.github/9
ISSUE_TEMPLATE/3bug_report.md config.yml feature_request.md
workflows/3ci.yml clean-clone.yml release.yml
CODEOWNERS dependabot.yml pull_request_template.md
apps/630
api/250
src/243
common/30
__tests__/3authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts
filters/1all-exceptions.filter.ts
guards/3auth.guard.ts internal-service.guard.ts rate-limit.guard.ts
interceptors/2actor-context.interceptor.ts bigint-serialization.interceptor.ts
middleware/2idempotency.test.ts idempotency.ts
pipes/1zod-validation.pipe.ts
actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts
config/1env.ts
lib/11
__tests__/5crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts
authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts
modules/197
ai/28
__tests__/4ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts
generator/4executor.ts generate.controller.ts generate.dto.ts generate.service.ts
ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts
api-keys/3api-keys.controller.ts api-keys.module.ts api-keys.service.ts
audit/2audit-log.controller.ts audit.module.ts
auth/4auth.controller.ts auth.module.ts auth.service.ts dto.ts
automations/5automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts
blocks/5
__tests__/1batch-version-cas.test.ts
block.service.ts blocks.controller.ts blocks.module.ts dto.ts
comments/4comments.controller.ts comments.module.ts comments.service.ts dto.ts
databases/9
__tests__/3normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts
database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts
docs/2docs.controller.ts docs.module.ts
files/10
__tests__/1quota.test.ts
dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts
forms/18debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts
health/3health.controller.ts health.module.ts health.service.ts
integrations/3integrations.controller.ts integrations.module.ts integrations.service.ts
internal/12
__tests__/2flush-query-shape.test.ts internal.endpoints.test.ts
ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts
notifications/3notifications.controller.ts notifications.module.ts notifications.service.ts
oauth/6
__tests__/1oauth.scopes.test.ts
oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts
org/15audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts
orgs/5dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts
pages/4dto.ts page.service.ts pages.controller.ts pages.module.ts
scim/15
__tests__/3email-mapping.test.ts etag.test.ts filters.test.ts
etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts
search/4
__tests__/1search.service.test.ts
search.controller.ts search.module.ts search.service.ts
sessions/3sessions.controller.ts sessions.module.ts sessions.service.ts
share/3share.controller.ts share.module.ts share.service.ts
sso/16
__tests__/4enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts
enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts
teams/4dto.ts teams.controller.ts teams.module.ts teams.service.ts
users/4dto.ts users.controller.ts users.module.ts users.service.ts
webhooks/3webhooks.controller.ts webhooks.module.ts webhooks.service.ts
workspaces/4dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts
types/1xmldom.d.ts
app.module.ts constants.ts main.ts
_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts
realtime/33
src/17auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts
test/11auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts
.env.example Dockerfile package.json README.md tsconfig.json
web/255
src/244
app/45
__tests__/1theme-tokens.test.ts
(app)/26
w/25
[workspace]/25
ask/1page.tsx
databases/1
[id]/1page.tsx
favorites/1page.tsx
files/1page.tsx
notifications/1page.tsx
page/4
[id]/4
[block]/1page.tsx
share/1page.tsx
layout.tsx page.tsx
search/1page.tsx
settings/10
appearance/1page.tsx
automations/3
[id]/1page.tsx
new/1page.tsx
page.tsx
billing/1page.tsx
developers/1page.tsx
members/1page.tsx
permissions/1page.tsx
teams/1page.tsx
page.tsx
shared/1page.tsx
templates/1page.tsx
trash/1page.tsx
layout.tsx page.tsx
layout.tsx
(auth)/4
login/1page.tsx
register/1page.tsx
reset-password/1page.tsx
layout.tsx
api/2
metrics/1route.ts
v1/1
health/1route.ts
f/1
[slug]/1page.tsx
health/1
ready/1route.ts
org/2
[orgId]/2
admin/2
integrations/1page.tsx
page.tsx
share/1
[id]/1page.tsx
error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx
components/118
admin/10
org-admin/8ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx
ScimCard.tsx SsoTabs.tsx
ai/6ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx
automations/5action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx
collaboration/6CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx
comments/3comment-panel.tsx comment-thread.tsx mention-input.tsx
database/27
__tests__/2cell-editor.test.tsx cell-renderer.test.tsx
AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx
dialogs/7
__tests__/1move-to-dialog.test.tsx
create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx
editor/19
__tests__/3code-block-text.test.ts code-block.test.tsx expandable.test.tsx
block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx
files/4FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx
form/4form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx
layout/8
__tests__/1page-tree-icon.test.tsx
command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx
mentions/3
__tests__/1mention-model.test.ts
mention-model.ts MentionPopup.tsx
search/3ask-ai-search.tsx results-list.tsx search-dialog.tsx
settings/10
api-keys/4ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx
webhooks/5CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx
settings-shell.tsx
ui/3confirm-dialog.tsx form.tsx toaster.tsx
hooks/21
__tests__/4realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx
realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts
lib/50
__tests__/21ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts
files/7
__tests__/2picker.test.ts upload.test.ts
api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts
ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts
stores/8
__tests__/1block-patch-store.test.ts
block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts
instrumentation.ts middleware.ts
.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts
worker/92
src/87
__tests__/13ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts
health/1server.ts
lib/12
__tests__/1clamav.test.ts
clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts
processors/56
automations/28
__tests__/3condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts
executors/17assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts
condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts
files/15
__tests__/4errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts
steps/4finalize.ts metadata.ts scan.ts thumbnails.ts
cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts
search-index/4builders.ts grants.ts index.ts processor.ts
ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts
config.ts events.ts index.ts logger.ts queues.ts
.env.example Dockerfile package.json README.md tsconfig.json
docs/73
api/17ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md
architecture/10ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md
database/2database-architecture.md redis-keys.md
development/8admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md
product/4functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md
requirements/1requirements-matrix.md
security/5audit-report.md files.md forms.md license-allowlist.md security-architecture.md
tasks/16phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md
ui/9ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md
support-matrix.md
infrastructure/71
caddy/1Caddyfile
docker/6
init/101-extensions.sql
opensearch/1init-indices.json
.env.docker docker-compose.yml opensearch-init.sh README.md
kubernetes/40
observability/20
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1sync-sources.mjs
alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml
postgres/7configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml
api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml
nginx/2nginx.conf README.md
observability/14
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1dashboard-completeness.mjs
README.md
terraform/8compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf
packages/289
ai/24
src/20
providers/7anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts
schemas/2database.ts generate.ts
adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts
package.json README.md tsconfig.json vitest.config.ts
auth/11
src/7index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
collaboration/17
src/13awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
config/7
src/4eslint.base.js index.ts prettier.base.json tsconfig.base.json
package.json README.md tsconfig.json
database-client/5
src/2index.test.ts index.ts
package.json README.md tsconfig.json
database-engine/33
src/29
filter/2filter.test.ts index.ts
formula/8evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts
query/6group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts
relations/2index.ts relations.test.ts
rollups/2index.ts rollups.test.ts
values/5dates.ts index.ts registry.ts types.ts values.test.ts
views/3buttons.ts index.ts views.test.ts
index.ts
package.json README.md tsconfig.json vitest.config.ts
editor/25
src/21
marks/1highlight.ts
nodes/2equation.ts mention.ts
autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
observability/20
src/16
__tests__/8db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts
index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts
package.json README.md tsconfig.json vitest.config.ts
permissions/11
src/7index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts
package.json README.md tsconfig.json vitest.config.ts
search/22
src/18chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
shared/61
src/57
dto/17ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts
events/8audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts
realtime/6comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts
automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts
package.json README.md tsconfig.json vitest.config.ts
storage/16
src/12client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
ui/37
src/33
components/19avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx
color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
prisma/16
migrations/13
20260927000000_init/1migration.sql
20260928000000_search_documents_content_hash/1migration.sql
20260929000000_workspace_usage_storage_bytes/1migration.sql
20260930000000_form_submitted_notification_type/1migration.sql
20261001000000_ai_phase12/1migration.sql
20261002000000_webhooks_secret_encrypted_dlq/1migration.sql
20261002111436_webhook_delivery_latency/1migration.sql
20261002120000_org_admin_2fa_retention_unique/1migration.sql
20261002215124_audit_export/1migration.sql
20261003210000_perf_indexes_hot_paths/1migration.sql
20261004004500_perf_indexes_hot_paths_2/1migration.sql
migration_lock.toml README.md
schema.prisma seed.ts verify.ts
scripts/7backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh
tests/169
e2e/63
.auth/1user.json
fixtures/7
files/6clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt
realtime.ts
mocks/2oidc-issuer.ts saml-idp.ts
playwright-report/3
data/2a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm
index.html
reports/1files-security.json
specs/34ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts
test-results-final-flow/3
final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2test-failed-1.png trace.zip
.last-run.json
utils/4api.ts dnd.ts search-lag.ts wait.ts
.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json
fixtures/1
files/1make-sparse.ts
integration/60
ai-capability/2ai-app.capability.test.ts gateway.capability.test.ts
drill/2seed-drill.mjs verify-restore.mjs
fixtures/5
files/5clip.mp4 clip.wav doc.pdf hero-1400.png note.txt
helpers/3api.ts containers.ts seed.ts
realtime/11control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts
ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts
performance/28
fixtures/1search-100k.ts
helpers/2seed-100k.mjs seed-1k-load.mjs
reports/7api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json
api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs
security/16
helpers/1app.ts
audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts
README.md
.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json
realtime.tstests/e2e/fixtures/realtime.tsraw← fixtures24,786 B← Back to the app
1/**
2 * TASK-0095 S13 — Phase-7 realtime E2E suite: shared fixtures + raw-WS probes.
3 *
4 * This module is the SHARED half of the 7-scenario suite (the scenarios live
5 * in `tests/e2e/specs/realtime.spec.ts`). It provides:
6 *
7 *   - seeded contexts: the demo OWNER tab + two freshly-registered ADMIN
8 *     users (added through the S9 internal seam — the D3 unblock). ADMIN
9 *     (not MEMBER) is deliberate: the shared permissions engine's role
10 *     baseline on descendant resources (pages/databases) is
11 *     `member → view` (packages/permissions/src/resolve.ts,
12 *     ROLE_BASE_ON_DESCENDANTS) — a bare seam-MEMBER could not edit the
13 *     page, so the concurrent-editing/offline/resume scenarios that need
14 *     three EDIT identities use the seam's ADMIN role (the seam grants no
15 *     OWNER; recorded).
16 *   - a RAW WebSocket probe (`rawClient`) for the protocol-level assertions
17 *     the browser cannot observe: the `hello.serverTime` RTT (S2), the
18 *     `lastSeq` update-log resume delta (S4), the no-error-frame assert
19 *     (S1), and the 4010 drain (S6). It speaks the TASK-0091/0092 wire
20 *     protocol (packages/shared frames): JSON control frames + binary
21 *     `0x01 update / 0x02 awareness` frames, the `/realtime` upgrade path,
22 *     and the `?token=&room=` handshake (the same contract the k6 1k
23 *     baseline + the integration rt-helpers drive).
24 *   - the deterministic network cut (S3 offline): route-abort of the API +
25 *     the realtime socket + CDP offline emulation (navigator.onLine=false —
26 *     the outbox's enqueue gate, apps/web/src/lib/api.ts `isOffline()`).
27 *   - the realtime-process restart (S6): SIGTERM the running `tsx watch
28 *     apps/realtime/src/index.ts` (the stack's dev process), read the drain
29 *     4010, respawn it with the SAME environment (captured from
30 *     /proc/<pid>/environ), wait for :4001.
31 *
32 * ── RUNNER GATE (Docker) — NOT RUNNABLE LOCALLY ─────────────────────────
33 * Every scenario here needs the full stack (Postgres + Redis + API :4000 +
34 * realtime :4001 + web :3000, the seeded demo user). A Docker daemon is
35 * unavailable in the authoring environment (permission denied; recorded,
36 * never faked). The suite is CI-ready under the same contract as every
37 * other spec in this package (`pnpm docker:up && pnpm dev`, or the CI e2e
38 * job) and is committed so the Phase-7 exit criteria are pinned for CI.
39 */
40import { expect, request as pwRequest } from "@playwright/test";
41import * as Y from "yjs";
42import WebSocket from "ws";
43import * as fs from "node:fs";
44import * as net from "node:net";
45import { spawn, execFileSync } from "node:child_process";
46import type { Browser, Page, BrowserContext, APIRequestContext } from "@playwright/test";
47import type { AuthState, Workspace, PageDto } from "../fixtures";
48import { DEMO_EMAIL, DEMO_PASSWORD } from "../fixtures";
49import {
50  addMemberViaSeam,
51  createBlock,
52  createDatabase,
53  createPage,
54  createWorkspace,
55  register,
56  login,
57  seamServiceToken,
58  getBlocks,
59} from "../utils/api";
60 
61const API_BASE = process.env.E2E_API_URL ?? "http://localhost:4000";
62const WS_BASE = process.env.E2E_WS_URL ?? "ws://localhost:4001";
63 
64export const CONVERGE_MS = 3_000; // the exit-criterion window ("within 3 s")
65 
66// --- auth contexts ------------------------------------------------------------------
67 
68type Cookie = {
69  name: string;
70  value: string;
71  domain: string;
72  path: string;
73  expires: number;
74  httpOnly: boolean;
75  secure: boolean;
76  sameSite: "Strict" | "Lax" | "None";
77};
78 
79function cookiesFromLogin(jar: Cookie[]): AuthState["cookies"] {
80  return jar.map((c) => ({
81    name: c.name,
82    value: c.value,
83    domain: c.domain,
84    path: c.path,
85    expires: c.expires,
86    httpOnly: c.httpOnly,
87    secure: c.secure,
88    sameSite: c.sameSite,
89  }));
90}
91 
92/** A browser context authenticated as the user (S10: cookie → silent-refresh). */
93interface OwnerTab {
94  context: BrowserContext;
95  page: Page;
96  close: () => Promise<void>;
97}
98 
99async function contextWithLogin(
100  browser: Browser,
101  email: string,
102  password: string,
103): Promise<OwnerTab> {
104  const plain = await browser.newContext();
105  const res = await plain.request.post("/api/v1/auth/login", {
106    data: { email, password },
107  });
108  if (res.status() !== 200) {
109    throw new Error(`contextWithLogin(${email}): login failed (${res.status()})`);
110  }
111  const jar = await plain.cookies();
112  await plain.close();
113  const context = await browser.newContext({
114    storageState: { cookies: cookiesFromLogin(jar), origins: [] },
115  });
116  const page = await context.newPage();
117  return { context, page, close: () => context.close() };
118}
119 
120/**
121 * A freshly-REGISTERED user (no session yet). The caller adds the workspace
122 * membership (the S9 seam) and THEN calls `authedUser` to log in — the login
123 * is what bakes the `workspaces[]` claim into the access token (auth.service.ts
124 * captures `memberships.map(m => m.workspaceId)` at sign time), which the
125 * realtime handshake requires (server.ts: `session.workspaces.includes(wsId)`
126 * or 403). Registering before the seam add keeps the token honest.
127 */
128export interface NewUser {
129  user: { email: string; password: string };
130  context: BrowserContext;
131  page: Page;
132  api: APIRequestContext;
133  /** The user's access token (for rawClient); carries workspaces[]. */
134  token: string;
135  close: () => Promise<void>;
136}
137 
138export async function newUser(
139  browser: Browser,
140  name: string,
141): Promise<{ user: { email: string; password: string } }> {
142  const email = `e2e-rt-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@factory.local`;
143  const password = `e2e-${Date.now().toString(36)}`;
144  const plain = await browser.newContext();
145  await register(plain.request, email, password, name);
146  await plain.close();
147  return { user: { email, password } };
148}
149 
150/**
151 * Log in an existing user + open an authenticated browser context. The
152 * `accessToken` (rotation-safe: a throwaway session — the web's silent-refresh
153 * owns the cookie) is the raw-WS-probe credential (S2/S4/S6). MUST be called
154 * AFTER the user's workspace membership exists, so the token carries it.
155 */
156export async function authedUser(
157  browser: Browser,
158  user: { email: string; password: string },
159): Promise<NewUser> {
160  const plain = await browser.newContext();
161  const logged = await login(plain.request, user.email, user.password);
162  const token = logged.accessToken ?? "";
163  const jar = await plain.cookies();
164  await plain.close();
165  const context = await browser.newContext({
166    storageState: { cookies: cookiesFromLogin(jar), origins: [] },
167  });
168  const page = await context.newPage();
169  return {
170    user,
171    context,
172    page,
173    api: context.request,
174    token,
175    close: () => context.close(),
176  };
177}
178 
179/** The seeded demo owner (a fresh login — the S10 cookie + silent-refresh). */
180export async function ownerTab(browser: Browser) {
181  return contextWithLogin(browser, DEMO_EMAIL, DEMO_PASSWORD);
182}
183 
184// --- the 3-user page fixture (S9 seam + ADMIN, see the header) ----------------------
185 
186export interface RtPageSeed {
187  ws: Workspace;
188  page: PageDto;
189  url: string;
190  owner: OwnerTab;
191  a: NewUser;
192  b: NewUser;
193  closeAll: () => Promise<void>;
194}
195 
196/**
197 * Seed: fresh workspace (demo owner) + a page with `blockCount` paragraph
198 * blocks + the two ADMIN users (the S9 seam). The caller owns `api` (the
199 * demo-owner API fixture) — it is only used for the seed calls.
200 *
201 * ORDER (the token-carry subtlety): register Alice/Bob, add them through the
202 * seam, and THEN log them in. The access token bakes `workspaces[]` in at
203 * login time (auth.service.ts) — the realtime handshake 403s a token whose
204 * `workspaces[]` lacks the room's workspace — so the login MUST come after
205 * the seam membership exists. (The browser contexts use the cookie session,
206 * which is membership-agnostic at request time, but the raw probes use the
207 * token — hence the ordering.)
208 */
209export async function seedPage(
210  browser: Browser,
211  api: APIRequestContext,
212  blockCount = 3,
213): Promise<RtPageSeed> {
214  const ws = await createWorkspace(api, `RT ${Date.now()}`);
215  const page = await createPage(api, ws.id, { title: "Realtime page" });
216  const seeds = ["alpha", "beta", "gamma", "delta", "epsilon", "zeta"];
217  for (let i = 0; i < blockCount; i += 1) {
218    await createBlock(api, page.id, {
219      type: "paragraph",
220      content: { text: seeds[i] ?? `seed-${i}` },
221      position: `${i + 1}.0`,
222    });
223  }
224  const owner = await ownerTab(browser);
225  const aReg = await newUser(browser, "Alice");
226  const bReg = await newUser(browser, "Bob");
227  // The seam (S9 — the D3 unblock). ADMIN → full_access on descendants
228  // (the baseline table) — see the header for why not MEMBER.
229  const token = seamServiceToken();
230  await addMemberViaSeam(token, ws.id, aReg.user.email, "ADMIN");
231  await addMemberViaSeam(token, ws.id, bReg.user.email, "ADMIN");
232  // Log in AFTER the seam add (the token now carries the workspace).
233  const a = await authedUser(browser, aReg.user);
234  const b = await authedUser(browser, bReg.user);
235  const url = `/w/${ws.id}/page/${page.id}`;
236  return {
237    ws,
238    page,
239    url,
240    owner,
241    a,
242    b,
243    closeAll: async () => {
244      await owner.close().catch(() => {});
245      await a.close().catch(() => {});
246      await b.close().catch(() => {});
247    },
248  };
249}
250 
251// --- block DOM helpers (the (b) overlay mechanics) -----------------------------------
252 
253/** The `nth` block's rendered text (0-based, position order). */
254export function blockText(page: Page, nth: number): Promise<string> {
255  return page.locator('[data-testid^="block-"]').nth(nth).innerText().then((t) => t.trim());
256}
257 
258/** Click into the `nth` block, move to the end, type (one keystroke at a
259 *  time — the per-keystroke (b) flush path). */
260export async function typeInto(page: Page, nth: number, text: string): Promise<void> {
261  const block = page.locator('[data-testid^="block-"]').nth(nth);
262  await block.click();
263  await page.keyboard.press("End");
264  await page.keyboard.type(text);
265}
266 
267/** Wait until BOTH pages' blocks show the union (the (b) refetch convergence). */
268export async function expectConverged(
269  a: Page,
270  b: Page,
271  checks: { nth: number; contains: string }[],
272  timeoutMs = CONVERGE_MS * 4,
273): Promise<void> {
274  for (const p of [a, b]) {
275    for (const c of checks) {
276      await expect
277        .poll(() => blockText(p, c.nth), {
278          timeout: timeoutMs,
279          message: `block ${c.nth} to contain ${c.contains}`,
280        })
281        .toContain(c.contains);
282    }
283  }
284}
285 
286/** The page title input (apps/web/src/components/editor/page-view.tsx). */
287export function titleInput(page: Page) {
288  return page.locator('input[aria-label="Page title"]');
289}
290 
291/**
292 * The at-rest API truth for the page's blocks (the (b) "source of truth at
293 * rest" — the flush's /internal/blocks funnel output). Asserts the text of
294 * the `nth` block equals `text` exactly (position order). A paragraph block's
295 * content is `{ text }` (the canonical block JSON — see the integration
296 * convergence tests).
297 */
298export async function expectAtRestBlock(
299  api: APIRequestContext,
300  pageId: string,
301  nth: number,
302  text: string,
303): Promise<void> {
304  const blocks = await getBlocks(api, pageId);
305  const got = blocks[nth]?.content as { text?: unknown } | unknown[] | undefined;
306  const gotText =
307    got !== null && typeof got === "object" && !Array.isArray(got) && "text" in got
308      ? String((got as { text?: unknown }).text ?? "")
309      : Array.isArray(got)
310        ? got.join("")
311        : String(got ?? "");
312  expect(
313    gotText,
314    `at-rest block ${nth} (API truth) — expected "${text}", got "${gotText}"`,
315  ).toBe(text);
316}
317 
318// --- deterministic network cut (S3) ---------------------------------------------------
319 
320export interface NetworkCut {
321  restore: () => Promise<void>;
322}
323 
324/**
325 * Simulate the browser going offline, the way the outbox + status UI expect:
326 * `context.setOffline(true)` (Playwright) aborts every request AND sets
327 * `navigator.onLine === false` — the outbox's enqueue gate (lib/api.ts
328 * `isOffline()`) and the offline-banner condition (lib/offline-status.ts
329 * `bannerVisible = !navigatorOnline || …`). `restore()` → `setOffline(false)`
330 * restores the network + fires the window `online` event, which drains the
331 * outbox (offlineQueue.ts `initOutbox` wires window `online` → `drain()`) and
332 * clears the banner.
333 *
334 * A route-level abort (the collab-two-tab approach) CANNOT set
335 * `navigator.onLine` — so the R1 outbox (the enqueue gate) and the offline
336 * banner would never engage. `setOffline` is the faithful simulation; the
337 * collab-two-tab spec's "flaky" note was about an older, page-level variant —
338 * here it is the CONTEXT-level API, asserted type-safe against the pinned
339 * 1.49.1 runtime.
340 */
341export async function cutNetwork(context: BrowserContext): Promise<NetworkCut> {
342  await context.setOffline(true);
343  return {
344    restore: async () => {
345      await context.setOffline(false);
346    },
347  };
348}
349 
350// --- raw WebSocket probe (the TASK-0091/0092 protocol) --------------------------------
351 
352export interface RawClient {
353  ws: WebSocket;
354  /** Every received text frame (history view). */
355  frames: () => Record<string, unknown>[];
356  /** Every received binary frame, kind byte stripped (history view). */
357  binaries: () => Uint8Array[];
358  nextFrame: (type: string, timeoutMs?: number) => Promise<Record<string, unknown>>;
359  frameCount: (type: string) => number;
360  errorFrames: () => Record<string, unknown>[];
361  /** The last `ack {seq}` (the update-log resume fast path, R5). */
362  lastAckSeq: () => number | null;
363  sendText: (obj: unknown) => void;
364  /** Append `text` to a local Y.Doc's "t" type and send the delta as a
365   *  `0x01`-prefixed binary update frame (the TASK-0091 wire format). */
366  sendUpdate: (doc: Y.Doc, text: string) => void;
367  close: (code?: number) => void;
368  onClose: (timeoutMs?: number) => Promise<{ code: number; reason: string }>;
369  closed: () => { code: number; reason: string } | null;
370}
371 
372/**
373 * Connect a raw WS client the way the k6 baseline + the integration
374 * rt-helpers do: `<WS>/realtime?token=&room=`, JSON frames + binary
375 * `0x01`-prefixed Yjs updates. The token must carry `workspaces: [wsId]`
376 * (the handshake binds the room's workspace to the claim — note 13).
377 */
378export async function rawClient(
379  token: string,
380  room: string,
381  wsBase: string = WS_BASE,
382): Promise<RawClient> {
383  const url = `${wsBase.replace(/\/+$/, "")}/realtime?token=${encodeURIComponent(
384    token,
385  )}&room=${encodeURIComponent(room)}`;
386  const ws = new WebSocket(url);
387  const textQueue: Record<string, unknown>[] = [];
388  const binQueue: Uint8Array[] = [];
389  let closeInfo: { code: number; reason: string } | null = null;
390  const closeWaiters: {
391    resolve: (v: { code: number; reason: string }) => void;
392    timer: ReturnType<typeof setTimeout>;
393  }[] = [];
394 
395  ws.on("message", (data: Buffer, isBinary: boolean) => {
396    if (isBinary) {
397      // Strip the 0x01/0x02 kind byte (the server's binary frame prefix).
398      binQueue.push(new Uint8Array(data.subarray(1)));
399      return;
400    }
401    try {
402      textQueue.push(JSON.parse(data.toString("utf8")) as Record<string, unknown>);
403    } catch {
404      /* non-JSON text — ignore */
405    }
406  });
407  ws.on("close", (code, reason) => {
408    closeInfo = { code, reason: reason.toString() };
409    for (const w of closeWaiters.splice(0)) {
410      clearTimeout(w.timer);
411      w.resolve(closeInfo!);
412    }
413  });
414 
415  await new Promise<void>((resolve, reject) => {
416    const t = setTimeout(
417      () => reject(new Error(`rawClient connect timeout (${room})`)),
418      8_000,
419    );
420    ws.once("open", () => {
421      clearTimeout(t);
422      resolve();
423    });
424    ws.once("error", (err) => {
425      clearTimeout(t);
426      reject(err instanceof Error ? err : new Error(String(err)));
427    });
428  });
429 
430  return {
431    ws,
432    frames: () => [...textQueue],
433    binaries: () => [...binQueue],
434    nextFrame: (type, timeoutMs = 8_000) =>
435      new Promise((resolve, reject) => {
436        const i = textQueue.findIndex((f) => f.type === type);
437        if (i !== -1) {
438          resolve(textQueue.splice(i, 1)[0]!);
439          return;
440        }
441        const timer = setTimeout(
442          () =>
443            reject(
444              new Error(
445                `timeout waiting for "${type}" (got ${textQueue.length} frames)`,
446              ),
447            ),
448          timeoutMs,
449        );
450        const onMsg = (data: Buffer, isBinary: boolean) => {
451          if (isBinary) return;
452          try {
453            const f = JSON.parse(data.toString("utf8")) as Record<string, unknown>;
454            if (f.type !== type) return;
455            const j = textQueue.indexOf(f);
456            if (j !== -1) textQueue.splice(j, 1);
457            ws.off("message", onMsg);
458            clearTimeout(timer);
459            resolve(f);
460          } catch {
461            /* ignore */
462          }
463        };
464        ws.on("message", onMsg);
465      }),
466    frameCount: (type) => textQueue.filter((f) => f.type === type).length,
467    errorFrames: () => textQueue.filter((f) => f.type === "error"),
468    lastAckSeq: () => {
469      for (let i = textQueue.length - 1; i >= 0; i -= 1) {
470        const f = textQueue[i]!;
471        if (f.type === "ack" && typeof f.seq === "number") return f.seq;
472      }
473      return null;
474    },
475    sendText: (obj) => ws.send(JSON.stringify(obj)),
476    sendUpdate: (doc, text) => {
477      const yText = doc.getText("t");
478      // Encode the delta against the CURRENT STATE VECTOR (the incremental
479      // update since this client's last known state) — `encodeStateAsUpdate`
480      // with a full-update argument returns an empty buffer, so it must be a
481      // state vector (the TASK-0091 wire format the rt-helpers drive).
482      const sv = Y.encodeStateVector(doc);
483      yText.insert(0, text);
484      const delta = Y.encodeStateAsUpdate(doc, sv);
485      const out = new Uint8Array(delta.byteLength + 1);
486      out[0] = 0x01; // BINARY_KIND.Update
487      out.set(delta, 1);
488      ws.send(out);
489    },
490    close: (code = 1000) => ws.close(code),
491    onClose: (timeoutMs = 8_000) =>
492      new Promise((resolve, reject) => {
493        if (closeInfo !== null) {
494          resolve(closeInfo);
495          return;
496        }
497        const w = {
498          resolve,
499          timer: setTimeout(
500            () => reject(new Error("timeout waiting for close (socket still open)")),
501            timeoutMs,
502          ),
503        };
504        closeWaiters.push(w);
505      }),
506    closed: () => closeInfo,
507  };
508}
509 
510// --- the realtime process restart (S6) -------------------------------------------------
511 
512/**
513 * Restart the running realtime server the way CI runs it (the R6 recovery
514 * path — the SIGTERM drain → 4010 to every socket → flush ≤ 10 s → respawn).
515 *
516 * The stack is `pnpm dev` → `turbo run dev` → a per-app child (apps/realtime
517 * runs `tsx watch src/index.ts`). The process actually binding :4001 is a
518 * descendant of turbo, NOT turbo itself — so we locate it by the LISTENING
519 * PORT (the unambiguous signal) and kill ONLY its subtree (turbo + the API/
520 * web children must keep running). We then respawn the EXACT command we found
521 * (argv + cwd + env, captured from /proc) so the restart is faithful to the
522 * runner's real process rather than a re-guessed `tsx watch`.
523 *
524 * CI-gated: `ss -tlnp` + /proc are the Linux CI runner's primitives (Docker
525 * gate — this suite never runs locally).
526 */
527export async function restartRealtimeServer(): Promise<void> {
528  const pid = pidListeningOn(4001);
529  if (pid === null) {
530    throw new Error("restartRealtimeServer: nothing is listening on :4001 (stack not up?)");
531  }
532  const info = procInfo(pid);
533  if (info === null) {
534    throw new Error(`restartRealtimeServer: cannot read /proc/${pid} (non-Linux runner?)`);
535  }
536 
537  // SIGTERM the whole subtree (tsx watch + its node child hold the port).
538  for (const p of [...descendantsOf(pid), pid].sort((x, y) => y - x)) {
539    try {
540      process.kill(p, "SIGTERM");
541    } catch {
542      /* already gone */
543    }
544  }
545  await waitForPortFree(4001, 30_000);
546 
547  // Respawn the exact command (argv[0] + rest) in its original cwd + env.
548  const child = spawn(info.argv[0]!, info.argv.slice(1), {
549    cwd: info.cwd,
550    env: info.env,
551    stdio: "ignore",
552    detached: true,
553  });
554  child.unref();
555  await waitForPort(4001, 90_000);
556  await waitForPort(4002, 90_000);
557}
558 
559/** The PID holding the LISTEN socket on `port` (`ss -tlnp`). */
560function pidListeningOn(port: number): number | null {
561  let out: string;
562  try {
563    out = execFileSync("ss", ["-tlnp"], { encoding: "utf8" });
564  } catch {
565    return null;
566  }
567  for (const line of out.split("\n")) {
568    // ...:4001 ... users:(("node",pid=1234,fd=20))
569    const portMatch = new RegExp(`:\\b${port}\\b`).test(line);
570    if (!portMatch) continue;
571    const pid = /pid=(\d+)/.exec(line)?.[1];
572    if (pid !== undefined) return Number(pid);
573  }
574  return null;
575}
576 
577/** A process's direct + transitive descendants (the /proc ppid walk). */
578function descendantsOf(pid: number): number[] {
579  const children = new Map<number, number[]>();
580  const pids = fs
581    .readdirSync("/proc")
582    .filter((n) => /^\d+$/.test(n))
583    .map(Number);
584  for (const p of pids) {
585    try {
586      // /proc/<p>/stat: pid (comm) state ppid ...
587      const stat = fs.readFileSync(`/proc/${p}/stat`, "utf8");
588      const close = stat.lastIndexOf(")");
589      const fields = stat.slice(close + 2).split(" ");
590      const ppid = Number(fields[1]); // state(0) ppid(1)
591      if (!Number.isFinite(ppid)) continue;
592      const arr = children.get(ppid) ?? [];
593      arr.push(p);
594      children.set(ppid, arr);
595    } catch {
596      /* gone / no perm */
597    }
598  }
599  const out: number[] = [];
600  const stack = [...(children.get(pid) ?? [])];
601  while (stack.length > 0) {
602    const p = stack.pop()!;
603    out.push(p);
604    for (const c of children.get(p) ?? []) stack.push(c);
605  }
606  return out;
607}
608 
609interface ProcInfo {
610  argv: string[];
611  env: Record<string, string>;
612  cwd: string;
613}
614 
615/** argv + env + cwd for `pid` (the respawn inputs). Null off-Linux. */
616function procInfo(pid: number): ProcInfo | null {
617  try {
618    const argv = fs
619      .readFileSync(`/proc/${pid}/cmdline`, "utf8")
620      .split("\0")
621      .filter((s) => s.length > 0);
622    const cwd = fs.readlinkSync(`/proc/${pid}/cwd`);
623    const raw = fs.readFileSync(`/proc/${pid}/environ`, "utf8");
624    const env: Record<string, string> = {};
625    for (const entry of raw.split("\0")) {
626      const eq = entry.indexOf("=");
627      if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
628    }
629    if (argv.length === 0) return null;
630    return { argv, env, cwd };
631  } catch {
632    return null;
633  }
634}
635 
636export async function waitForPort(port: number, timeoutMs: number): Promise<void> {
637  const deadline = Date.now() + timeoutMs;
638  // eslint-disable-next-line no-constant-condition
639  while (true) {
640    const ok = await new Promise<boolean>((resolve) => {
641      const s = net.connect(port, "127.0.0.1");
642      s.once("connect", () => {
643        s.destroy();
644        resolve(true);
645      });
646      s.once("error", () => resolve(false));
647    });
648    if (ok) return;
649    if (Date.now() >= deadline) throw new Error(`port ${port} not accepting within ${timeoutMs}ms`);
650    await new Promise((r) => setTimeout(r, 500));
651  }
652}
653 
654async function waitForPortFree(port: number, timeoutMs: number): Promise<void> {
655  const deadline = Date.now() + timeoutMs;
656  // eslint-disable-next-line no-constant-condition
657  while (true) {
658    const ok = await new Promise<boolean>((resolve) => {
659      const s = net.connect(port, "127.0.0.1");
660      s.once("connect", () => {
661        s.destroy();
662        resolve(true);
663      });
664      s.once("error", () => resolve(false));
665    });
666    if (!ok) return;
667    if (Date.now() >= deadline) throw new Error(`port ${port} still bound after ${timeoutMs}ms`);
668    await new Promise((r) => setTimeout(r, 300));
669  }
670}
671 
672// --- the API liveness guard (local vs CI) ---------------------------------------------
673 
674/** The API is reachable (global-setup throws first; this is a belt). */
675export async function apiReachable(): Promise<boolean> {
676  try {
677    const req = await pwRequest.newContext({ baseURL: API_BASE, timeout: 5_000 });
678    const res = await req.get("/api/v1/health").catch(() => null);
679    await req.dispose();
680    return res !== null;
681  } catch {
682    return false;
683  }
684}
685 
686/** Create a database (title + a text prop) for the record-outbox scenario. */
687export async function seedDatabase(
688  api: APIRequestContext,
689  wsId: string,
690  title = "RT Records",
691) {
692  return createDatabase(api, wsId, {
693    title,
694    pageId: null,
695    properties: [{ name: "Name", type: "title" }, { name: "Note", type: "text" }],
696  });
697}
698