seamless-cli 0.10.2 → 0.12.1

package/verify/harness/lib/env.ts

@@ -4,6 +4,10 @@ import { randomInt, randomUUID } from 'crypto';
 
 export const API_URL = process.env.SEAMLESS_API_URL ?? 'http://localhost:5312';
 export const ADAPTER_URL = process.env.SEAMLESS_ADAPTER_URL ?? 'http://localhost:3000';
+// The Fastify twin of the adapter, on its own port. The adapter specs run against
+// both, so a regression in one framework is visible on its own row of the matrix.
+export const FASTIFY_ADAPTER_URL =
+  process.env.SEAMLESS_FASTIFY_ADAPTER_URL ?? 'http://localhost:3001';
 export const REACT_URL = process.env.SEAMLESS_REACT_URL ?? 'http://localhost:5173';
 export const MOCK_OIDC_PORT = Number(process.env.SEAMLESS_MOCK_OIDC_PORT ?? 9000);
 
@@ -11,10 +15,9 @@ export const MOCK_OIDC_PORT = Number(process.env.SEAMLESS_MOCK_OIDC_PORT ?? 9000
 export const API_SERVICE_TOKEN =
   process.env.SEAMLESS_API_SERVICE_TOKEN ?? 'verify-dev-service-token';
 
-// Must match the API's SEAMLESS_BOOTSTRAP_SECRET so the harness can mint the
-// first admin invite (bootstrap-promotion flow).
-export const BOOTSTRAP_SECRET =
-  process.env.SEAMLESS_BOOTSTRAP_SECRET ?? 'verify-dev-bootstrap-secret';
+// Must match the API's OWNER_EMAIL so the harness can assert that registering
+// the tenant owner grants the admin role at signup.
+export const OWNER_EMAIL = process.env.SEAMLESS_OWNER_EMAIL ?? 'owner@verify.local';
 
 // Non-production seam: makes the API return OTP / magic-link tokens in the
 // response `delivery` object instead of sending real email/SMS.

package/verify/harness/lib/fixtures.ts

@@ -1,17 +1,26 @@
 import { test as base } from '@playwright/test';
 
 import { Actor, newAdapterActor, newApiActor } from './client';
+import { ADAPTER_URL } from './env';
+
+// `adapterUrl` is a project option rather than something a spec sets: the adapter
+// suite is written once and each project points it at a different adopter backend
+// (Express, Fastify). A spec cannot tell which one answered, which is the point.
+export interface AdapterOptions {
+  adapterUrl: string;
+}
 
 // `actor` drives the API directly (Bearer + service token); `adapterActor` drives
 // the adopter backend over cookies. Both are auto-created and disposed per test.
-export const test = base.extend<{ actor: Actor; adapterActor: Actor }>({
+export const test = base.extend<AdapterOptions & { actor: Actor; adapterActor: Actor }>({
+  adapterUrl: [ADAPTER_URL, { option: true }],
   actor: async ({}, use) => {
     const actor = await newApiActor();
     await use(actor);
     await actor.dispose();
   },
-  adapterActor: async ({}, use) => {
-    const actor = await newAdapterActor();
+  adapterActor: async ({ adapterUrl }, use) => {
+    const actor = await newAdapterActor(adapterUrl);
     await use(actor);
     await actor.dispose();
   },

package/verify/harness/lib/flows.ts

@@ -1,6 +1,6 @@
 import { APIRequestContext, expect } from '@playwright/test';
 
-import { BOOTSTRAP_SECRET, EXTERNAL_DELIVERY } from './env';
+import { EXTERNAL_DELIVERY } from './env';
 
 export interface SessionTokens {
   token: string; // signed access token
@@ -43,41 +43,6 @@ export async function registerWithPhone(
   return body.token as string;
 }
 
-/**
- * Mint the one-time bootstrap admin invite (returns the raw invite token via
- * the external-delivery seam). Only succeeds before any admin exists — the API
- * gates re-use with 410, so this assumes a fresh DB (what `seamless verify` runs).
- */
-export async function createBootstrapInvite(
-  ctx: APIRequestContext,
-  email: string,
-): Promise<string> {
-  const res = await ctx.post('/internal/bootstrap/admin-invite', {
-    headers: { Authorization: `Bearer ${BOOTSTRAP_SECRET}`, ...EXTERNAL_DELIVERY },
-    data: { email },
-  });
-  expect(res.ok(), `bootstrap invite -> ${res.status()} ${await res.text()}`).toBeTruthy();
-  const token = (await res.json())?.data?.token;
-  expect(token, 'bootstrap invite returns a token via external delivery').toBeTruthy();
-  return String(token);
-}
-
-/** Register a user carrying a bootstrap invite token; returns the ephemeral token. */
-export async function registerWithBootstrapToken(
-  ctx: APIRequestContext,
-  email: string,
-  bootstrapToken: string,
-): Promise<string> {
-  const res = await ctx.post('/registration/register', {
-    headers: EXTERNAL_DELIVERY,
-    data: { email, bootstrapToken },
-  });
-  expect(res.ok(), `register ${email} -> ${res.status()} ${await res.text()}`).toBeTruthy();
-  const body = await res.json();
-  expect(body.token, 'register returns an ephemeral token').toBeTruthy();
-  return body.token as string;
-}
-
 /** Generate a phone OTP and return the raw code via the external-delivery seam. */
 export async function requestPhoneOtp(ctx: APIRequestContext, ephemeral: string): Promise<string> {
   const res = await ctx.get('/otp/generate-phone-otp', {

package/verify/harness/lib/matrixReporter.ts

@@ -1,12 +1,16 @@
 import type { FullResult, Reporter, TestCase, TestResult } from '@playwright/test/reporter';
 
 // Prints a flow x layer conformance grid at the end of the run. Layer comes from
-// the spec's directory (api/adapter/react); flow from the spec file name, with a
-// few aliases folded together so the same flow lines up across layers.
+// the Playwright project; flow from the spec file name, with a few aliases folded
+// together so the same flow lines up across layers.
 
-const LAYERS = ['api', 'adapter', 'react'] as const;
+const LAYERS = ['api', 'adapter', 'adapter-fastify', 'react'] as const;
 type Layer = (typeof LAYERS)[number];
 
+function isLayer(name: string): name is Layer {
+  return (LAYERS as readonly string[]).includes(name);
+}
+
 const FLOW_ALIASES: Record<string, string> = {
   emailOtpLogin: 'emailOtp',
   registration: 'register',
@@ -29,7 +33,11 @@ export default class MatrixReporter implements Reporter {
   onTestEnd(test: TestCase, result: TestResult): void {
     const match = test.location.file.match(/\/(api|adapter|react)\/([^/]+)\.spec\.[tj]s$/);
     if (!match) return;
-    const layer = match[1] as Layer;
+    // The project name, not the directory: the two adapter projects run the same
+    // specs from ./adapter, so the path cannot tell them apart. Falls back to the
+    // directory for a run driven by something that does not name its projects.
+    const projectName = test.parent.project()?.name ?? '';
+    const layer = isLayer(projectName) ? projectName : (match[1] as Layer);
     const base = match[2];
     const flow = FLOW_ALIASES[base] ?? base;
     // Keyed by test id so the final attempt (after retries) is the one that counts.
@@ -51,11 +59,16 @@ export default class MatrixReporter implements Reporter {
     };
 
     const flowWidth = Math.max('flow'.length, ...flows.map((f) => f.length));
+    // Each column is as wide as its own header, so a long layer name (like
+    // adapter-fastify) widens its column instead of running into the next one.
+    const layerWidth = (layer: Layer) => layer.length + 3;
     const pad = (text: string, width: number) =>
       text + ' '.repeat(Math.max(0, width - text.length));
     const row = (label: string, get: (layer: Layer) => string) =>
-      `  ${pad(label, flowWidth)}   ${LAYERS.map((l) => pad(get(l), 9)).join('')}`;
-    const rule = `  ${'-'.repeat(flowWidth + 3 + LAYERS.length * 9)}`;
+      `  ${pad(label, flowWidth)}   ${LAYERS.map((l) => pad(get(l), layerWidth(l))).join('')}`;
+    const totalWidth =
+      flowWidth + 3 + LAYERS.reduce((sum, l) => sum + layerWidth(l), 0);
+    const rule = `  ${'-'.repeat(totalWidth)}`;
 
     const lines = [
       '',

package/verify/harness/lib/reactFlows.ts

@@ -90,8 +90,6 @@ export async function registerWithPasskey(page: Page, email: string): Promise<vo
     page.getByRole('heading', { name: /Secure Your Account with a Passkey/ }),
   ).toBeVisible();
   await page.getByRole('button', { name: 'Register Passkey' }).click();
-  await page.getByPlaceholder(/MacBook/).fill('Verify Device');
-  await page.getByRole('button', { name: 'Continue' }).click();
 }
 
 /** Sign in an existing user whose passkey is registered (the ceremony auto-runs). */

package/verify/harness/playwright.config.ts

@@ -1,11 +1,12 @@
 import { defineConfig, devices } from '@playwright/test';
 
-import { REACT_URL } from './lib/env';
+import { FASTIFY_ADAPTER_URL, REACT_URL } from './lib/env';
+import type { AdapterOptions } from './lib/fixtures';
 
 // One runner, multiple projects. `api` and `adapter` hit HTTP directly (no
 // browser); `react` drives chromium against the starter SPA. global-setup
 // health-gates the stack before any project runs.
-export default defineConfig({
+export default defineConfig<AdapterOptions>({
   testDir: '.',
   globalSetup: './global-setup.ts',
   timeout: 30_000,
@@ -18,12 +19,25 @@ export default defineConfig({
     ['junit', { outputFile: 'results/junit.xml' }],
     ['html', { outputFolder: 'results/html', open: 'never' }],
   ],
+  // Each project scopes itself with testDir, not testMatch. A testMatch regex is
+  // applied to the absolute path, so `/api\/.*\.spec\.ts$/` also matched every
+  // adapter and react spec whenever the checkout lived under a directory
+  // containing "api/" (the seamless-auth-api conformance run does exactly that),
+  // pulling browser specs into a project with no baseURL.
   projects: [
-    { name: 'api', testMatch: /api\/.*\.spec\.ts$/ },
-    { name: 'adapter', testMatch: /adapter\/.*\.spec\.ts$/ },
+    { name: 'api', testDir: './api' },
+    // Both adapter projects run the same specs from the same directory; only the
+    // adopter backend they point at differs. Adding a framework is a project
+    // entry plus a compose service, not a copy of the suite.
+    { name: 'adapter', testDir: './adapter' },
+    {
+      name: 'adapter-fastify',
+      testDir: './adapter',
+      use: { adapterUrl: FASTIFY_ADAPTER_URL },
+    },
     {
       name: 'react',
-      testMatch: /react\/.*\.spec\.ts$/,
+      testDir: './react',
       use: { ...devices['Desktop Chrome'], baseURL: REACT_URL },
     },
   ],

package/dist/commands/bootstrapAdmin.js

@@ -1,96 +0,0 @@
-import { intro, outro, text, confirm, spinner } from "@clack/prompts";
-import kleur from "kleur";
-import { extractFlag } from "../core/args.js";
-import { resolveBootstrapSecret } from "../core/bootstrapSecret.js";
-const DEFAULT_API_URL = "http://localhost:3000";
-// Bootstrap targets the app API (the SeamlessAuth server adapter), which is what
-// exposes /auth/internal/bootstrap/admin-invite and delivers the invite. That is a
-// different service from a login profile's auth-server URL, which does not serve
-// that route — so this resolves independently of any profile: an explicit
-// --api-url wins, then SEAMLESS_API_URL, then the local dev default.
-function resolveApiUrl(apiUrlFlag) {
-    return (apiUrlFlag?.trim() ||
-        process.env.SEAMLESS_API_URL?.trim() ||
-        DEFAULT_API_URL);
-}
-export async function runBootstrapAdmin(args = []) {
-    intro("Seamless Auth Bootstrap");
-    const { value: apiUrlFlag, rest } = extractFlag(args, "api-url");
-    let email = rest.find((a) => !a.startsWith("-"));
-    if (!email) {
-        email = (await text({
-            message: "Admin email address",
-            placeholder: "admin@example.com",
-            validate: (value) => {
-                if (!value || !value.includes("@")) {
-                    return "Enter a valid email address";
-                }
-            },
-        }));
-    }
-    const proceed = await confirm({
-        message: "Create bootstrap admin invite?",
-        initialValue: true,
-    });
-    if (!proceed) {
-        outro("Cancelled.");
-        return;
-    }
-    const apiUrl = resolveApiUrl(apiUrlFlag);
-    let secret = resolveBootstrapSecret();
-    if (secret) {
-        console.log(kleur.gray("Using bootstrap secret from local environment"));
-    }
-    else {
-        console.log("");
-        console.log(kleur.yellow("No bootstrap secret detected automatically."));
-        console.log("This may happen if the project is not initialized locally or running in production.");
-        secret = (await text({
-            message: "Bootstrap secret",
-            placeholder: "Enter your bootstrap secret",
-            validate: (value) => {
-                if (!value)
-                    return "Bootstrap secret is required";
-            },
-        }));
-    }
-    const s = spinner();
-    s.start("Creating bootstrap invite...");
-    try {
-        const res = await fetch(`${apiUrl}/auth/internal/bootstrap/admin-invite`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${secret}`,
-            },
-            body: JSON.stringify({ email }),
-        });
-        const data = await res.json();
-        if (!res.ok) {
-            s.stop("Failed");
-            console.error(kleur.red("Error creating bootstrap invite"));
-            console.error(data);
-            process.exit(1);
-        }
-        s.stop("Done");
-        console.log("");
-        if (data?.data?.url) {
-            console.log(kleur.bold("Registration URL"));
-            console.log(kleur.cyan(data.data.url));
-        }
-        else {
-            console.log(kleur.green(`Invite sent to ${email}`));
-        }
-        console.log("");
-        console.log("Next step:");
-        console.log("The invited user must complete registration to receive admin access.");
-        outro("Bootstrap complete.");
-    }
-    catch (err) {
-        s.stop("Failed");
-        console.error(kleur.red("Unexpected error"));
-        console.error(err.message);
-        process.exit(1);
-    }
-}
-//# sourceMappingURL=bootstrapAdmin.js.map

package/dist/commands/bootstrapAdmin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapAdmin.js","sourceRoot":"","sources":["../../src/commands/bootstrapAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,0EAA0E;AAC1E,qEAAqE;AACrE,SAAS,aAAa,CAAC,UAAmB;IACxC,OAAO,CACL,UAAU,EAAE,IAAI,EAAE;QAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACpC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiB,EAAE;IACzD,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEjC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC;YAClB,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE,mBAAmB;YAChC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,OAAO,6BAA6B,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;QAC5B,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,YAAY,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzC,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;IAEtC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CACT,qFAAqF,CACtF,CAAC;QAEF,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC;YACnB,OAAO,EAAE,kBAAkB;YAC3B,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK;oBAAE,OAAO,8BAA8B,CAAC;YACpD,CAAC;SACF,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uCAAuC,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,sEAAsE,CACvE,CAAC;QAEF,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/core/bootstrapSecret.js

@@ -1,39 +0,0 @@
-import fs from "fs";
-import path from "path";
-export function resolveBootstrapSecret() {
-    const root = process.cwd();
-    if (process.env.SEAMLESS_BOOTSTRAP_SECRET) {
-        return normalizeSecretValue(process.env.SEAMLESS_BOOTSTRAP_SECRET);
-    }
-    const rootEnv = path.join(root, ".env");
-    if (fs.existsSync(rootEnv)) {
-        const content = fs.readFileSync(rootEnv, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET=(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    const authEnv = path.join(root, "auth", ".env");
-    if (fs.existsSync(authEnv)) {
-        const content = fs.readFileSync(authEnv, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET=(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    const compose = path.join(root, "docker-compose.yml");
-    if (fs.existsSync(compose)) {
-        const content = fs.readFileSync(compose, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET:\s*(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    return null;
-}
-function normalizeSecretValue(value) {
-    const trimmed = value.trim();
-    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
-        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-        return trimmed.slice(1, -1);
-    }
-    return trimmed;
-}
-//# sourceMappingURL=bootstrapSecret.js.map

package/dist/core/bootstrapSecret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapSecret.js","sourceRoot":"","sources":["../../src/core/bootstrapSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC;QAC1C,OAAO,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjE,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/verify/harness/api/adminBootstrap.spec.ts

@@ -1,34 +0,0 @@
-import { expect, test } from '../lib/fixtures';
-import {
-  createBootstrapInvite,
-  pollMagicLink,
-  registerWithBootstrapToken,
-  requestMagicLink,
-  verifyMagicLink,
-} from '../lib/flows';
-
-test.describe('admin bootstrap (api)', () => {
-  // The first-admin invite is single-use per DB (the API returns 410 once an
-  // admin exists), so this relies on the fresh DB `seamless verify` provisions.
-  test('invite -> register -> magic-link completion promotes the user to admin', async ({
-    actor,
-  }) => {
-    const inviteToken = await createBootstrapInvite(actor.ctx, actor.email);
-    const ephemeral = await registerWithBootstrapToken(actor.ctx, actor.email, inviteToken);
-
-    const { token } = await requestMagicLink(actor.ctx, ephemeral);
-    const verified = await verifyMagicLink(actor.ctx, token);
-    expect(verified.ok(), `verify -> ${verified.status()}`).toBeTruthy();
-
-    const completed = await pollMagicLink(actor.ctx, ephemeral);
-    expect(completed.status(), 'poll after verify issues a session').toBe(200);
-
-    const body = await completed.json();
-    expect(body.token, 'session access token').toBeTruthy();
-    const roles = (body.roles ?? []) as string[];
-    expect(
-      roles.includes('admin'),
-      `bootstrap promotion grants the admin role (got ${JSON.stringify(roles)})`,
-    ).toBeTruthy();
-  });
-});