deepspace 0.19.5 → 0.21.0

package/dist/testing-mcp.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `deepspace/testing/mcp` — dependency-free JSON-RPC client for exercising
+ * the documentation MCP endpoint over its real HTTP wire contract.
+ *
+ * The endpoint is JSON-only (never SSE), stateless (no session ids), and
+ * unauthenticated, so the client is plain `fetch`: incrementing request ids,
+ * the negotiated `MCP-Protocol-Version` echoed after `initialize`, JSON-RPC
+ * error objects surfaced as typed throws, and notifications resolved on the
+ * wire's 202 + null body. It must stay importable without `@playwright/test`,
+ * so it lives beside — never inside — `./index.ts`.
+ */
+interface McpTestClientOptions {
+    /** Endpoint path resolved against the base URL. */
+    endpoint?: string;
+    /** Fetch implementation, e.g. one bound to an in-process worker. */
+    fetch?: typeof fetch;
+}
+interface McpInitializeResult {
+    protocolVersion: string;
+    capabilities: Record<string, unknown>;
+    serverInfo: {
+        name: string;
+        version: string;
+        title?: string;
+    };
+    instructions?: string;
+}
+interface McpTool {
+    name: string;
+    title?: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+interface McpToolCallResult {
+    content: Array<{
+        type: string;
+        text?: string;
+    }>;
+    structuredContent?: Record<string, unknown>;
+    isError?: boolean;
+}
+interface McpTestClient {
+    /** Negotiated at `initialize`; writable so suites can force a wire mismatch. */
+    protocolVersion: string | undefined;
+    initialize(params?: Record<string, unknown>): Promise<McpInitializeResult>;
+    listTools(): Promise<McpTool[]>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<McpToolCallResult>;
+    notify(method: string, params?: Record<string, unknown>): Promise<void>;
+}
+/** A JSON-RPC `error` object answered by the endpoint. */
+declare class McpRpcError extends Error {
+    readonly code: number;
+    readonly data: unknown;
+    readonly status: number;
+    constructor(status: number, error: {
+        code: number;
+        message: string;
+        data?: unknown;
+    });
+}
+/** A response outside the JSON-RPC contract, e.g. an unpublished surface's 404 page. */
+declare class McpTransportError extends Error {
+    readonly status: number;
+    readonly bodyHead: string;
+    constructor(status: number, body: string);
+}
+declare function createMcpTestClient(baseUrl: string, options?: McpTestClientOptions): McpTestClient;
+
+export { type McpInitializeResult, McpRpcError, type McpTestClient, type McpTestClientOptions, type McpTool, type McpToolCallResult, McpTransportError, createMcpTestClient };

package/dist/testing-mcp.js

@@ -0,0 +1,99 @@
+// src/testing/mcp.ts
+var McpRpcError = class extends Error {
+  code;
+  data;
+  status;
+  constructor(status, error) {
+    super(error.message);
+    this.name = "McpRpcError";
+    this.code = error.code;
+    this.data = error.data;
+    this.status = status;
+  }
+};
+var McpTransportError = class extends Error {
+  status;
+  bodyHead;
+  constructor(status, body) {
+    const bodyHead = body.slice(0, 200);
+    super(`Unexpected MCP response (HTTP ${status}): ${bodyHead || "<empty body>"}`);
+    this.name = "McpTransportError";
+    this.status = status;
+    this.bodyHead = bodyHead;
+  }
+};
+function createMcpTestClient(baseUrl, options = {}) {
+  const endpoint = new URL(options.endpoint ?? "/mcp", baseUrl).toString();
+  const fetchImpl = options.fetch ?? fetch;
+  let nextId = 1;
+  let protocolVersion;
+  const post = (payload) => fetchImpl(endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      // The header exists only after negotiation, so `initialize` never carries it.
+      ...protocolVersion !== void 0 && payload.method !== "initialize" ? { "MCP-Protocol-Version": protocolVersion } : {}
+    },
+    body: JSON.stringify(payload)
+  });
+  const parseMessage = async (response) => {
+    const body = await response.text();
+    let message;
+    try {
+      message = JSON.parse(body);
+    } catch {
+      throw new McpTransportError(response.status, body);
+    }
+    if (!message || typeof message !== "object" || Array.isArray(message)) {
+      throw new McpTransportError(response.status, body);
+    }
+    const { error } = message;
+    if (error) throw new McpRpcError(response.status, error);
+    return { body, message };
+  };
+  const request = async (method, params) => {
+    const response = await post({
+      jsonrpc: "2.0",
+      id: nextId++,
+      method,
+      ...params !== void 0 ? { params } : {}
+    });
+    return (await parseMessage(response)).message.result;
+  };
+  return {
+    get protocolVersion() {
+      return protocolVersion;
+    },
+    set protocolVersion(value) {
+      protocolVersion = value;
+    },
+    async initialize(params) {
+      const result = await request("initialize", params);
+      protocolVersion = typeof result?.protocolVersion === "string" ? result.protocolVersion : void 0;
+      return result;
+    },
+    async listTools() {
+      return (await request("tools/list")).tools;
+    },
+    async callTool(name, args = {}) {
+      return request("tools/call", { name, arguments: args });
+    },
+    async notify(method, params) {
+      const response = await post({
+        jsonrpc: "2.0",
+        method,
+        ...params !== void 0 ? { params } : {}
+      });
+      if (response.status === 202) return;
+      const { body } = await parseMessage(response);
+      throw new McpTransportError(response.status, body);
+    }
+  };
+}
+export {
+  McpRpcError,
+  McpTransportError,
+  createMcpTestClient
+};
+//# sourceMappingURL=testing-mcp.js.map

package/dist/testing-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing/mcp.ts"],"sourcesContent":["/**\n * `deepspace/testing/mcp` — dependency-free JSON-RPC client for exercising\n * the documentation MCP endpoint over its real HTTP wire contract.\n *\n * The endpoint is JSON-only (never SSE), stateless (no session ids), and\n * unauthenticated, so the client is plain `fetch`: incrementing request ids,\n * the negotiated `MCP-Protocol-Version` echoed after `initialize`, JSON-RPC\n * error objects surfaced as typed throws, and notifications resolved on the\n * wire's 202 + null body. It must stay importable without `@playwright/test`,\n * so it lives beside — never inside — `./index.ts`.\n */\n\nexport interface McpTestClientOptions {\n  /** Endpoint path resolved against the base URL. */\n  endpoint?: string\n  /** Fetch implementation, e.g. one bound to an in-process worker. */\n  fetch?: typeof fetch\n}\n\nexport interface McpInitializeResult {\n  protocolVersion: string\n  capabilities: Record<string, unknown>\n  serverInfo: { name: string; version: string; title?: string }\n  instructions?: string\n}\n\nexport interface McpTool {\n  name: string\n  title?: string\n  description?: string\n  inputSchema: Record<string, unknown>\n}\n\nexport interface McpToolCallResult {\n  content: Array<{ type: string; text?: string }>\n  structuredContent?: Record<string, unknown>\n  isError?: boolean\n}\n\nexport interface McpTestClient {\n  /** Negotiated at `initialize`; writable so suites can force a wire mismatch. */\n  protocolVersion: string | undefined\n  initialize(params?: Record<string, unknown>): Promise<McpInitializeResult>\n  listTools(): Promise<McpTool[]>\n  callTool(name: string, args?: Record<string, unknown>): Promise<McpToolCallResult>\n  notify(method: string, params?: Record<string, unknown>): Promise<void>\n}\n\n/** A JSON-RPC `error` object answered by the endpoint. */\nexport class McpRpcError extends Error {\n  readonly code: number\n  readonly data: unknown\n  readonly status: number\n  constructor(status: number, error: { code: number; message: string; data?: unknown }) {\n    super(error.message)\n    this.name = 'McpRpcError'\n    this.code = error.code\n    this.data = error.data\n    this.status = status\n  }\n}\n\n/** A response outside the JSON-RPC contract, e.g. an unpublished surface's 404 page. */\nexport class McpTransportError extends Error {\n  readonly status: number\n  readonly bodyHead: string\n  constructor(status: number, body: string) {\n    const bodyHead = body.slice(0, 200)\n    super(`Unexpected MCP response (HTTP ${status}): ${bodyHead || '<empty body>'}`)\n    this.name = 'McpTransportError'\n    this.status = status\n    this.bodyHead = bodyHead\n  }\n}\n\nexport function createMcpTestClient(\n  baseUrl: string,\n  options: McpTestClientOptions = {},\n): McpTestClient {\n  const endpoint = new URL(options.endpoint ?? '/mcp', baseUrl).toString()\n  const fetchImpl = options.fetch ?? fetch\n  let nextId = 1\n  let protocolVersion: string | undefined\n\n  const post = (payload: Record<string, unknown>): Promise<Response> =>\n    fetchImpl(endpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        // The header exists only after negotiation, so `initialize` never carries it.\n        ...(protocolVersion !== undefined && payload.method !== 'initialize'\n          ? { 'MCP-Protocol-Version': protocolVersion }\n          : {}),\n      },\n      body: JSON.stringify(payload),\n    })\n\n  const parseMessage = async (\n    response: Response,\n  ): Promise<{ body: string; message: Record<string, unknown> }> => {\n    const body = await response.text()\n    let message: unknown\n    try {\n      message = JSON.parse(body)\n    } catch {\n      throw new McpTransportError(response.status, body)\n    }\n    if (!message || typeof message !== 'object' || Array.isArray(message)) {\n      throw new McpTransportError(response.status, body)\n    }\n    const { error } = message as { error?: { code: number; message: string; data?: unknown } }\n    if (error) throw new McpRpcError(response.status, error)\n    return { body, message: message as Record<string, unknown> }\n  }\n\n  const request = async <Result>(method: string, params?: unknown): Promise<Result> => {\n    const response = await post({\n      jsonrpc: '2.0',\n      id: nextId++,\n      method,\n      ...(params !== undefined ? { params } : {}),\n    })\n    return (await parseMessage(response)).message.result as Result\n  }\n\n  return {\n    get protocolVersion() {\n      return protocolVersion\n    },\n    set protocolVersion(value) {\n      protocolVersion = value\n    },\n    async initialize(params) {\n      const result = await request<McpInitializeResult>('initialize', params)\n      protocolVersion =\n        typeof result?.protocolVersion === 'string' ? result.protocolVersion : undefined\n      return result\n    },\n    async listTools() {\n      return (await request<{ tools: McpTool[] }>('tools/list')).tools\n    },\n    async callTool(name, args = {}) {\n      return request<McpToolCallResult>('tools/call', { name, arguments: args })\n    },\n    async notify(method, params) {\n      const response = await post({\n        jsonrpc: '2.0',\n        method,\n        ...(params !== undefined ? { params } : {}),\n      })\n      if (response.status === 202) return\n      // Anything else breaches the notification contract: a JSON-RPC error\n      // throws typed above, and a stray result is itself a transport fault.\n      const { body } = await parseMessage(response)\n      throw new McpTransportError(response.status, body)\n    },\n  }\n}\n"],"mappings":";AAiDO,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,QAAgB,OAA0D;AACpF,UAAM,MAAM,OAAO;AACnB,SAAK,OAAO;AACZ,SAAK,OAAO,MAAM;AAClB,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS;AAAA,EAChB;AACF;AAGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACT,YAAY,QAAgB,MAAc;AACxC,UAAM,WAAW,KAAK,MAAM,GAAG,GAAG;AAClC,UAAM,iCAAiC,MAAM,MAAM,YAAY,cAAc,EAAE;AAC/E,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,WAAW;AAAA,EAClB;AACF;AAEO,SAAS,oBACd,SACA,UAAgC,CAAC,GAClB;AACf,QAAM,WAAW,IAAI,IAAI,QAAQ,YAAY,QAAQ,OAAO,EAAE,SAAS;AACvE,QAAM,YAAY,QAAQ,SAAS;AACnC,MAAI,SAAS;AACb,MAAI;AAEJ,QAAM,OAAO,CAAC,YACZ,UAAU,UAAU;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA;AAAA,MAER,GAAI,oBAAoB,UAAa,QAAQ,WAAW,eACpD,EAAE,wBAAwB,gBAAgB,IAC1C,CAAC;AAAA,IACP;AAAA,IACA,MAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,CAAC;AAEH,QAAM,eAAe,OACnB,aACgE;AAChE,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,IAAI;AAAA,IAC3B,QAAQ;AACN,YAAM,IAAI,kBAAkB,SAAS,QAAQ,IAAI;AAAA,IACnD;AACA,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,YAAM,IAAI,kBAAkB,SAAS,QAAQ,IAAI;AAAA,IACnD;AACA,UAAM,EAAE,MAAM,IAAI;AAClB,QAAI,MAAO,OAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AACvD,WAAO,EAAE,MAAM,QAA4C;AAAA,EAC7D;AAEA,QAAM,UAAU,OAAe,QAAgB,WAAsC;AACnF,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B,SAAS;AAAA,MACT,IAAI;AAAA,MACJ;AAAA,MACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3C,CAAC;AACD,YAAQ,MAAM,aAAa,QAAQ,GAAG,QAAQ;AAAA,EAChD;AAEA,SAAO;AAAA,IACL,IAAI,kBAAkB;AACpB,aAAO;AAAA,IACT;AAAA,IACA,IAAI,gBAAgB,OAAO;AACzB,wBAAkB;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,QAAQ;AACvB,YAAM,SAAS,MAAM,QAA6B,cAAc,MAAM;AACtE,wBACE,OAAO,QAAQ,oBAAoB,WAAW,OAAO,kBAAkB;AACzE,aAAO;AAAA,IACT;AAAA,IACA,MAAM,YAAY;AAChB,cAAQ,MAAM,QAA8B,YAAY,GAAG;AAAA,IAC7D;AAAA,IACA,MAAM,SAAS,MAAM,OAAO,CAAC,GAAG;AAC9B,aAAO,QAA2B,cAAc,EAAE,MAAM,WAAW,KAAK,CAAC;AAAA,IAC3E;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ;AAC3B,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,SAAS;AAAA,QACT;AAAA,QACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3C,CAAC;AACD,UAAI,SAAS,WAAW,IAAK;AAG7B,YAAM,EAAE,KAAK,IAAI,MAAM,aAAa,QAAQ;AAC5C,YAAM,IAAI,kBAAkB,SAAS,QAAQ,IAAI;AAAA,IACnD;AAAA,EACF;AACF;","names":[]}

package/dist/testing.d.ts

@@ -72,7 +72,7 @@ declare function findTestAccountByName(name: string): TestAccount;
  * subsequent runs.
  *
  * Cache layout:
- *   ~/.deepspace/playwright-states/<sha256(email)>.json
+ *   ~/.deepspace/playwright-states/<sha256(authScope, appOrigin, email)>.json
  *
  * Validity: a cached file is reused if Playwright successfully loads it
  * AND the resulting context produces a non-anonymous session on the
@@ -80,33 +80,30 @@ declare function findTestAccountByName(name: string): TestAccount;
  * overwrite the cache.
  */
 
+interface StorageStateAccount {
+    email: string;
+    password: string;
+    /** Remote user id, when the local registry knows it. */
+    userId?: string;
+}
+/** Where the cache for `email` against `baseURL`'s origin lives. */
+declare function getStatePathForEmail(email: string, baseURL: string): string;
 interface EnsureStorageStateOptions {
-    /** Max age of a cached state file before we re-sign-in. Default 7 days. */
-    maxAgeMs?: number;
-    /** Force a fresh sign-in even if the cache is fresh. */
+    /** Force a fresh sign-in even if a cached state validates. */
     force?: boolean;
 }
 /**
- * Ensure a Playwright `storageState` file exists for `account` and
- * return its path. Signs in once if the cache is missing, stale, or
- * `force: true`.
+ * Ensure a validated Playwright `storageState` file exists for `account`
+ * and return its path. A cached file is probed against the app before
+ * reuse (once per worker process); a missing, expired, or wrong-account
+ * state triggers one fresh sign-in that overwrites it.
  */
-declare function ensureStorageState(browser: Browser, account: {
-    email: string;
-    password: string;
-}, baseURL: string, options?: EnsureStorageStateOptions): Promise<string>;
+declare function ensureStorageState(browser: Browser, account: StorageStateAccount, baseURL: string, options?: EnsureStorageStateOptions): Promise<string>;
 /**
  * Convenience: open a fresh `BrowserContext` for `account` using the
  * cached storage state (signing in if needed). The caller is responsible
  * for closing the context.
  */
-declare function newSignedInContext(browser: Browser, account: {
-    email: string;
-    password: string;
-}, baseURL: string, options?: EnsureStorageStateOptions): Promise<BrowserContext>;
-/** Read a cached storageState file (mostly for debugging). */
-declare function readCachedState(email: string): unknown | null;
-/** Where the cache for `email` lives. Useful for diagnostics. */
-declare function getStatePathForEmail(email: string): string;
+declare function newSignedInContext(browser: Browser, account: StorageStateAccount, baseURL: string, options?: EnsureStorageStateOptions): Promise<BrowserContext>;
 
-export { type EnsureStorageStateOptions, type MultiplayerUser, type TestAccount, type UsersFixture, ensureStorageState, findTestAccountByName, getStatePathForEmail, loadAllTestAccounts, newSignedInContext, pickTestAccounts, readCachedState, test };
+export { type EnsureStorageStateOptions, type MultiplayerUser, type TestAccount, type UsersFixture, ensureStorageState, findTestAccountByName, getStatePathForEmail, loadAllTestAccounts, newSignedInContext, pickTestAccounts, test };

package/dist/testing.js

@@ -73,23 +73,49 @@ function findTestAccountByName(name) {
 
 // src/testing/storage-state.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+import { request } from "@playwright/test";
+
+// src/shared/jwt.ts
+function decodeJwtPayload(token) {
+  const payloadSegment = token.split(".")[1];
+  if (!payloadSegment) {
+    throw new Error("JWT payload is missing");
+  }
+  return JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+}
+
+// src/testing/storage-state.ts
 var STATES_DIR = join2(homedir2(), ".deepspace", "playwright-states");
-var DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
-function statePathForEmail(email) {
-  const hash = createHash("sha256").update(email.trim().toLowerCase()).digest("hex").slice(0, 24);
+var stateValidations = /* @__PURE__ */ new Map();
+function getStatePathForEmail(email, baseURL) {
+  const key = `${currentTestAccountScope()}
+${new URL(baseURL).origin}
+${email.trim().toLowerCase()}`;
+  const hash = createHash("sha256").update(key).digest("hex").slice(0, 24);
   return join2(STATES_DIR, `${hash}.json`);
 }
 function ensureStatesDir() {
   if (!existsSync2(STATES_DIR)) mkdirSync2(STATES_DIR, { recursive: true });
 }
-function isCacheFresh(path, maxAgeMs) {
-  if (!existsSync2(path)) return false;
+function tokenClaimsMatchAccount(claims, account) {
+  if (account.userId && claims.sub === account.userId) return true;
+  return typeof claims.email === "string" && claims.email.trim().toLowerCase() === account.email.trim().toLowerCase();
+}
+async function probeStoredSession(path, baseURL, account) {
   try {
-    const age = Date.now() - statSync(path).mtimeMs;
-    return age < maxAgeMs;
+    const ctx = await request.newContext({ storageState: path, baseURL });
+    try {
+      const res = await ctx.post("/api/auth/token");
+      if (!res.ok()) return false;
+      const { token } = await res.json();
+      if (typeof token !== "string") return false;
+      return tokenClaimsMatchAccount(decodeJwtPayload(token), account);
+    } finally {
+      await ctx.dispose();
+    }
   } catch {
     return false;
   }
@@ -116,7 +142,7 @@ async function signInAndSaveState(browser, account, baseURL, outPath) {
           message: typeof error?.message === "string" ? error.message : null
         };
       },
-      account
+      { email: account.email, password: account.password }
     );
     if (!result.ok) throw new Error(formatSignInFailure(account.email, result));
     await ctx.storageState({ path: outPath });
@@ -132,9 +158,18 @@ function formatSignInFailure(email, failure) {
   return `Sign-in failed for ${email} (HTTP ${failure.status}${code})${detail}. ${nextStep}`;
 }
 async function ensureStorageState(browser, account, baseURL, options = {}) {
-  const path = statePathForEmail(account.email);
-  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
-  if (!options.force && isCacheFresh(path, maxAgeMs)) {
+  const path = getStatePathForEmail(account.email, baseURL);
+  if (options.force) stateValidations.delete(path);
+  let pending = stateValidations.get(path);
+  if (!pending) {
+    pending = validateOrSignIn(browser, account, baseURL, path, options.force === true);
+    stateValidations.set(path, pending);
+    pending.catch(() => stateValidations.delete(path));
+  }
+  return pending;
+}
+async function validateOrSignIn(browser, account, baseURL, path, force) {
+  if (!force && existsSync2(path) && await probeStoredSession(path, baseURL, account)) {
     return path;
   }
   return signInAndSaveState(browser, account, baseURL, path);
@@ -143,18 +178,6 @@ async function newSignedInContext(browser, account, baseURL, options = {}) {
   const statePath = await ensureStorageState(browser, account, baseURL, options);
   return browser.newContext({ storageState: statePath, baseURL });
 }
-function readCachedState(email) {
-  const path = statePathForEmail(email);
-  if (!existsSync2(path)) return null;
-  try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function getStatePathForEmail(email) {
-  return statePathForEmail(email);
-}
 
 // src/testing/fixtures.ts
 import { expect } from "@playwright/test";
@@ -206,7 +229,6 @@ export {
   loadAllTestAccounts,
   newSignedInContext,
   pickTestAccounts,
-  readCachedState,
   test
 };
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/testing/fixtures.ts","../src/testing/accounts.ts","../src/testing/storage-state.ts"],"sourcesContent":["/**\n * Multi-user Playwright fixture for DeepSpace apps.\n *\n * Usage:\n *\n *   import { test, expect } from 'deepspace/testing'\n *\n *   test('A sends, B sees', async ({ users }) => {\n *     const [a, b] = await users(2)\n *     await a.page.goto('/chat')\n *     await b.page.goto('/chat')\n *     await a.page.getByTestId('message-input').fill('hi')\n *     await a.page.getByTestId('send-message-btn').click()\n *     await expect(b.page.getByText('hi')).toBeVisible()\n *   })\n *\n * `users(N)` picks the first N test accounts from\n * `~/.deepspace/test-accounts.json` (created via\n * `deepspace test accounts create`). `users(['Alice', 'Bob'])` picks\n * specific accounts by name.\n *\n * Each user gets a separate browser context with cached storageState\n * (per-account JSON in `~/.deepspace/playwright-states/`). Sign-in\n * happens once per account, not once per test, sidestepping Better\n * Auth's per-IP rate limit on `/api/auth/sign-in/email`.\n *\n * Contexts are auto-closed when the test finishes.\n */\n\nimport { test as baseTest, type Browser, type BrowserContext, type Page } from '@playwright/test'\nimport {\n  type TestAccount,\n  pickTestAccounts,\n  findTestAccountByName,\n} from './accounts'\nimport { ensureStorageState } from './storage-state'\n\nexport interface MultiplayerUser {\n  context: BrowserContext\n  page: Page\n  email: string\n  name: string\n  /** Test account user ID, if known from the accounts registry. */\n  userId?: string\n}\n\n/**\n * Fixture function signature. Pass either a count (`users(2)`) or an\n * array of account names (`users(['Alice', 'Bob'])`). Returns one entry\n * per requested user.\n */\nexport type UsersFixture = (\n  selector: number | string[],\n  options?: { label?: string },\n) => Promise<MultiplayerUser[]>\n\ninterface MultiplayerFixtures {\n  users: UsersFixture\n}\n\nasync function buildUser(\n  browser: Browser,\n  account: TestAccount,\n  baseURL: string,\n): Promise<{ user: MultiplayerUser; cleanup: () => Promise<void> }> {\n  const statePath = await ensureStorageState(browser, account, baseURL)\n  const context = await browser.newContext({ storageState: statePath, baseURL })\n  const page = await context.newPage()\n  return {\n    user: {\n      context,\n      page,\n      email: account.email,\n      name: account.name ?? account.email.split('@')[0],\n      userId: account.userId,\n    },\n    cleanup: async () => {\n      await context.close()\n    },\n  }\n}\n\nexport const test = baseTest.extend<MultiplayerFixtures>({\n  users: async ({ browser, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        '`users` fixture requires a baseURL. Set it on your Playwright config ' +\n          '(e.g. `use: { baseURL: \"http://localhost:5173\" }`) or via the ' +\n          'webServer.url shortcut.',\n      )\n    }\n\n    const cleanups: Array<() => Promise<void>> = []\n\n    const usersFn: UsersFixture = async (selector, options) => {\n      const accounts: TestAccount[] = Array.isArray(selector)\n        ? selector.map((name) => findTestAccountByName(name))\n        : pickTestAccounts(selector, options)\n\n      const built = await Promise.all(\n        accounts.map((acct) => buildUser(browser, acct, baseURL)),\n      )\n      for (const b of built) cleanups.push(b.cleanup)\n      return built.map((b) => b.user)\n    }\n\n    await use(usersFn)\n\n    // Tear down any contexts we created. Errors are swallowed — a test\n    // failure shouldn't be masked by a cleanup error.\n    for (const cleanup of cleanups) {\n      await cleanup().catch(() => {})\n    }\n  },\n})\n\nexport { expect } from '@playwright/test'\n","/**\n * Account-credential plumbing for the testing module.\n *\n * Reads test accounts from the auth-origin-scoped registry at\n * `~/.deepspace/test-accounts.json` (the same file\n * `deepspace test accounts create` writes). Persisted accounts are bound to a\n * remote account id; `name` and `label` are optional.\n *\n * Used by the multi-user Playwright fixture in `./fixtures.ts` and is\n * also exported standalone in case suites want to do their own\n * orchestration.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface TestAccount {\n  email: string\n  password: string\n  name?: string\n  label?: string | null\n  id?: string\n  userId?: string\n  createdAt?: number\n}\n\nexport const TEST_ACCOUNTS_PATH = join(homedir(), '.deepspace', 'test-accounts.json')\n\nconst PRODUCTION_AUTH_ORIGIN = 'https://auth.deep.space'\nconst STAGING_AUTH_ORIGIN = 'https://auth.deepspacesites.com'\n\nexport interface TestAccountCredentialStore {\n  version: 2\n  scopes: Record<string, TestAccount[]>\n}\n\nexport interface RemoteTestAccount {\n  id: string\n  email: string\n  userId: string\n  label: string | null\n  createdAt: number\n}\n\n/**\n * Load all test accounts the developer has created. Returns an empty\n * array if the file doesn't exist yet.\n */\nexport function currentTestAccountScope(env: NodeJS.ProcessEnv = process.env): string {\n  const selected = env.DEEPSPACE_AUTH_URL ??\n    (env.DEEPSPACE_ENV === 'staging' ? STAGING_AUTH_ORIGIN : PRODUCTION_AUTH_ORIGIN)\n  return normalizeTestAccountScope(selected)\n}\n\nexport function normalizeTestAccountScope(value: string): string {\n  try {\n    return new URL(value).origin\n  } catch {\n    return value\n  }\n}\n\nexport function loadAllTestAccounts(scope = currentTestAccountScope()): TestAccount[] {\n  const store = readTestAccountStore()\n  return store.scopes[scope] ?? []\n}\n\n/**\n * Replace the local credential registry with the subset that still exists\n * remotely. Passwords and display names remain local-only; a recreated email\n * with a different id is deliberately treated as a different account.\n */\nexport function reconcileTestAccountStore(\n  remote: RemoteTestAccount[],\n  scope = currentTestAccountScope(),\n): {\n  accounts: TestAccount[]\n  removed: number\n} {\n  const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope)\n  saveTestAccountStore(result.store)\n  return { accounts: result.accounts, removed: result.removed }\n}\n\nexport function reconcileTestAccountScopes(\n  store: TestAccountCredentialStore,\n  remote: RemoteTestAccount[],\n  scope: string,\n): { store: TestAccountCredentialStore; accounts: TestAccount[]; removed: number } {\n  const scoped = store.scopes[scope] ?? []\n  const accounts = reconcileTestAccounts(scoped, remote)\n  return {\n    accounts,\n    removed: Math.max(0, scoped.length - accounts.length),\n    store: {\n      version: 2,\n      scopes: { ...store.scopes, [scope]: accounts },\n    },\n  }\n}\n\nexport function reconcileTestAccounts(\n  local: TestAccount[],\n  remote: RemoteTestAccount[],\n): TestAccount[] {\n  const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]))\n  return remote.flatMap((account) => {\n    const stored = localById.get(account.id)\n    return stored ? [{ ...stored, ...account }] : []\n  })\n}\n\n/** Add or replace one locally stored credential without creating duplicates. */\nexport function upsertTestAccount(account: TestAccount, scope = currentTestAccountScope()): void {\n  const store = readTestAccountStore()\n  const accounts = (store.scopes[scope] ?? []).filter(\n    (stored) => stored.id !== account.id && stored.email !== account.email,\n  )\n  saveTestAccountStore({\n    version: 2,\n    scopes: { ...store.scopes, [scope]: [...accounts, account] },\n  })\n}\n\n/** Remove credentials after the corresponding remote delete succeeds. */\nexport function removeTestAccounts(\n  ids: string[],\n  emails: string[] = [],\n  scope = currentTestAccountScope(),\n): void {\n  const idSet = new Set(ids)\n  const emailSet = new Set(emails)\n  const keep = (account: TestAccount): boolean =>\n    !idSet.has(account.id ?? '') && !emailSet.has(account.email)\n  const store = readTestAccountStore()\n  saveTestAccountStore({\n    version: 2,\n    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },\n  })\n}\n\nfunction readTestAccountStore(): TestAccountCredentialStore {\n  if (!existsSync(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} }\n  try {\n    const raw: unknown = JSON.parse(readFileSync(TEST_ACCOUNTS_PATH, 'utf-8'))\n    if (Array.isArray(raw)) return { version: 2, scopes: {} }\n    if (!raw || typeof raw !== 'object') {\n      return { version: 2, scopes: {} }\n    }\n    const candidate = raw as { scopes?: unknown }\n    const scopes = candidate.scopes && typeof candidate.scopes === 'object' && !Array.isArray(candidate.scopes)\n      ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)]))\n      : {}\n    return { version: 2, scopes }\n  } catch {\n    return { version: 2, scopes: {} }\n  }\n}\n\nfunction validTestAccounts(value: unknown): TestAccount[] {\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is TestAccount =>\n    Boolean(\n      item &&\n        typeof item === 'object' &&\n        typeof (item as TestAccount).id === 'string' &&\n        typeof (item as TestAccount).email === 'string' &&\n        typeof (item as TestAccount).password === 'string',\n    ),\n  )\n}\n\nfunction saveTestAccountStore(store: TestAccountCredentialStore): void {\n  mkdirSync(join(homedir(), '.deepspace'), { recursive: true })\n  writeFileSync(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 0o600 })\n}\n\n/**\n * Pick `count` test accounts from the local registry, optionally\n * filtered by `label`. Order-stable: sorted by `createdAt` ascending so\n * the first test account you created is always the first one returned.\n *\n * Throws with a helpful message if not enough accounts exist.\n */\nexport function pickTestAccounts(\n  count: number,\n  options?: { label?: string },\n): TestAccount[] {\n  const all = loadAllTestAccounts()\n  const filtered = options?.label\n    ? all.filter((a) => a.label === options.label)\n    : all\n  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0))\n\n  if (sorted.length < count) {\n    const labelHint = options?.label ? ` (label=\"${options.label}\")` : ''\n    throw new Error(\n      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} ` +\n        `are present in ${TEST_ACCOUNTS_PATH}. Create more with:\\n` +\n        `  deepspace test accounts create --email <name>@deepspace.test --password <pw> --name \"<name>\"${\n          options?.label ? ` --label ${options.label}` : ''\n        }`,\n    )\n  }\n\n  return sorted.slice(0, count)\n}\n\n/**\n * Find a single account by name. Used by `users(['Alice', 'Bob'])`.\n * Throws if not found.\n */\nexport function findTestAccountByName(name: string): TestAccount {\n  const all = loadAllTestAccounts()\n  const match = all.find((a) => a.name === name)\n  if (!match) {\n    throw new Error(\n      `No test account named \"${name}\" in ${TEST_ACCOUNTS_PATH}. Create with:\\n` +\n        `  deepspace test accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name \"${name}\"`,\n    )\n  }\n  return match\n}\n","/**\n * Per-account `storageState` cache for Playwright.\n *\n * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`\n * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up\n * 5+ users per spec would hit the limit and start failing in non-obvious\n * ways. This module signs each account in *once*, persists the\n * resulting browser cookies + storage to disk, and reuses the file on\n * subsequent runs.\n *\n * Cache layout:\n *   ~/.deepspace/playwright-states/<sha256(email)>.json\n *\n * Validity: a cached file is reused if Playwright successfully loads it\n * AND the resulting context produces a non-anonymous session on the\n * target app. If validation fails, we fall back to a fresh sign-in and\n * overwrite the cache.\n */\n\nimport { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { Browser, BrowserContext } from '@playwright/test'\n\nconst STATES_DIR = join(homedir(), '.deepspace', 'playwright-states')\n\n/** Default freshness window — re-sign-in if the cache is older than this. */\nconst DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000 // 7 days\n\nfunction statePathForEmail(email: string): string {\n  const hash = createHash('sha256').update(email.trim().toLowerCase()).digest('hex').slice(0, 24)\n  return join(STATES_DIR, `${hash}.json`)\n}\n\nfunction ensureStatesDir() {\n  if (!existsSync(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true })\n}\n\n/** Returns true if a cache file exists and is younger than `maxAgeMs`. */\nfunction isCacheFresh(path: string, maxAgeMs: number): boolean {\n  if (!existsSync(path)) return false\n  try {\n    const age = Date.now() - statSync(path).mtimeMs\n    return age < maxAgeMs\n  } catch {\n    return false\n  }\n}\n\n/**\n * Sign `account` in by POSTing `/api/auth/sign-in/email` against\n * `baseURL` and capturing the resulting cookies. Returns the path to the\n * Playwright `storageState` JSON file.\n *\n * The browser-driven approach is intentional: we want the cookies set\n * on the same origin Playwright contexts will load from, otherwise the\n * Set-Cookie domain attribute won't match.\n */\nasync function signInAndSaveState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  outPath: string,\n): Promise<string> {\n  ensureStatesDir()\n  const ctx = await browser.newContext({ baseURL })\n  try {\n    const page = await ctx.newPage()\n    // Hit the app first so the origin is established (some auth plugins\n    // require a same-origin Origin header on sign-in).\n    await page.goto('/')\n    const result = await page.evaluate(\n      async ({ email, password }: { email: string; password: string }) => {\n        const res = await fetch('/api/auth/sign-in/email', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ email, password }),\n        })\n        const body: unknown = await res.json().catch(() => null)\n        const error = body && typeof body === 'object' ? (body as Record<string, unknown>) : null\n        return {\n          ok: res.ok,\n          status: res.status,\n          code: typeof error?.code === 'string' ? error.code : null,\n          message: typeof error?.message === 'string' ? error.message : null,\n        }\n      },\n      account,\n    )\n    if (!result.ok) throw new Error(formatSignInFailure(account.email, result))\n    await ctx.storageState({ path: outPath })\n    return outPath\n  } finally {\n    await ctx.close()\n  }\n}\n\ninterface SignInFailure {\n  status: number\n  code: string | null\n  message: string | null\n}\n\n/** Keep the server's safe status/code so auth failures remain actionable. */\nexport function formatSignInFailure(email: string, failure: SignInFailure): string {\n  const code = failure.code ? ` ${failure.code}` : ''\n  const detail = failure.message ? `: ${failure.message}` : ''\n  const nextStep =\n    failure.code === 'INVALID_ORIGIN'\n      ? 'Add this app origin to the auth allowlist, then retry.'\n      : 'Check the stored credential or recreate the account with `deepspace test accounts create`.'\n  return `Sign-in failed for ${email} (HTTP ${failure.status}${code})${detail}. ${nextStep}`\n}\n\nexport interface EnsureStorageStateOptions {\n  /** Max age of a cached state file before we re-sign-in. Default 7 days. */\n  maxAgeMs?: number\n  /** Force a fresh sign-in even if the cache is fresh. */\n  force?: boolean\n}\n\n/**\n * Ensure a Playwright `storageState` file exists for `account` and\n * return its path. Signs in once if the cache is missing, stale, or\n * `force: true`.\n */\nexport async function ensureStorageState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<string> {\n  const path = statePathForEmail(account.email)\n  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS\n\n  if (!options.force && isCacheFresh(path, maxAgeMs)) {\n    return path\n  }\n\n  return signInAndSaveState(browser, account, baseURL, path)\n}\n\n/**\n * Convenience: open a fresh `BrowserContext` for `account` using the\n * cached storage state (signing in if needed). The caller is responsible\n * for closing the context.\n */\nexport async function newSignedInContext(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<BrowserContext> {\n  const statePath = await ensureStorageState(browser, account, baseURL, options)\n  return browser.newContext({ storageState: statePath, baseURL })\n}\n\n/** Read a cached storageState file (mostly for debugging). */\nexport function readCachedState(email: string): unknown | null {\n  const path = statePathForEmail(email)\n  if (!existsSync(path)) return null\n  try {\n    return JSON.parse(readFileSync(path, 'utf-8'))\n  } catch {\n    return null\n  }\n}\n\n/** Where the cache for `email` lives. Useful for diagnostics. */\nexport function getStatePathForEmail(email: string): string {\n  return statePathForEmail(email)\n}\n"],"mappings":";AA6BA,SAAS,QAAQ,gBAA8D;;;AChB/E,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAYd,IAAM,qBAAqB,KAAK,QAAQ,GAAG,cAAc,oBAAoB;AAEpF,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAmBrB,SAAS,wBAAwB,MAAyB,QAAQ,KAAa;AACpF,QAAM,WAAW,IAAI,uBAClB,IAAI,kBAAkB,YAAY,sBAAsB;AAC3D,SAAO,0BAA0B,QAAQ;AAC3C;AAEO,SAAS,0BAA0B,OAAuB;AAC/D,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB,QAAQ,wBAAwB,GAAkB;AACpF,QAAM,QAAQ,qBAAqB;AACnC,SAAO,MAAM,OAAO,KAAK,KAAK,CAAC;AACjC;AA4EA,SAAS,uBAAmD;AAC1D,MAAI,CAAC,WAAW,kBAAkB,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACrE,MAAI;AACF,UAAM,MAAe,KAAK,MAAM,aAAa,oBAAoB,OAAO,CAAC;AACzE,QAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACxD,QAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,aAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AAAA,IAClC;AACA,UAAM,YAAY;AAClB,UAAM,SAAS,UAAU,UAAU,OAAO,UAAU,WAAW,YAAY,CAAC,MAAM,QAAQ,UAAU,MAAM,IACtG,OAAO,YAAY,OAAO,QAAQ,UAAU,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,kBAAkB,KAAK,CAAC,CAAC,CAAC,IAC1G,CAAC;AACL,WAAO,EAAE,SAAS,GAAG,OAAO;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAA+B;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM;AAAA,IAAO,CAAC,SACnB;AAAA,MACE,QACE,OAAO,SAAS,YAChB,OAAQ,KAAqB,OAAO,YACpC,OAAQ,KAAqB,UAAU,YACvC,OAAQ,KAAqB,aAAa;AAAA,IAC9C;AAAA,EACF;AACF;AAcO,SAAS,iBACd,OACA,SACe;AACf,QAAM,MAAM,oBAAoB;AAChC,QAAM,WAAW,SAAS,QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ,KAAK,IAC3C;AACJ,QAAM,SAAS,SAAS,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,MAAM,EAAE,aAAa,EAAE;AAEtF,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,YAAY,SAAS,QAAQ,YAAY,QAAQ,KAAK,OAAO;AACnE,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,iBAAiB,SAAS,cAAc,OAAO,MAAM,mBAChE,kBAAkB;AAAA,gGAElC,SAAS,QAAQ,YAAY,QAAQ,KAAK,KAAK,EACjD;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,OAAO,MAAM,GAAG,KAAK;AAC9B;AAMO,SAAS,sBAAsB,MAA2B;AAC/D,QAAM,MAAM,oBAAoB;AAChC,QAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI,QAAQ,kBAAkB;AAAA,2CACV,KAAK,YAAY,CAAC,2CAA2C,IAAI;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;;;AC5MA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,aAAAC,YAAW,gBAAAC,eAAc,gBAAgB;AAC9D,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,IAAM,aAAaA,MAAKD,SAAQ,GAAG,cAAc,mBAAmB;AAGpE,IAAM,qBAAqB,IAAI,KAAK,KAAK,KAAK;AAE9C,SAAS,kBAAkB,OAAuB;AAChD,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9F,SAAOC,MAAK,YAAY,GAAG,IAAI,OAAO;AACxC;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAACJ,YAAW,UAAU,EAAG,CAAAC,WAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACxE;AAGA,SAAS,aAAa,MAAc,UAA2B;AAC7D,MAAI,CAACD,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,EAAE;AACxC,WAAO,MAAM;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,mBACb,SACA,SACA,SACA,SACiB;AACjB,kBAAgB;AAChB,QAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ,CAAC;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,QAAQ;AAG/B,UAAM,KAAK,KAAK,GAAG;AACnB,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB,OAAO,EAAE,OAAO,SAAS,MAA2C;AAClE,cAAM,MAAM,MAAM,MAAM,2BAA2B;AAAA,UACjD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,QAC1C,CAAC;AACD,cAAM,OAAgB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACvD,cAAM,QAAQ,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACrF,eAAO;AAAA,UACL,IAAI,IAAI;AAAA,UACR,QAAQ,IAAI;AAAA,UACZ,MAAM,OAAO,OAAO,SAAS,WAAW,MAAM,OAAO;AAAA,UACrD,SAAS,OAAO,OAAO,YAAY,WAAW,MAAM,UAAU;AAAA,QAChE;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,oBAAoB,QAAQ,OAAO,MAAM,CAAC;AAC1E,UAAM,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AACxC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,IAAI,MAAM;AAAA,EAClB;AACF;AASO,SAAS,oBAAoB,OAAe,SAAgC;AACjF,QAAM,OAAO,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK;AACjD,QAAM,SAAS,QAAQ,UAAU,KAAK,QAAQ,OAAO,KAAK;AAC1D,QAAM,WACJ,QAAQ,SAAS,mBACb,2DACA;AACN,SAAO,sBAAsB,KAAK,UAAU,QAAQ,MAAM,GAAG,IAAI,IAAI,MAAM,KAAK,QAAQ;AAC1F;AAcA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACrB;AACjB,QAAM,OAAO,kBAAkB,QAAQ,KAAK;AAC5C,QAAM,WAAW,QAAQ,YAAY;AAErC,MAAI,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,GAAG;AAClD,WAAO;AAAA,EACT;AAEA,SAAO,mBAAmB,SAAS,SAAS,SAAS,IAAI;AAC3D;AAOA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACb;AACzB,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,SAAS,OAAO;AAC7E,SAAO,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAChE;AAGO,SAAS,gBAAgB,OAA+B;AAC7D,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAME,cAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,kBAAkB,KAAK;AAChC;;;AFxDA,SAAS,cAAc;AAxDvB,eAAe,UACb,SACA,SACA,SACkE;AAClE,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,OAAO;AACpE,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAC7E,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,QAAQ,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACF;AAEO,IAAM,OAAO,SAAS,OAA4B;AAAA,EACvD,OAAO,OAAO,EAAE,SAAS,QAAQ,GAAG,QAAQ;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAEA,UAAM,WAAuC,CAAC;AAE9C,UAAM,UAAwB,OAAO,UAAU,YAAY;AACzD,YAAM,WAA0B,MAAM,QAAQ,QAAQ,IAClD,SAAS,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAClD,iBAAiB,UAAU,OAAO;AAEtC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,SAAS,IAAI,CAAC,SAAS,UAAU,SAAS,MAAM,OAAO,CAAC;AAAA,MAC1D;AACA,iBAAW,KAAK,MAAO,UAAS,KAAK,EAAE,OAAO;AAC9C,aAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChC;AAEA,UAAM,IAAI,OAAO;AAIjB,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AACF,CAAC;","names":["existsSync","mkdirSync","readFileSync","homedir","join"]}
+{"version":3,"sources":["../src/testing/fixtures.ts","../src/testing/accounts.ts","../src/testing/storage-state.ts","../src/shared/jwt.ts"],"sourcesContent":["/**\n * Multi-user Playwright fixture for DeepSpace apps.\n *\n * Usage:\n *\n *   import { test, expect } from 'deepspace/testing'\n *\n *   test('A sends, B sees', async ({ users }) => {\n *     const [a, b] = await users(2)\n *     await a.page.goto('/chat')\n *     await b.page.goto('/chat')\n *     await a.page.getByTestId('message-input').fill('hi')\n *     await a.page.getByTestId('send-message-btn').click()\n *     await expect(b.page.getByText('hi')).toBeVisible()\n *   })\n *\n * `users(N)` picks the first N test accounts from\n * `~/.deepspace/test-accounts.json` (created via\n * `deepspace test accounts create`). `users(['Alice', 'Bob'])` picks\n * specific accounts by name.\n *\n * Each user gets a separate browser context with cached storageState\n * (per-account JSON in `~/.deepspace/playwright-states/`). Sign-in\n * happens once per account, not once per test, sidestepping Better\n * Auth's per-IP rate limit on `/api/auth/sign-in/email`.\n *\n * Contexts are auto-closed when the test finishes.\n */\n\nimport { test as baseTest, type Browser, type BrowserContext, type Page } from '@playwright/test'\nimport {\n  type TestAccount,\n  pickTestAccounts,\n  findTestAccountByName,\n} from './accounts'\nimport { ensureStorageState } from './storage-state'\n\nexport interface MultiplayerUser {\n  context: BrowserContext\n  page: Page\n  email: string\n  name: string\n  /** Test account user ID, if known from the accounts registry. */\n  userId?: string\n}\n\n/**\n * Fixture function signature. Pass either a count (`users(2)`) or an\n * array of account names (`users(['Alice', 'Bob'])`). Returns one entry\n * per requested user.\n */\nexport type UsersFixture = (\n  selector: number | string[],\n  options?: { label?: string },\n) => Promise<MultiplayerUser[]>\n\ninterface MultiplayerFixtures {\n  users: UsersFixture\n}\n\nasync function buildUser(\n  browser: Browser,\n  account: TestAccount,\n  baseURL: string,\n): Promise<{ user: MultiplayerUser; cleanup: () => Promise<void> }> {\n  const statePath = await ensureStorageState(browser, account, baseURL)\n  const context = await browser.newContext({ storageState: statePath, baseURL })\n  const page = await context.newPage()\n  return {\n    user: {\n      context,\n      page,\n      email: account.email,\n      name: account.name ?? account.email.split('@')[0],\n      userId: account.userId,\n    },\n    cleanup: async () => {\n      await context.close()\n    },\n  }\n}\n\nexport const test = baseTest.extend<MultiplayerFixtures>({\n  users: async ({ browser, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        '`users` fixture requires a baseURL. Set it on your Playwright config ' +\n          '(e.g. `use: { baseURL: \"http://localhost:5173\" }`) or via the ' +\n          'webServer.url shortcut.',\n      )\n    }\n\n    const cleanups: Array<() => Promise<void>> = []\n\n    const usersFn: UsersFixture = async (selector, options) => {\n      const accounts: TestAccount[] = Array.isArray(selector)\n        ? selector.map((name) => findTestAccountByName(name))\n        : pickTestAccounts(selector, options)\n\n      const built = await Promise.all(\n        accounts.map((acct) => buildUser(browser, acct, baseURL)),\n      )\n      for (const b of built) cleanups.push(b.cleanup)\n      return built.map((b) => b.user)\n    }\n\n    await use(usersFn)\n\n    // Tear down any contexts we created. Errors are swallowed — a test\n    // failure shouldn't be masked by a cleanup error.\n    for (const cleanup of cleanups) {\n      await cleanup().catch(() => {})\n    }\n  },\n})\n\nexport { expect } from '@playwright/test'\n","/**\n * Account-credential plumbing for the testing module.\n *\n * Reads test accounts from the auth-origin-scoped registry at\n * `~/.deepspace/test-accounts.json` (the same file\n * `deepspace test accounts create` writes). Persisted accounts are bound to a\n * remote account id; `name` and `label` are optional.\n *\n * Used by the multi-user Playwright fixture in `./fixtures.ts` and is\n * also exported standalone in case suites want to do their own\n * orchestration.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface TestAccount {\n  email: string\n  password: string\n  name?: string\n  label?: string | null\n  id?: string\n  userId?: string\n  createdAt?: number\n}\n\nexport const TEST_ACCOUNTS_PATH = join(homedir(), '.deepspace', 'test-accounts.json')\n\nconst PRODUCTION_AUTH_ORIGIN = 'https://auth.deep.space'\nconst STAGING_AUTH_ORIGIN = 'https://auth.deepspacesites.com'\n\nexport interface TestAccountCredentialStore {\n  version: 2\n  scopes: Record<string, TestAccount[]>\n}\n\nexport interface RemoteTestAccount {\n  id: string\n  email: string\n  userId: string\n  label: string | null\n  createdAt: number\n}\n\n/**\n * Load all test accounts the developer has created. Returns an empty\n * array if the file doesn't exist yet.\n */\nexport function currentTestAccountScope(env: NodeJS.ProcessEnv = process.env): string {\n  const selected = env.DEEPSPACE_AUTH_URL ??\n    (env.DEEPSPACE_ENV === 'staging' ? STAGING_AUTH_ORIGIN : PRODUCTION_AUTH_ORIGIN)\n  return normalizeTestAccountScope(selected)\n}\n\nexport function normalizeTestAccountScope(value: string): string {\n  try {\n    return new URL(value).origin\n  } catch {\n    return value\n  }\n}\n\nexport function loadAllTestAccounts(scope = currentTestAccountScope()): TestAccount[] {\n  const store = readTestAccountStore()\n  return store.scopes[scope] ?? []\n}\n\n/**\n * Replace the local credential registry with the subset that still exists\n * remotely. Passwords and display names remain local-only; a recreated email\n * with a different id is deliberately treated as a different account.\n */\nexport function reconcileTestAccountStore(\n  remote: RemoteTestAccount[],\n  scope = currentTestAccountScope(),\n): {\n  accounts: TestAccount[]\n  removed: number\n} {\n  const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope)\n  saveTestAccountStore(result.store)\n  return { accounts: result.accounts, removed: result.removed }\n}\n\nexport function reconcileTestAccountScopes(\n  store: TestAccountCredentialStore,\n  remote: RemoteTestAccount[],\n  scope: string,\n): { store: TestAccountCredentialStore; accounts: TestAccount[]; removed: number } {\n  const scoped = store.scopes[scope] ?? []\n  const accounts = reconcileTestAccounts(scoped, remote)\n  return {\n    accounts,\n    removed: Math.max(0, scoped.length - accounts.length),\n    store: {\n      version: 2,\n      scopes: { ...store.scopes, [scope]: accounts },\n    },\n  }\n}\n\nexport function reconcileTestAccounts(\n  local: TestAccount[],\n  remote: RemoteTestAccount[],\n): TestAccount[] {\n  const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]))\n  return remote.flatMap((account) => {\n    const stored = localById.get(account.id)\n    return stored ? [{ ...stored, ...account }] : []\n  })\n}\n\n/** Add or replace one locally stored credential without creating duplicates. */\nexport function upsertTestAccount(account: TestAccount, scope = currentTestAccountScope()): void {\n  const store = readTestAccountStore()\n  const accounts = (store.scopes[scope] ?? []).filter(\n    (stored) => stored.id !== account.id && stored.email !== account.email,\n  )\n  saveTestAccountStore({\n    version: 2,\n    scopes: { ...store.scopes, [scope]: [...accounts, account] },\n  })\n}\n\n/** Remove credentials after the corresponding remote delete succeeds. */\nexport function removeTestAccounts(\n  ids: string[],\n  emails: string[] = [],\n  scope = currentTestAccountScope(),\n): void {\n  const idSet = new Set(ids)\n  const emailSet = new Set(emails)\n  const keep = (account: TestAccount): boolean =>\n    !idSet.has(account.id ?? '') && !emailSet.has(account.email)\n  const store = readTestAccountStore()\n  saveTestAccountStore({\n    version: 2,\n    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },\n  })\n}\n\nfunction readTestAccountStore(): TestAccountCredentialStore {\n  if (!existsSync(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} }\n  try {\n    const raw: unknown = JSON.parse(readFileSync(TEST_ACCOUNTS_PATH, 'utf-8'))\n    if (Array.isArray(raw)) return { version: 2, scopes: {} }\n    if (!raw || typeof raw !== 'object') {\n      return { version: 2, scopes: {} }\n    }\n    const candidate = raw as { scopes?: unknown }\n    const scopes = candidate.scopes && typeof candidate.scopes === 'object' && !Array.isArray(candidate.scopes)\n      ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)]))\n      : {}\n    return { version: 2, scopes }\n  } catch {\n    return { version: 2, scopes: {} }\n  }\n}\n\nfunction validTestAccounts(value: unknown): TestAccount[] {\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is TestAccount =>\n    Boolean(\n      item &&\n        typeof item === 'object' &&\n        typeof (item as TestAccount).id === 'string' &&\n        typeof (item as TestAccount).email === 'string' &&\n        typeof (item as TestAccount).password === 'string',\n    ),\n  )\n}\n\nfunction saveTestAccountStore(store: TestAccountCredentialStore): void {\n  mkdirSync(join(homedir(), '.deepspace'), { recursive: true })\n  writeFileSync(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 0o600 })\n}\n\n/**\n * Pick `count` test accounts from the local registry, optionally\n * filtered by `label`. Order-stable: sorted by `createdAt` ascending so\n * the first test account you created is always the first one returned.\n *\n * Throws with a helpful message if not enough accounts exist.\n */\nexport function pickTestAccounts(\n  count: number,\n  options?: { label?: string },\n): TestAccount[] {\n  const all = loadAllTestAccounts()\n  const filtered = options?.label\n    ? all.filter((a) => a.label === options.label)\n    : all\n  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0))\n\n  if (sorted.length < count) {\n    const labelHint = options?.label ? ` (label=\"${options.label}\")` : ''\n    throw new Error(\n      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} ` +\n        `are present in ${TEST_ACCOUNTS_PATH}. Create more with:\\n` +\n        `  deepspace test accounts create --email <name>@deepspace.test --password <pw> --name \"<name>\"${\n          options?.label ? ` --label ${options.label}` : ''\n        }`,\n    )\n  }\n\n  return sorted.slice(0, count)\n}\n\n/**\n * Find a single account by name. Used by `users(['Alice', 'Bob'])`.\n * Throws if not found.\n */\nexport function findTestAccountByName(name: string): TestAccount {\n  const all = loadAllTestAccounts()\n  const match = all.find((a) => a.name === name)\n  if (!match) {\n    throw new Error(\n      `No test account named \"${name}\" in ${TEST_ACCOUNTS_PATH}. Create with:\\n` +\n        `  deepspace test accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name \"${name}\"`,\n    )\n  }\n  return match\n}\n","/**\n * Per-account `storageState` cache for Playwright.\n *\n * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`\n * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up\n * 5+ users per spec would hit the limit and start failing in non-obvious\n * ways. This module signs each account in *once*, persists the\n * resulting browser cookies + storage to disk, and reuses the file on\n * subsequent runs.\n *\n * Cache layout:\n *   ~/.deepspace/playwright-states/<sha256(authScope, appOrigin, email)>.json\n *\n * Validity: a cached file is reused if Playwright successfully loads it\n * AND the resulting context produces a non-anonymous session on the\n * target app. If validation fails, we fall back to a fresh sign-in and\n * overwrite the cache.\n */\n\nimport { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport { request, type Browser, type BrowserContext } from '@playwright/test'\nimport { decodeJwtPayload } from '../shared/jwt'\nimport { currentTestAccountScope } from './accounts'\n\nconst STATES_DIR = join(homedir(), '.deepspace', 'playwright-states')\n\n/**\n * Validation/sign-in per state path, in flight or settled. Memoizing the\n * promise — rather than flagging a Set after the await — makes concurrent\n * callers for the same account share one probe/sign-in instead of racing\n * duplicate sign-ins into the rate limit. A rejected attempt is evicted so\n * a later call can retry.\n */\nconst stateValidations = new Map<string, Promise<string>>()\n\ninterface StorageStateAccount {\n  email: string\n  password: string\n  /** Remote user id, when the local registry knows it. */\n  userId?: string\n}\n\n/** Where the cache for `email` against `baseURL`'s origin lives. */\nexport function getStatePathForEmail(email: string, baseURL: string): string {\n  // Keyed by auth scope + app origin + email: one email signed into two\n  // apps (or two auth environments) must never serve the wrong session.\n  const key = `${currentTestAccountScope()}\\n${new URL(baseURL).origin}\\n${email.trim().toLowerCase()}`\n  const hash = createHash('sha256').update(key).digest('hex').slice(0, 24)\n  return join(STATES_DIR, `${hash}.json`)\n}\n\nfunction ensureStatesDir() {\n  if (!existsSync(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true })\n}\n\n/**\n * Does a token minted from a cached session belong to `account`? `sub` is\n * authoritative when the registry knows the remote user id; the `email`\n * claim covers states recorded before the id was known.\n */\nexport function tokenClaimsMatchAccount(\n  claims: Record<string, unknown>,\n  account: { email: string; userId?: string },\n): boolean {\n  if (account.userId && claims.sub === account.userId) return true\n  return (\n    typeof claims.email === 'string' &&\n    claims.email.trim().toLowerCase() === account.email.trim().toLowerCase()\n  )\n}\n\n/**\n * Live-validate a cached state: load it into a request context and ask the\n * app to mint a token. Only a token for this account counts — a transport\n * failure, an anonymous session, or another user's session all report\n * false, so the caller signs in fresh (where a real outage surfaces as an\n * actionable sign-in error instead of silent reuse of a dead session).\n */\nasync function probeStoredSession(\n  path: string,\n  baseURL: string,\n  account: { email: string; userId?: string },\n): Promise<boolean> {\n  try {\n    const ctx = await request.newContext({ storageState: path, baseURL })\n    try {\n      const res = await ctx.post('/api/auth/token')\n      if (!res.ok()) return false\n      const { token } = (await res.json()) as { token?: unknown }\n      if (typeof token !== 'string') return false\n      return tokenClaimsMatchAccount(decodeJwtPayload(token), account)\n    } finally {\n      await ctx.dispose()\n    }\n  } catch {\n    return false\n  }\n}\n\n/**\n * Sign `account` in by POSTing `/api/auth/sign-in/email` against\n * `baseURL` and capturing the resulting cookies. Returns the path to the\n * Playwright `storageState` JSON file.\n *\n * The browser-driven approach is intentional: we want the cookies set\n * on the same origin Playwright contexts will load from, otherwise the\n * Set-Cookie domain attribute won't match.\n */\nasync function signInAndSaveState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  outPath: string,\n): Promise<string> {\n  ensureStatesDir()\n  const ctx = await browser.newContext({ baseURL })\n  try {\n    const page = await ctx.newPage()\n    // Hit the app first so the origin is established (some auth plugins\n    // require a same-origin Origin header on sign-in).\n    await page.goto('/')\n    const result = await page.evaluate(\n      async ({ email, password }: { email: string; password: string }) => {\n        const res = await fetch('/api/auth/sign-in/email', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ email, password }),\n        })\n        const body: unknown = await res.json().catch(() => null)\n        const error = body && typeof body === 'object' ? (body as Record<string, unknown>) : null\n        return {\n          ok: res.ok,\n          status: res.status,\n          code: typeof error?.code === 'string' ? error.code : null,\n          message: typeof error?.message === 'string' ? error.message : null,\n        }\n      },\n      { email: account.email, password: account.password },\n    )\n    if (!result.ok) throw new Error(formatSignInFailure(account.email, result))\n    await ctx.storageState({ path: outPath })\n    return outPath\n  } finally {\n    await ctx.close()\n  }\n}\n\ninterface SignInFailure {\n  status: number\n  code: string | null\n  message: string | null\n}\n\n/** Keep the server's safe status/code so auth failures remain actionable. */\nexport function formatSignInFailure(email: string, failure: SignInFailure): string {\n  const code = failure.code ? ` ${failure.code}` : ''\n  const detail = failure.message ? `: ${failure.message}` : ''\n  const nextStep =\n    failure.code === 'INVALID_ORIGIN'\n      ? 'Add this app origin to the auth allowlist, then retry.'\n      : 'Check the stored credential or recreate the account with `deepspace test accounts create`.'\n  return `Sign-in failed for ${email} (HTTP ${failure.status}${code})${detail}. ${nextStep}`\n}\n\nexport interface EnsureStorageStateOptions {\n  /** Force a fresh sign-in even if a cached state validates. */\n  force?: boolean\n}\n\n/**\n * Ensure a validated Playwright `storageState` file exists for `account`\n * and return its path. A cached file is probed against the app before\n * reuse (once per worker process); a missing, expired, or wrong-account\n * state triggers one fresh sign-in that overwrites it.\n */\nexport async function ensureStorageState(\n  browser: Browser,\n  account: StorageStateAccount,\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<string> {\n  const path = getStatePathForEmail(account.email, baseURL)\n  if (options.force) stateValidations.delete(path)\n  let pending = stateValidations.get(path)\n  if (!pending) {\n    pending = validateOrSignIn(browser, account, baseURL, path, options.force === true)\n    stateValidations.set(path, pending)\n    pending.catch(() => stateValidations.delete(path))\n  }\n  return pending\n}\n\nasync function validateOrSignIn(\n  browser: Browser,\n  account: StorageStateAccount,\n  baseURL: string,\n  path: string,\n  force: boolean,\n): Promise<string> {\n  if (!force && existsSync(path) && (await probeStoredSession(path, baseURL, account))) {\n    return path\n  }\n  return signInAndSaveState(browser, account, baseURL, path)\n}\n\n/**\n * Convenience: open a fresh `BrowserContext` for `account` using the\n * cached storage state (signing in if needed). The caller is responsible\n * for closing the context.\n */\nexport async function newSignedInContext(\n  browser: Browser,\n  account: StorageStateAccount,\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<BrowserContext> {\n  const statePath = await ensureStorageState(browser, account, baseURL, options)\n  return browser.newContext({ storageState: statePath, baseURL })\n}\n","export function decodeJwtPayload<T = Record<string, unknown>>(token: string): T {\n  const payloadSegment = token.split('.')[1]\n  if (!payloadSegment) {\n    throw new Error('JWT payload is missing')\n  }\n  return JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8')) as T\n}\n"],"mappings":";AA6BA,SAAS,QAAQ,gBAA8D;;;AChB/E,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAYd,IAAM,qBAAqB,KAAK,QAAQ,GAAG,cAAc,oBAAoB;AAEpF,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAmBrB,SAAS,wBAAwB,MAAyB,QAAQ,KAAa;AACpF,QAAM,WAAW,IAAI,uBAClB,IAAI,kBAAkB,YAAY,sBAAsB;AAC3D,SAAO,0BAA0B,QAAQ;AAC3C;AAEO,SAAS,0BAA0B,OAAuB;AAC/D,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB,QAAQ,wBAAwB,GAAkB;AACpF,QAAM,QAAQ,qBAAqB;AACnC,SAAO,MAAM,OAAO,KAAK,KAAK,CAAC;AACjC;AA4EA,SAAS,uBAAmD;AAC1D,MAAI,CAAC,WAAW,kBAAkB,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACrE,MAAI;AACF,UAAM,MAAe,KAAK,MAAM,aAAa,oBAAoB,OAAO,CAAC;AACzE,QAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AACxD,QAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,aAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AAAA,IAClC;AACA,UAAM,YAAY;AAClB,UAAM,SAAS,UAAU,UAAU,OAAO,UAAU,WAAW,YAAY,CAAC,MAAM,QAAQ,UAAU,MAAM,IACtG,OAAO,YAAY,OAAO,QAAQ,UAAU,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,kBAAkB,KAAK,CAAC,CAAC,CAAC,IAC1G,CAAC;AACL,WAAO,EAAE,SAAS,GAAG,OAAO;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE;AAAA,EAClC;AACF;AAEA,SAAS,kBAAkB,OAA+B;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM;AAAA,IAAO,CAAC,SACnB;AAAA,MACE,QACE,OAAO,SAAS,YAChB,OAAQ,KAAqB,OAAO,YACpC,OAAQ,KAAqB,UAAU,YACvC,OAAQ,KAAqB,aAAa;AAAA,IAC9C;AAAA,EACF;AACF;AAcO,SAAS,iBACd,OACA,SACe;AACf,QAAM,MAAM,oBAAoB;AAChC,QAAM,WAAW,SAAS,QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ,KAAK,IAC3C;AACJ,QAAM,SAAS,SAAS,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,MAAM,EAAE,aAAa,EAAE;AAEtF,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,YAAY,SAAS,QAAQ,YAAY,QAAQ,KAAK,OAAO;AACnE,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,iBAAiB,SAAS,cAAc,OAAO,MAAM,mBAChE,kBAAkB;AAAA,gGAElC,SAAS,QAAQ,YAAY,QAAQ,KAAK,KAAK,EACjD;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,OAAO,MAAM,GAAG,KAAK;AAC9B;AAMO,SAAS,sBAAsB,MAA2B;AAC/D,QAAM,MAAM,oBAAoB;AAChC,QAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI,QAAQ,kBAAkB;AAAA,2CACV,KAAK,YAAY,CAAC,2CAA2C,IAAI;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;;;AC5MA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,aAAAC,kBAAiB;AACtC,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AACrB,SAAS,eAAkD;;;ACvBpD,SAAS,iBAA8C,OAAkB;AAC9E,QAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,SAAO,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAC7E;;;ADqBA,IAAM,aAAaC,MAAKC,SAAQ,GAAG,cAAc,mBAAmB;AASpE,IAAM,mBAAmB,oBAAI,IAA6B;AAUnD,SAAS,qBAAqB,OAAe,SAAyB;AAG3E,QAAM,MAAM,GAAG,wBAAwB,CAAC;AAAA,EAAK,IAAI,IAAI,OAAO,EAAE,MAAM;AAAA,EAAK,MAAM,KAAK,EAAE,YAAY,CAAC;AACnG,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACvE,SAAOD,MAAK,YAAY,GAAG,IAAI,OAAO;AACxC;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAACE,YAAW,UAAU,EAAG,CAAAC,WAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACxE;AAOO,SAAS,wBACd,QACA,SACS;AACT,MAAI,QAAQ,UAAU,OAAO,QAAQ,QAAQ,OAAQ,QAAO;AAC5D,SACE,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,KAAK,EAAE,YAAY,MAAM,QAAQ,MAAM,KAAK,EAAE,YAAY;AAE3E;AASA,eAAe,mBACb,MACA,SACA,SACkB;AAClB,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,cAAc,MAAM,QAAQ,CAAC;AACpE,QAAI;AACF,YAAM,MAAM,MAAM,IAAI,KAAK,iBAAiB;AAC5C,UAAI,CAAC,IAAI,GAAG,EAAG,QAAO;AACtB,YAAM,EAAE,MAAM,IAAK,MAAM,IAAI,KAAK;AAClC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO,wBAAwB,iBAAiB,KAAK,GAAG,OAAO;AAAA,IACjE,UAAE;AACA,YAAM,IAAI,QAAQ;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,mBACb,SACA,SACA,SACA,SACiB;AACjB,kBAAgB;AAChB,QAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ,CAAC;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,QAAQ;AAG/B,UAAM,KAAK,KAAK,GAAG;AACnB,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB,OAAO,EAAE,OAAO,SAAS,MAA2C;AAClE,cAAM,MAAM,MAAM,MAAM,2BAA2B;AAAA,UACjD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,QAC1C,CAAC;AACD,cAAM,OAAgB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACvD,cAAM,QAAQ,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACrF,eAAO;AAAA,UACL,IAAI,IAAI;AAAA,UACR,QAAQ,IAAI;AAAA,UACZ,MAAM,OAAO,OAAO,SAAS,WAAW,MAAM,OAAO;AAAA,UACrD,SAAS,OAAO,OAAO,YAAY,WAAW,MAAM,UAAU;AAAA,QAChE;AAAA,MACF;AAAA,MACA,EAAE,OAAO,QAAQ,OAAO,UAAU,QAAQ,SAAS;AAAA,IACrD;AACA,QAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,oBAAoB,QAAQ,OAAO,MAAM,CAAC;AAC1E,UAAM,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AACxC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,IAAI,MAAM;AAAA,EAClB;AACF;AASO,SAAS,oBAAoB,OAAe,SAAgC;AACjF,QAAM,OAAO,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK;AACjD,QAAM,SAAS,QAAQ,UAAU,KAAK,QAAQ,OAAO,KAAK;AAC1D,QAAM,WACJ,QAAQ,SAAS,mBACb,2DACA;AACN,SAAO,sBAAsB,KAAK,UAAU,QAAQ,MAAM,GAAG,IAAI,IAAI,MAAM,KAAK,QAAQ;AAC1F;AAaA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACrB;AACjB,QAAM,OAAO,qBAAqB,QAAQ,OAAO,OAAO;AACxD,MAAI,QAAQ,MAAO,kBAAiB,OAAO,IAAI;AAC/C,MAAI,UAAU,iBAAiB,IAAI,IAAI;AACvC,MAAI,CAAC,SAAS;AACZ,cAAU,iBAAiB,SAAS,SAAS,SAAS,MAAM,QAAQ,UAAU,IAAI;AAClF,qBAAiB,IAAI,MAAM,OAAO;AAClC,YAAQ,MAAM,MAAM,iBAAiB,OAAO,IAAI,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAEA,eAAe,iBACb,SACA,SACA,SACA,MACA,OACiB;AACjB,MAAI,CAAC,SAASD,YAAW,IAAI,KAAM,MAAM,mBAAmB,MAAM,SAAS,OAAO,GAAI;AACpF,WAAO;AAAA,EACT;AACA,SAAO,mBAAmB,SAAS,SAAS,SAAS,IAAI;AAC3D;AAOA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACb;AACzB,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,SAAS,OAAO;AAC7E,SAAO,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAChE;;;AFzGA,SAAS,cAAc;AAxDvB,eAAe,UACb,SACA,SACA,SACkE;AAClE,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,OAAO;AACpE,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAC7E,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,QAAQ,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACF;AAEO,IAAM,OAAO,SAAS,OAA4B;AAAA,EACvD,OAAO,OAAO,EAAE,SAAS,QAAQ,GAAG,QAAQ;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAEA,UAAM,WAAuC,CAAC;AAE9C,UAAM,UAAwB,OAAO,UAAU,YAAY;AACzD,YAAM,WAA0B,MAAM,QAAQ,QAAQ,IAClD,SAAS,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAClD,iBAAiB,UAAU,OAAO;AAEtC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,SAAS,IAAI,CAAC,SAAS,UAAU,SAAS,MAAM,OAAO,CAAC;AAAA,MAC1D;AACA,iBAAW,KAAK,MAAO,UAAS,KAAK,EAAE,OAAO;AAC9C,aAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChC;AAEA,UAAM,IAAI,OAAO;AAIjB,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AACF,CAAC;","names":["existsSync","mkdirSync","homedir","join","join","homedir","existsSync","mkdirSync"]}