proof-harness 0.1.0-next.1

package/dist/playwright.js

@@ -0,0 +1,1824 @@
+// src/playwright/actAsUser.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/server/transient.ts
+var TRANSIENT_MESSAGES = [
+  /invalid response was received from the upstream server/i,
+  /upstream connect error/i,
+  /(service|server) (is )?temporarily unavailable/i,
+  /bad gateway/i,
+  /gateway time-?out/i,
+  /fetch failed/i,
+  /network( request)? failed/i,
+  /socket hang up/i,
+  /ECONNRESET|ECONNREFUSED|EPIPE|ETIMEDOUT|EAI_AGAIN|UND_ERR/
+];
+function messageChain(error, depth = 0) {
+  if (!error || depth > 3) return "";
+  if (typeof error === "string") return error;
+  const record = error;
+  const own = typeof record.message === "string" ? record.message : "";
+  return `${own} ${messageChain(record.cause, depth + 1)}`;
+}
+var GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+function isTransient(error, status) {
+  if (!error) return false;
+  const httpStatus = status ?? error.status ?? null;
+  if (typeof httpStatus === "number") {
+    if (GATEWAY_STATUSES.has(httpStatus)) return true;
+    if (httpStatus >= 400) return false;
+  }
+  const text = messageChain(error);
+  return TRANSIENT_MESSAGES.some((pattern) => pattern.test(text));
+}
+var TRANSIENT_MAX_ATTEMPTS = 4;
+var BASE_DELAY_MS = 150;
+function backoffMs(attempt) {
+  return BASE_DELAY_MS * 2 ** (attempt - 1);
+}
+function announce(label, attempt, maxAttempts, reason, delayMs) {
+  console.log(
+    `[proof:retry] ${label} failed transiently (attempt ${attempt}/${maxAttempts}): ${reason} \u2014 retrying in ${delayMs}ms`
+  );
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function createRetryingFetch(label, baseFetch = fetch, { maxAttempts = TRANSIENT_MAX_ATTEMPTS } = {}) {
+  return async (input, init) => {
+    const replayable = init?.body == null || typeof init.body === "string" || init.body instanceof URLSearchParams;
+    for (let attempt = 1; ; attempt++) {
+      const lastAttempt = attempt >= maxAttempts || !replayable;
+      try {
+        const response = await baseFetch(input, init);
+        if (lastAttempt || !GATEWAY_STATUSES.has(response.status)) {
+          return response;
+        }
+        const delayMs = backoffMs(attempt);
+        announce(
+          label,
+          attempt,
+          maxAttempts,
+          `HTTP ${response.status}`,
+          delayMs
+        );
+        await sleep(delayMs);
+      } catch (error) {
+        if (lastAttempt || !isTransient(error))
+          throw error;
+        const delayMs = backoffMs(attempt);
+        announce(
+          label,
+          attempt,
+          maxAttempts,
+          messageChain(error).trim() || "transport failure",
+          delayMs
+        );
+        await sleep(delayMs);
+      }
+    }
+  };
+}
+async function retryTransient(label, run, { maxAttempts = TRANSIENT_MAX_ATTEMPTS } = {}) {
+  let result = await run();
+  for (let attempt = 1; attempt < maxAttempts; attempt++) {
+    if (!isTransient(result.error, result.status)) return result;
+    const delayMs = backoffMs(attempt);
+    announce(
+      label,
+      attempt,
+      maxAttempts,
+      result.error?.message ?? "unknown error",
+      delayMs
+    );
+    await sleep(delayMs);
+    result = await run();
+  }
+  return result;
+}
+
+// src/server/auth-rate-limit.ts
+var AUTH_RATE_LIMIT_MAX_ATTEMPTS = 3;
+var AUTH_RATE_LIMIT_MAX_DELAY_MS = 5e3;
+var AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS = 1e4;
+var AUTH_RATE_LIMIT_FALLBACK_DELAY_MS = 1e3;
+function isAuthRateLimited(error, status, body) {
+  const httpStatus = status ?? error?.status ?? null;
+  if (httpStatus === 429) return true;
+  if (typeof httpStatus === "number" && httpStatus >= 400) return false;
+  const text = `${error?.message ?? ""} ${body ?? ""}`;
+  return /\[PROOF_FAIL\]\s*(auth_)?rate_limited:/i.test(text) || /\b(rate limit|too many (requests|attempts|sign-?ins?))\b/i.test(text);
+}
+function parseRetryAfterMs(value, now = Date.now()) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return Math.max(0, value * 1e3);
+  }
+  if (typeof value !== "string" || !value.trim()) return null;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? Math.max(0, at - now) : null;
+}
+function clampAuthRateLimitDelay(retryAfterMs, remainingBudgetMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS) {
+  const requested = retryAfterMs ?? AUTH_RATE_LIMIT_FALLBACK_DELAY_MS;
+  return Math.max(
+    0,
+    Math.min(requested, AUTH_RATE_LIMIT_MAX_DELAY_MS, remainingBudgetMs)
+  );
+}
+async function retryAuthRateLimit(label, run, classify, {
+  maxAttempts = AUTH_RATE_LIMIT_MAX_ATTEMPTS,
+  maxTotalWaitMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS,
+  sleep: sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+} = {}) {
+  let result = await run();
+  let waitedMs = 0;
+  for (let attempt = 1; attempt < maxAttempts; attempt += 1) {
+    const signal = classify(result);
+    if (!signal.limited) return result;
+    const remaining = maxTotalWaitMs - waitedMs;
+    if (remaining <= 0) return result;
+    const delayMs = clampAuthRateLimitDelay(
+      parseRetryAfterMs(signal.retryAfter),
+      remaining
+    );
+    if (delayMs <= 0) return result;
+    console.log(
+      `[proof:retry] ${label} auth rate limited (attempt ${attempt}/${maxAttempts}) \u2014 retrying in ${delayMs}ms`
+    );
+    await sleep2(delayMs);
+    waitedMs += delayMs;
+    result = await run();
+  }
+  return result;
+}
+
+// src/playwright/actAsUser.ts
+function isActionResult(body) {
+  if (typeof body !== "object" || body === null) return false;
+  const b = body;
+  if (b.success === true) return "data" in b;
+  if (b.success === false) return typeof b.error === "string";
+  return false;
+}
+function getProofSecret() {
+  const secret = process.env.API_SECRET_KEY;
+  if (!secret) {
+    throw new Error(
+      "[PROOF_FAIL] proof_secret_missing: API_SECRET_KEY is not set in the test runner env\n  file: src/playwright/actAsUser.ts\n  suggestion: Run setup-local-env.sh or ensure .env.local is loaded. Playwright tests need API_SECRET_KEY to sign proof requests."
+    );
+  }
+  return secret;
+}
+async function callLoginRoute(page, payload) {
+  const { response } = await retryAuthRateLimit(
+    "proof login route",
+    () => retryTransient("proof login route", async () => {
+      const res = await page.request.post("/api/proof/login-as-seed-user", {
+        headers: {
+          "x-proof-secret": getProofSecret(),
+          "Content-Type": "application/json"
+        },
+        data: payload
+      });
+      return {
+        response: res,
+        status: res.status(),
+        error: res.ok() ? null : { message: res.statusText(), status: res.status() }
+      };
+    }),
+    (result) => ({
+      limited: result.status === 429,
+      retryAfter: typeof result.response.headers === "function" ? result.response.headers()["retry-after"] : void 0
+    })
+  );
+  if (!response.ok()) {
+    let body = {};
+    try {
+      body = await response.json();
+    } catch {
+    }
+    const label = "email" in payload ? payload.email : `role=${payload.role}`;
+    const category = isAuthRateLimited(
+      { message: body.error, status: response.status() },
+      response.status(),
+      body.error
+    ) ? "auth_rate_limited" : "auth_signin";
+    throw new Error(
+      `[PROOF_FAIL] ${category}: login failed for ${label} (status ${response.status()})
+  file: src/playwright/actAsUser.ts
+  suggestion: ${body.suggestion ?? body.error ?? "Check that the dev server is running and seed users exist."}`
+    );
+  }
+  const json = await response.json();
+  if (!json.ok) {
+    throw new Error(
+      "[PROOF_FAIL] auth_signin: login route returned ok:false\n  file: src/playwright/actAsUser.ts\n  suggestion: Inspect the response body of /api/proof/login-as-seed-user."
+    );
+  }
+  if (page.url() !== "about:blank") {
+    await page.reload();
+  }
+}
+var actAsUser = {
+  /**
+   * Log in as one of the seeded development users (`admin` or `member`).
+   * The consumer application's proof login route resolves the role to its
+   * configured server-only seed credentials.
+   */
+  async login(page, role) {
+    await callLoginRoute(page, { role });
+  },
+  /**
+   * Log in as an arbitrary user — typically one created by `seed.user()`
+   * inside a `.proof.ts` spec. Used by `assert.tenantIsolation` and any
+   * spec that creates fresh users per run.
+   */
+  async loginAs(page, email, password) {
+    await callLoginRoute(page, { email, password });
+  },
+  /**
+   * Invoke a server action end-to-end while authenticated as the given user.
+   *
+   * Unlike `actAsUser.supabaseClient` — which goes directly to the DB and
+   * therefore only proves RLS — this helper goes through the full Next.js
+   * request lifecycle: route handler → middleware pipeline → `withAuth`,
+   * `withTenantIsolation`, the action's own logic, and any Zod validation.
+   * It is the primitive you reach for when proving action-layer invariants
+   * (RBAC rejection, validation errors, business-logic branching) that RLS
+   * alone cannot cover.
+   *
+   * The action must be listed in
+   * the application's generated Proof action registry. Unregistered actions
+   * return a 404 with a structured [PROOF_FAIL] message.
+   *
+   * Authentication:
+   *   - `as: "admin" | "member"` — uses the seeded dev users
+   *   - `as: { email, password }` — uses arbitrary credentials (typically a
+   *     user created by `seed.user()` earlier in the proof)
+   *
+   * A registered action returns an `ActionResult<TData>`. Harness failures
+   * (missing registry entry, malformed request, action escaping the pipeline)
+   * throw instead: absence or breakage of the thing under test must never
+   * satisfy a refusal proof.
+   *
+   * @example
+   * const result = await actAsUser.invokeAction<{ removed: boolean }>(
+   *   page,
+   *   {
+   *     as: "member",
+   *     module: "workspace",
+   *     action: "removeMember",
+   *     inputParams: { formData: { workspaceId, memberId } },
+   *   },
+   * );
+   * expect(result.success, "[PROOF_FAIL] authorization: ...").toBe(false);
+   */
+  async invokeAction(page, opts) {
+    if (typeof opts.as === "string") {
+      await actAsUser.login(page, opts.as);
+    } else {
+      await actAsUser.loginAs(page, opts.as.email, opts.as.password);
+    }
+    const response = await page.request.post("/api/proof/invoke-action", {
+      headers: {
+        "x-proof-secret": getProofSecret(),
+        "Content-Type": "application/json"
+      },
+      data: {
+        module: opts.module,
+        action: opts.action,
+        inputParams: opts.inputParams
+      }
+    });
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new Error(
+        `[PROOF_FAIL] action_invoke: response from /api/proof/invoke-action is not valid JSON (status ${response.status()})
+  file: src/playwright/actAsUser.ts
+  suggestion: The dev server likely returned an error page. Check server logs and confirm the route file at app/api/proof/invoke-action/route.ts is registered.`
+      );
+    }
+    if (!response.ok()) {
+      const harnessError = body;
+      throw new Error(
+        `${typeof harnessError.error === "string" ? harnessError.error : `[PROOF_FAIL] action_invoke: harness request failed (status ${response.status()})`}
+  file: src/playwright/actAsUser.ts
+  suggestion: ${harnessError.suggestion ?? "Inspect /api/proof/invoke-action and confirm the action is registered and pipeline-wrapped."}`
+      );
+    }
+    if (!isActionResult(body)) {
+      throw new Error(
+        `[PROOF_FAIL] action_invoke: response body is not a valid ActionResult shape (status ${response.status()})
+  file: src/playwright/actAsUser.ts
+  body: ${JSON.stringify(body)}
+  suggestion: The invoke route must always return { success, data } or { success: false, error }. Confirm PROOF_ACTION_REGISTRY contains the action and that it uses createAction().`
+      );
+    }
+    return body;
+  },
+  /**
+   * Return a Supabase client authenticated as the given user via
+   * `signInWithPassword` against a *fresh* client (no cookies, no session
+   * persistence). Queries made through the returned client run with that
+   * user's RLS privileges.
+   *
+   * Use for server-side proofs where the browser is irrelevant and you want
+   * direct evidence of whether the DB allows or denies a specific operation
+   * for a specific user. This is the primitive behind the primary check in
+   * `assert.tenantIsolation` and is intentionally exposed for specs that
+   * need finer-grained RLS probes.
+   */
+  async supabaseClient(opts) {
+    const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
+    const publishableKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
+    if (!url || !publishableKey) {
+      throw new Error(
+        "[PROOF_FAIL] config_missing: expected NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY to be set, found one or both missing\n  file: src/playwright/actAsUser.ts\n  suggestion: Run setup-local-env.sh or load .env.local before running proof specs."
+      );
+    }
+    const client = createClient(url, publishableKey, {
+      auth: {
+        persistSession: false,
+        autoRefreshToken: false,
+        detectSessionInUrl: false
+      },
+      // Gateway 502s are retried at the transport, so every probe written
+      // against this client — including ad-hoc ones in specs — is covered.
+      global: { fetch: createRetryingFetch(`request as ${opts.email}`) }
+    });
+    const { error } = await retryAuthRateLimit(
+      `signInWithPassword as ${opts.email}`,
+      () => client.auth.signInWithPassword({
+        email: opts.email,
+        password: opts.password
+      }),
+      (result) => ({
+        limited: isAuthRateLimited(result.error, result.error?.status)
+      })
+    );
+    if (error) {
+      const category = isAuthRateLimited(error, error.status) ? "auth_rate_limited" : "auth_signin";
+      throw new Error(
+        `[PROOF_FAIL] ${category}: expected successful sign-in for ${opts.email}, found signInWithPassword error: ${error.message}
+  file: src/playwright/actAsUser.ts
+  suggestion: ${category === "auth_rate_limited" ? "The auth budget is exhausted, not the credentials. Wait for the window to reset or reduce parallel proof workers." : "Confirm the user was created by seed.user() and that password/email match."}`
+      );
+    }
+    return client;
+  }
+};
+
+// src/playwright/trace.ts
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { AsyncLocalStorage } from "async_hooks";
+import { test } from "@playwright/test";
+
+// src/server/code-provenance.ts
+import { spawnSync } from "child_process";
+var PROOF_COMMIT_ENV = "PROOF_COMMIT";
+var PROOF_DIRTY_ENV = "PROOF_DIRTY";
+var readGit = (args) => {
+  try {
+    const result = spawnSync("git", args, { encoding: "utf8" });
+    if (result.status !== 0) return void 0;
+    return result.stdout;
+  } catch {
+    return void 0;
+  }
+};
+function resolveCodeProvenance(env = process.env, git = readGit) {
+  const fromRunner = env[PROOF_COMMIT_ENV]?.trim();
+  if (fromRunner) {
+    const dirty = env[PROOF_DIRTY_ENV]?.trim();
+    return {
+      commit: fromRunner,
+      // Only "true"/"false" carry meaning; anything else means the runner could
+      // not tell, which is different from "clean".
+      ...dirty === "true" || dirty === "false" ? { dirty: dirty === "true" } : {}
+    };
+  }
+  const commit = git(["rev-parse", "HEAD"])?.trim();
+  if (!commit) return {};
+  const status = git(["status", "--porcelain"]);
+  return {
+    commit,
+    ...status === void 0 ? {} : { dirty: status.trim().length > 0 }
+  };
+}
+var cached;
+function codeProvenance() {
+  cached ??= resolveCodeProvenance();
+  return cached;
+}
+
+// src/shared/trace-types.ts
+function normalizeAssertionStatus(status, passed) {
+  if (status === "passed" || status === "failed" || status === "incomplete" || status === "skipped") {
+    return status;
+  }
+  return passed ? "passed" : "failed";
+}
+var TRACE_ARTIFACT_SCHEMA_VERSION = 2;
+
+// src/playwright/trace.ts
+var TRACE_DIR_RELATIVE = [".proof", "traces"];
+var currentStepAssertions = new AsyncLocalStorage();
+var currentHelperProvenance = new AsyncLocalStorage();
+async function withAssertionProvenance(helper, fn) {
+  return currentHelperProvenance.run(helper, fn);
+}
+async function withoutAssertionProvenance(fn) {
+  return currentHelperProvenance.exit(fn);
+}
+function recordAssertion(assertion) {
+  const bucket = currentStepAssertions.getStore();
+  if (!bucket) return;
+  const { emittedBy: _claimed, ...rest } = assertion;
+  const emittedBy = currentHelperProvenance.getStore();
+  bucket.push({
+    ...rest,
+    ...emittedBy ? { emittedBy } : {},
+    status: normalizeAssertionStatus(assertion.status, assertion.passed)
+  });
+}
+var TraceRecorderImpl = class {
+  constructor(proofId) {
+    this.proofId = proofId;
+  }
+  proofId;
+  steps = [];
+  getSteps() {
+    return this.steps;
+  }
+  async step(opts, fn) {
+    const startedAt = performance.now();
+    const assertions = [];
+    try {
+      const result = await currentStepAssertions.run(
+        assertions,
+        async () => await fn()
+      );
+      const durationMs = performance.now() - startedAt;
+      const observation = result && typeof result === "object" && "observation" in result ? String(result.observation ?? "") : "";
+      this.steps.push({
+        intent: opts.intent,
+        kind: opts.kind,
+        target: opts.target,
+        actor: opts.actor,
+        workspaceId: opts.workspaceId,
+        observation,
+        passed: true,
+        durationMs: Math.round(durationMs),
+        ...assertions.length > 0 ? { assertions: [...assertions] } : {}
+      });
+      return result;
+    } catch (error) {
+      const durationMs = performance.now() - startedAt;
+      const message = error instanceof Error ? error.message : String(error);
+      this.steps.push({
+        intent: opts.intent,
+        kind: opts.kind,
+        target: opts.target,
+        actor: opts.actor,
+        workspaceId: opts.workspaceId,
+        observation: "",
+        passed: false,
+        durationMs: Math.round(durationMs),
+        error: message,
+        ...assertions.length > 0 ? { assertions: [...assertions] } : {}
+      });
+      throw error;
+    }
+  }
+};
+var specHashCache = /* @__PURE__ */ new Map();
+function specProvenance() {
+  let absolutePath;
+  try {
+    absolutePath = test.info().file;
+  } catch {
+    return {};
+  }
+  if (!absolutePath) return {};
+  const specFile = path.relative(process.cwd(), absolutePath);
+  const cached2 = specHashCache.get(absolutePath);
+  if (cached2) return { specFile, specHash: cached2 };
+  try {
+    const contents = fs.readFileSync(absolutePath);
+    const specHash = crypto.createHash("sha256").update(contents).digest("hex").slice(0, 12);
+    specHashCache.set(absolutePath, specHash);
+    return { specFile, specHash };
+  } catch {
+    return { specFile };
+  }
+}
+function writeArtifact(proofId, artifact) {
+  const traceDir = path.join(process.cwd(), ...TRACE_DIR_RELATIVE);
+  fs.mkdirSync(traceDir, { recursive: true });
+  const target = path.join(traceDir, `${proofId}.json`);
+  fs.writeFileSync(target, JSON.stringify(artifact, null, 2), "utf8");
+}
+function normalizeOptions(arg) {
+  return typeof arg === "string" ? { proofId: arg } : arg;
+}
+function mutationProvenance() {
+  const id = process.env.PROOF_MUTATION_ID?.trim();
+  return id ? { id, planted: true } : void 0;
+}
+var trace = {
+  /**
+   * Start a proof. The callback receives a recorder whose `.step()` method
+   * wraps individual observations. When the callback resolves (or throws),
+   * a JSON artifact is written to `.proof/traces/<proofId>.json`.
+   *
+   * The proof rethrows any thrown error so the Playwright test still fails —
+   * the trace is written first so you can inspect the failure.
+   *
+   * @example
+   * // Common v0.5 case: no mission attached
+   * await trace.proof("auth-login-admin", async (t) => { ... });
+   *
+   * @example
+   * // v1 case: proof belongs to an external mission
+   * await trace.proof(
+   *   { proofId: "auth-login-admin", missionId: "M-042" },
+   *   async (t) => { ... },
+   * );
+   */
+  async proof(arg, fn) {
+    const { proofId, missionId } = normalizeOptions(arg);
+    const startedAt = performance.now();
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const recorder = new TraceRecorderImpl(proofId);
+    let proofError;
+    try {
+      await fn(recorder);
+    } catch (error) {
+      proofError = error;
+    }
+    const durationMs = Math.round(performance.now() - startedAt);
+    const steps = recorder.getSteps();
+    const passed = !proofError && steps.every((s) => s.passed);
+    const mutation = mutationProvenance();
+    const artifact = {
+      schemaVersion: TRACE_ARTIFACT_SCHEMA_VERSION,
+      proofId,
+      ...missionId ? { missionId } : {},
+      ...specProvenance(),
+      ...codeProvenance(),
+      ...mutation ? { mutation } : {},
+      timestamp,
+      durationMs,
+      passed,
+      steps: [...steps]
+    };
+    writeArtifact(proofId, artifact);
+    if (proofError) throw proofError;
+  }
+};
+
+// src/server/service-client.ts
+import { createClient as createClient2 } from "@supabase/supabase-js";
+function requireProofEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(
+      `[PROOF_FAIL] missing_env: expected ${name}, found empty
+  file: src/server/service-client.ts
+  suggestion: Ensure CI exports the Supabase env vars before running pnpm proof:verify.`
+    );
+  }
+  return value;
+}
+function createProofServiceClient() {
+  return createClient2(
+    requireProofEnv("NEXT_PUBLIC_SUPABASE_URL"),
+    requireProofEnv("SUPABASE_SECRET_KEY"),
+    {
+      auth: {
+        persistSession: false,
+        autoRefreshToken: false,
+        detectSessionInUrl: false
+      },
+      // Local Supabase sits behind Kong, which intermittently 502s under the
+      // load of a proof run. Installing the retry here covers every query made
+      // through this client, including ad-hoc ones inside proof specs.
+      global: { fetch: createRetryingFetch("service-role request") }
+    }
+  );
+}
+
+// src/server/seed.ts
+function failProof(category, expected, found, suggestion = `Check that Supabase is running (pnpm exec supabase status) and that SUPABASE_SECRET_KEY is set in .env.local.`) {
+  throw new Error(
+    `[PROOF_FAIL] ${category}: expected ${expected}, found ${found}
+  file: src/server/seed.ts
+  suggestion: ${suggestion}`
+  );
+}
+function failSeed(category, expected, found, error, status) {
+  if (isTransient(error, status)) {
+    failProof(
+      `${category}_transient`,
+      expected,
+      `${found} \u2014 still failing after ${TRANSIENT_MAX_ATTEMPTS} attempts`,
+      `This is a gateway/transport failure, not a schema problem: the request never reached Postgres. Check that the local Supabase stack is healthy (pnpm exec supabase status) and is not restarting mid-run.`
+    );
+  }
+  failProof(category, expected, found);
+}
+async function waitForPublicUser(sb, userId, email) {
+  const maxAttempts = 10;
+  const delayMs = 50;
+  for (let i = 0; i < maxAttempts; i++) {
+    const { data } = await sb.from("users").select("id").eq("id", userId).maybeSingle();
+    if (data) return;
+    await new Promise((r) => setTimeout(r, delayMs));
+  }
+  failProof(
+    "seed_user_trigger",
+    `public.users row for ${email} (id ${userId}) within ${maxAttempts * delayMs}ms`,
+    "row still missing \u2014 the handle_new_user trigger did not materialize the public.users mirror row"
+  );
+}
+var seed = {
+  /**
+   * Create a workspace with no owner. Use `seed.user({ workspace, role: "owner" })`
+   * afterwards to attach an owner. Returns the inserted row.
+   *
+   * Bypasses RLS via the service-role client, so it works even when no user
+   * is authenticated.
+   */
+  async workspace(name) {
+    const sb = createProofServiceClient();
+    const { data, error, status } = await sb.from("workspaces").insert({
+      name,
+      type: "team"
+    }).select("id, name, owner_id").single();
+    if (error || !data) {
+      failSeed(
+        "seed_workspace",
+        "a workspace row to be created",
+        `insert error: ${error?.message ?? "no row returned"}`,
+        error,
+        status
+      );
+    }
+    return {
+      id: data.id,
+      name: data.name,
+      ownerId: data.owner_id
+    };
+  },
+  /**
+   * Create an auth user with the given credentials and attach them to the
+   * provided workspace with the given role. Relies on the `handle_new_user`
+   * trigger to mirror the row into `public.users` automatically.
+   */
+  async user(opts) {
+    const sb = createProofServiceClient();
+    const { data: userData, error: createErr } = await sb.auth.admin.createUser(
+      {
+        email: opts.email,
+        password: opts.password,
+        email_confirm: true
+      }
+    );
+    if (createErr || !userData?.user) {
+      failSeed(
+        "seed_user_auth",
+        `auth user to be created for ${opts.email}`,
+        `admin.createUser error: ${createErr?.message ?? "no user returned"}`,
+        createErr
+      );
+    }
+    const userId = userData.user.id;
+    await waitForPublicUser(sb, userId, opts.email);
+    const {
+      data: memberRow,
+      error: memberErr,
+      status: memberStatus
+    } = await sb.from("workspace_members").insert({
+      workspace_id: opts.workspace.id,
+      user_id: userId,
+      role: opts.role
+    }).select("id").single();
+    if (memberErr || !memberRow) {
+      failSeed(
+        "seed_user_membership",
+        `workspace_members row for user ${opts.email} in workspace ${opts.workspace.id}`,
+        `insert error: ${memberErr?.message ?? "no row returned"}`,
+        memberErr,
+        memberStatus
+      );
+    }
+    return {
+      id: userId,
+      email: opts.email,
+      password: opts.password,
+      workspaceId: opts.workspace.id,
+      role: opts.role,
+      membershipId: memberRow.id
+    };
+  },
+  /**
+   * Delete a workspace and cascade-clean its members. Used by helpers for
+   * teardown. Safe to call on a workspace that no longer exists.
+   */
+  async deleteWorkspace(workspaceId) {
+    const sb = createProofServiceClient();
+    await sb.from("workspaces").delete().eq("id", workspaceId);
+  },
+  /**
+   * Delete an auth user (cascades to public.users and workspace_members via
+   * the schema's ON DELETE CASCADE). Safe to call if the user no longer
+   * exists.
+   */
+  async deleteUser(userId) {
+    const sb = createProofServiceClient();
+    await sb.auth.admin.deleteUser(userId);
+  }
+};
+
+// src/server/fixture.ts
+var ProofFixturePendingError = class extends Error {
+  constructor(table, reason) {
+    super(
+      `Fixture factory for "${table}" is incomplete: ${reason}. Complete e2e/fixtures/${table}.ts with values valid for the final schema.`
+    );
+    this.table = table;
+    this.reason = reason;
+    this.name = "ProofFixturePendingError";
+  }
+  table;
+  reason;
+  code = "fixture_factory_required";
+};
+function isProofFixturePendingError(error) {
+  return error instanceof ProofFixturePendingError;
+}
+
+// src/playwright/assert.ts
+function randomSuffix() {
+  return Math.random().toString(36).slice(2, 10);
+}
+function proofFail(category, expected, found, extras) {
+  return new Error(
+    `[PROOF_FAIL] ${category}: expected ${expected}, found ${found}
+  file: ${extras.file ?? "src/playwright/assert.ts"}
+  suggestion: ${extras.suggestion}`
+  );
+}
+function failIfInfrastructure(error, status, setupCategory, what) {
+  if (isAuthRateLimited(error, status)) {
+    throw proofFail(
+      setupCategory.replace(/_setup$/, "_rate_limited"),
+      `${what} to receive a database verdict`,
+      `HTTP 429/auth budget exhaustion: ${error?.message ?? "rate limited"}`,
+      {
+        suggestion: "This is infrastructure, not an RLS denial. Wait for the auth window to reset or reduce parallel proof workers."
+      }
+    );
+  }
+  if (!isTransient(error, status)) return;
+  throw proofFail(
+    setupCategory,
+    `${what} to reach the database, so that the result means something`,
+    `gateway/transport failure after ${TRANSIENT_MAX_ATTEMPTS} attempts: ${error?.message ?? "unknown error"}`,
+    {
+      suggestion: `The request never got an answer from Postgres, so neither "denied" nor "allowed" was observed \u2014 reading it as a denial would certify an invariant that nothing exercised. Check that the local Supabase stack is healthy (pnpm exec supabase status) and re-run.`
+    }
+  );
+}
+function validateTenantIsolationCriterion(table, scopeColumn, criterion) {
+  if (!criterion) return;
+  const invalidReason = criterion.description.trim().length === 0 ? "criterion.description is empty" : Object.keys(criterion.where).length === 0 ? "criterion.where has no equality filters" : Object.prototype.hasOwnProperty.call(criterion.where, scopeColumn) ? `criterion.where contains the tenant scope column "${scopeColumn}"` : null;
+  if (!invalidReason) return;
+  recordAssertion({
+    kind: "tenant_isolation",
+    target: table,
+    operation: "select",
+    passed: false,
+    status: "incomplete",
+    role: "primary",
+    detail: `planner-owned fixture criterion is invalid: ${invalidReason}`
+  });
+  throw proofFail(
+    "fixture_criterion_invalid",
+    "a non-empty semantic equality filter that does not redefine tenant scope",
+    invalidReason,
+    {
+      suggestion: `Keep "${scopeColumn}" out of criterion.where; assert.tenantIsolation applies the current side's scope automatically. Use criterion.where only for semantic state such as status, type, or visibility.`
+    }
+  );
+}
+async function teardown(orgA, orgB, userA, userB) {
+  await Promise.allSettled([
+    seed.deleteWorkspace(orgA.id),
+    seed.deleteWorkspace(orgB.id)
+  ]);
+  await Promise.allSettled([
+    seed.deleteUser(userA.id),
+    seed.deleteUser(userB.id)
+  ]);
+}
+function describeActor(actor) {
+  if (typeof actor === "string") {
+    const emailEnv = actor === "admin" ? process.env.SEED_ADMIN_EMAIL : process.env.SEED_MEMBER_EMAIL;
+    const passwordEnv = actor === "admin" ? process.env.SEED_ADMIN_PASSWORD : process.env.SEED_MEMBER_PASSWORD;
+    if (!emailEnv || !passwordEnv) {
+      const prefix = actor === "admin" ? "SEED_ADMIN" : "SEED_MEMBER";
+      throw new Error(
+        `[PROOF_FAIL] seed_credentials_missing: ${prefix}_EMAIL and ${prefix}_PASSWORD must be set when using the "${actor}" seed actor`
+      );
+    }
+    return {
+      email: emailEnv,
+      password: passwordEnv,
+      label: `seed:${actor}`
+    };
+  }
+  return { email: actor.email, password: actor.password, label: actor.email };
+}
+function applyEq(query, filter) {
+  let out = query;
+  for (const [k, v] of Object.entries(filter)) {
+    out = out.eq(k, v);
+  }
+  return out;
+}
+async function countMatchingAsService(sb, table, filter) {
+  const { count, error } = await applyEq(
+    sb.from(table).select("*", { count: "exact", head: true }),
+    filter
+  );
+  if (error) {
+    throw proofFail(
+      "authorization_setup",
+      `to verify the state of "${table}" with the service role`,
+      `Supabase error: ${error.message}`,
+      {
+        suggestion: `The probe cannot confirm whether the write was actually blocked without reading the table as service_role. Check the table name and that SUPABASE_SERVICE_ROLE_KEY is set.`
+      }
+    );
+  }
+  return count ?? 0;
+}
+async function countVisibleToActor(client, table, filter) {
+  const { count, error, status } = await applyEq(
+    client.from(table).select("*", { count: "exact", head: true }),
+    filter
+  );
+  failIfInfrastructure(
+    error,
+    status,
+    "authorization_setup",
+    `the actor's visibility check on ${table}`
+  );
+  if (error) return 0;
+  return count ?? 0;
+}
+async function requireWriteTargetVisible(args) {
+  const { client, probe, target, filter, existing, actorLabel } = args;
+  const visible = await countVisibleToActor(client, probe.table, filter);
+  if (visible > 0) {
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: "select",
+      passed: true,
+      role: "control",
+      detail: `${actorLabel} can read ${visible} of the ${existing} row(s) matching ${JSON.stringify(filter)} in ${probe.table}, so a refused ${probe.op.toUpperCase()} is distinguishable from one that never reached a row`
+    });
+    return;
+  }
+  recordAssertion({
+    kind: "authorization",
+    target,
+    operation: "select",
+    passed: false,
+    status: "incomplete",
+    role: "control",
+    detail: `${actorLabel} cannot read any of the ${existing} row(s) matching ${JSON.stringify(filter)} in ${probe.table}, so its ${probe.op.toUpperCase()} matches zero rows whether or not the operation is permitted`
+  });
+  throw proofFail(
+    "authorization_blind",
+    `${actorLabel} to be able to read at least one of the ${existing} target row(s) in "${probe.table}", so that a refused ${probe.op.toUpperCase()} means the write was rejected`,
+    `0 visible row(s) \u2014 this probe cannot fail, because PostgreSQL filters the rows an ${probe.op.toUpperCase()} reaches through its WHERE clause by the SELECT policy`,
+    {
+      suggestion: `Point the probe at a row the actor can read, or use an actor who can \u2014 for an admin-only table that is the admin, and "not even the actor who can read every row may change one" is usually the stronger claim anyway. If the invariant you actually want is "the actor cannot SEE these rows", use \`op: "select"\` or assert.tenantIsolation, which grade visibility directly.`
+    }
+  );
+}
+async function runRlsProbe(probe, actorCreds) {
+  const target = probe.target ?? probe.table;
+  const client = await actAsUser.supabaseClient({
+    email: actorCreds.email,
+    password: actorCreds.password
+  });
+  const sb = createProofServiceClient();
+  if (probe.op === "select") {
+    const existing = await countMatchingAsService(
+      sb,
+      probe.table,
+      probe.filter ?? {}
+    );
+    if (existing === 0) {
+      recordAssertion({
+        kind: "authorization",
+        target,
+        operation: probe.op,
+        passed: false,
+        status: "incomplete",
+        role: "primary",
+        detail: `no rows in ${probe.table} matching ${JSON.stringify(probe.filter ?? {})}, so "${actorCreds.label} read 0 rows" proves nothing`
+      });
+      throw proofFail(
+        "authorization_vacuous",
+        `at least one row in "${probe.table}" matching ${JSON.stringify(probe.filter ?? {})} for the select probe to be denied access to`,
+        "0 row(s) \u2014 there was nothing for the actor to fail to read",
+        {
+          suggestion: `Seed the fixture row(s) with the service-role client before probing. Reading zero rows from an empty table is not evidence that RLS filtered anything.`
+        }
+      );
+    }
+    let query = client.from(probe.table).select("*");
+    for (const [k, v] of Object.entries(probe.filter ?? {})) {
+      query = query.eq(k, v);
+    }
+    const { data, error: error2, status: status2 } = await query;
+    failIfInfrastructure(
+      error2,
+      status2,
+      "authorization_setup",
+      `the actor's SELECT on ${probe.table}`
+    );
+    const rows = data ?? [];
+    if (!error2 && rows.length > 0) {
+      recordAssertion({
+        kind: "authorization",
+        target,
+        operation: probe.op,
+        passed: false,
+        role: "primary",
+        detail: `actor ${actorCreds.label} SELECTed ${rows.length} row(s) from ${probe.table}; expected RLS to filter to 0`
+      });
+      throw proofFail(
+        "authorization",
+        `0 rows from ${probe.table} when selected by ${actorCreds.label} with filter ${JSON.stringify(probe.filter ?? {})}`,
+        `${rows.length} row(s)`,
+        {
+          suggestion: `Check SELECT RLS policy on ${probe.table}. The actor should not have read access to these rows.`
+        }
+      );
+    }
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: probe.op,
+      passed: true,
+      role: "primary",
+      detail: `${actorCreds.label} SELECT on ${probe.table} returned 0 of the ${existing} row(s) that exist (RLS honored)${error2 ? `; the query itself errored: ${error2.message}` : ""}`
+    });
+    return;
+  }
+  if (probe.op === "insert") {
+    if (!probe.payload) {
+      throw new Error(
+        "[PROOF_FAIL] bad_probe: rls.op='insert' requires `payload`\n  file: src/playwright/assert.ts"
+      );
+    }
+    const { error: error2, status: status2 } = await client.from(probe.table).insert(probe.payload);
+    failIfInfrastructure(
+      error2,
+      status2,
+      "authorization_setup",
+      `the actor's INSERT on ${probe.table}`
+    );
+    const committed = await countMatchingAsService(
+      sb,
+      probe.table,
+      probe.payload
+    );
+    if (committed > 0) {
+      await applyEq(sb.from(probe.table).delete(), probe.payload);
+      recordAssertion({
+        kind: "authorization",
+        target,
+        operation: probe.op,
+        passed: false,
+        role: "primary",
+        detail: `actor ${actorCreds.label} INSERT on ${probe.table} COMMITTED ${committed} row(s)${error2 ? ` even though the API returned "${error2.message}"` : ""}; expected RLS/policy denial`
+      });
+      throw proofFail(
+        "authorization",
+        `INSERT on ${probe.table} to be denied for ${actorCreds.label}`,
+        error2 ? `the API returned an error ("${error2.message}") but a service-role read found ${committed} row(s) committed \u2014 the write went through` : `insert succeeded (${committed} row(s) committed)`,
+        {
+          suggestion: `Check INSERT RLS policy and grants on ${probe.table}.`
+        }
+      );
+    }
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: probe.op,
+      passed: true,
+      role: "primary",
+      detail: `${actorCreds.label} INSERT on ${probe.table} denied${error2 ? ` (${error2.message})` : ""}; service-role read confirmed 0 row(s) committed`
+    });
+    return;
+  }
+  if (!probe.filter) {
+    throw new Error(
+      `[PROOF_FAIL] bad_probe: rls.op='${probe.op}' requires \`filter\`
+  file: src/playwright/assert.ts`
+    );
+  }
+  if (probe.op === "delete") {
+    const before2 = await countMatchingAsService(sb, probe.table, probe.filter);
+    if (before2 === 0) {
+      recordAssertion({
+        kind: "authorization",
+        target,
+        operation: probe.op,
+        passed: false,
+        role: "primary",
+        detail: `no rows in ${probe.table} matched ${JSON.stringify(probe.filter)} before the DELETE probe, so the probe could not have failed`
+      });
+      throw proofFail(
+        "authorization_vacuous",
+        `at least one row in "${probe.table}" matching ${JSON.stringify(probe.filter)} so the DELETE has a target`,
+        "0 matching rows before the probe ran",
+        {
+          suggestion: `Seed the row you expect the actor to be unable to delete before calling assert.authorization.`
+        }
+      );
+    }
+    await requireWriteTargetVisible({
+      client,
+      probe,
+      target,
+      filter: probe.filter,
+      existing: before2,
+      actorLabel: actorCreds.label
+    });
+    const { error: error2, status: status2 } = await applyEq(
+      client.from(probe.table).delete(),
+      probe.filter
+    );
+    failIfInfrastructure(
+      error2,
+      status2,
+      "authorization_setup",
+      `the actor's DELETE on ${probe.table}`
+    );
+    const after2 = await countMatchingAsService(sb, probe.table, probe.filter);
+    if (after2 < before2) {
+      recordAssertion({
+        kind: "authorization",
+        target,
+        operation: probe.op,
+        passed: false,
+        role: "primary",
+        detail: `actor ${actorCreds.label} DELETE on ${probe.table} removed ${before2 - after2} row(s) (${before2} \u2192 ${after2})${error2 ? ` even though the API returned "${error2.message}"` : ""}; expected none`
+      });
+      throw proofFail(
+        "authorization",
+        `0 rows removed from ${probe.table} by ${actorCreds.label}`,
+        `${before2 - after2} row(s) removed (${before2} \u2192 ${after2})`,
+        {
+          suggestion: `Check the DELETE RLS policy on ${probe.table}.`
+        }
+      );
+    }
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: probe.op,
+      passed: true,
+      role: "primary",
+      detail: `${actorCreds.label} DELETE on ${probe.table} removed 0 of ${before2} matching row(s)${error2 ? ` (${error2.message})` : ""}; service-role recount confirmed ${after2} (RLS honored)`
+    });
+    return;
+  }
+  if (!probe.payload || Object.keys(probe.payload).length === 0) {
+    throw new Error(
+      "[PROOF_FAIL] bad_probe: rls.op='update' requires a non-empty `payload`\n  file: src/playwright/assert.ts\n  suggestion: The payload is both the attempted change and the way the probe verifies whether it was applied."
+    );
+  }
+  const columns = Object.keys(probe.payload);
+  const readTargetRows = async () => {
+    const { data, error: error2 } = await applyEq(
+      sb.from(probe.table).select(columns.join(",")),
+      probe.filter
+    );
+    if (error2) {
+      throw proofFail(
+        "authorization_setup",
+        `to read ${columns.join(", ")} from "${probe.table}" with the service role`,
+        `Supabase error: ${error2.message}`,
+        {
+          suggestion: `The probe compares these columns before and after the update to decide whether the write landed.`
+        }
+      );
+    }
+    return data ?? [];
+  };
+  const rowMatchesPayload = (row) => columns.every(
+    (c) => JSON.stringify(row[c]) === JSON.stringify(probe.payload?.[c])
+  );
+  const before = await readTargetRows();
+  if (before.length === 0) {
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: probe.op,
+      passed: false,
+      role: "primary",
+      detail: `no rows in ${probe.table} matched ${JSON.stringify(probe.filter)} before the UPDATE probe, so the probe could not have failed`
+    });
+    throw proofFail(
+      "authorization_vacuous",
+      `at least one row in "${probe.table}" matching ${JSON.stringify(probe.filter)} so the UPDATE has a target`,
+      "0 matching rows before the probe ran",
+      {
+        suggestion: `Seed the row you expect the actor to be unable to modify before calling assert.authorization.`
+      }
+    );
+  }
+  await requireWriteTargetVisible({
+    client,
+    probe,
+    target,
+    filter: probe.filter,
+    existing: before.length,
+    actorLabel: actorCreds.label
+  });
+  const { error, status } = await applyEq(
+    client.from(probe.table).update(probe.payload),
+    probe.filter
+  );
+  failIfInfrastructure(
+    error,
+    status,
+    "authorization_setup",
+    `the actor's UPDATE on ${probe.table}`
+  );
+  const after = await readTargetRows();
+  const beforeApplied = before.filter(rowMatchesPayload).length;
+  const afterApplied = after.filter(rowMatchesPayload).length;
+  if (afterApplied > beforeApplied) {
+    recordAssertion({
+      kind: "authorization",
+      target,
+      operation: probe.op,
+      passed: false,
+      role: "primary",
+      detail: `actor ${actorCreds.label} UPDATE on ${probe.table} applied ${columns.join(", ")} to ${afterApplied - beforeApplied} row(s)${error ? ` even though the API returned "${error.message}"` : ""}; expected the write to be rejected`
+    });
+    throw proofFail(
+      "authorization",
+      `${columns.join(", ")} on ${probe.table} to be unchanged for ${actorCreds.label}`,
+      `${afterApplied - beforeApplied} row(s) now hold the attempted value(s) ${JSON.stringify(probe.payload)}`,
+      {
+        suggestion: `Check the UPDATE RLS policy and any column guard on ${probe.table}.`
+      }
+    );
+  }
+  recordAssertion({
+    kind: "authorization",
+    target,
+    operation: probe.op,
+    passed: true,
+    role: "primary",
+    detail: `${actorCreds.label} UPDATE on ${probe.table} left ${columns.join(", ")} unchanged across ${before.length} targeted row(s)${error ? ` (${error.message})` : ""}; verified by service-role re-read (RLS honored)`
+  });
+}
+async function countRowsAsService(sb, table, filter) {
+  const { count, error } = await applyEq(
+    sb.from(table).select("*", { count: "exact", head: true }),
+    filter
+  );
+  if (error) {
+    throw proofFail(
+      "tenant_isolation_setup",
+      `to count rows in "${table}" with the service role to establish ground truth`,
+      `Supabase error: ${error.message}`,
+      {
+        suggestion: `Confirm "${table}" exists and supports the planner-owned filter ${JSON.stringify(filter)}. Tenant isolation cannot be measured without first knowing how many matching rows are actually there.`
+      }
+    );
+  }
+  return count ?? 0;
+}
+async function probeTenantIsolation(args) {
+  const {
+    table,
+    viewer,
+    viewerLabel,
+    owner,
+    ownerLabel,
+    scopeColumn,
+    scopeValue,
+    scopeLabel,
+    criterion,
+    scopePattern,
+    sb
+  } = args;
+  const filter = {
+    [scopeColumn]: scopeValue,
+    ...criterion?.where ?? {}
+  };
+  const criterionDetail = criterion ? ` matching planner criterion "${criterion.description}" (${JSON.stringify(criterion.where)})` : "";
+  const actualRowCount = await countRowsAsService(sb, table, filter);
+  if (actualRowCount === 0) {
+    return "skipped_no_data";
+  }
+  const ownerClient = await actAsUser.supabaseClient({
+    email: owner.email,
+    password: owner.password
+  });
+  const {
+    data: ownRows,
+    error: ownError,
+    status: ownStatus
+  } = await applyEq(ownerClient.from(table).select("*"), filter);
+  failIfInfrastructure(
+    ownError,
+    ownStatus,
+    "tenant_isolation_setup",
+    `the owner's control SELECT on ${table}`
+  );
+  if (ownError || (ownRows?.length ?? 0) === 0) {
+    recordAssertion({
+      kind: "tenant_isolation",
+      target: table,
+      operation: "select",
+      passed: false,
+      role: "control",
+      detail: `positive control FAILED: ${ownerLabel} (owner of ${scopeLabel}) read ${ownRows?.length ?? 0} of ${actualRowCount} row(s) in ${table}${criterionDetail}${ownError ? `; error: ${ownError.message}` : ""}`
+    });
+    throw proofFail(
+      "tenant_isolation_control",
+      `${ownerLabel} to read the ${actualRowCount} row(s) that exist in "${table}" for ${scopeLabel}${criterionDetail}`,
+      ownError ? `Supabase error: ${ownError.message}` : `0 row(s) \u2014 their own data is invisible to them`,
+      {
+        suggestion: `The negative probe would have "passed" here for the wrong reason: if the owner cannot read their own rows, then an outsider seeing 0 rows proves nothing. Check the SELECT policy/grant on "${table}" \u2014 the canonical pattern for this scope is ${scopePattern}. If this table is intentionally service-role-only, it is not a tenant-isolation target: use assert.authorization instead.`
+      }
+    );
+  }
+  recordAssertion({
+    kind: "tenant_isolation",
+    target: table,
+    operation: "select",
+    passed: true,
+    role: "control",
+    detail: `${ownerLabel} read ${ownRows?.length ?? 0} of ${actualRowCount} row(s) in ${table} for ${scopeLabel}${criterionDetail} \u2014 the probe can observe these rows, so a leak would be detected`
+  });
+  const client = await actAsUser.supabaseClient({
+    email: viewer.email,
+    password: viewer.password
+  });
+  const {
+    data: leakedRows,
+    error: queryError,
+    status: queryStatus
+  } = await applyEq(client.from(table).select("*"), filter);
+  failIfInfrastructure(
+    queryError,
+    queryStatus,
+    "tenant_isolation_setup",
+    `the outsider's SELECT on ${table}`
+  );
+  if (queryError) {
+    recordAssertion({
+      kind: "tenant_isolation",
+      target: table,
+      operation: "select",
+      passed: false,
+      role: "primary",
+      detail: `${viewerLabel} select on ${table} scoped to ${scopeLabel}${criterionDetail} failed: ${queryError.message}`
+    });
+    throw proofFail(
+      "tenant_isolation",
+      `query against ${table} as ${viewerLabel} to succeed (possibly returning 0 rows)`,
+      `Supabase error: ${queryError.message}`,
+      {
+        suggestion: `Verify "${table}" has a ${scopeColumn} column and a SELECT grant for authenticated users. Tenant isolation cannot be proven if the query itself is denied at the grant level.`
+      }
+    );
+  }
+  if (leakedRows && leakedRows.length > 0) {
+    const sampleIds = leakedRows.slice(0, 3).map((r) => r.id ?? "?").join(", ");
+    recordAssertion({
+      kind: "tenant_isolation",
+      target: table,
+      operation: "select",
+      passed: false,
+      role: "primary",
+      detail: `${viewerLabel} saw ${leakedRows.length} row(s) in ${table} belonging to ${scopeLabel}${criterionDetail} (sample ids: ${sampleIds})`
+    });
+    throw proofFail(
+      "tenant_isolation",
+      `0 rows in "${table}" for ${viewerLabel} filtered to ${JSON.stringify(filter)}`,
+      `${leakedRows.length} row(s) (sample ids: ${sampleIds})`,
+      {
+        suggestion: `Inspect the RLS policy on "${table}". The canonical pattern for this scope is ${scopePattern}.`
+      }
+    );
+  }
+  recordAssertion({
+    kind: "tenant_isolation",
+    target: table,
+    operation: "select",
+    passed: true,
+    role: "primary",
+    detail: `${viewerLabel} saw 0 of the ${actualRowCount} row(s) that exist in ${table} for ${scopeLabel}${criterionDetail}, which ${ownerLabel} can read (RLS honored)`
+  });
+  return "proved";
+}
+async function runActionProbe(probe, actorCreds, page) {
+  const target = probe.target ?? `${probe.module}:${probe.name}`;
+  const kind = probe.kind ?? "authorization";
+  const result = await actAsUser.invokeAction(page, {
+    as: actorCreds.label === "seed:admin" ? "admin" : actorCreds.label === "seed:member" ? "member" : { email: actorCreds.email, password: actorCreds.password },
+    module: probe.module,
+    action: probe.name,
+    inputParams: probe.inputParams
+  });
+  if (result.success) {
+    recordAssertion({
+      kind,
+      target,
+      operation: "invoke",
+      passed: false,
+      role: "primary",
+      detail: `actor ${actorCreds.label} successfully invoked ${target}; expected action-layer rejection`
+    });
+    throw proofFail(
+      kind,
+      `action "${target}" to return { success: false } for ${actorCreds.label}`,
+      "action returned { success: true }",
+      {
+        suggestion: `Check withRBAC / role-check logic inside ${probe.module}/${probe.name}. The action should reject the actor.`
+      }
+    );
+  }
+  if (probe.expectedErrorMatch && !probe.expectedErrorMatch.test(result.error)) {
+    recordAssertion({
+      kind,
+      target,
+      operation: "invoke",
+      passed: false,
+      role: "primary",
+      detail: `action "${target}" rejected ${actorCreds.label} but with unexpected message: ${result.error}`
+    });
+    throw proofFail(
+      kind,
+      `rejection message matching ${probe.expectedErrorMatch}`,
+      `error: "${result.error}"`,
+      {
+        suggestion: `The action rejected the caller (good) but not for the expected reason. Confirm the proof is asserting on the right invariant.`
+      }
+    );
+  }
+  recordAssertion({
+    kind,
+    target,
+    operation: "invoke",
+    passed: true,
+    role: "primary",
+    detail: `action "${target}" rejected ${actorCreds.label} with: ${result.error}`
+  });
+}
+async function runSuccessfulActionProbe(opts) {
+  const actorCreds = describeActor(opts.actor);
+  const target = opts.action.target ?? `${opts.action.module}:${opts.action.name}`;
+  const kind = opts.kind ?? opts.action.kind ?? "happy_path";
+  const role = opts.role ?? "control";
+  const result = await actAsUser.invokeAction(opts.page, {
+    as: actorCreds.label === "seed:admin" ? "admin" : actorCreds.label === "seed:member" ? "member" : { email: actorCreds.email, password: actorCreds.password },
+    module: opts.action.module,
+    action: opts.action.name,
+    inputParams: opts.action.inputParams
+  });
+  if (!result.success) {
+    recordAssertion({
+      kind,
+      target,
+      operation: "invoke",
+      passed: false,
+      role,
+      detail: `action "${target}" rejected ${actorCreds.label}; expected success: ${result.error}`
+    });
+    throw proofFail(
+      kind,
+      `action "${target}" to return { success: true } for ${actorCreds.label}`,
+      `action returned { success: false, error: "${result.error}" }`,
+      {
+        suggestion: `A refusal proof needs a working positive path. Check the action registry, validation input, and the permissions for ${actorCreds.label}.`
+      }
+    );
+  }
+  recordAssertion({
+    kind,
+    target,
+    operation: "invoke",
+    passed: true,
+    role,
+    detail: `action "${target}" succeeded for ${actorCreds.label}`
+  });
+  return result.data;
+}
+var assertMethods = {
+  /**
+   * Prove that workspace-scoped data in `table` is invisible to members of a
+   * different workspace. See file header for full semantics.
+   *
+   * Records two assertions per proved direction: a `control` showing the org's
+   * own member CAN read the rows, and the `primary` showing the outsider
+   * cannot. Only the `primary` can satisfy a mission's `trace_must_prove`
+   * entry.
+   *
+   * Fails rather than passing vacuously when `setup()` leaves orgA empty.
+   */
+  async tenantIsolation(opts) {
+    const { table, page } = opts;
+    const tag = opts.tag ?? randomSuffix();
+    const scope = opts.scope ?? "workspace";
+    const scopeColumn = opts.scopeColumn ?? (scope === "user" ? "user_id" : "workspace_id");
+    validateTenantIsolationCriterion(table, scopeColumn, opts.criterion);
+    const orgA = await seed.workspace(`Proof OrgA ${tag}`);
+    const orgB = await seed.workspace(`Proof OrgB ${tag}`);
+    const userA = await seed.user({
+      email: `proof-a-${tag}@proof.test`,
+      password: `ProofPass!${tag}1`,
+      workspace: orgA,
+      role: "owner"
+    });
+    const userB = await seed.user({
+      email: `proof-b-${tag}@proof.test`,
+      password: `ProofPass!${tag}1`,
+      workspace: orgB,
+      role: "owner"
+    });
+    const sb = createProofServiceClient();
+    const scopePattern = scope === "user" ? "user_id = auth.uid()" : "workspace_id IN (SELECT get_user_workspace_ids(auth.uid()))";
+    const sideA = scope === "user" ? userA.id : orgA.id;
+    const sideB = scope === "user" ? userB.id : orgB.id;
+    const labelA = scope === "user" ? "user A's rows" : "orgA";
+    const labelB = scope === "user" ? "user B's rows" : "orgB";
+    try {
+      const fixtureContext = {
+        orgA,
+        orgB,
+        userA,
+        userB,
+        sb
+      };
+      if (opts.fixture && opts.fixture.table !== table) {
+        recordAssertion({
+          kind: "tenant_isolation",
+          target: table,
+          operation: "select",
+          passed: false,
+          status: "incomplete",
+          role: "primary",
+          detail: `fixture for "${opts.fixture.table}" cannot seed proof target "${table}"`
+        });
+        throw proofFail(
+          "fixture_factory_mismatch",
+          `the imported fixture factory to declare table "${table}"`,
+          `factory declares "${opts.fixture.table}"`,
+          {
+            file: `e2e/fixtures/${table}.ts`,
+            suggestion: `Import the factory owned by "${table}", or correct its table declaration. A copied factory must not silently seed one table while the proof probes another.`
+          }
+        );
+      }
+      try {
+        if (opts.fixture) {
+          await withoutAssertionProvenance(
+            () => opts.fixture.create(fixtureContext)
+          );
+        } else {
+          await withoutAssertionProvenance(() => opts.setup(fixtureContext));
+        }
+      } catch (error) {
+        if (!isProofFixturePendingError(error)) throw error;
+        recordAssertion({
+          kind: "tenant_isolation",
+          target: table,
+          operation: "select",
+          passed: false,
+          status: "incomplete",
+          role: "primary",
+          detail: `fixture factory incomplete: ${error.reason}`
+        });
+        throw proofFail(
+          error.code,
+          `a completed fixture factory for "${table}"`,
+          error.reason,
+          {
+            file: `e2e/fixtures/${table}.ts`,
+            suggestion: `Replace pendingProofFixture(...) with defineProofFixture(...), using values valid for the final schema. Resolve required foreign keys from seeded/existing rows and honor NOT NULL, CHECK, domain, and enum constraints. Do not weaken a product constraint to make the proof easier to seed.`
+          }
+        );
+      }
+      const forward = await probeTenantIsolation({
+        table,
+        viewer: userB,
+        viewerLabel: "user B",
+        owner: userA,
+        ownerLabel: "user A",
+        scopeColumn,
+        scopeValue: sideA,
+        scopeLabel: labelA,
+        criterion: opts.criterion,
+        scopePattern,
+        sb
+      });
+      if (forward === "skipped_no_data") {
+        recordAssertion({
+          kind: "tenant_isolation",
+          target: table,
+          operation: "select",
+          passed: false,
+          status: "incomplete",
+          role: "primary",
+          detail: `fixture setup created 0 rows in "${table}" where ${scopeColumn} = ${sideA}` + (opts.criterion ? ` matching planner criterion "${opts.criterion.description}" (${JSON.stringify(opts.criterion.where)})` : "")
+        });
+        throw proofFail(
+          "tenant_isolation_vacuous",
+          `setup() to create at least one "${table}" row for ${labelA}${opts.criterion ? ` matching planner criterion "${opts.criterion.description}"` : ""} so there is something for user B to fail to see`,
+          `0 rows in "${table}" matching ${JSON.stringify({
+            [scopeColumn]: sideA,
+            ...opts.criterion?.where ?? {}
+          })} after setup() returned`,
+          {
+            suggestion: `An empty table cannot demonstrate isolation: user B seeing 0 rows would be indistinguishable from working RLS. Insert the fixture row(s) in e2e/fixtures/${table}.ts (or the inline setup) using the provided service-role client (\`sb\`), and make sure they carry ${scopeColumn} = ${sideA}${opts.criterion ? ` and satisfy planner criterion "${opts.criterion.description}" (${JSON.stringify(opts.criterion.where)})` : ""}.`
+          }
+        );
+      }
+      const reverse = await probeTenantIsolation({
+        table,
+        viewer: userA,
+        viewerLabel: "user A",
+        owner: userB,
+        ownerLabel: "user B",
+        scopeColumn,
+        scopeValue: sideB,
+        scopeLabel: labelB,
+        criterion: opts.criterion,
+        scopePattern,
+        sb
+      });
+      if (reverse === "skipped_no_data") {
+        recordAssertion({
+          kind: "tenant_isolation",
+          target: table,
+          operation: "select",
+          passed: false,
+          status: "skipped",
+          role: "primary",
+          detail: `reverse direction (A\u2192B) not measured: setup() left ${labelB}${opts.criterion ? ` without rows matching planner criterion "${opts.criterion.description}"` : " empty"}, so there is nothing for user A to fail to see. Populate both sides in setup() to prove isolation in both directions.`
+        });
+        console.log(
+          `[proof] tenantIsolation(${table}): reverse probe (A\u2192B) skipped \u2014 setup() left ${labelB}${opts.criterion ? ` without rows matching criterion "${opts.criterion.description}"` : " empty"}, so there is nothing for user A to fail to see. The A\u2192B direction is unproven; populate it in setup() if you need it proven in both directions.`
+        );
+      }
+      if (page) {
+        await actAsUser.loginAs(page, userB.email, userB.password);
+      }
+    } finally {
+      await teardown(orgA, orgB, userA, userB);
+    }
+  },
+  /**
+   * Prove that an operation is rejected when performed by an unauthorized
+   * actor. Can probe either the RLS layer (direct Supabase client), the
+   * action layer (via POST /api/proof/invoke-action), or both.
+   *
+   * RLS probes record `kind: "authorization"`. Action probes default to the
+   * same kind but may set `action.kind` to the withProof invariant they
+   * establish. The helper throws on the first probe that SUCCEEDS when it was
+   * expected to fail — that's the PROOF_FAIL signal.
+   *
+   * Caller is responsible for seeding any fixture rows needed; this helper
+   * creates no users or workspaces on its own.
+   *
+   * @example
+   * // Action-layer: member cannot remove admin
+   * await assert.authorization({
+   *   actor: { email: member.email, password: member.password },
+   *   action: {
+   *     module: "workspace",
+   *     name: "removeMember",
+   *     inputParams: { formData: { workspaceId, memberId } },
+   *     expectedErrorMatch: /permission|unauthorized/i,
+   *   },
+   *   page,
+   * });
+   *
+   * @example
+   * // RLS-layer: member cannot DELETE admin's workspace_members row
+   * await assert.authorization({
+   *   actor: { email: member.email, password: member.password },
+   *   rls: {
+   *     table: "workspace_members",
+   *     op: "delete",
+   *     filter: { user_id: admin.id, workspace_id: orgA.id },
+   *   },
+   * });
+   */
+  async authorization(opts) {
+    if (!opts.rls && !opts.action) {
+      throw new Error(
+        "[PROOF_FAIL] bad_options: assert.authorization requires at least one of `rls` or `action`\n  file: src/playwright/assert.ts\n  suggestion: Pass an `rls` probe for DB-layer denial or an `action` probe for action-layer denial (or both)."
+      );
+    }
+    if (opts.action && !opts.page) {
+      throw new Error(
+        "[PROOF_FAIL] bad_options: assert.authorization's `action` probe requires a Playwright `page`\n  file: src/playwright/assert.ts\n  suggestion: Destructure `page` from the test callback and pass it in."
+      );
+    }
+    const actorCreds = describeActor(opts.actor);
+    if (opts.rls) {
+      await runRlsProbe(opts.rls, actorCreds);
+    }
+    if (opts.action && opts.page) {
+      await runActionProbe(opts.action, actorCreds, opts.page);
+    }
+  },
+  /**
+   * Prove that a registered action succeeds for an actor who should be allowed.
+   *
+   * This is the positive-control companion to action-level refusal probes.
+   * Assertions default to `role: "control"`, so a working happy path cannot
+   * satisfy the mission's primary requirement by itself. Override `role` only
+   * when success is the primary invariant being proved.
+   *
+   * Returns the action's data so the caller can make domain-specific checks.
+   */
+  async actionSucceeds(opts) {
+    return runSuccessfulActionProbe(opts);
+  },
+  /**
+   * Assert on an HTTP response from a page route. Streaming-RSC aware: when
+   * only body markers (`mustContain` / `mustNotContain`) are provided, the
+   * helper does NOT check the status code — crucial for routes guarded by
+   * a server component's `notFound()` call that Next.js can only signal via
+   * an embedded NOT_FOUND marker because headers were already committed as
+   * 200 by `loading.tsx`. See
+   * [proof-authoring.mdc](mdc:.cursor/rules/proof-authoring.mdc) for the
+   * streaming-RSC gotcha in full.
+   *
+   * Defaults:
+   *   - method: "GET"
+   *   - maxRedirects: 0 (intentional — silent redirect-following has caused
+   *     real false passes on auth-gated pages)
+   *
+   * Records one TraceAssertion with caller-provided `kind` and `target`.
+   * Returns the raw Playwright APIResponse so callers can run additional
+   * custom checks (headers, etc.) after.
+   *
+   * @example
+   * // Streaming-RSC page: assert body markers, not status code
+   * await assert.httpResponse({
+   *   page,
+   *   path: "/secret-admin",
+   *   as: "member",
+   *   kind: "authorization",
+   *   target: "/secret-admin",
+   *   expect: {
+   *     mustContain: [/Sorry, we could not find this page/i],
+   *     mustNotContain: [/Here you can see what.?s happening on your platform/i],
+   *   },
+   * });
+   *
+   * @example
+   * // Flat API route: assert status
+   * await assert.httpResponse({
+   *   page,
+   *   path: "/api/public-ping",
+   *   kind: "happy_path",
+   *   expect: { status: 200 },
+   * });
+   */
+  async httpResponse(opts) {
+    const target = opts.target ?? opts.path;
+    const method = opts.method ?? "GET";
+    const role = opts.role ?? "primary";
+    if (opts.as !== void 0) {
+      if (typeof opts.as === "string") {
+        await actAsUser.login(opts.page, opts.as);
+      } else {
+        await actAsUser.loginAs(opts.page, opts.as.email, opts.as.password);
+      }
+    }
+    const requestCtx = opts.page.request;
+    const requestOpts = { maxRedirects: 0 };
+    let response;
+    switch (method) {
+      case "GET":
+        response = await requestCtx.get(opts.path, requestOpts);
+        break;
+      case "POST":
+        response = await requestCtx.post(opts.path, requestOpts);
+        break;
+      case "PUT":
+        response = await requestCtx.put(opts.path, requestOpts);
+        break;
+      case "PATCH":
+        response = await requestCtx.patch(opts.path, requestOpts);
+        break;
+      case "DELETE":
+        response = await requestCtx.delete(opts.path, requestOpts);
+        break;
+    }
+    const status = response.status();
+    let body = null;
+    const failures = [];
+    if (opts.expect.status !== void 0 && status !== opts.expect.status) {
+      failures.push(
+        `status mismatch: expected ${opts.expect.status}, got ${status}`
+      );
+    }
+    if (opts.expect.mustContain && opts.expect.mustContain.length > 0 || opts.expect.mustNotContain && opts.expect.mustNotContain.length > 0) {
+      body = await response.text();
+      for (const re of opts.expect.mustContain ?? []) {
+        if (!re.test(body)) {
+          failures.push(`mustContain not matched: ${re}`);
+        }
+      }
+      for (const re of opts.expect.mustNotContain ?? []) {
+        if (re.test(body)) {
+          failures.push(
+            `mustNotContain matched (should have been absent): ${re}`
+          );
+        }
+      }
+    }
+    if (failures.length > 0) {
+      recordAssertion({
+        kind: opts.kind,
+        target,
+        operation: "request",
+        passed: false,
+        role,
+        detail: `${method} ${opts.path} -> ${status}; failures: ${failures.join("; ")}`
+      });
+      throw new Error(
+        `[PROOF_FAIL] ${opts.kind}: response from ${method} ${opts.path} did not match expectations
+  status: ${status}
+  failures:
+${failures.map((f) => `    - ${f}`).join("\n")}
+  file: src/playwright/assert.ts
+  suggestion: ${opts.expect.mustContain || opts.expect.mustNotContain ? "For streaming RSC routes, assert on body markers rather than status. See .cursor/rules/proof-authoring.mdc." : "Check the route handler or page component and confirm the expected response shape."}`
+      );
+    }
+    recordAssertion({
+      kind: opts.kind,
+      target,
+      operation: "request",
+      passed: true,
+      role,
+      detail: `${method} ${opts.path} -> ${status}${opts.expect.mustContain || opts.expect.mustNotContain ? " (body markers matched)" : ""}`
+    });
+    return response;
+  }
+};
+function withHelperProvenance(name, fn) {
+  return (...args) => withAssertionProvenance(name, () => fn(...args));
+}
+var assert = {
+  tenantIsolation: withHelperProvenance(
+    "assert.tenantIsolation",
+    assertMethods.tenantIsolation
+  ),
+  authorization: withHelperProvenance(
+    "assert.authorization",
+    assertMethods.authorization
+  ),
+  // Cast preserves the <TData> generic that the wrapper's closed-over
+  // signature would otherwise collapse to `unknown`.
+  actionSucceeds: withHelperProvenance(
+    "assert.actionSucceeds",
+    assertMethods.actionSucceeds
+  ),
+  httpResponse: withHelperProvenance(
+    "assert.httpResponse",
+    assertMethods.httpResponse
+  )
+};
+export {
+  actAsUser,
+  assert,
+  recordAssertion,
+  trace
+};
+//# sourceMappingURL=playwright.js.map