proof-harness 0.1.0-next.1

package/dist/server.js

@@ -0,0 +1,376 @@
+// src/server/runtime-guard.ts
+import { NextResponse } from "next/server.js";
+function proofGuard(request) {
+  const envOk = process.env.NODE_ENV === "development" || process.env.PROOF_MODE === "true";
+  if (!envOk) {
+    return jsonError(403, {
+      error: "[PROOF_FAIL] guard_env: proof endpoints are disabled in this environment",
+      suggestion: "Run against a dev server (NODE_ENV=development) or set PROOF_MODE=true on the server."
+    });
+  }
+  const expected = process.env.API_SECRET_KEY;
+  if (!expected) {
+    return jsonError(500, {
+      error: "[PROOF_FAIL] guard_secret_missing: API_SECRET_KEY is not set",
+      suggestion: "Set API_SECRET_KEY in the server environment. Proof helpers use it as the shared secret for /api/proof/* routes."
+    });
+  }
+  const provided = request.headers.get("x-proof-secret");
+  if (provided !== expected) {
+    return jsonError(403, {
+      error: "[PROOF_FAIL] guard_secret: x-proof-secret header missing or invalid",
+      suggestion: "The runner's API_SECRET_KEY does not match the dev server. If .env.local changed after the server started, restart that server; proof helpers already send the current key in x-proof-secret."
+    });
+  }
+  return null;
+}
+function jsonError(status, body) {
+  return NextResponse.json(body, { status });
+}
+
+// src/server/service-client.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/server/transient.ts
+var TRANSIENT_MESSAGES = [
+  /invalid response was received from the upstream server/i,
+  /upstream connect error/i,
+  /(service|server) (is )?temporarily unavailable/i,
+  /bad gateway/i,
+  /gateway time-?out/i,
+  /fetch failed/i,
+  /network( request)? failed/i,
+  /socket hang up/i,
+  /ECONNRESET|ECONNREFUSED|EPIPE|ETIMEDOUT|EAI_AGAIN|UND_ERR/
+];
+function messageChain(error, depth = 0) {
+  if (!error || depth > 3) return "";
+  if (typeof error === "string") return error;
+  const record = error;
+  const own = typeof record.message === "string" ? record.message : "";
+  return `${own} ${messageChain(record.cause, depth + 1)}`;
+}
+var GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+function isTransient(error, status) {
+  if (!error) return false;
+  const httpStatus = status ?? error.status ?? null;
+  if (typeof httpStatus === "number") {
+    if (GATEWAY_STATUSES.has(httpStatus)) return true;
+    if (httpStatus >= 400) return false;
+  }
+  const text = messageChain(error);
+  return TRANSIENT_MESSAGES.some((pattern) => pattern.test(text));
+}
+var TRANSIENT_MAX_ATTEMPTS = 4;
+var BASE_DELAY_MS = 150;
+function backoffMs(attempt) {
+  return BASE_DELAY_MS * 2 ** (attempt - 1);
+}
+function announce(label, attempt, maxAttempts, reason, delayMs) {
+  console.log(
+    `[proof:retry] ${label} failed transiently (attempt ${attempt}/${maxAttempts}): ${reason} \u2014 retrying in ${delayMs}ms`
+  );
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function createRetryingFetch(label, baseFetch = fetch, { maxAttempts = TRANSIENT_MAX_ATTEMPTS } = {}) {
+  return async (input, init) => {
+    const replayable = init?.body == null || typeof init.body === "string" || init.body instanceof URLSearchParams;
+    for (let attempt = 1; ; attempt++) {
+      const lastAttempt = attempt >= maxAttempts || !replayable;
+      try {
+        const response = await baseFetch(input, init);
+        if (lastAttempt || !GATEWAY_STATUSES.has(response.status)) {
+          return response;
+        }
+        const delayMs = backoffMs(attempt);
+        announce(
+          label,
+          attempt,
+          maxAttempts,
+          `HTTP ${response.status}`,
+          delayMs
+        );
+        await sleep(delayMs);
+      } catch (error) {
+        if (lastAttempt || !isTransient(error))
+          throw error;
+        const delayMs = backoffMs(attempt);
+        announce(
+          label,
+          attempt,
+          maxAttempts,
+          messageChain(error).trim() || "transport failure",
+          delayMs
+        );
+        await sleep(delayMs);
+      }
+    }
+  };
+}
+
+// src/server/service-client.ts
+function requireProofEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(
+      `[PROOF_FAIL] missing_env: expected ${name}, found empty
+  file: src/server/service-client.ts
+  suggestion: Ensure CI exports the Supabase env vars before running pnpm proof:verify.`
+    );
+  }
+  return value;
+}
+function createProofServiceClient() {
+  return createClient(
+    requireProofEnv("NEXT_PUBLIC_SUPABASE_URL"),
+    requireProofEnv("SUPABASE_SECRET_KEY"),
+    {
+      auth: {
+        persistSession: false,
+        autoRefreshToken: false,
+        detectSessionInUrl: false
+      },
+      // Local Supabase sits behind Kong, which intermittently 502s under the
+      // load of a proof run. Installing the retry here covers every query made
+      // through this client, including ad-hoc ones inside proof specs.
+      global: { fetch: createRetryingFetch("service-role request") }
+    }
+  );
+}
+
+// src/server/seed.ts
+function failProof(category, expected, found, suggestion = `Check that Supabase is running (pnpm exec supabase status) and that SUPABASE_SECRET_KEY is set in .env.local.`) {
+  throw new Error(
+    `[PROOF_FAIL] ${category}: expected ${expected}, found ${found}
+  file: src/server/seed.ts
+  suggestion: ${suggestion}`
+  );
+}
+function failSeed(category, expected, found, error, status) {
+  if (isTransient(error, status)) {
+    failProof(
+      `${category}_transient`,
+      expected,
+      `${found} \u2014 still failing after ${TRANSIENT_MAX_ATTEMPTS} attempts`,
+      `This is a gateway/transport failure, not a schema problem: the request never reached Postgres. Check that the local Supabase stack is healthy (pnpm exec supabase status) and is not restarting mid-run.`
+    );
+  }
+  failProof(category, expected, found);
+}
+async function waitForPublicUser(sb, userId, email) {
+  const maxAttempts = 10;
+  const delayMs = 50;
+  for (let i = 0; i < maxAttempts; i++) {
+    const { data } = await sb.from("users").select("id").eq("id", userId).maybeSingle();
+    if (data) return;
+    await new Promise((r) => setTimeout(r, delayMs));
+  }
+  failProof(
+    "seed_user_trigger",
+    `public.users row for ${email} (id ${userId}) within ${maxAttempts * delayMs}ms`,
+    "row still missing \u2014 the handle_new_user trigger did not materialize the public.users mirror row"
+  );
+}
+var seed = {
+  /**
+   * Create a workspace with no owner. Use `seed.user({ workspace, role: "owner" })`
+   * afterwards to attach an owner. Returns the inserted row.
+   *
+   * Bypasses RLS via the service-role client, so it works even when no user
+   * is authenticated.
+   */
+  async workspace(name) {
+    const sb = createProofServiceClient();
+    const { data, error, status } = await sb.from("workspaces").insert({
+      name,
+      type: "team"
+    }).select("id, name, owner_id").single();
+    if (error || !data) {
+      failSeed(
+        "seed_workspace",
+        "a workspace row to be created",
+        `insert error: ${error?.message ?? "no row returned"}`,
+        error,
+        status
+      );
+    }
+    return {
+      id: data.id,
+      name: data.name,
+      ownerId: data.owner_id
+    };
+  },
+  /**
+   * Create an auth user with the given credentials and attach them to the
+   * provided workspace with the given role. Relies on the `handle_new_user`
+   * trigger to mirror the row into `public.users` automatically.
+   */
+  async user(opts) {
+    const sb = createProofServiceClient();
+    const { data: userData, error: createErr } = await sb.auth.admin.createUser(
+      {
+        email: opts.email,
+        password: opts.password,
+        email_confirm: true
+      }
+    );
+    if (createErr || !userData?.user) {
+      failSeed(
+        "seed_user_auth",
+        `auth user to be created for ${opts.email}`,
+        `admin.createUser error: ${createErr?.message ?? "no user returned"}`,
+        createErr
+      );
+    }
+    const userId = userData.user.id;
+    await waitForPublicUser(sb, userId, opts.email);
+    const {
+      data: memberRow,
+      error: memberErr,
+      status: memberStatus
+    } = await sb.from("workspace_members").insert({
+      workspace_id: opts.workspace.id,
+      user_id: userId,
+      role: opts.role
+    }).select("id").single();
+    if (memberErr || !memberRow) {
+      failSeed(
+        "seed_user_membership",
+        `workspace_members row for user ${opts.email} in workspace ${opts.workspace.id}`,
+        `insert error: ${memberErr?.message ?? "no row returned"}`,
+        memberErr,
+        memberStatus
+      );
+    }
+    return {
+      id: userId,
+      email: opts.email,
+      password: opts.password,
+      workspaceId: opts.workspace.id,
+      role: opts.role,
+      membershipId: memberRow.id
+    };
+  },
+  /**
+   * Delete a workspace and cascade-clean its members. Used by helpers for
+   * teardown. Safe to call on a workspace that no longer exists.
+   */
+  async deleteWorkspace(workspaceId) {
+    const sb = createProofServiceClient();
+    await sb.from("workspaces").delete().eq("id", workspaceId);
+  },
+  /**
+   * Delete an auth user (cascades to public.users and workspace_members via
+   * the schema's ON DELETE CASCADE). Safe to call if the user no longer
+   * exists.
+   */
+  async deleteUser(userId) {
+    const sb = createProofServiceClient();
+    await sb.auth.admin.deleteUser(userId);
+  }
+};
+
+// src/server/auth-rate-limit.ts
+var AUTH_RATE_LIMIT_MAX_ATTEMPTS = 3;
+var AUTH_RATE_LIMIT_MAX_DELAY_MS = 5e3;
+var AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS = 1e4;
+var AUTH_RATE_LIMIT_FALLBACK_DELAY_MS = 1e3;
+function isAuthRateLimited(error, status, body) {
+  const httpStatus = status ?? error?.status ?? null;
+  if (httpStatus === 429) return true;
+  if (typeof httpStatus === "number" && httpStatus >= 400) return false;
+  const text = `${error?.message ?? ""} ${body ?? ""}`;
+  return /\[PROOF_FAIL\]\s*(auth_)?rate_limited:/i.test(text) || /\b(rate limit|too many (requests|attempts|sign-?ins?))\b/i.test(text);
+}
+function parseRetryAfterMs(value, now = Date.now()) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return Math.max(0, value * 1e3);
+  }
+  if (typeof value !== "string" || !value.trim()) return null;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? Math.max(0, at - now) : null;
+}
+function clampAuthRateLimitDelay(retryAfterMs, remainingBudgetMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS) {
+  const requested = retryAfterMs ?? AUTH_RATE_LIMIT_FALLBACK_DELAY_MS;
+  return Math.max(
+    0,
+    Math.min(requested, AUTH_RATE_LIMIT_MAX_DELAY_MS, remainingBudgetMs)
+  );
+}
+async function retryAuthRateLimit(label, run, classify, {
+  maxAttempts = AUTH_RATE_LIMIT_MAX_ATTEMPTS,
+  maxTotalWaitMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS,
+  sleep: sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+} = {}) {
+  let result = await run();
+  let waitedMs = 0;
+  for (let attempt = 1; attempt < maxAttempts; attempt += 1) {
+    const signal = classify(result);
+    if (!signal.limited) return result;
+    const remaining = maxTotalWaitMs - waitedMs;
+    if (remaining <= 0) return result;
+    const delayMs = clampAuthRateLimitDelay(
+      parseRetryAfterMs(signal.retryAfter),
+      remaining
+    );
+    if (delayMs <= 0) return result;
+    console.log(
+      `[proof:retry] ${label} auth rate limited (attempt ${attempt}/${maxAttempts}) \u2014 retrying in ${delayMs}ms`
+    );
+    await sleep2(delayMs);
+    waitedMs += delayMs;
+    result = await run();
+  }
+  return result;
+}
+
+// src/server/fixture.ts
+function defineProofFixture(options) {
+  return Object.freeze({
+    table: options.table,
+    create: options.create
+  });
+}
+var ProofFixturePendingError = class extends Error {
+  constructor(table, reason) {
+    super(
+      `Fixture factory for "${table}" is incomplete: ${reason}. Complete e2e/fixtures/${table}.ts with values valid for the final schema.`
+    );
+    this.table = table;
+    this.reason = reason;
+    this.name = "ProofFixturePendingError";
+  }
+  table;
+  reason;
+  code = "fixture_factory_required";
+};
+function pendingProofFixture(table, reason = "the table schema and product constraints are not final") {
+  return defineProofFixture({
+    table,
+    async create() {
+      throw new ProofFixturePendingError(table, reason);
+    }
+  });
+}
+function isProofFixturePendingError(error) {
+  return error instanceof ProofFixturePendingError;
+}
+export {
+  AUTH_RATE_LIMIT_MAX_ATTEMPTS,
+  AUTH_RATE_LIMIT_MAX_DELAY_MS,
+  AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS,
+  ProofFixturePendingError,
+  clampAuthRateLimitDelay,
+  createProofServiceClient,
+  defineProofFixture,
+  isAuthRateLimited,
+  isProofFixturePendingError,
+  parseRetryAfterMs,
+  pendingProofFixture,
+  proofGuard,
+  retryAuthRateLimit,
+  seed
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/runtime-guard.ts","../src/server/service-client.ts","../src/server/transient.ts","../src/server/seed.ts","../src/server/auth-rate-limit.ts","../src/server/fixture.ts"],"sourcesContent":["// Import External Packages\nimport { NextResponse } from \"next/server.js\";\n// Import Local Imports\n// Import Core Dependencies\n// Import Shared Dependencies\n// Import Extension Dependencies\n\n// ---------------------------------------------------------------------------\n// Runtime guard for /api/proof/* routes.\n//\n// The Proof runtime endpoints (seed-login, later capabilities/schema) exist\n// only to support local verification runs and CI. They must never be usable\n// in production builds aimed at end users.\n//\n// Guarded by two gates:\n//   1. Environment: NODE_ENV === \"development\" OR PROOF_MODE === \"true\"\n//   2. Shared secret: x-proof-secret header must match API_SECRET_KEY\n//\n// The secret gate reuses the existing API_SECRET_KEY rather than introducing\n// a new env var — one fewer thing to configure per environment.\n// ---------------------------------------------------------------------------\n\ninterface GuardRejection {\n  error: string;\n  suggestion: string;\n}\n\n/**\n * Check whether a request is allowed to hit a /api/proof/* route.\n *\n * @returns `null` when the request may proceed, or a `Response` to return\n *          directly (403) when the request must be blocked.\n */\nexport function proofGuard(request: Request): Response | null {\n  const envOk =\n    process.env.NODE_ENV === \"development\" || process.env.PROOF_MODE === \"true\";\n\n  if (!envOk) {\n    return jsonError(403, {\n      error:\n        \"[PROOF_FAIL] guard_env: proof endpoints are disabled in this environment\",\n      suggestion:\n        \"Run against a dev server (NODE_ENV=development) or set PROOF_MODE=true on the server.\",\n    });\n  }\n\n  const expected = process.env.API_SECRET_KEY;\n  if (!expected) {\n    return jsonError(500, {\n      error: \"[PROOF_FAIL] guard_secret_missing: API_SECRET_KEY is not set\",\n      suggestion:\n        \"Set API_SECRET_KEY in the server environment. Proof helpers use it as the shared secret for /api/proof/* routes.\",\n    });\n  }\n\n  const provided = request.headers.get(\"x-proof-secret\");\n  if (provided !== expected) {\n    return jsonError(403, {\n      error:\n        \"[PROOF_FAIL] guard_secret: x-proof-secret header missing or invalid\",\n      suggestion:\n        \"The runner's API_SECRET_KEY does not match the dev server. If .env.local changed after the server started, restart that server; proof helpers already send the current key in x-proof-secret.\",\n    });\n  }\n\n  return null;\n}\n\nfunction jsonError(status: number, body: GuardRejection): Response {\n  return NextResponse.json(body, { status });\n}\n","// Import External Packages\nimport { createClient } from \"@supabase/supabase-js\";\n// Import Local Imports\nimport { createRetryingFetch } from \"./transient\";\n// Import Core Dependencies\n// Import Shared Dependencies\n// Import Extension Dependencies\n\n// ---------------------------------------------------------------------------\n// Thin re-export of the service-role Supabase client, scoped to Proof.\n//\n// Proof helpers use the service-role client for two things:\n//   1. Seed fixture setup (`seed.workspace`, `seed.user`)\n//   2. Teardown of test data after assertions complete\n//\n// Consumers inside `.proof.ts` specs receive the result of this factory\n// through the `setup({ sb })` callback of `assert.tenantIsolation`. They\n// should NEVER construct a service-role client themselves — keeping the\n// construction centralized makes it easy to add logging, usage limits, or\n// a future mock in one place.\n//\n// This package does not depend on an application's generated database types or\n// service-client wrapper. The factory reads the standard environment variables\n// directly and gives proof-specific diagnostics.\n// ---------------------------------------------------------------------------\n\nfunction requireProofEnv(name: string): string {\n  const value = process.env[name];\n  if (!value) {\n    throw new Error(\n      `[PROOF_FAIL] missing_env: expected ${name}, found empty\\n` +\n        \"  file: src/server/service-client.ts\\n\" +\n        \"  suggestion: Ensure CI exports the Supabase env vars before running pnpm proof:verify.\",\n    );\n  }\n  return value;\n}\n\n/**\n * Factory for a service-role Supabase client used inside Proof helpers and\n * `.proof.ts` spec files.\n *\n * Returns a service-role Supabase client so spec code can safely type the `sb`\n * parameter as the library's `SupabaseClient`.\n */\nexport function createProofServiceClient() {\n  return createClient(\n    requireProofEnv(\"NEXT_PUBLIC_SUPABASE_URL\"),\n    requireProofEnv(\"SUPABASE_SECRET_KEY\"),\n    {\n      auth: {\n        persistSession: false,\n        autoRefreshToken: false,\n        detectSessionInUrl: false,\n      },\n      // Local Supabase sits behind Kong, which intermittently 502s under the\n      // load of a proof run. Installing the retry here covers every query made\n      // through this client, including ad-hoc ones inside proof specs.\n      global: { fetch: createRetryingFetch(\"service-role request\") },\n    },\n  );\n}\n","// Import External Packages\n// Import Local Imports\n// Import Core Dependencies\n// Import Shared Dependencies\n// Import Extension Dependencies\n\n// ---------------------------------------------------------------------------\n// Transient-failure retry\n//\n// Local Supabase sits behind Kong. During a proof run — every spec seeding its\n// own fixtures through the service role, plus the dev server's own queries — the\n// gateway intermittently answers a request with a 502 whose body reads \"An\n// invalid response was received from the upstream server\", then serves the next\n// request normally. Roughly one local `proof:check` in two hit this, always on a\n// different spec.\n//\n// That noise is not evidence about the code under test, and it can hurt in two\n// ways:\n//\n//   1. A spurious red build. Worse than it sounds: a suite that fails half the\n//      time for reasons nobody controls teaches people to re-run until green,\n//      which is exactly the reflex that lets a real failure through.\n//   2. A false pass. Several probes read \"the actor's write returned an error and\n//      no row landed\" as proof of denial. A write that never reached PostgREST\n//      looks identical, so an unretried gateway error can certify an invariant\n//      that was never exercised. Callers use `isTransient` to refuse that\n//      reading.\n//\n// The retry lives at the transport (`createRetryingFetch`, installed on every\n// Supabase client the SDK hands out) rather than at each call site, because the\n// call sites that matter most are the ad-hoc queries inside `.proof.ts` specs —\n// there is no version of \"remember to wrap it\" that survives the next spec\n// somebody writes.\n//\n// It is bounded, announced on stdout, and deliberately narrow: only gateway\n// statuses (502/503/504) and transport-level failures qualify. A 4xx is the\n// database answering, and even a 500 is usually PostgREST or a route handler\n// answering; retrying either would turn a real failure into a slow real failure,\n// or worse, hide it.\n// ---------------------------------------------------------------------------\n\n/** The shape both `PostgrestError` and `AuthError` satisfy. */\nexport interface TransientErrorLike {\n  message?: string | null;\n  status?: number | null;\n  code?: string | null;\n}\n\n/**\n * Messages that mean \"the request did not reach the database\", matched because\n * Supabase surfaces gateway and transport failures as error text without a\n * usable status on every client path.\n */\nconst TRANSIENT_MESSAGES = [\n  /invalid response was received from the upstream server/i,\n  /upstream connect error/i,\n  /(service|server) (is )?temporarily unavailable/i,\n  /bad gateway/i,\n  /gateway time-?out/i,\n  /fetch failed/i,\n  /network( request)? failed/i,\n  /socket hang up/i,\n  /ECONNRESET|ECONNREFUSED|EPIPE|ETIMEDOUT|EAI_AGAIN|UND_ERR/,\n];\n\n/** Node wraps the real cause; the useful text is often one or two levels down. */\nfunction messageChain(error: unknown, depth = 0): string {\n  if (!error || depth > 3) return \"\";\n  if (typeof error === \"string\") return error;\n  const record = error as { message?: unknown; cause?: unknown };\n  const own = typeof record.message === \"string\" ? record.message : \"\";\n  return `${own} ${messageChain(record.cause, depth + 1)}`;\n}\n\n/**\n * Statuses the gateway returns when it could not get an answer out of the\n * upstream service. A 500 is excluded on purpose: PostgREST and our own route\n * handlers use it to report real failures.\n */\nexport const GATEWAY_STATUSES = new Set([502, 503, 504]);\n\n/**\n * True when a failure is infrastructure, not an answer.\n *\n * `status` is the HTTP status when the caller has it separately from the error\n * (PostgREST responses carry it alongside `error`; auth errors carry it inside).\n */\nexport function isTransient(\n  error: TransientErrorLike | null | undefined,\n  status?: number | null,\n): boolean {\n  if (!error) return false;\n  const httpStatus = status ?? error.status ?? null;\n  if (typeof httpStatus === \"number\") {\n    if (GATEWAY_STATUSES.has(httpStatus)) return true;\n    // Any other status is the stack answering — a denial, a validation error, an\n    // internal error — and each is a fact the proof is entitled to act on.\n    if (httpStatus >= 400) return false;\n  }\n  const text = messageChain(error);\n  return TRANSIENT_MESSAGES.some((pattern) => pattern.test(text));\n}\n\nexport const TRANSIENT_MAX_ATTEMPTS = 4;\nconst BASE_DELAY_MS = 150;\n\nfunction backoffMs(attempt: number): number {\n  return BASE_DELAY_MS * 2 ** (attempt - 1);\n}\n\nfunction announce(\n  label: string,\n  attempt: number,\n  maxAttempts: number,\n  reason: string,\n  delayMs: number,\n): void {\n  // Announced rather than silent: a suite that only goes green on its third\n  // attempt every time is a real problem, and hidden retries hide it.\n  console.log(\n    `[proof:retry] ${label} failed transiently (attempt ${attempt}/${maxAttempts}): ` +\n      `${reason} — retrying in ${delayMs}ms`,\n  );\n}\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * A `fetch` that retries gateway failures, for installing on a Supabase client\n * via `createClient(url, key, { global: { fetch } })`.\n *\n * Covers every request that client makes — PostgREST queries, auth admin calls,\n * RPC — including the ad-hoc ones written inside proof specs, which is the whole\n * reason the retry lives here instead of at the call sites.\n *\n * Retrying a write is safe here only because gateway failures mean the request\n * did not reach PostgREST; a request carrying a stream body is never retried,\n * since it cannot be replayed and we cannot know how far it got.\n */\nexport function createRetryingFetch(\n  label: string,\n  baseFetch: typeof fetch = fetch,\n  { maxAttempts = TRANSIENT_MAX_ATTEMPTS } = {},\n): typeof fetch {\n  return async (input, init) => {\n    const replayable =\n      init?.body == null ||\n      typeof init.body === \"string\" ||\n      init.body instanceof URLSearchParams;\n\n    for (let attempt = 1; ; attempt++) {\n      const lastAttempt = attempt >= maxAttempts || !replayable;\n      try {\n        const response = await baseFetch(input, init);\n        if (lastAttempt || !GATEWAY_STATUSES.has(response.status)) {\n          return response;\n        }\n        const delayMs = backoffMs(attempt);\n        announce(\n          label,\n          attempt,\n          maxAttempts,\n          `HTTP ${response.status}`,\n          delayMs,\n        );\n        await sleep(delayMs);\n      } catch (error) {\n        if (lastAttempt || !isTransient(error as TransientErrorLike))\n          throw error;\n        const delayMs = backoffMs(attempt);\n        announce(\n          label,\n          attempt,\n          maxAttempts,\n          messageChain(error).trim() || \"transport failure\",\n          delayMs,\n        );\n        await sleep(delayMs);\n      }\n    }\n  };\n}\n\n/**\n * Retry a call that reports failure in its result rather than by throwing.\n *\n * For anything going through a Supabase client, prefer `createRetryingFetch` —\n * it is already installed. This is for the surfaces that do not use it, such as\n * Playwright's `APIRequestContext`.\n *\n * `run` must build the request from scratch on each call: a PostgREST builder is\n * a one-shot thenable, so re-awaiting the same object does not re-issue it.\n *\n * The final result is returned as-is — including a still-failing error — because\n * the caller owns the diagnostics. Nothing here throws, and nothing here decides\n * what a failure means.\n */\nexport async function retryTransient<\n  T extends { error?: TransientErrorLike | null; status?: number },\n>(\n  label: string,\n  // `PromiseLike`, not `Promise`: a PostgREST builder is a thenable, and typing\n  // this as `Promise<T>` makes inference fall back to the constraint, which\n  // erases `data` and `count` from the caller's result.\n  run: () => PromiseLike<T>,\n  { maxAttempts = TRANSIENT_MAX_ATTEMPTS } = {},\n): Promise<T> {\n  let result = await run();\n\n  for (let attempt = 1; attempt < maxAttempts; attempt++) {\n    if (!isTransient(result.error, result.status)) return result;\n    const delayMs = backoffMs(attempt);\n    announce(\n      label,\n      attempt,\n      maxAttempts,\n      result.error?.message ?? \"unknown error\",\n      delayMs,\n    );\n    await sleep(delayMs);\n    result = await run();\n  }\n\n  return result;\n}\n","// Import External Packages\n// Import Local Imports\nimport { createProofServiceClient } from \"./service-client\";\nimport { isTransient, TRANSIENT_MAX_ATTEMPTS } from \"./transient\";\n// Import Core Dependencies\n// Import Shared Dependencies\n// Import Extension Dependencies\n\n// ---------------------------------------------------------------------------\n// seed.workspace / seed.user\n//\n// Fixture helpers used by `.proof.ts` specs and by `assert.tenantIsolation`\n// to set up isolated test data. They bypass the business-logic pipeline on\n// purpose: creating fixtures should not exercise the very actions we are\n// trying to verify. Instead we insert directly via the service-role client.\n//\n// Both helpers are idempotent on upsert conflicts is NOT implemented; callers\n// are responsible for passing unique names/emails (`assert.tenantIsolation`\n// uses a short random suffix).\n// ---------------------------------------------------------------------------\n\nexport interface SeedWorkspace {\n  id: string;\n  name: string;\n  ownerId: string | null;\n}\n\nexport interface SeedUser {\n  id: string;\n  email: string;\n  password: string;\n  workspaceId: string;\n  role: \"owner\" | \"admin\" | \"member\" | \"viewer\";\n  /**\n   * `workspace_members.id` for this user's membership row in `workspaceId`.\n   * Needed by proofs that invoke actions keyed on the membership (e.g.\n   * `removeMember` takes `memberId = workspace_members.id`, not user_id).\n   */\n  membershipId: string;\n}\n\nfunction failProof(\n  category: string,\n  expected: string,\n  found: string,\n  suggestion = `Check that Supabase is running (pnpm exec supabase status) and that SUPABASE_SECRET_KEY is set in .env.local.`,\n): never {\n  throw new Error(\n    `[PROOF_FAIL] ${category}: expected ${expected}, found ${found}\\n` +\n      `  file: src/server/seed.ts\\n` +\n      `  suggestion: ${suggestion}`,\n  );\n}\n\n/**\n * Fixture setup that failed because the gateway never answered is reported as\n * infrastructure. Otherwise the operator reads \"expected a workspace row to be\n * created\" and goes looking for a broken migration.\n */\nfunction failSeed(\n  category: string,\n  expected: string,\n  found: string,\n  error: { message?: string | null; status?: number | null } | null | undefined,\n  status?: number,\n): never {\n  if (isTransient(error, status)) {\n    failProof(\n      `${category}_transient`,\n      expected,\n      `${found} — still failing after ${TRANSIENT_MAX_ATTEMPTS} attempts`,\n      `This is a gateway/transport failure, not a schema problem: the request never reached Postgres. ` +\n        `Check that the local Supabase stack is healthy (pnpm exec supabase status) and is not restarting mid-run.`,\n    );\n  }\n  failProof(category, expected, found);\n}\n\n/**\n * Wait until `public.users` has a row for the given `userId`.\n *\n * `supabase.auth.admin.createUser` creates a row in `auth.users`, which fires\n * the `handle_new_user` trigger that inserts into `public.users`. Postgres\n * runs the trigger inside the same transaction as the INSERT, so the row\n * exists the moment the admin API's HTTP call returns — in theory.\n *\n * In practice the admin API occasionally returns before the post-commit\n * visibility window has settled, and the very next `workspace_members`\n * INSERT fails its FK to `public.users(id)`. This poll closes that window\n * deterministically: short, bounded, ~500ms worst case. A real failure\n * still surfaces with a structured [PROOF_FAIL] so the race is not masked.\n *\n * Note: `workspace_members.user_id` FKs to `public.users(id)`, NOT\n * `auth.users`. The value is the same UUID because `handle_new_user`\n * copies it, but the FK target matters if future migrations ever split\n * them.\n */\nasync function waitForPublicUser(\n  sb: ReturnType<typeof createProofServiceClient>,\n  userId: string,\n  email: string,\n): Promise<void> {\n  const maxAttempts = 10;\n  const delayMs = 50;\n  for (let i = 0; i < maxAttempts; i++) {\n    const { data } = await sb\n      .from(\"users\")\n      .select(\"id\")\n      .eq(\"id\", userId)\n      .maybeSingle();\n    if (data) return;\n    await new Promise((r) => setTimeout(r, delayMs));\n  }\n  failProof(\n    \"seed_user_trigger\",\n    `public.users row for ${email} (id ${userId}) within ${maxAttempts * delayMs}ms`,\n    \"row still missing — the handle_new_user trigger did not materialize the public.users mirror row\",\n  );\n}\n\nexport const seed = {\n  /**\n   * Create a workspace with no owner. Use `seed.user({ workspace, role: \"owner\" })`\n   * afterwards to attach an owner. Returns the inserted row.\n   *\n   * Bypasses RLS via the service-role client, so it works even when no user\n   * is authenticated.\n   */\n  async workspace(name: string): Promise<SeedWorkspace> {\n    const sb = createProofServiceClient();\n\n    const { data, error, status } = await sb\n      .from(\"workspaces\")\n      .insert({\n        name,\n        type: \"team\",\n      })\n      .select(\"id, name, owner_id\")\n      .single();\n\n    if (error || !data) {\n      failSeed(\n        \"seed_workspace\",\n        \"a workspace row to be created\",\n        `insert error: ${error?.message ?? \"no row returned\"}`,\n        error,\n        status,\n      );\n    }\n\n    return {\n      id: data.id,\n      name: data.name,\n      ownerId: data.owner_id,\n    };\n  },\n\n  /**\n   * Create an auth user with the given credentials and attach them to the\n   * provided workspace with the given role. Relies on the `handle_new_user`\n   * trigger to mirror the row into `public.users` automatically.\n   */\n  async user(opts: {\n    email: string;\n    password: string;\n    workspace: SeedWorkspace;\n    role: \"owner\" | \"admin\" | \"member\" | \"viewer\";\n  }): Promise<SeedUser> {\n    const sb = createProofServiceClient();\n\n    const { data: userData, error: createErr } = await sb.auth.admin.createUser(\n      {\n        email: opts.email,\n        password: opts.password,\n        email_confirm: true,\n      },\n    );\n\n    if (createErr || !userData?.user) {\n      failSeed(\n        \"seed_user_auth\",\n        `auth user to be created for ${opts.email}`,\n        `admin.createUser error: ${createErr?.message ?? \"no user returned\"}`,\n        createErr,\n      );\n    }\n\n    const userId = userData.user.id;\n\n    // `workspace_members.user_id` references `public.users(id)`, not\n    // `auth.users`. The `handle_new_user` trigger mirrors the row on\n    // `auth.users` INSERT; poll briefly to rule out any post-commit\n    // visibility race before the FK insert below.\n    await waitForPublicUser(sb, userId, opts.email);\n\n    const {\n      data: memberRow,\n      error: memberErr,\n      status: memberStatus,\n    } = await sb\n      .from(\"workspace_members\")\n      .insert({\n        workspace_id: opts.workspace.id,\n        user_id: userId,\n        role: opts.role,\n      })\n      .select(\"id\")\n      .single();\n\n    if (memberErr || !memberRow) {\n      failSeed(\n        \"seed_user_membership\",\n        `workspace_members row for user ${opts.email} in workspace ${opts.workspace.id}`,\n        `insert error: ${memberErr?.message ?? \"no row returned\"}`,\n        memberErr,\n        memberStatus,\n      );\n    }\n\n    return {\n      id: userId,\n      email: opts.email,\n      password: opts.password,\n      workspaceId: opts.workspace.id,\n      role: opts.role,\n      membershipId: memberRow.id,\n    };\n  },\n\n  /**\n   * Delete a workspace and cascade-clean its members. Used by helpers for\n   * teardown. Safe to call on a workspace that no longer exists.\n   */\n  async deleteWorkspace(workspaceId: string): Promise<void> {\n    const sb = createProofServiceClient();\n    await sb.from(\"workspaces\").delete().eq(\"id\", workspaceId);\n  },\n\n  /**\n   * Delete an auth user (cascades to public.users and workspace_members via\n   * the schema's ON DELETE CASCADE). Safe to call if the user no longer\n   * exists.\n   */\n  async deleteUser(userId: string): Promise<void> {\n    const sb = createProofServiceClient();\n    await sb.auth.admin.deleteUser(userId);\n  },\n};\n","// ---------------------------------------------------------------------------\n// Bounded authentication rate-limit retry.\n//\n// HTTP 429 is neither a product verdict nor a transient gateway failure. Proof\n// login may retry it briefly, honoring Retry-After within a strict budget; once\n// exhausted it remains an explicit auth_rate_limited infrastructure diagnosis.\n// ---------------------------------------------------------------------------\n\nexport interface AuthRateLimitErrorLike {\n  message?: string | null;\n  status?: number | null;\n}\n\nexport const AUTH_RATE_LIMIT_MAX_ATTEMPTS = 3;\nexport const AUTH_RATE_LIMIT_MAX_DELAY_MS = 5_000;\nexport const AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS = 10_000;\nconst AUTH_RATE_LIMIT_FALLBACK_DELAY_MS = 1_000;\n\nexport function isAuthRateLimited(\n  error: AuthRateLimitErrorLike | null | undefined,\n  status?: number | null,\n  body?: string | null,\n): boolean {\n  const httpStatus = status ?? error?.status ?? null;\n  if (httpStatus === 429) return true;\n  if (typeof httpStatus === \"number\" && httpStatus >= 400) return false;\n\n  const text = `${error?.message ?? \"\"} ${body ?? \"\"}`;\n  return (\n    /\\[PROOF_FAIL\\]\\s*(auth_)?rate_limited:/i.test(text) ||\n    /\\b(rate limit|too many (requests|attempts|sign-?ins?))\\b/i.test(text)\n  );\n}\n\nexport function parseRetryAfterMs(\n  value: string | number | null | undefined,\n  now = Date.now(),\n): number | null {\n  if (typeof value === \"number\" && Number.isFinite(value)) {\n    return Math.max(0, value * 1_000);\n  }\n  if (typeof value !== \"string\" || !value.trim()) return null;\n\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n\n  const at = Date.parse(value);\n  return Number.isFinite(at) ? Math.max(0, at - now) : null;\n}\n\nexport function clampAuthRateLimitDelay(\n  retryAfterMs: number | null,\n  remainingBudgetMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS,\n): number {\n  const requested = retryAfterMs ?? AUTH_RATE_LIMIT_FALLBACK_DELAY_MS;\n  return Math.max(\n    0,\n    Math.min(requested, AUTH_RATE_LIMIT_MAX_DELAY_MS, remainingBudgetMs),\n  );\n}\n\nexport async function retryAuthRateLimit<T>(\n  label: string,\n  run: () => PromiseLike<T>,\n  classify: (result: T) => {\n    limited: boolean;\n    retryAfter?: string | number | null;\n  },\n  {\n    maxAttempts = AUTH_RATE_LIMIT_MAX_ATTEMPTS,\n    maxTotalWaitMs = AUTH_RATE_LIMIT_MAX_TOTAL_WAIT_MS,\n    sleep = (ms: number) =>\n      new Promise<void>((resolve) => setTimeout(resolve, ms)),\n  } = {},\n): Promise<T> {\n  let result = await run();\n  let waitedMs = 0;\n\n  for (let attempt = 1; attempt < maxAttempts; attempt += 1) {\n    const signal = classify(result);\n    if (!signal.limited) return result;\n\n    const remaining = maxTotalWaitMs - waitedMs;\n    if (remaining <= 0) return result;\n    const delayMs = clampAuthRateLimitDelay(\n      parseRetryAfterMs(signal.retryAfter),\n      remaining,\n    );\n    if (delayMs <= 0) return result;\n\n    console.log(\n      `[proof:retry] ${label} auth rate limited (attempt ${attempt}/${maxAttempts}) — retrying in ${delayMs}ms`,\n    );\n    await sleep(delayMs);\n    waitedMs += delayMs;\n    result = await run();\n  }\n\n  return result;\n}\n","// Import External Packages\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\n// Import Local Imports\nimport type { SeedUser, SeedWorkspace } from \"./seed\";\n// Import Core Dependencies\n// Import Shared Dependencies\n// Import Extension Dependencies\n\n/**\n * Seed handles available to a tenant-isolation fixture factory.\n *\n * A factory normally inserts one row for each side so the helper can prove both\n * isolation directions. It may use fewer handles when the table is user-scoped\n * or when an existing seeded workspace/user row is itself the fixture.\n */\nexport interface ProofFixtureContext {\n  orgA: SeedWorkspace;\n  orgB: SeedWorkspace;\n  userA: SeedUser;\n  userB: SeedUser;\n  sb: SupabaseClient;\n}\n\n/**\n * Explicit, table-owned setup contract for a Proof fixture.\n *\n * Keep factories under `e2e/fixtures/<table>.ts`. The table name is repeated at\n * runtime so a copied factory cannot silently seed one table while a proof\n * probes another.\n */\nexport interface ProofFixtureFactory<TTable extends string = string> {\n  readonly table: TTable;\n  create(context: ProofFixtureContext): Promise<void>;\n}\n\nexport interface DefineProofFixtureOptions<TTable extends string> {\n  table: TTable;\n  create(context: ProofFixtureContext): Promise<void>;\n}\n\n/** Define a completed, explicit fixture factory. */\nexport function defineProofFixture<const TTable extends string>(\n  options: DefineProofFixtureOptions<TTable>,\n): ProofFixtureFactory<TTable> {\n  return Object.freeze({\n    table: options.table,\n    create: options.create,\n  });\n}\n\n/**\n * Error used when a proof exists before its table's valid fixture shape is\n * known. `assert.tenantIsolation` recognizes it and records an incomplete\n * assertion rather than allowing the missing setup to look green.\n */\nexport class ProofFixturePendingError extends Error {\n  readonly code = \"fixture_factory_required\";\n\n  constructor(\n    readonly table: string,\n    readonly reason: string,\n  ) {\n    super(\n      `Fixture factory for \"${table}\" is incomplete: ${reason}. Complete e2e/fixtures/${table}.ts with values valid for the final schema.`,\n    );\n    this.name = \"ProofFixturePendingError\";\n  }\n}\n\n/**\n * Declare the intentional pre-schema state of a fixture.\n *\n * The builder replaces this with `defineProofFixture(...)` after migrations\n * settle. Until then the proof remains explicitly incomplete.\n */\nexport function pendingProofFixture<const TTable extends string>(\n  table: TTable,\n  reason = \"the table schema and product constraints are not final\",\n): ProofFixtureFactory<TTable> {\n  return defineProofFixture({\n    table,\n    async create() {\n      throw new ProofFixturePendingError(table, reason);\n    },\n  });\n}\n\nexport function isProofFixturePendingError(\n  error: unknown,\n): error is ProofFixturePendingError {\n  return error instanceof ProofFixturePendingError;\n}\n"],"mappings":";AACA,SAAS,oBAAoB;AAgCtB,SAAS,WAAW,SAAmC;AAC5D,QAAM,QACJ,QAAQ,IAAI,aAAa,iBAAiB,QAAQ,IAAI,eAAe;AAEvE,MAAI,CAAC,OAAO;AACV,WAAO,UAAU,KAAK;AAAA,MACpB,OACE;AAAA,MACF,YACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AACb,WAAO,UAAU,KAAK;AAAA,MACpB,OAAO;AAAA,MACP,YACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;AACrD,MAAI,aAAa,UAAU;AACzB,WAAO,UAAU,KAAK;AAAA,MACpB,OACE;AAAA,MACF,YACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,QAAgB,MAAgC;AACjE,SAAO,aAAa,KAAK,MAAM,EAAE,OAAO,CAAC;AAC3C;;;ACrEA,SAAS,oBAAoB;;;ACoD7B,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,aAAa,OAAgB,QAAQ,GAAW;AACvD,MAAI,CAAC,SAAS,QAAQ,EAAG,QAAO;AAChC,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS;AACf,QAAM,MAAM,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAClE,SAAO,GAAG,GAAG,IAAI,aAAa,OAAO,OAAO,QAAQ,CAAC,CAAC;AACxD;AAOO,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AAQhD,SAAS,YACd,OACA,QACS;AACT,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,UAAU,MAAM,UAAU;AAC7C,MAAI,OAAO,eAAe,UAAU;AAClC,QAAI,iBAAiB,IAAI,UAAU,EAAG,QAAO;AAG7C,QAAI,cAAc,IAAK,QAAO;AAAA,EAChC;AACA,QAAM,OAAO,aAAa,KAAK;AAC/B,SAAO,mBAAmB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAChE;AAEO,IAAM,yBAAyB;AACtC,IAAM,gBAAgB;AAEtB,SAAS,UAAU,SAAyB;AAC1C,SAAO,gBAAgB,MAAM,UAAU;AACzC;AAEA,SAAS,SACP,OACA,SACA,aACA,QACA,SACM;AAGN,UAAQ;AAAA,IACN,iBAAiB,KAAK,gCAAgC,OAAO,IAAI,WAAW,MACvE,MAAM,uBAAkB,OAAO;AAAA,EACtC;AACF;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAcvE,SAAS,oBACd,OACA,YAA0B,OAC1B,EAAE,cAAc,uBAAuB,IAAI,CAAC,GAC9B;AACd,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,aACJ,MAAM,QAAQ,QACd,OAAO,KAAK,SAAS,YACrB,KAAK,gBAAgB;AAEvB,aAAS,UAAU,KAAK,WAAW;AACjC,YAAM,cAAc,WAAW,eAAe,CAAC;AAC/C,UAAI;AACF,cAAM,WAAW,MAAM,UAAU,OAAO,IAAI;AAC5C,YAAI,eAAe,CAAC,iBAAiB,IAAI,SAAS,MAAM,GAAG;AACzD,iBAAO;AAAA,QACT;AACA,cAAM,UAAU,UAAU,OAAO;AACjC;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,SAAS,MAAM;AAAA,UACvB;AAAA,QACF;AACA,cAAM,MAAM,OAAO;AAAA,MACrB,SAAS,OAAO;AACd,YAAI,eAAe,CAAC,YAAY,KAA2B;AACzD,gBAAM;AACR,cAAM,UAAU,UAAU,OAAO;AACjC;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,KAAK,EAAE,KAAK,KAAK;AAAA,UAC9B;AAAA,QACF;AACA,cAAM,MAAM,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;;;AD3JA,SAAS,gBAAgB,MAAsB;AAC7C,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,sCAAsC,IAAI;AAAA;AAAA;AAAA,IAG5C;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,2BAA2B;AACzC,SAAO;AAAA,IACL,gBAAgB,0BAA0B;AAAA,IAC1C,gBAAgB,qBAAqB;AAAA,IACrC;AAAA,MACE,MAAM;AAAA,QACJ,gBAAgB;AAAA,QAChB,kBAAkB;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA;AAAA;AAAA;AAAA,MAIA,QAAQ,EAAE,OAAO,oBAAoB,sBAAsB,EAAE;AAAA,IAC/D;AAAA,EACF;AACF;;;AEpBA,SAAS,UACP,UACA,UACA,OACA,aAAa,iHACN;AACP,QAAM,IAAI;AAAA,IACR,gBAAgB,QAAQ,cAAc,QAAQ,WAAW,KAAK;AAAA;AAAA,gBAE3C,UAAU;AAAA,EAC/B;AACF;AAOA,SAAS,SACP,UACA,UACA,OACA,OACA,QACO;AACP,MAAI,YAAY,OAAO,MAAM,GAAG;AAC9B;AAAA,MACE,GAAG,QAAQ;AAAA,MACX;AAAA,MACA,GAAG,KAAK,+BAA0B,sBAAsB;AAAA,MACxD;AAAA,IAEF;AAAA,EACF;AACA,YAAU,UAAU,UAAU,KAAK;AACrC;AAqBA,eAAe,kBACb,IACA,QACA,OACe;AACf,QAAM,cAAc;AACpB,QAAM,UAAU;AAChB,WAAS,IAAI,GAAG,IAAI,aAAa,KAAK;AACpC,UAAM,EAAE,KAAK,IAAI,MAAM,GACpB,KAAK,OAAO,EACZ,OAAO,IAAI,EACX,GAAG,MAAM,MAAM,EACf,YAAY;AACf,QAAI,KAAM;AACV,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAAA,EACjD;AACA;AAAA,IACE;AAAA,IACA,wBAAwB,KAAK,QAAQ,MAAM,YAAY,cAAc,OAAO;AAAA,IAC5E;AAAA,EACF;AACF;AAEO,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,MAAM,UAAU,MAAsC;AACpD,UAAM,KAAK,yBAAyB;AAEpC,UAAM,EAAE,MAAM,OAAO,OAAO,IAAI,MAAM,GACnC,KAAK,YAAY,EACjB,OAAO;AAAA,MACN;AAAA,MACA,MAAM;AAAA,IACR,CAAC,EACA,OAAO,oBAAoB,EAC3B,OAAO;AAEV,QAAI,SAAS,CAAC,MAAM;AAClB;AAAA,QACE;AAAA,QACA;AAAA,QACA,iBAAiB,OAAO,WAAW,iBAAiB;AAAA,QACpD;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,MAKW;AACpB,UAAM,KAAK,yBAAyB;AAEpC,UAAM,EAAE,MAAM,UAAU,OAAO,UAAU,IAAI,MAAM,GAAG,KAAK,MAAM;AAAA,MAC/D;AAAA,QACE,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,eAAe;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,aAAa,CAAC,UAAU,MAAM;AAChC;AAAA,QACE;AAAA,QACA,+BAA+B,KAAK,KAAK;AAAA,QACzC,2BAA2B,WAAW,WAAW,kBAAkB;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,SAAS,KAAK;AAM7B,UAAM,kBAAkB,IAAI,QAAQ,KAAK,KAAK;AAE9C,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,IACV,IAAI,MAAM,GACP,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACN,cAAc,KAAK,UAAU;AAAA,MAC7B,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,IACb,CAAC,EACA,OAAO,IAAI,EACX,OAAO;AAEV,QAAI,aAAa,CAAC,WAAW;AAC3B;AAAA,QACE;AAAA,QACA,kCAAkC,KAAK,KAAK,iBAAiB,KAAK,UAAU,EAAE;AAAA,QAC9E,iBAAiB,WAAW,WAAW,iBAAiB;AAAA,QACxD;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,aAAa,KAAK,UAAU;AAAA,MAC5B,MAAM,KAAK;AAAA,MACX,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAoC;AACxD,UAAM,KAAK,yBAAyB;AACpC,UAAM,GAAG,KAAK,YAAY,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,QAA+B;AAC9C,UAAM,KAAK,yBAAyB;AACpC,UAAM,GAAG,KAAK,MAAM,WAAW,MAAM;AAAA,EACvC;AACF;;;AC1OO,IAAM,+BAA+B;AACrC,IAAM,+BAA+B;AACrC,IAAM,oCAAoC;AACjD,IAAM,oCAAoC;AAEnC,SAAS,kBACd,OACA,QACA,MACS;AACT,QAAM,aAAa,UAAU,OAAO,UAAU;AAC9C,MAAI,eAAe,IAAK,QAAO;AAC/B,MAAI,OAAO,eAAe,YAAY,cAAc,IAAK,QAAO;AAEhE,QAAM,OAAO,GAAG,OAAO,WAAW,EAAE,IAAI,QAAQ,EAAE;AAClD,SACE,0CAA0C,KAAK,IAAI,KACnD,4DAA4D,KAAK,IAAI;AAEzE;AAEO,SAAS,kBACd,OACA,MAAM,KAAK,IAAI,GACA;AACf,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,KAAK,IAAI,GAAG,QAAQ,GAAK;AAAA,EAClC;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,EAAG,QAAO;AAEvD,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,OAAO,SAAS,OAAO,EAAG,QAAO,KAAK,IAAI,GAAG,UAAU,GAAK;AAEhE,QAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,SAAO,OAAO,SAAS,EAAE,IAAI,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI;AACvD;AAEO,SAAS,wBACd,cACA,oBAAoB,mCACZ;AACR,QAAM,YAAY,gBAAgB;AAClC,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,IAAI,WAAW,8BAA8B,iBAAiB;AAAA,EACrE;AACF;AAEA,eAAsB,mBACpB,OACA,KACA,UAIA;AAAA,EACE,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,OAAAA,SAAQ,CAAC,OACP,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAC1D,IAAI,CAAC,GACO;AACZ,MAAI,SAAS,MAAM,IAAI;AACvB,MAAI,WAAW;AAEf,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW,GAAG;AACzD,UAAM,SAAS,SAAS,MAAM;AAC9B,QAAI,CAAC,OAAO,QAAS,QAAO;AAE5B,UAAM,YAAY,iBAAiB;AACnC,QAAI,aAAa,EAAG,QAAO;AAC3B,UAAM,UAAU;AAAA,MACd,kBAAkB,OAAO,UAAU;AAAA,MACnC;AAAA,IACF;AACA,QAAI,WAAW,EAAG,QAAO;AAEzB,YAAQ;AAAA,MACN,iBAAiB,KAAK,+BAA+B,OAAO,IAAI,WAAW,wBAAmB,OAAO;AAAA,IACvG;AACA,UAAMA,OAAM,OAAO;AACnB,gBAAY;AACZ,aAAS,MAAM,IAAI;AAAA,EACrB;AAEA,SAAO;AACT;;;AC1DO,SAAS,mBACd,SAC6B;AAC7B,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;AAOO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YACW,OACA,QACT;AACA;AAAA,MACE,wBAAwB,KAAK,oBAAoB,MAAM,2BAA2B,KAAK;AAAA,IACzF;AALS;AACA;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EAPW;AAAA,EACA;AAAA,EAJF,OAAO;AAWlB;AAQO,SAAS,oBACd,OACA,SAAS,0DACoB;AAC7B,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,MAAM,SAAS;AACb,YAAM,IAAI,yBAAyB,OAAO,MAAM;AAAA,IAClD;AAAA,EACF,CAAC;AACH;AAEO,SAAS,2BACd,OACmC;AACnC,SAAO,iBAAiB;AAC1B;","names":["sleep"]}

package/dist/shared.d.ts

@@ -0,0 +1,169 @@
+import { A as AppliedBy, M as ModuleKind } from './trace-types-DkIzq-l9.js';
+export { b as APPLIED_BY, c as ASSERTION_ROLE_ALIASES, d as AssertionRole, e as AssertionStatus, f as MODULE_KINDS, P as PROOF_KINDS, g as PROOF_VERBS, h as ProofKind, i as ProofOperation, j as ProofOptions, k as ProofVerb, R as RLS_CLASSIFICATIONS, l as RlsClassification, S as StepOptions, m as StepResult, n as TRACE_ARTIFACT_SCHEMA_VERSION, T as TraceArtifact, a as TraceAssertion, o as TraceMutation, p as TraceRecorder, q as TraceStep, r as isAppliedBy, s as isModuleKind, t as isProofKind, u as isProofVerb, v as isRlsClassification, w as normalizeAssertionRole, x as normalizeAssertionStatus } from './trace-types-DkIzq-l9.js';
+export { A as ActionResult, I as InvokeActionRequest } from './action-types-C3OmHRyH.js';
+export { C as CapabilityRequirement, M as MISSION_MANIFEST_SCHEMA_VERSION, a as MissionManifest, b as MissionRequirements, S as SchemaRequirement, T as TraceRequirement, c as ValidationCategory, d as ValidationIssue, V as ValidationResult } from './mission-types-Dr5rBHYO.js';
+export { TENANT_ISOLATION_ACTION_HELPERS, TENANT_ISOLATION_TABLE_HELPERS } from './portable-vocabulary.js';
+
+declare const MODULE_DESCRIPTOR_SCHEMA_VERSION = 1;
+/**
+ * Where a buyer's answer has to land, so the code agent that applies it does
+ * not have to rediscover the seams — and so a rename breaks CI instead of
+ * quietly misleading the next agent.
+ *
+ * Two forms, both checkable:
+ *
+ *   "app/__core/legal-notices/src/pages/imprint.tsx"        — the file must exist
+ *   "app/__core/user-auth/src/config.ts#MFA_POLICY"         — ...and contain that identifier
+ *
+ * Seams routinely sit **outside** the declaring module. Answering "we do not
+ * need an Impressum" touches the page, its route, the shared footer and
+ * `llm.txt`; an agent that only knows about `legal-notices` deletes one of the
+ * four and leaves three links pointing at a 404. That is the whole reason this
+ * field exists.
+ */
+type ModuleSeam = string;
+/**
+ * Something the buyer chooses between before this module can be used.
+ *
+ * Declared by the module rather than known by the planner, so a planner's
+ * context stays flat as the library grows from one extension to thirty.
+ *
+ * **A question the buyer cannot answer does not belong here.** Anything needing
+ * technical judgement is a `ModuleDefault` and we own it; asking a dentist
+ * about webhook retry semantics is not consultation, it is abdication.
+ */
+interface ModuleDecision {
+    /** snake_case, unique across every module. A planner keys answers by it. */
+    id: string;
+    /** In the buyer's language. They must be able to answer it unaided. */
+    ask: string;
+    /** Why it is being asked, in terms of what changes for them. */
+    because: string;
+    options: {
+        value: string;
+        /** What choosing this gets them, again in their language. */
+        means: string;
+    }[];
+    /** How the answer reaches the code. The planner's cost signal. */
+    applied_by: AppliedBy;
+    /** Every place the answer lands. Checked to still exist. */
+    applies: ModuleSeam[];
+}
+/**
+ * A value the buyer supplies rather than picks — a legal name, a domain, a
+ * support address.
+ *
+ * Separate from `decisions` because these are not choices and forcing them into
+ * one would mean options that are not options. Separate from `defaults` because
+ * nothing can be built until they exist: this is the planner's answer to "what
+ * must I collect before I dispatch anything?".
+ */
+interface ModuleInput {
+    /** snake_case, unique across every module. */
+    id: string;
+    /** In the buyer's language. */
+    ask: string;
+    /** What breaks or looks wrong if it is left as shipped. */
+    because: string;
+    /** A concrete illustration, so nobody has to guess the format. */
+    example: string;
+    /** False when the template's placeholder is survivable for a while. */
+    required: boolean;
+    applies: ModuleSeam[];
+}
+/**
+ * Something we decided on the buyer's behalf.
+ *
+ * Recorded rather than asked, so a planner can answer "what else could change?"
+ * without putting a question in front of someone who has no opinion on invite
+ * expiry windows. The code agent gets the seam either way.
+ */
+interface ModuleDefault {
+    /** snake_case, unique across every module. */
+    id: string;
+    /** What the template does today, in one plain sentence. */
+    is: string;
+    /** Where it is set. Checked to still exist. */
+    where: ModuleSeam;
+}
+/**
+ * The declared half — everything a person writes. The derived half is added by
+ * `proof-harness modules`.
+ */
+interface ModuleMeta {
+    /** Directory name. Checked against where the file sits. */
+    id: string;
+    kind: ModuleKind;
+    /**
+     * What this is for, in a sentence a buyer would recognise.
+     *
+     * The field a planner leans on hardest and the only one nothing can verify —
+     * so it is short, and reviewed whenever the module changes.
+     */
+    purpose: string;
+    /**
+     * Environment variables this module needs.
+     *
+     * Declared rather than derived because need is transitive: the notification
+     * system reaches Resend through `@shared/email`, so no grep of its own source
+     * finds `RESEND_API_KEY`. Checked against `.env.local.example`, and anything
+     * the module reads directly must appear here.
+     */
+    env: string[];
+    decisions: ModuleDecision[];
+    inputs: ModuleInput[];
+    defaults: ModuleDefault[];
+}
+/**
+ * A descriptor plus everything the scanner read from the source.
+ *
+ * This is what lands in `.proof/modules.json` and what a planner actually
+ * reads. Nothing below `purpose` is hand-written.
+ */
+interface ScannedModule extends ModuleMeta {
+    /** Repo-relative, `/` separators. */
+    path: string;
+    /** Tables this module's own migrations create. */
+    entities: string[];
+    /** Core / extension / business modules it imports. Never declared. */
+    requires: string[];
+    /** Shared utilities it imports. Not installable, so not a dependency to order. */
+    uses_shared: string[];
+    /** From `capabilities.json`: what this module can be asked to do. */
+    actions: {
+        name: string;
+        verb: string | null;
+        object: string | null;
+    }[];
+    /**
+     * How battle-tested it is. Derived, and eventually the reason an installed
+     * module costs a buyer less than a built one: somebody has already shown
+     * these checks can fail.
+     */
+    proven: {
+        specs: number;
+        mutations: number;
+    };
+}
+/**
+ * The generated artifact. Deterministic and unordered-by-nothing: every list is
+ * sorted and there is no timestamp, so two runs on one tree are byte-identical.
+ */
+interface ModulesArtifact {
+    schemaVersion: number;
+    modules: ScannedModule[];
+    /**
+     * Tables no descriptor claims — today the ones owned by `__shared` modules,
+     * which are utilities nobody installs and so carry no descriptor.
+     *
+     * Listed rather than omitted. A planner that cannot see `audit_logs` will
+     * eventually promise to build it.
+     */
+    unowned_tables: {
+        table: string;
+        module: string;
+        path: string;
+    }[];
+}
+
+export { AppliedBy, MODULE_DESCRIPTOR_SCHEMA_VERSION, type ModuleDecision, type ModuleDefault, type ModuleInput, ModuleKind, type ModuleMeta, type ModuleSeam, type ModulesArtifact, type ScannedModule };