, "HANDSHAKE_ENV", {
+	enumerable: true,
+	get: function() {
+		return HANDSHAKE_ENV;
+	}
+});
+Object.defineProperty(exports, "SUPERVISOR_CONFIG_ENV", {
+	enumerable: true,
+	get: function() {
+		return SUPERVISOR_CONFIG_ENV;
+	}
+});
+Object.defineProperty(exports, "parseAppRunnerConfig", {
+	enumerable: true,
+	get: function() {
+		return parseAppRunnerConfig;
+	}
+});
+Object.defineProperty(exports, "parseSupervisorConfig", {
+	enumerable: true,
+	get: function() {
+		return parseSupervisorConfig;
+	}
+});
+Object.defineProperty(exports, "requireHandshakePath", {
+	enumerable: true,
+	get: function() {
+		return requireHandshakePath;
+	}
+});
+
+//# sourceMappingURL=orchestration-D7QBgQ0l.cjs.map

package/dist/orchestration-D7QBgQ0l.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestration-D7QBgQ0l.cjs","names":[],"sources":["../src/orchestration.ts"],"sourcesContent":["import type { SetupPreset, SetupUseCase } from \"@zitadel/config/defaults\";\n\nimport type { AppEnvTemplate } from \"./app-env\";\n\n/**\n * The contract between `withZitadel()` (evaluated in the Playwright config\n * process) and the two executables it points webServer entries at. Options\n * travel as JSON in these env vars because a webServer command is a plain\n * string — there is no richer channel.\n */\nexport const SUPERVISOR_CONFIG_ENV = \"ZITADEL_TESTING_SUPERVISOR\";\nexport const APP_RUNNER_CONFIG_ENV = \"ZITADEL_TESTING_APP_RUNNER\";\n/** Read by the executables and the Playwright fixtures alike. */\nexport const HANDSHAKE_ENV = \"ZITADEL_TESTING_HANDSHAKE\";\n\nexport interface SupervisorConfig {\n  /** Fixed port: the config process must know the health URL up front. */\n  port: number;\n  appOrigins?: string[];\n  serverBinary?: string;\n  /** Appended to the missing-binary error, e.g. how to build it. */\n  serverBinaryHint?: string;\n  dir?: string;\n  keep?: boolean;\n  projectName?: string;\n  preset?: SetupPreset;\n  useCase?: SetupUseCase;\n  timeoutMs?: number;\n}\n\nexport interface AppRunnerConfig {\n  /** Spawn argv; executed without a shell. */\n  command: string[];\n  cwd?: string;\n  env?: AppEnvTemplate;\n  handshakeTimeoutMs?: number;\n}\n\nexport function parseSupervisorConfig(raw: string | undefined): SupervisorConfig {\n  const value = parseJsonEnv(raw, SUPERVISOR_CONFIG_ENV) as Partial<SupervisorConfig>;\n  if (typeof value.port !== \"number\" || !Number.isInteger(value.port) || value.port <= 0) {\n    throw new Error(`${SUPERVISOR_CONFIG_ENV} must carry a positive integer \"port\"`);\n  }\n  return value as SupervisorConfig;\n}\n\nexport function parseAppRunnerConfig(raw: string | undefined): AppRunnerConfig {\n  const value = parseJsonEnv(raw, APP_RUNNER_CONFIG_ENV) as Partial<AppRunnerConfig>;\n  if (\n    !Array.isArray(value.command) ||\n    value.command.length === 0 ||\n    value.command.some((part) => typeof part !== \"string\" || part.length === 0)\n  ) {\n    throw new Error(`${APP_RUNNER_CONFIG_ENV} must carry a non-empty string[] \"command\"`);\n  }\n  return value as AppRunnerConfig;\n}\n\nexport function requireHandshakePath(env: NodeJS.ProcessEnv): string {\n  const path = env[HANDSHAKE_ENV];\n  if (!path) {\n    throw new Error(\n      `${HANDSHAKE_ENV} is not set. These entry points are meant to be launched ` +\n        `by the webServer entries that withZitadel() generates.`,\n    );\n  }\n  return path;\n}\n\nfunction parseJsonEnv(raw: string | undefined, name: string): unknown {\n  if (!raw) {\n    throw new Error(\n      `${name} is not set. This entry point is meant to be launched by the ` +\n        `webServer entries that withZitadel() generates.`,\n    );\n  }\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`${name} contains invalid JSON: ${(error as Error).message}`, {\n      cause: error,\n    });\n  }\n}\n"],"mappings":";;;;;;;AAUA,MAAa,wBAAwB;AACrC,MAAa,wBAAwB;;AAErC,MAAa,gBAAgB;AAyB7B,SAAgB,sBAAsB,KAA2C;CAC/E,MAAM,QAAQ,aAAa,KAAK,sBAAsB;AACtD,KAAI,OAAO,MAAM,SAAS,YAAY,CAAC,OAAO,UAAU,MAAM,KAAK,IAAI,MAAM,QAAQ,EACnF,OAAM,IAAI,MAAM,GAAG,sBAAsB,uCAAuC;AAElF,QAAO;;AAGT,SAAgB,qBAAqB,KAA0C;CAC7E,MAAM,QAAQ,aAAa,KAAK,sBAAsB;AACtD,KACE,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAC7B,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,MAAM,SAAS,OAAO,SAAS,YAAY,KAAK,WAAW,EAAE,CAE3E,OAAM,IAAI,MAAM,GAAG,sBAAsB,4CAA4C;AAEvF,QAAO;;AAGT,SAAgB,qBAAqB,KAAgC;CACnE,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KACH,OAAM,IAAI,MACR,GAAG,cAAc,iHAElB;AAEH,QAAO;;AAGT,SAAS,aAAa,KAAyB,MAAuB;AACpE,KAAI,CAAC,IACH,OAAM,IAAI,MACR,GAAG,KAAK,8GAET;AAEH,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,OAAO;AACd,QAAM,IAAI,MAAM,GAAG,KAAK,0BAA2B,MAAgB,WAAW,EAC5E,OAAO,OACR,CAAC"}

package/dist/playwright.cjs

@@ -0,0 +1,156 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_src = require("./src-BIL0PdSd.cjs");
+const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_orchestration = require("./orchestration-D7QBgQ0l.cjs");
+let node_fs = require("node:fs");
+let node_url = require("node:url");
+let node_path = require("node:path");
+let _playwright_test = require("@playwright/test");
+//#region src/playwright-config.ts
+/**
+* Generate the Playwright `webServer` entries that boot an ephemeral seeded
+* Zitadel and run the app against it, replacing the per-suite wrapper
+* scripts. Spread the result into `defineConfig`:
+*
+* ```ts
+* export default defineConfig({
+*   ...withZitadel({ configDir: import.meta.dirname, port: 8092, ... }),
+*   testDir: "./src-real",
+* });
+* ```
+*
+* Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the
+* `@zitadel/testing/playwright` fixtures resolve the instance — Playwright
+* workers re-evaluate the config, which re-applies this for every process
+* that needs it. The returned value is plain data; append your own entries
+* to `webServer` if the suite needs additional servers.
+*/
+function withZitadel(options, resolveEntry = entryPoint) {
+	const { configDir, port, appOrigin, app } = options;
+	if (!(0, node_path.isAbsolute)(configDir)) throw new Error(`withZitadel: configDir must be absolute, got "${configDir}"`);
+	if (!Number.isInteger(port) || port <= 0) throw new Error(`withZitadel: port must be a positive integer, got ${port}`);
+	const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : void 0;
+	if (!origin || origin.protocol !== "http:" && origin.protocol !== "https:" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error(`withZitadel: appOrigin must be an origin like "http://localhost:3002", got "${appOrigin}"`);
+	if (!app.readyPath.startsWith("/")) throw new Error(`withZitadel: app.readyPath must start with "/", got "${app.readyPath}"`);
+	if (app.command.length === 0) throw new Error("withZitadel: app.command must not be empty");
+	if (!(0, node_path.isAbsolute)(app.cwd)) throw new Error(`withZitadel: app.cwd must be absolute, got "${app.cwd}"`);
+	for (const [label, value] of [
+		["zitadel.serverBinary", options.zitadel?.serverBinary],
+		["zitadel.dir", options.zitadel?.dir],
+		["handshakePath", options.handshakePath]
+	]) if (value !== void 0 && !(0, node_path.isAbsolute)(value)) throw new Error(`withZitadel: ${label} must be an absolute path, got "${value}"`);
+	const handshakePath = options.handshakePath ?? (0, node_path.join)(configDir, ".zitadel-testing", "handshake.json");
+	process.env[require_orchestration.HANDSHAKE_ENV] = handshakePath;
+	const supervisorConfig = {
+		port,
+		appOrigins: [appOrigin],
+		serverBinary: options.zitadel?.serverBinary,
+		serverBinaryHint: options.zitadel?.serverBinaryHint,
+		dir: options.zitadel?.dir,
+		keep: options.zitadel?.keep,
+		projectName: options.zitadel?.projectName,
+		preset: options.zitadel?.preset,
+		useCase: options.zitadel?.useCase
+	};
+	const appRunnerConfig = {
+		command: app.command,
+		cwd: app.cwd,
+		env: app.env,
+		handshakeTimeoutMs: app.readyTimeoutMs ?? 18e4
+	};
+	return { webServer: [{
+		command: `node ${JSON.stringify(resolveEntry("supervisor"))}`,
+		url: `http://localhost:${port}/healthz`,
+		reuseExistingServer: false,
+		cwd: configDir,
+		stdout: "pipe",
+		stderr: "pipe",
+		timeout: options.zitadel?.bootTimeoutMs ?? 12e4,
+		env: {
+			[require_orchestration.HANDSHAKE_ENV]: handshakePath,
+			[require_orchestration.SUPERVISOR_CONFIG_ENV]: JSON.stringify(supervisorConfig)
+		},
+		gracefulShutdown: {
+			signal: "SIGTERM",
+			timeout: 3e4
+		}
+	}, {
+		command: `node ${JSON.stringify(resolveEntry("app-runner"))}`,
+		url: new URL(app.readyPath, appOrigin).toString(),
+		reuseExistingServer: false,
+		cwd: configDir,
+		stdout: "pipe",
+		stderr: "pipe",
+		timeout: app.readyTimeoutMs ?? 18e4,
+		env: {
+			[require_orchestration.HANDSHAKE_ENV]: handshakePath,
+			[require_orchestration.APP_RUNNER_CONFIG_ENV]: JSON.stringify(appRunnerConfig)
+		},
+		gracefulShutdown: {
+			signal: "SIGTERM",
+			timeout: app.gracefulShutdownMs ?? 15e3
+		}
+	}] };
+}
+/**
+* Resolve a sibling dist entry in the same module format this file was loaded
+* as (dist/supervisor.mjs next to dist/playwright.mjs, .cjs next to .cjs), so
+* the spawned process needs no package-manager bin plumbing.
+*/
+function entryPoint(name) {
+	const self = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+	const ext = (0, node_path.extname)(self);
+	if (ext !== ".mjs" && ext !== ".cjs") throw new Error(`withZitadel: expected to run from the built package (got ${self}); build @zitadel/testing first (in-repo: \`moon run testing:build\`).`);
+	const path = (0, node_url.fileURLToPath)(new URL(`./${name}${ext}`, require("url").pathToFileURL(__filename).href));
+	if (!(0, node_fs.existsSync)(path)) throw new Error(`withZitadel: missing ${path}; rebuild @zitadel/testing (in-repo: \`moon run testing:build\`).`);
+	return path;
+}
+//#endregion
+//#region src/playwright.ts
+const test = _playwright_test.test.extend({
+	zitadel: [async ({}, use) => {
+		const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;
+		if (!handshakePath) throw new Error("ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file written by the script that boots the instance (see @zitadel/testing docs).");
+		await use(require_src.connectZitadel(require_handshake.readHandshakeSync(handshakePath)));
+	}, { scope: "worker" }],
+	seed: async ({ zitadel, baseURL }, use) => {
+		await use({
+			user: (input) => zitadel.seedUser(input),
+			users: (count, template) => zitadel.seedUsers(count, template),
+			identity: () => zitadel.identity(),
+			session: (input) => zitadel.seedSession({
+				origin: baseURL,
+				...input
+			})
+		});
+	},
+	authenticatedPage: async ({ browser, zitadel, baseURL }, use) => {
+		if (!baseURL) throw new Error("authenticatedPage requires `use.baseURL` so the session cookie can be scoped to the app under test.");
+		const session = await zitadel.seedSession({ origin: baseURL });
+		const context = await browser.newContext({ baseURL });
+		const { path: _path, ...cookie } = session.cookie;
+		await context.addCookies([{
+			...cookie,
+			url: baseURL
+		}]);
+		await use({
+			page: await context.newPage(),
+			user: session.user,
+			session
+		});
+		await context.close();
+	}
+});
+//#endregion
+exports.applyAppEnvTemplate = require_handshake.applyAppEnvTemplate;
+Object.defineProperty(exports, "expect", {
+	enumerable: true,
+	get: function() {
+		return _playwright_test.expect;
+	}
+});
+exports.nextAppEnv = require_handshake.nextAppEnv;
+exports.test = test;
+exports.withZitadel = withZitadel;
+
+//# sourceMappingURL=playwright.cjs.map

package/dist/playwright.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"playwright.cjs","names":["HANDSHAKE_ENV","SUPERVISOR_CONFIG_ENV","APP_RUNNER_CONFIG_ENV","base","connectZitadel","readHandshakeSync"],"sources":["../src/playwright-config.ts","../src/playwright.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { extname, isAbsolute, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type { PlaywrightTestConfig } from \"@playwright/test\";\n\nimport type { AppEnvTemplate } from \"./app-env\";\nimport {\n  APP_RUNNER_CONFIG_ENV,\n  HANDSHAKE_ENV,\n  SUPERVISOR_CONFIG_ENV,\n  type AppRunnerConfig,\n  type SupervisorConfig,\n} from \"./orchestration\";\n\ntype WebServerEntry = Extract<\n  NonNullable<PlaywrightTestConfig[\"webServer\"]>,\n  readonly unknown[]\n>[number];\n\nexport interface WithZitadelOptions {\n  /**\n   * The Playwright config's directory (`import.meta.dirname`). Anchors the\n   * default handshake location and the working directory of the generated\n   * webServer entries.\n   */\n  configDir: string;\n  /**\n   * Fixed TCP port for the instance. Required (unlike `startLocalZitadel`,\n   * which defaults to a free port) because Playwright's readiness URL must be\n   * known while the config is evaluated, before anything boots.\n   */\n  port: number;\n  /**\n   * Origin the browser will use for the app under test. Registered as the\n   * project's preview origin (the backend's origin check rejects forwarded\n   * requests from unregistered origins) and the base of `app.readyPath`.\n   */\n  appOrigin: string;\n  /** Boot/bootstrap options forwarded to the instance supervisor. */\n  zitadel?: {\n    /** Absolute path to the server binary. */\n    serverBinary?: string;\n    /** Appended to the missing-binary error, e.g. \"run `moon run server:build` first.\" */\n    serverBinaryHint?: string;\n    projectName?: string;\n    preset?: SupervisorConfig[\"preset\"];\n    useCase?: SupervisorConfig[\"useCase\"];\n    /** Absolute state directory; defaults to a fresh temp dir removed on stop. */\n    dir?: string;\n    /** Keep the owned temp dir after stop (debugging). */\n    keep?: boolean;\n    /** webServer readiness timeout for the boot; cold boot dominates it. */\n    bootTimeoutMs?: number;\n  };\n  /** The app dev server to run against the instance. */\n  app: {\n    /** Spawn argv (no shell), e.g. [\"corepack\", \"pnpm\", \"--filter\", \"my-app\", \"dev\"]. */\n    command: string[];\n    /** Working directory for the app command. */\n    cwd: string;\n    /** Path on `appOrigin` Playwright polls for readiness, e.g. \"/login\". */\n    readyPath: string;\n    /**\n     * Env vars the app needs, as a template mapping env names to\n     * InstanceHandle fields — see `nextAppEnv` for the `@zitadel/sdk-next`\n     * shape. A template (not a callback) because it crosses into the app\n     * runner process.\n     */\n    env: AppEnvTemplate;\n    readyTimeoutMs?: number;\n    /** How long SIGTERM gets before the app is killed on teardown. */\n    gracefulShutdownMs?: number;\n  };\n  /** Absolute path; defaults to `<configDir>/.zitadel-testing/handshake.json`. */\n  handshakePath?: string;\n}\n\n/**\n * Generate the Playwright `webServer` entries that boot an ephemeral seeded\n * Zitadel and run the app against it, replacing the per-suite wrapper\n * scripts. Spread the result into `defineConfig`:\n *\n * ```ts\n * export default defineConfig({\n *   ...withZitadel({ configDir: import.meta.dirname, port: 8092, ... }),\n *   testDir: \"./src-real\",\n * });\n * ```\n *\n * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the\n * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright\n * workers re-evaluate the config, which re-applies this for every process\n * that needs it. The returned value is plain data; append your own entries\n * to `webServer` if the suite needs additional servers.\n */\nexport function withZitadel(\n  options: WithZitadelOptions,\n  /** Test seam: alternative executable resolution. */\n  resolveEntry: (name: \"supervisor\" | \"app-runner\") => string = entryPoint,\n): { webServer: WebServerEntry[] } {\n  const { configDir, port, appOrigin, app } = options;\n  if (!isAbsolute(configDir)) {\n    throw new Error(`withZitadel: configDir must be absolute, got \"${configDir}\"`);\n  }\n  if (!Number.isInteger(port) || port <= 0) {\n    throw new Error(`withZitadel: port must be a positive integer, got ${port}`);\n  }\n  const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : undefined;\n  if (\n    !origin ||\n    (origin.protocol !== \"http:\" && origin.protocol !== \"https:\") ||\n    origin.pathname !== \"/\" ||\n    origin.search !== \"\" ||\n    origin.hash !== \"\"\n  ) {\n    throw new Error(\n      `withZitadel: appOrigin must be an origin like \"http://localhost:3002\", got \"${appOrigin}\"`,\n    );\n  }\n  if (!app.readyPath.startsWith(\"/\")) {\n    throw new Error(`withZitadel: app.readyPath must start with \"/\", got \"${app.readyPath}\"`);\n  }\n  if (app.command.length === 0) {\n    throw new Error(\"withZitadel: app.command must not be empty\");\n  }\n  if (!isAbsolute(app.cwd)) {\n    throw new Error(`withZitadel: app.cwd must be absolute, got \"${app.cwd}\"`);\n  }\n  // Path options are consumed by the executables, whose cwd is configDir —\n  // a relative path would silently resolve against that, not the project.\n  for (const [label, value] of [\n    [\"zitadel.serverBinary\", options.zitadel?.serverBinary],\n    [\"zitadel.dir\", options.zitadel?.dir],\n    [\"handshakePath\", options.handshakePath],\n  ] as const) {\n    if (value !== undefined && !isAbsolute(value)) {\n      throw new Error(`withZitadel: ${label} must be an absolute path, got \"${value}\"`);\n    }\n  }\n\n  const handshakePath =\n    options.handshakePath ?? join(configDir, \".zitadel-testing\", \"handshake.json\");\n  // Workers inherit the runner's env; the fixtures resolve the instance from it.\n  process.env[HANDSHAKE_ENV] = handshakePath;\n\n  const supervisorConfig: SupervisorConfig = {\n    port,\n    appOrigins: [appOrigin],\n    serverBinary: options.zitadel?.serverBinary,\n    serverBinaryHint: options.zitadel?.serverBinaryHint,\n    dir: options.zitadel?.dir,\n    keep: options.zitadel?.keep,\n    projectName: options.zitadel?.projectName,\n    preset: options.zitadel?.preset,\n    useCase: options.zitadel?.useCase,\n  };\n  const appRunnerConfig: AppRunnerConfig = {\n    command: app.command,\n    cwd: app.cwd,\n    env: app.env,\n    handshakeTimeoutMs: app.readyTimeoutMs ?? 180_000,\n  };\n\n  return {\n    webServer: [\n      {\n        command: `node ${JSON.stringify(resolveEntry(\"supervisor\"))}`,\n        url: `http://localhost:${port}/healthz`,\n        reuseExistingServer: false,\n        cwd: configDir,\n        stdout: \"pipe\",\n        stderr: \"pipe\",\n        // Cold boot (fresh data dir: migrations + health wait) dominates.\n        timeout: options.zitadel?.bootTimeoutMs ?? 120_000,\n        env: {\n          [HANDSHAKE_ENV]: handshakePath,\n          [SUPERVISOR_CONFIG_ENV]: JSON.stringify(supervisorConfig),\n        },\n        // SIGTERM first so the supervisor can stop the instance; the default\n        // hard kill would orphan the server process group.\n        gracefulShutdown: { signal: \"SIGTERM\", timeout: 30_000 },\n      },\n      {\n        command: `node ${JSON.stringify(resolveEntry(\"app-runner\"))}`,\n        url: new URL(app.readyPath, appOrigin).toString(),\n        reuseExistingServer: false,\n        cwd: configDir,\n        stdout: \"pipe\",\n        stderr: \"pipe\",\n        timeout: app.readyTimeoutMs ?? 180_000,\n        env: {\n          [HANDSHAKE_ENV]: handshakePath,\n          [APP_RUNNER_CONFIG_ENV]: JSON.stringify(appRunnerConfig),\n        },\n        gracefulShutdown: {\n          signal: \"SIGTERM\",\n          timeout: app.gracefulShutdownMs ?? 15_000,\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Resolve a sibling dist entry in the same module format this file was loaded\n * as (dist/supervisor.mjs next to dist/playwright.mjs, .cjs next to .cjs), so\n * the spawned process needs no package-manager bin plumbing.\n */\nfunction entryPoint(name: \"supervisor\" | \"app-runner\"): string {\n  const self = fileURLToPath(import.meta.url);\n  const ext = extname(self);\n  if (ext !== \".mjs\" && ext !== \".cjs\") {\n    throw new Error(\n      `withZitadel: expected to run from the built package (got ${self}); ` +\n        \"build @zitadel/testing first (in-repo: `moon run testing:build`).\",\n    );\n  }\n  const path = fileURLToPath(new URL(`./${name}${ext}`, import.meta.url));\n  if (!existsSync(path)) {\n    throw new Error(\n      `withZitadel: missing ${path}; rebuild @zitadel/testing (in-repo: \\`moon run testing:build\\`).`,\n    );\n  }\n  return path;\n}\n","import { test as base, type Page } from \"@playwright/test\";\n\nimport { readHandshakeSync } from \"./handshake\";\nimport { connectZitadel } from \"./index\";\nimport type {\n  ConnectedZitadel,\n  Identity,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n\nexport interface AuthenticatedPage {\n  /** A page in its own context, already carrying the session cookie. */\n  page: Page;\n  user: SeededUser;\n  session: MintedSession;\n}\n\nexport interface ZitadelTestFixtures {\n  /** Per-test seeding; each call mints unique data on the shared instance. */\n  seed: {\n    user(input?: SeedUserInput): Promise<SeededUser>;\n    users(count: number, template?: SeedUsersTemplate): Promise<SeededUser[]>;\n    /** Unused email+password for registration flows — creates nothing. */\n    identity(): Identity;\n    /** Seeded user + headless real-flow login; password flows only. */\n    session(input?: SeedSessionInput): Promise<MintedSession>;\n  };\n  /**\n   * Start the test authenticated: a fresh user, a real session minted through\n   * the flow API, and the cookie injected into a dedicated browser context —\n   * the default `page` stays signed out for login-flow tests. Requires\n   * `use.baseURL` (every withZitadel consumer sets it).\n   */\n  authenticatedPage: AuthenticatedPage;\n}\n\nexport interface ZitadelWorkerFixtures {\n  /** Connection to the suite's instance, resolved once per worker. */\n  zitadel: ConnectedZitadel;\n}\n\nexport const test = base.extend<ZitadelTestFixtures, ZitadelWorkerFixtures>({\n  zitadel: [\n    // Playwright derives fixture dependencies from the destructuring pattern,\n    // so the empty pattern is required here.\n    // oxlint-disable-next-line no-empty-pattern\n    async ({}, use) => {\n      const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;\n      if (!handshakePath) {\n        throw new Error(\n          \"ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file \" +\n            \"written by the script that boots the instance (see @zitadel/testing docs).\",\n        );\n      }\n      await use(connectZitadel(readHandshakeSync(handshakePath)));\n    },\n    { scope: \"worker\" },\n  ],\n  seed: async ({ zitadel, baseURL }, use) => {\n    await use({\n      user: (input) => zitadel.seedUser(input),\n      users: (count, template) => zitadel.seedUsers(count, template),\n      identity: () => zitadel.identity(),\n      // The suite's baseURL is the app origin the project allowlists.\n      session: (input) => zitadel.seedSession({ origin: baseURL, ...input }),\n    });\n  },\n  authenticatedPage: async ({ browser, zitadel, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        \"authenticatedPage requires `use.baseURL` so the session cookie can be \" +\n          \"scoped to the app under test.\",\n      );\n    }\n    const session = await zitadel.seedSession({ origin: baseURL });\n    const context = await browser.newContext({ baseURL });\n    // `addCookies` takes either url or domain/path; url derives the rest.\n    const { path: _path, ...cookie } = session.cookie;\n    await context.addCookies([{ ...cookie, url: baseURL }]);\n    const page = await context.newPage();\n    await use({ page, user: session.user, session });\n    await context.close();\n  },\n});\n\nexport { expect } from \"@playwright/test\";\nexport { applyAppEnvTemplate, nextAppEnv } from \"./app-env\";\nexport type { AppEnvTemplate } from \"./app-env\";\nexport { withZitadel } from \"./playwright-config\";\nexport type { WithZitadelOptions } from \"./playwright-config\";\nexport type {\n  ConnectedZitadel,\n  Identity,\n  InstanceHandle,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgGA,SAAgB,YACd,SAEA,eAA8D,YAC7B;CACjC,MAAM,EAAE,WAAW,MAAM,WAAW,QAAQ;AAC5C,KAAI,EAAA,GAAA,UAAA,YAAY,UAAU,CACxB,OAAM,IAAI,MAAM,iDAAiD,UAAU,GAAG;AAEhF,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,QAAQ,EACrC,OAAM,IAAI,MAAM,qDAAqD,OAAO;CAE9E,MAAM,SAAS,IAAI,SAAS,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,KAAA;AAC9D,KACE,CAAC,UACA,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,GAEhB,OAAM,IAAI,MACR,+EAA+E,UAAU,GAC1F;AAEH,KAAI,CAAC,IAAI,UAAU,WAAW,IAAI,CAChC,OAAM,IAAI,MAAM,wDAAwD,IAAI,UAAU,GAAG;AAE3F,KAAI,IAAI,QAAQ,WAAW,EACzB,OAAM,IAAI,MAAM,6CAA6C;AAE/D,KAAI,EAAA,GAAA,UAAA,YAAY,IAAI,IAAI,CACtB,OAAM,IAAI,MAAM,+CAA+C,IAAI,IAAI,GAAG;AAI5E,MAAK,MAAM,CAAC,OAAO,UAAU;EAC3B,CAAC,wBAAwB,QAAQ,SAAS,aAAa;EACvD,CAAC,eAAe,QAAQ,SAAS,IAAI;EACrC,CAAC,iBAAiB,QAAQ,cAAc;EACzC,CACC,KAAI,UAAU,KAAA,KAAa,EAAA,GAAA,UAAA,YAAY,MAAM,CAC3C,OAAM,IAAI,MAAM,gBAAgB,MAAM,kCAAkC,MAAM,GAAG;CAIrF,MAAM,gBACJ,QAAQ,kBAAA,GAAA,UAAA,MAAsB,WAAW,oBAAoB,iBAAiB;AAEhF,SAAQ,IAAIA,sBAAAA,iBAAiB;CAE7B,MAAM,mBAAqC;EACzC;EACA,YAAY,CAAC,UAAU;EACvB,cAAc,QAAQ,SAAS;EAC/B,kBAAkB,QAAQ,SAAS;EACnC,KAAK,QAAQ,SAAS;EACtB,MAAM,QAAQ,SAAS;EACvB,aAAa,QAAQ,SAAS;EAC9B,QAAQ,QAAQ,SAAS;EACzB,SAAS,QAAQ,SAAS;EAC3B;CACD,MAAM,kBAAmC;EACvC,SAAS,IAAI;EACb,KAAK,IAAI;EACT,KAAK,IAAI;EACT,oBAAoB,IAAI,kBAAkB;EAC3C;AAED,QAAO,EACL,WAAW,CACT;EACE,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,oBAAoB,KAAK;EAC9B,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EAER,SAAS,QAAQ,SAAS,iBAAiB;EAC3C,KAAK;IACFA,sBAAAA,gBAAgB;IAChBC,sBAAAA,wBAAwB,KAAK,UAAU,iBAAiB;GAC1D;EAGD,kBAAkB;GAAE,QAAQ;GAAW,SAAS;GAAQ;EACzD,EACD;EACE,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,IAAI,IAAI,IAAI,WAAW,UAAU,CAAC,UAAU;EACjD,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EACR,SAAS,IAAI,kBAAkB;EAC/B,KAAK;IACFD,sBAAAA,gBAAgB;IAChBE,sBAAAA,wBAAwB,KAAK,UAAU,gBAAgB;GACzD;EACD,kBAAkB;GAChB,QAAQ;GACR,SAAS,IAAI,sBAAsB;GACpC;EACF,CACF,EACF;;;;;;;AAQH,SAAS,WAAW,MAA2C;CAC7D,MAAM,QAAA,GAAA,SAAA,eAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAqC;CAC3C,MAAM,OAAA,GAAA,UAAA,SAAc,KAAK;AACzB,KAAI,QAAQ,UAAU,QAAQ,OAC5B,OAAM,IAAI,MACR,4DAA4D,KAAK,wEAElE;CAEH,MAAM,QAAA,GAAA,SAAA,eAAqB,IAAI,IAAI,KAAK,OAAO,OAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAuB,CAAC;AACvE,KAAI,EAAA,GAAA,QAAA,YAAY,KAAK,CACnB,OAAM,IAAI,MACR,wBAAwB,KAAK,mEAC9B;AAEH,QAAO;;;;ACnLT,MAAa,OAAOC,iBAAAA,KAAK,OAAmD;CAC1E,SAAS,CAIP,OAAO,IAAI,QAAQ;EACjB,MAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,cACH,OAAM,IAAI,MACR,kJAED;AAEH,QAAM,IAAIC,YAAAA,eAAeC,kBAAAA,kBAAkB,cAAc,CAAC,CAAC;IAE7D,EAAE,OAAO,UAAU,CACpB;CACD,MAAM,OAAO,EAAE,SAAS,WAAW,QAAQ;AACzC,QAAM,IAAI;GACR,OAAO,UAAU,QAAQ,SAAS,MAAM;GACxC,QAAQ,OAAO,aAAa,QAAQ,UAAU,OAAO,SAAS;GAC9D,gBAAgB,QAAQ,UAAU;GAElC,UAAU,UAAU,QAAQ,YAAY;IAAE,QAAQ;IAAS,GAAG;IAAO,CAAC;GACvE,CAAC;;CAEJ,mBAAmB,OAAO,EAAE,SAAS,SAAS,WAAW,QAAQ;AAC/D,MAAI,CAAC,QACH,OAAM,IAAI,MACR,sGAED;EAEH,MAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,QAAQ,SAAS,CAAC;EAC9D,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,CAAC;EAErD,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW,QAAQ;AAC3C,QAAM,QAAQ,WAAW,CAAC;GAAE,GAAG;GAAQ,KAAK;GAAS,CAAC,CAAC;AAEvD,QAAM,IAAI;GAAE,MAAA,MADO,QAAQ,SAAS;GAClB,MAAM,QAAQ;GAAM;GAAS,CAAC;AAChD,QAAM,QAAQ,OAAO;;CAExB,CAAC"}