Test against real WorkOS/Autumn SDKs via wire-level emulators (#931)

* Run cloud's real auth/billing against WorkOS + Autumn emulators; delete all hand-rolled test layers - WORKOS_API_URL / AUTUMN_API_URL env seams point the REAL SDKs (incl. the vault plugin via credentials.apiUrl) at the vendored emulators. Production composition is unconditional again — the EXECUTOR_E2E_STUB layer swap and every *.test-layer.ts are deleted. - e2e cloud target: identities minted through the REAL login flow (login → emulator-hosted AuthKit, headless via login_hint → callback → genuine sealed-session cookie), orgs through the real create-organization route. - MCP_AUTHKIT_DOMAIN points at the emulator's OAuth authorization server — cloud MCP OAuth e2e now RUNS (was capability-skipped): 19/19 scenarios, zero skips across both targets. - Readiness probes wait for /api/auth/login to actually 302 (vite serves the SPA for /api/* during cold compile); submenu interactions wait for the loaded sub-content before clicking. * Type the optional apiUrl on cloud's workosCredentials dep * Pin emulate fork: OAuth refresh grant + hosted WorkOS/Autumn on the worker * e2e: consume published @executor-js/emulate and @executor-js/mcporter Import the WorkOS/Autumn emulators and the mcporter MCP client from their published npm packages instead of the vendored submodule dist. The submodules remain for fork development, but nothing imports from vendor/ at runtime, so a fresh clone (and CI) resolves these via the registry — which lets e2e typecheck in CI without building the submodules.

Rhys Sullivan committed 5 months ago

Commit 098bfcb1 parent 17174c427 files · +283 −620Browse files

Unified · Split

27 files

apps/cloud/executor.config.ts +2 −0
apps/cloud/src/app.ts +4 −7
apps/cloud/src/auth/api-keys.test-layer.ts +0 −11
apps/cloud/src/auth/cloud-auth-api.test-context.ts +0 −90
apps/cloud/src/auth/context.test-layer.ts +0 −41
apps/cloud/src/auth/create-organization.e2e.node.test.ts +0 −103
apps/cloud/src/auth/middleware.test-layer.ts +0 −29
apps/cloud/src/auth/workos.test-layer.ts +0 −206
apps/cloud/src/auth/workos.ts +20 −1
apps/cloud/src/engine/execution-stack.ts +1 −0
apps/cloud/src/env-augment.d.ts +5 −0
apps/cloud/src/extensions/billing/route.ts +1 −0
apps/cloud/src/extensions/billing/service.test-layer.ts +0 −36
apps/cloud/src/extensions/billing/service.ts +5 −1
apps/cloud/src/extensions/routes.ts +1 −5
apps/cloud/src/testing/e2e-stub.ts +0 −21
bun.lock +91 −13
e2e/cloud/org-limit.test.ts +7 −3
e2e/cloud/org-switcher.test.ts +3 −1
e2e/package.json +2 −0
e2e/setup/boot.ts +8 −3
e2e/setup/cloud.globalsetup.ts +45 −21
e2e/src/surfaces/mcp.ts +1 −1
e2e/targets/cloud.ts +70 −25
e2e/targets/selfhost.ts +1 −1
packages/plugins/workos-vault/src/sdk/client.ts +15 −0
vendor/emulate +1 −1

apps/cloud/executor.config.ts+2−0

   readonly workosCredentials?: {
     readonly apiKey: string;
     readonly clientId: string;
+    /** Optional WorkOS API base-URL override (WorkOS emulator in tests/dev). */
+    readonly apiUrl?: string;
   };
   /** Pluggable WorkOS Vault HTTP client — set by the test harness to
    *  bypass the real WorkOS API. Production leaves this undefined and

apps/cloud/src/app.ts+4−7

 import { cloudPlugins } from "./plugins";
 import { CoreSharedServices } from "./auth/workos";
-import { E2E_STUB, E2EStubWorkOSLayer } from "./testing/e2e-stub";
 import { makeCloudExtensionRoutes } from "./extensions/routes";
 import { RequestScopedServicesLive } from "./api/layers";
 import { CloudMeteringEngineDecorator } from "./engine/execution-stack-metered";
 // the account provider + MCP seam, AND by the per-request identity layer below).
 // Lives in `boot`, so `workosIdentityLayer`'s residual `WorkOSClient |
 // ApiKeyService` (the long-lived control plane it reads) resolves from there.
-// EXECUTOR_E2E_STUB swaps the WorkOS control plane for an in-memory stub whose
+// Tests point the REAL client at a WorkOS emulator via WORKOS_API_URL — no
-// `authenticateSealedSession` resolves to user_1 — so the whole app (session +
+// layer substitution.
-// account + SSR) is logged in with no real WorkOS. Off in production.
+const apiKeyService = ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices));
-const workOSBase = E2E_STUB ? E2EStubWorkOSLayer : CoreSharedServices;
+const controlPlane = Layer.mergeAll(CoreSharedServices, apiKeyService);
-const apiKeyService = ApiKeyService.WorkOS.pipe(Layer.provide(workOSBase));
-const controlPlane = Layer.mergeAll(workOSBase, apiKeyService);
 // `CloudDbProvider` only reads the per-request `DbService` at runtime; we widen
 // its residual type to also carry the boot `AutumnService` the metering

apps/cloud/src/auth/api-keys.test-layer.ts+0−11

@@ -1,11 +0,0 @@
1	import { Effect, Layer } from "effect";
2
3	import { ApiKeyService } from "./api-keys";
4	import { ApiKeyManagementError } from "./errors";
5
6	export const ApiKeyServiceTestLayer = Layer.succeed(ApiKeyService)({
7	validate: () => Effect.succeed(null),
8	listUserKeys: () => Effect.succeed([]),
9	createUserKey: () => Effect.fail(new ApiKeyManagementError({ cause: "unstubbed" })),
10	revokeUserKey: () => Effect.void,
11	});

apps/cloud/src/auth/cloud-auth-api.test-context.ts+0−90

@@ -1,90 +0,0 @@
1	import { requestHandler } from "@tanstack/react-start/server";
2	import { Context, Effect, Layer } from "effect";
3	import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http";
4	import { HttpApiBuilder, HttpApiClient } from "effect/unstable/httpapi";
5
6	import {
7	AutumnTestLayer,
8	makeAutumnTestState,
9	type AutumnTestState,
10	} from "../extensions/billing/service.test-layer";
11	import { ApiKeyServiceTestLayer } from "./api-keys.test-layer";
12	import {
13	makeUserStoreTestState,
14	UserStoreTestLayer,
15	type UserStoreTestState,
16	} from "./context.test-layer";
17	import { CloudAuthPublicHandlers, CloudSessionAuthHandlers, NonProtectedApi } from "./handlers";
18	import {
19	makeSessionTestContext,
20	SessionAuthTestLayer,
21	type SessionTestContext,
22	} from "./middleware.test-layer";
23	import { makeWorkOSTestState, WorkOSTestLayer, type WorkOSTestState } from "./workos.test-layer";
24
25	const TEST_BASE_URL = "http://test.local";
26	const SESSION_COOKIE = "wos-session=test_session";
27
28	export type CloudAuthApiTestState = {
29	readonly workos: WorkOSTestState;
30	readonly autumn: AutumnTestState;
31	readonly userStore: UserStoreTestState;
32	readonly session: SessionTestContext;
33	};
34
35	export const makeCloudAuthApiTestState = (
36	overrides: Partial<CloudAuthApiTestState> = {},
37	): CloudAuthApiTestState => ({
38	workos: makeWorkOSTestState(),
39	autumn: makeAutumnTestState(),
40	userStore: makeUserStoreTestState(),
41	session: makeSessionTestContext(),
42	...overrides,
43	});
44
45	const makeCloudAuthApiTestClient = (state: CloudAuthApiTestState) => {
46	const ApiLive = HttpApiBuilder.layer(NonProtectedApi).pipe(
47	Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
48	Layer.provide(SessionAuthTestLayer(state.session)),
49	Layer.provideMerge(WorkOSTestLayer(state.workos)),
50	Layer.provideMerge(AutumnTestLayer(state.autumn)),
51	Layer.provideMerge(UserStoreTestLayer(state.userStore)),
52	Layer.provideMerge(ApiKeyServiceTestLayer),
53	Layer.provideMerge(HttpServer.layerServices),
54	Layer.provideMerge(Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 })),
55	);
56
57	const handler = HttpRouter.toWebHandler(ApiLive, { disableLogger: true }).handler;
58	const startHandler = requestHandler((request) => handler(request, undefined));
59	const fetchViaHandler: typeof globalThis.fetch = async (input, init) => {
60	const request = input instanceof Request ? input : new Request(input, init);
61	request.headers.set("cookie", SESSION_COOKIE);
62	return await startHandler(request, undefined);
63	};
64	const clientLayer = FetchHttpClient.layer.pipe(
65	Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(fetchViaHandler)),
66	);
67
68	return HttpApiClient.make(NonProtectedApi, { baseUrl: TEST_BASE_URL }).pipe(
69	Effect.provide(clientLayer),
70	);
71	};
72
73	export type CloudAuthApiTestClient = Effect.Success<ReturnType<typeof makeCloudAuthApiTestClient>>;
74
75	export class CloudAuthApiTestContext extends Context.Service<
76	CloudAuthApiTestContext,
77	{
78	readonly state: CloudAuthApiTestState;
79	readonly client: CloudAuthApiTestClient;
80	}
81	>()("CloudAuthApiTestContext") {}
82
83	export const CloudAuthApiTestContextLayer = (state = makeCloudAuthApiTestState()) =>
84	Layer.effect(
85	CloudAuthApiTestContext,
86	Effect.gen(function* () {
87	const client = yield* makeCloudAuthApiTestClient(state);
88	return { state, client };
89	}),
90	);

apps/cloud/src/auth/context.test-layer.ts+0−41

@@ -1,41 +0,0 @@
1	import { Effect, Layer } from "effect";
2
3	import { UserStoreService } from "./context";
4
5	type UserStore = Parameters<Parameters<UserStoreService["Service"]["use"]>[0]>[0];
6
7	export type UserStoreTestState = {
8	readonly upsertedOrganizations: Array<{ readonly id: string; readonly name: string }>;
9	};
10
11	export const makeUserStoreTestState = (
12	overrides: Partial<UserStoreTestState> = {},
13	): UserStoreTestState => ({
14	upsertedOrganizations: [],
15	...overrides,
16	});
17
18	const testDate = () => new Date("2026-01-01T00:00:00.000Z");
19
20	const makeUserStoreTestService = (state: UserStoreTestState): UserStoreService["Service"] => {
21	const store = {
22	ensureAccount: async (id: string) => ({ id, createdAt: testDate() }),
23	getAccount: async (id: string) => ({ id, createdAt: testDate() }),
24	upsertOrganization: async (org: { readonly id: string; readonly name: string }) => {
25	state.upsertedOrganizations.push(org);
26	return { ...org, createdAt: testDate() };
27	},
28	getOrganization: async (id: string) => ({
29	id,
30	name: id,
31	createdAt: testDate(),
32	}),
33	} satisfies UserStore;
34
35	return {
36	use: (fn) => Effect.promise(() => fn(store)),
37	};
38	};
39
40	export const UserStoreTestLayer = (state: UserStoreTestState) =>
41	Layer.succeed(UserStoreService)(makeUserStoreTestService(state));

apps/cloud/src/auth/create-organization.e2e.node.test.ts+0−103

@@ -1,103 +0,0 @@
1	import { assert, describe, it } from "@effect/vitest";
2	import { Effect, Exit } from "effect";
3
4	import {
5	CloudAuthApiTestContext,
6	CloudAuthApiTestContextLayer,
7	makeCloudAuthApiTestState,
8	} from "./cloud-auth-api.test-context";
9	import { makeWorkOSTestMembership, makeWorkOSTestState } from "./workos.test-layer";
10	import { makeAutumnTestState } from "../extensions/billing/service.test-layer";
11
12	describe("create organization API", () => {
13	it.effect("lets a paid user create another organization through the HTTP API client", () => {
14	const state = makeCloudAuthApiTestState({
15	workos: makeWorkOSTestState({
16	memberships: [
17	makeWorkOSTestMembership("org_free_1", "active"),
18	makeWorkOSTestMembership("org_free_2", "active"),
19	makeWorkOSTestMembership("org_paid", "active"),
20	],
21	}),
22	autumn: makeAutumnTestState({
23	subscriptionsByOrgId: {
24	org_paid: [{ planId: "team", status: "active" }],
25	},
26	}),
27	});
28
29	return Effect.gen(function* () {
30	const { client } = yield* CloudAuthApiTestContext;
31
32	const result = yield* client.cloudAuth.createOrganization({
33	payload: { name: "Paid Extra Org" },
34	});
35
36	assert.deepEqual(result, { id: "org_created", name: "Paid Extra Org" });
37	assert.deepEqual(state.workos.createdOrganizations, [
38	{ id: "org_created", name: "Paid Extra Org" },
39	]);
40	assert.deepEqual(state.workos.createdMemberships, [
41	{ organizationId: "org_created", userId: "user_1", roleSlug: "admin" },
42	]);
43	assert.deepEqual(state.userStore.upsertedOrganizations, [
44	{ id: "org_created", name: "Paid Extra Org" },
45	]);
46	}).pipe(Effect.provide(CloudAuthApiTestContextLayer(state)));
47	});
48
49	it.effect(
50	"rejects a free-only user at the free organization limit through the HTTP API client",
51	() => {
52	const state = makeCloudAuthApiTestState({
53	workos: makeWorkOSTestState({
54	memberships: [
55	makeWorkOSTestMembership("org_free_1", "active"),
56	makeWorkOSTestMembership("org_free_2", "active"),
57	makeWorkOSTestMembership("org_free_3", "active"),
58	],
59	}),
60	});
61
62	return Effect.gen(function* () {
63	const { client } = yield* CloudAuthApiTestContext;
64
65	const exit = yield* Effect.exit(
66	client.cloudAuth.createOrganization({
67	payload: { name: "Blocked Org" },
68	}),
69	);
70
71	assert.isTrue(Exit.isFailure(exit));
72	assert.deepEqual(state.workos.createdOrganizations, []);
73	assert.deepEqual(state.workos.createdMemberships, []);
74	assert.deepEqual(state.userStore.upsertedOrganizations, []);
75	}).pipe(Effect.provide(CloudAuthApiTestContextLayer(state)));
76	},
77	);
78
79	it.effect("does not count pending memberships toward the free organization limit", () => {
80	const state = makeCloudAuthApiTestState({
81	workos: makeWorkOSTestState({
82	memberships: [
83	makeWorkOSTestMembership("org_free_1", "active"),
84	makeWorkOSTestMembership("org_free_2", "active"),
85	makeWorkOSTestMembership("org_invited", "pending"),
86	],
87	}),
88	});
89
90	return Effect.gen(function* () {
91	const { client } = yield* CloudAuthApiTestContext;
92
93	const result = yield* client.cloudAuth.createOrganization({
94	payload: { name: "Below Active Limit" },
95	});
96
97	assert.deepEqual(result, { id: "org_created", name: "Below Active Limit" });
98	assert.deepEqual(state.workos.createdOrganizations, [
99	{ id: "org_created", name: "Below Active Limit" },
100	]);
101	}).pipe(Effect.provide(CloudAuthApiTestContextLayer(state)));
102	});
103	});

apps/cloud/src/auth/middleware.test-layer.ts+0−29

@@ -1,29 +0,0 @@
1	import { Effect, Layer } from "effect";
2
3	import { SessionAuth, SessionContext, SessionCookies, type Session } from "./middleware";
4
5	export type SessionTestContext = Session;
6
7	export const makeSessionTestContext = (
8	overrides: Partial<SessionTestContext> = {},
9	): SessionTestContext => ({
10	accountId: "user_1",
11	email: "test@example.com",
12	name: "Test User",
13	avatarUrl: null,
14	organizationId: "org_existing_1",
15	sealedSession: "test_session",
16	refreshedSession: null,
17	...overrides,
18	});
19
20	export const SessionAuthTestLayer = (session: Session = makeSessionTestContext()) =>
21	Layer.succeed(SessionAuth)({
22	cookie: (httpEffect) =>
23	httpEffect.pipe(
24	Effect.provideService(SessionContext, session),
25	// The session handlers driven via this layer don't assert cookie output;
26	// a no-op setter satisfies the SessionCookies the middleware provides.
27	Effect.provideService(SessionCookies, { set: () => {} }),
28	),
29	});

apps/cloud/src/auth/workos.test-layer.ts+0−206

@@ -1,206 +0,0 @@
1	import { Data, Effect, Layer } from "effect";
2	import type { Organization, OrganizationMembership, OrganizationRole } from "@workos-inc/node";
3
4	import { WorkOSClient, type WorkOSCollectedList } from "./workos";
5
6	export type WorkOSTestState = {
7	readonly memberships: readonly OrganizationMembership[];
8	// When set, a successful create adds a unique org id + an active membership,
9	// so a running server's free-org limit trips live across requests. Off by
10	// default — existing tests keep the fixed `org_created` id and static list.
11	readonly growMembershipsOnCreate?: boolean;
12	// When set, the user is resolved from the `wos-session` cookie value and
13	// memberships are keyed per user — so each test/browser picks its own user id
14	// and is isolated on a shared instance (no reset needed), matching the
15	// in-process per-org harness. Implies grow-on-create.
16	readonly multiUser?: boolean;
17	readonly createdOrganizations: Array<{ readonly id: string; readonly name: string }>;
18	readonly createdMemberships: Array<{
19	readonly organizationId: string;
20	readonly userId: string;
21	readonly roleSlug: string \| undefined;
22	}>;
23	};
24
25	export class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{
26	readonly method: string;
27	}> {}
28
29	export const makeWorkOSTestState = (overrides: Partial<WorkOSTestState> = {}): WorkOSTestState => ({
30	memberships: [],
31	createdOrganizations: [],
32	createdMemberships: [],
33	...overrides,
34	});
35
36	export const WorkOSTestRole: OrganizationRole = {
37	object: "role",
38	id: "role_admin",
39	name: "Admin",
40	slug: "admin",
41	description: null,
42	permissions: [],
43	resourceTypeSlug: "organization",
44	type: "OrganizationRole",
45	createdAt: "2026-01-01T00:00:00.000Z",
46	updatedAt: "2026-01-01T00:00:00.000Z",
47	};
48
49	export const makeWorkOSTestOrganization = (id: string, name = id): Organization => ({
50	object: "organization",
51	id,
52	name,
53	allowProfilesOutsideOrganization: false,
54	domains: [],
55	createdAt: "2026-01-01T00:00:00.000Z",
56	updatedAt: "2026-01-01T00:00:00.000Z",
57	externalId: null,
58	metadata: {},
59	});
60
61	export const makeWorkOSTestMembership = (
62	organizationId: string,
63	status: OrganizationMembership["status"],
64	) =>
65	({
66	object: "organization_membership",
67	id: `membership_${organizationId}`,
68	organizationId,
69	organizationName: organizationId,
70	status,
71	userId: "user_1",
72	role: WorkOSTestRole,
73	directoryManaged: false,
74	createdAt: "2026-01-01T00:00:00.000Z",
75	updatedAt: "2026-01-01T00:00:00.000Z",
76	customAttributes: {},
77	}) satisfies OrganizationMembership;
78
79	const decode = (value: string): string => {
80	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: tolerate non-URL-encoded cookie values from direct API callers
81	try {
82	return decodeURIComponent(value);
83	} catch {
84	return value;
85	}
86	};
87
88	const collected = <A>(data: readonly A[]): WorkOSCollectedList<A> => ({
89	object: "list",
90	data: [...data],
91	listMetadata: {
92	before: null,
93	after: null,
94	},
95	});
96
97	const makeWorkOSTestService = (state: WorkOSTestState): WorkOSClient["Service"] => {
98	const nextOrgId = "org_created";
99	let orgCounter = 0;
100	// Per-user membership buckets (multi-user mode). Closure-scoped, so they live
101	// for the layer's lifetime (= the running server) and isolate users from each
102	// other without a reset.
103	const byUser = new Map<string, OrganizationMembership[]>();
104	const memsFor = (userId: string) => {
105	let m = byUser.get(userId);
106	if (!m) byUser.set(userId, (m = []));
107	return m;
108	};
109	const grows = state.multiUser \|\| state.growMembershipsOnCreate;
110	const service: Partial<WorkOSClient["Service"]> = {
111	listUserMemberships: (userId: string) =>
112	Effect.succeed(collected(state.multiUser ? memsFor(userId) : state.memberships)),
113	createOrganization: (name) =>
114	Effect.sync(() => {
115	const id = grows ? `${nextOrgId}_${++orgCounter}` : nextOrgId;
116	const org = makeWorkOSTestOrganization(id, name);
117	state.createdOrganizations.push({ id: org.id, name: org.name });
118	return org;
119	}),
120	createMembership: (organizationId, userId, roleSlug) =>
121	Effect.sync(() => {
122	state.createdMemberships.push({ organizationId, userId, roleSlug });
123	const membership = makeWorkOSTestMembership(organizationId, "active");
124	if (state.multiUser) memsFor(userId).push(membership);
125	else if (state.growMembershipsOnCreate) {
126	(state.memberships as OrganizationMembership[]).push(membership);
127	}
128	return membership;
129	}),
130	getOrganization: (organizationId: string) =>
131	Effect.succeed(makeWorkOSTestOrganization(organizationId)),
132	// The create-org page polls pending invitations; no invitation flows in
133	// the stub world, so the list is always empty.
134	listInvitationsByEmail: (_email: string) => Effect.succeed(collected([])),
135	getUserOrgMembership: (organizationId: string, _userId: string) =>
136	Effect.succeed(makeWorkOSTestMembership(organizationId, "active")),
137	// Multi-user refresh carries the user id forward + the switched-to org, so the
138	// create-org handler's `verified.organizationId === org.id` check passes and
139	// the user stays consistent across the refresh. The incoming sealed session
140	// may be URL-encoded (set-cookie round-trip through a real browser) and may
141	// already carry an `\|org:` suffix from a previous switch — normalize both.
142	refreshSession: (sealedSession, organizationId) =>
143	Effect.succeed(
144	state.multiUser
145	? `${userOf(sealedSession)}\|org:${organizationId}`
146	: `session_${organizationId}`,
147	),
148	authenticateSealedSession: (sealedSession) => Effect.sync(() => sessionOf(sealedSession)),
149	// The protected-API identity path (`resolveSessionPrincipal`) authenticates
150	// from the Request; mirror the real client's cookie-parse + delegate.
151	authenticateRequest: (request: Request) =>
152	Effect.sync(() => {
153	const match = /(?:^\|;\s*)wos-session=([^;]+)/.exec(request.headers.get("cookie") ?? "");
154	return match ? sessionOf(decodeURIComponent(match[1]!)) : null;
155	}),
156	};
157
158	function userOf(sealedSession: string): string {
159	return decode(sealedSession).split("\|org:")[0] \|\| "user_1";
160	}
161
162	function sessionOf(sealedSession: string) {
163	if (state.multiUser) {
164	// Cookie is `<userId>` (initial) or `<userId>\|org:<orgId>` (after refresh);
165	// a browser round-trip URL-encodes it. The LAST org segment is current.
166	const parts = decode(sealedSession).split("\|org:");
167	const userPart = parts[0];
168	const orgPart = parts.length > 1 ? parts[parts.length - 1] : undefined;
169	return {
170	userId: userPart \|\| "user_1",
171	email: "test@example.com",
172	firstName: "Test",
173	lastName: "User",
174	avatarUrl: null,
175	organizationId: orgPart ?? "",
176	sessionId: "session_id",
177	refreshedSession: undefined,
178	};
179	}
180	return {
181	userId: "user_1",
182	email: "test@example.com",
183	firstName: "Test",
184	lastName: "User",
185	avatarUrl: null,
186	organizationId: sealedSession.replace("session_", ""),
187	sessionId: "session_id",
188	refreshedSession: undefined,
189	};
190	}
191
192	return new Proxy(service as WorkOSClient["Service"], {
193	get: (target, prop) => {
194	if (prop in target) return target[prop as keyof typeof target];
195	return () =>
196	Effect.fail(
197	new UnstubbedWorkOSMethod({
198	method: typeof prop === "string" ? prop : (prop.description ?? "symbol"),
199	}),
200	);
201	},
202	});
203	};
204
205	export const WorkOSTestLayer = (state: WorkOSTestState) =>
206	Layer.succeed(WorkOSClient)(makeWorkOSTestService(state));

apps/cloud/src/auth/workos.ts+20−1

@@ -110,6 +110,25 @@ class WorkOSConfigurationError extends Data.TaggedError("WorkOSConfigurationErro · 109 unmodified lines
110	readonly message: string;	110	readonly message: string;
111	}> {}	111	}> {}
112		112
		113	/**
		114	* Optional base-URL override for the WorkOS API (`WORKOS_API_URL`) — points
		115	* the REAL SDK at a WorkOS emulator in tests/dev. Unset in production, where
		116	* the SDK uses api.workos.com. Sealed-session crypto, JWKS verification, and
		117	* every endpoint follow this host, so the whole auth stack runs against the
		118	* emulator with zero code substitution.
		119	*/
		120	export const workosApiUrlOptions = (
		121	url: string \| undefined,
		122	): { apiHostname?: string; port?: number; https?: boolean } => {
		123	if (!url) return {};
		124	const parsed = new URL(url);
		125	return {
		126	apiHostname: parsed.hostname,
		127	...(parsed.port ? { port: Number(parsed.port) } : {}),
		128	https: parsed.protocol === "https:",
		129	};
		130	};
		131
113	// ---------------------------------------------------------------------------	132	// ---------------------------------------------------------------------------
114	// Service	133	// Service
115	// ---------------------------------------------------------------------------	134	// ---------------------------------------------------------------------------
@@ -125,7 +144,7 @@ const make = Effect.gen(function* () { · 9 unmodified lines
125	});	144	});
126	}	145	}
127		146
128	const workos = new WorkOS({ apiKey, clientId });	147	const workos = new WorkOS({ apiKey, clientId, ...workosApiUrlOptions(env.WORKOS_API_URL) });
129		148
130	const use = <A>(fn: (wos: WorkOS) => Promise<A>) =>	149	const use = <A>(fn: (wos: WorkOS) => Promise<A>) =>
131	withServiceLogging(	150	withServiceLogging(

apps/cloud/src/engine/execution-stack.ts+1−0

@@ -62,6 +62,7 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 61 unmodified lines
62	workosCredentials: {	62	workosCredentials: {
63	apiKey: env.WORKOS_API_KEY,	63	apiKey: env.WORKOS_API_KEY,
64	clientId: env.WORKOS_CLIENT_ID,	64	clientId: env.WORKOS_CLIENT_ID,
		65	apiUrl: env.WORKOS_API_URL,
65	},	66	},
66	}),	67	}),
67	});	68	});

apps/cloud/src/env-augment.d.ts+5−0

       // Billing
       AUTUMN_SECRET_KEY?: string;
+      /** Optional Autumn base-URL override (Autumn emulator in tests/dev). */
+      AUTUMN_API_URL?: string;
+      /** Optional WorkOS base-URL override (WorkOS emulator in tests/dev). */
+      WORKOS_API_URL?: string;
       // MCP
       EXECUTOR_MCP_DEBUG?: string;

apps/cloud/src/extensions/billing/route.ts+1−0

@@ -57,6 +57,7 @@ const handler = Effect.gen(function* () { · 56 unmodified lines
57	},	57	},
58	clientOptions: {	58	clientOptions: {
59	secretKey: env.AUTUMN_SECRET_KEY ?? "",	59	secretKey: env.AUTUMN_SECRET_KEY ?? "",
		60	...(env.AUTUMN_API_URL ? { serverURL: env.AUTUMN_API_URL } : {}),
60	},	61	},
61	pathPrefix: "/api/billing",	62	pathPrefix: "/api/billing",
62	}),	63	}),

apps/cloud/src/extensions/billing/service.test-layer.ts+0−36

@@ -1,36 +0,0 @@
1	import { Effect, Layer } from "effect";
2	import type { Autumn } from "autumn-js";
3
4	import { AutumnService, type IAutumnService } from "./service";
5
6	export type AutumnTestSubscriptionSummary = {
7	readonly planId?: string \| null;
8	readonly status?: string \| null;
9	};
10
11	export type AutumnTestState = {
12	readonly subscriptionsByOrgId: Readonly<Record<string, readonly AutumnTestSubscriptionSummary[]>>;
13	};
14
15	export const makeAutumnTestState = (overrides: Partial<AutumnTestState> = {}): AutumnTestState => ({
16	subscriptionsByOrgId: {},
17	...overrides,
18	});
19
20	const makeAutumnTestService = (state: AutumnTestState): IAutumnService => {
21	const fakeClient = {
22	customers: {
23	getOrCreate: async ({ customerId }: { readonly customerId: string }) => ({
24	subscriptions: state.subscriptionsByOrgId[customerId] ?? [],
25	}),
26	},
27	} as Autumn;
28
29	return {
30	use: (fn) => Effect.promise(() => fn(fakeClient)),
31	trackExecution: () => Effect.void,
32	};
33	};
34
35	export const AutumnTestLayer = (state: AutumnTestState) =>
36	Layer.succeed(AutumnService)(makeAutumnTestService(state));

apps/cloud/src/extensions/billing/service.ts+5−1

     } satisfies IAutumnService;
   }
-  const client = new Autumn({ secretKey });
+  // AUTUMN_API_URL points the real SDK at an Autumn emulator in tests/dev.
+  const client = new Autumn({
+    secretKey,
+    ...(env.AUTUMN_API_URL ? { serverURL: env.AUTUMN_API_URL } : {}),
+  });
   const use = <A>(fn: (client: Autumn) => Promise<A>) =>
     Effect.tryPromise({

apps/cloud/src/extensions/routes.ts+1−5

 } from "../auth/handlers";
 import { CloudAuthApi, CloudAuthPublicApi } from "../auth/api";
 import { OrgAuthLive, SessionAuthLive } from "../auth/middleware-live";
-import { E2E_STUB, E2EStubAutumnLayer } from "../testing/e2e-stub";
 import { OrgApi, OrgHttpApi } from "../org/api";
 import { OrgHandlers } from "../org/handlers";
 import { AutumnService } from "../extensions/billing/service";
   const SessionRoutes = HttpApiBuilder.layer(NonProtectedApi).pipe(
     Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
     Layer.provide(requestScopedMiddleware(rsLive).layer),
-    // SessionAuthLive resolves the user from the wos-session cookie via WorkOSClient
-    // — which is the stub under EXECUTOR_E2E_STUB (app.ts), so the user is the cookie
-    // value. Only Autumn is swapped to the free-plan stub here. Off in production.
     Layer.provideMerge(SessionAuthLive),
-    Layer.provideMerge(E2E_STUB ? E2EStubAutumnLayer : AutumnService.Default),
+    Layer.provideMerge(AutumnService.Default),
     Layer.provide(apiPrefixedRouter),
   );

apps/cloud/src/testing/e2e-stub.ts+0−21

@@ -1,21 +0,0 @@
1	// Env-gated stub layers that turn `vite dev` into a fully-stubbed, logged-in
2	// instance — one target every surface (browser / API / MCP / CLI) can drive,
3	// replacing the bespoke in-process harnesses + e2e-server wiring.
4	//
5	// Enabled by `EXECUTOR_E2E_STUB=1`. NEVER set in production — when unset, the
6	// served route composition is byte-for-byte the real `*Live` layers.
7	import { WorkOSTestLayer, makeWorkOSTestState } from "../auth/workos.test-layer";
8	import { AutumnTestLayer, makeAutumnTestState } from "../extensions/billing/service.test-layer";
9
10	export const E2E_STUB = process.env.EXECUTOR_E2E_STUB === "1";
11
12	// Multi-user stub WorkOS: the `wos-session` cookie value IS the user id, with
13	// per-user membership buckets — so each test/browser picks a fresh user and is
14	// isolated on the one shared instance (no reset). Swapped in for
15	// `CoreSharedServices`, it authenticates every surface (session routes,
16	// /account/me, SSR) with no real WorkOS.
17	const workos = makeWorkOSTestState({ memberships: [], multiUser: true });
18	const autumn = makeAutumnTestState({}); // no paid subscription → free plan → 3-org limit applies
19
20	export const E2EStubWorkOSLayer = WorkOSTestLayer(workos);
21	export const E2EStubAutumnLayer = AutumnTestLayer(autumn);

bun.lock+91−13

       "version": "0.0.3",
       "dependencies": {
         "@executor-js/api": "workspace:*",
+        "@executor-js/emulate": "^0.6.0",
+        "@executor-js/mcporter": "^0.11.4",
         "@executor-js/plugin-graphql": "workspace:*",
         "@executor-js/plugin-mcp": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/e2e": ["@executor-js/e2e@workspace:e2e"],
+    "@executor-js/emulate": ["@executor-js/emulate@0.6.0", "", { "dependencies": { "commander": "^14", "graphql": "^16.9.0", "jose": "^6", "picocolors": "^1.1.1", "yaml": "^2" }, "bin": { "emulate": "dist/index.js" } }, "sha512-GtQsuLRZhD8LKu57IuHsHlLpTgho+JMhkvdFfj/DGsFlm7Gs4KzlUP7fuuZ/zrf/c7ue1urdUNEO1I2y0/a2pg=="],
     "@executor-js/example-all-plugins": ["@executor-js/example-all-plugins@workspace:examples/all-plugins"],
     "@executor-js/example-docs-sdk-quickstart": ["@executor-js/example-docs-sdk-quickstart@workspace:examples/docs-sdk-quickstart"],
     "@executor-js/marketing": ["@executor-js/marketing@workspace:apps/marketing"],
+    "@executor-js/mcporter": ["@executor-js/mcporter@0.11.4", "", { "dependencies": { "@iarna/toml": "^2.2.5", "@modelcontextprotocol/sdk": "^1.29.0", "acorn": "^8.16.0", "commander": "^14.0.3", "es-toolkit": "^1.47.0", "jsonc-parser": "^3.3.1", "ora": "^9.4.0", "rolldown": "1.0.1", "zod": "^4.3.6" }, "bin": { "mcporter": "dist/cli.js" } }, "sha512-KewlNnqmzSkJAH7JS/2le9WxPWzL/ND7Pt/G5KGgfrSK9K9cE8UPIsEYZYZUJYoFnbCBzhlU9ugg59ptv1h3Ow=="],
     "@executor-js/plugin-desktop-settings": ["@executor-js/plugin-desktop-settings@workspace:packages/plugins/desktop-settings"],
     "@executor-js/plugin-encrypted-secrets": ["@executor-js/plugin-encrypted-secrets@workspace:packages/plugins/encrypted-secrets"],
     "@hookform/resolvers": ["@hookform/resolvers@5.2.2", "", { "dependencies": { "@standard-schema/utils": "^0.3.0" }, "peerDependencies": { "react-hook-form": "^7.55.0" } }, "sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA=="],
+    "@iarna/toml": ["@iarna/toml@2.2.5", "", {}, "sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg=="],
     "@iconify/types": ["@iconify/types@2.0.0", "", {}, "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg=="],
     "@iconify/utils": ["@iconify/utils@3.1.0", "", { "dependencies": { "@antfu/install-pkg": "^1.1.0", "@iconify/types": "^2.0.0", "mlly": "^1.8.0" } }, "sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw=="],
     "es-set-tostringtag": ["es-set-tostringtag@2.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA=="],
-    "es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
+    "es-toolkit": ["es-toolkit@1.47.0", "", {}, "sha512-n1GuoD0WEQZMBk5tttoZSqwgyLx01oqa5XsBmCHwPyNe1S9jPBEmtR2pSgp2kJuWE3ciFZ6yRHmY4pM4C3OOkw=="],
     "es6-error": ["es6-error@4.1.1", "", {}, "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg=="],
     "lodash.startcase": ["lodash.startcase@4.4.0", "", {}, "sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg=="],
-    "log-symbols": ["log-symbols@6.0.0", "", { "dependencies": { "chalk": "^5.3.0", "is-unicode-supported": "^1.3.0" } }, "sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw=="],
+    "log-symbols": ["log-symbols@7.0.1", "", { "dependencies": { "is-unicode-supported": "^2.0.0", "yoctocolors": "^2.1.1" } }, "sha512-ja1E3yCr9i/0hmBVaM0bfwDjnGy8I/s6PP4DFp+yP+a+mrHO4Rm7DtmnqROTUkHIkqffC84YY7AeqX6oFk0WFg=="],
     "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
     "openapi-types": ["openapi-types@12.1.3", "", {}, "sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw=="],
-    "ora": ["ora@8.2.0", "", { "dependencies": { "chalk": "^5.3.0", "cli-cursor": "^5.0.0", "cli-spinners": "^2.9.2", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.0.0", "log-symbols": "^6.0.0", "stdin-discarder": "^0.2.2", "string-width": "^7.2.0", "strip-ansi": "^7.1.0" } }, "sha512-weP+BZ8MVNnlCm8c0Qdc1WSWq4Qn7I+9CJGm7Qali6g44e/PUzbjNqJX5NJ9ljlNMosfJvg1fKEGILklK9cwnw=="],
+    "ora": ["ora@9.4.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ=="],
     "outdent": ["outdent@0.5.0", "", {}, "sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q=="],
     "std-env": ["std-env@4.1.0", "", {}, "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ=="],
-    "stdin-discarder": ["stdin-discarder@0.2.2", "", {}, "sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ=="],
+    "stdin-discarder": ["stdin-discarder@0.3.2", "", {}, "sha512-eCPu1qRxPVkl5605OTWF8Wz40b4Mf45NY5LQmVPQ599knfs5QhASUm9GbJ5BDMDOXgrnh0wyEdvzmL//YMlw0A=="],
     "streamdown": ["streamdown@2.5.0", "", { "dependencies": { "clsx": "^2.1.1", "hast-util-to-jsx-runtime": "^2.3.6", "html-url-attributes": "^3.0.1", "marked": "^17.0.1", "mermaid": "^11.12.2", "rehype-harden": "^1.1.8", "rehype-raw": "^7.0.0", "rehype-sanitize": "^6.0.0", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remend": "1.3.0", "tailwind-merge": "^3.4.0", "unified": "^11.0.5", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.0" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" } }, "sha512-/tTnURfIOxZK/pqJAxsfCvETG/XCJHoWnk3jq9xLcuz6CSpnjjuxSRBTTL4PKGhxiZQf0lqPxGhImdpwcZ2XwA=="],
     "@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],
+    "@executor-js/emulate/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+    "@executor-js/emulate/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="],
     "@executor-js/example-all-plugins/typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
     "@executor-js/example-promise-sdk/typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
     "@executor-js/fumadb/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+    "@executor-js/mcporter/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+    "@executor-js/mcporter/rolldown": ["rolldown@1.0.1", "", { "dependencies": { "@oxc-project/types": "=0.130.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.1", "@rolldown/binding-darwin-arm64": "1.0.1", "@rolldown/binding-darwin-x64": "1.0.1", "@rolldown/binding-freebsd-x64": "1.0.1", "@rolldown/binding-linux-arm-gnueabihf": "1.0.1", "@rolldown/binding-linux-arm64-gnu": "1.0.1", "@rolldown/binding-linux-arm64-musl": "1.0.1", "@rolldown/binding-linux-ppc64-gnu": "1.0.1", "@rolldown/binding-linux-s390x-gnu": "1.0.1", "@rolldown/binding-linux-x64-gnu": "1.0.1", "@rolldown/binding-linux-x64-musl": "1.0.1", "@rolldown/binding-openharmony-arm64": "1.0.1", "@rolldown/binding-wasm32-wasi": "1.0.1", "@rolldown/binding-win32-arm64-msvc": "1.0.1", "@rolldown/binding-win32-x64-msvc": "1.0.1" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ=="],
     "@graphql-tools/executor/@graphql-tools/utils": ["@graphql-tools/utils@11.1.0", "", { "dependencies": { "@graphql-typed-document-node/core": "^3.1.1", "@whatwg-node/promise-helpers": "^1.0.0", "cross-inspect": "1.0.1", "tslib": "^2.4.0" }, "peerDependencies": { "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, "sha512-PtFVG4r8Z2LEBSaPYQMusBiB3o6kjLVJyjCLbnWem/SpSuM21v6LTmgpkXfYU1qpBV2UGsFyuEnSJInl8fR1Ag=="],
     "@graphql-tools/merge/@graphql-tools/utils": ["@graphql-tools/utils@11.1.0", "", { "dependencies": { "@graphql-typed-document-node/core": "^3.1.1", "@whatwg-node/promise-helpers": "^1.0.0", "cross-inspect": "1.0.1", "tslib": "^2.4.0" }, "peerDependencies": { "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, "sha512-PtFVG4r8Z2LEBSaPYQMusBiB3o6kjLVJyjCLbnWem/SpSuM21v6LTmgpkXfYU1qpBV2UGsFyuEnSJInl8fR1Ag=="],
     "@lobehub/fluent-emoji/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+    "@lobehub/fluent-emoji/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
     "@lobehub/fluent-emoji/lucide-react": ["lucide-react@0.562.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-82hOAu7y0dbVuFfmO4bYF1XEwYk/mEbM5E+b1jgci/udUBEE/R7LF5Ip0CCEmXe8AybRM8L+04eP+LGZeDvkiw=="],
+    "@lobehub/icons/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
     "@lobehub/icons/lucide-react": ["lucide-react@0.469.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-28vvUnnKQ/dBwiCQtwJw7QauYnE7yd2Cyp4tTTJpvglX4EMpbflcdBgrgToX2j71B3YvugK/NH3BGUk+E/p/Fw=="],
     "@lobehub/ui/@base-ui/react": ["@base-ui/react@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.28.4", "@base-ui/utils": "0.2.3", "@floating-ui/react-dom": "^2.1.6", "@floating-ui/utils": "^0.2.10", "reselect": "^5.1.1", "tabbable": "^6.3.0", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "@types/react": "^17 || ^18 || ^19", "react": "^17 || ^18 || ^19", "react-dom": "^17 || ^18 || ^19" }, "optionalPeers": ["@types/react"] }, "sha512-4USBWz++DUSLTuIYpbYkSgy1F9ZmNG9S/lXvlUN6qMK0P0RlW+6eQmDUB4DgZ7HVvtXl4pvi4z5J2fv6Z3+9hg=="],
     "@lobehub/ui/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.4", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA=="],
+    "@lobehub/ui/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
     "@lobehub/ui/immer": ["immer@11.1.4", "", {}, "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw=="],
     "@lobehub/ui/marked": ["marked@17.0.6", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-gB0gkNafnonOw0obSTEGZTT86IuhILt2Wfx0mWH/1Au83kybTayroZ/V6nS25mN7u8ASy+5fMhgB3XPNrOZdmA=="],
     "@react-grab/cli/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+    "@react-grab/cli/ora": ["ora@8.2.0", "", { "dependencies": { "chalk": "^5.3.0", "cli-cursor": "^5.0.0", "cli-spinners": "^2.9.2", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.0.0", "log-symbols": "^6.0.0", "stdin-discarder": "^0.2.2", "string-width": "^7.2.0", "strip-ansi": "^7.1.0" } }, "sha512-weP+BZ8MVNnlCm8c0Qdc1WSWq4Qn7I+9CJGm7Qali6g44e/PUzbjNqJX5NJ9ljlNMosfJvg1fKEGILklK9cwnw=="],
     "@reduxjs/toolkit/immer": ["immer@11.1.4", "", {}, "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw=="],
     "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
     "import-fresh/resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
+    "ink/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
     "ink/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
     "ink/type-fest": ["type-fest@5.5.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-PlBfpQwiUvGViBNX84Yxwjsdhd1TUlXr6zjX7eoirtCPIr08NAmxwa+fcYBTeRQxHo9YC9wwF3m9i700sHma8g=="],
     "libsql/detect-libc": ["detect-libc@2.0.2", "", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="],
-    "log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
     "matcher/escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
     "mdast-util-find-and-replace/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
     "ora/cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
-    "ora/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+    "ora/cli-spinners": ["cli-spinners@3.4.0", "", {}, "sha512-bXfOC4QcT1tKXGorxL3wbJm6XJPDqEnij2gQ2m7ESQuE+/z9YFIWnl/5RpTiKWbMq3EVKR4fRLJGn6DVfu0mpw=="],
-    "ora/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
     "p-locate/p-limit": ["p-limit@2.3.0", "", { "dependencies": { "p-try": "^2.0.0" } }, "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w=="],
     "readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+    "recharts/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
     "restore-cursor/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
     "rimraf/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
     "@esbuild-kit/core-utils/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.18.20", "", { "os": "win32", "cpu": "x64" }, "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ=="],
+    "@executor-js/mcporter/rolldown/@oxc-project/types": ["@oxc-project/types@0.130.0", "", {}, "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.1", "", { "os": "android", "cpu": "arm64" }, "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.1", "", { "os": "linux", "cpu": "arm" }, "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.1", "", { "os": "linux", "cpu": "x64" }, "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.1", "", { "os": "linux", "cpu": "x64" }, "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.1", "", { "os": "none", "cpu": "arm64" }, "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.1", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.1", "", { "os": "win32", "cpu": "x64" }, "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ=="],
+    "@executor-js/mcporter/rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
     "@inquirer/core/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
     "@inquirer/core/wrap-ansi/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
     "@pierre/diffs/shiki/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
+    "@react-grab/cli/ora/cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
+    "@react-grab/cli/ora/log-symbols": ["log-symbols@6.0.0", "", { "dependencies": { "chalk": "^5.3.0", "is-unicode-supported": "^1.3.0" } }, "sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw=="],
+    "@react-grab/cli/ora/stdin-discarder": ["stdin-discarder@0.2.2", "", {}, "sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ=="],
+    "@react-grab/cli/ora/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+    "@react-grab/cli/ora/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
     "@types/better-sqlite3/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
     "@types/cacheable-request/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
     "ora/cli-cursor/restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
-    "ora/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
-    "ora/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/core": ["@opentelemetry/core@2.2.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw=="],
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/otlp-exporter-base": ["@opentelemetry/otlp-exporter-base@0.208.0", "", { "dependencies": { "@opentelemetry/core": "2.2.0", "@opentelemetry/otlp-transformer": "0.208.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-gMd39gIfVb2OgxldxUtOwGJYSH8P1kVFFlJLuut32L6KgUC4gl1dMhn+YC2mGn0bDOiQYSk/uHOdSjuKp58vvA=="],
     "@electron/universal/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+    "@executor-js/mcporter/rolldown/@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
     "@inquirer/core/wrap-ansi/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
     "@libsql/kysely-libsql/@libsql/client/@libsql/hrana-client/node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="],
     "@libsql/kysely-libsql/@libsql/client/libsql/detect-libc": ["detect-libc@2.0.2", "", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="],
+    "@react-grab/cli/ora/cli-cursor/restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
+    "@react-grab/cli/ora/log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
+    "@react-grab/cli/ora/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+    "@react-grab/cli/ora/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
     "agents/yargs/cliui/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
     "agents/yargs/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
     "rimraf/glob/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
+    "@react-grab/cli/ora/cli-cursor/restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
     "agents/yargs/cliui/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
     "agents/yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],

e2e/cloud/org-limit.test.ts+7−3

         const openCreateOrgModal = async (currentOrg: string) => {
           await page.getByRole("button", { name: /Test User/ }).click();
-          // The org entry + "Create organization" are radix menu items; role
+          // The org entry is a radix submenu trigger; its content loads the
-          // locators keep us off the look-alike trigger button beneath.
+          // org list from the API, so wait for the sub-content to mount and
+          // click "Create organization" scoped INSIDE it — clicking during
+          // the loading re-render dismisses the whole menu.
           await page.getByRole("menuitem", { name: currentOrg }).click();
-          await page.getByRole("menuitem", { name: "Create organization" }).click();
+          const subContent = page.locator('[data-slot="dropdown-menu-sub-content"]');
+          await subContent.waitFor({ state: "visible" });
+          await subContent.getByText("Create organization", { exact: true }).click();
           await page.getByText("Add another organization").waitFor();
         };

e2e/cloud/org-switcher.test.ts+3−1

         await step('Open the org switcher and choose "Create organization"', async () => {
           await page.getByRole("button", { name: /Test User/ }).click();
           await page.getByRole("menuitem", { name: ORG_1 }).click();
-          await page.getByRole("menuitem", { name: "Create organization" }).click();
+          const subContent = page.locator('[data-slot="dropdown-menu-sub-content"]');
+          await subContent.waitFor({ state: "visible" });
+          await subContent.getByText("Create organization", { exact: true }).click();
           await page.getByText("Add another organization").waitFor();
         });

e2e/package.json+2−0

   },
   "dependencies": {
     "@executor-js/api": "workspace:*",
+    "@executor-js/emulate": "^0.6.0",
+    "@executor-js/mcporter": "^0.11.4",
     "@executor-js/plugin-graphql": "workspace:*",
     "@executor-js/plugin-mcp": "workspace:*",
     "@executor-js/plugin-openapi": "workspace:*",

e2e/setup/boot.ts+8−3

   };
 };
-export const waitForHttp = async (url: string, timeoutMs = 90_000): Promise<void> => {
+export const waitForHttp = async (
-  const deadline = Date.now() + timeoutMs;
+  url: string,
+  options: { readonly timeoutMs?: number; readonly expectRedirect?: boolean } = {},
+): Promise<void> => {
+  const deadline = Date.now() + (options.timeoutMs ?? 90_000);
   let lastError: unknown;
   while (Date.now() < deadline) {
     try {
       const response = await fetch(url, { redirect: "manual" });
-      if (response.status < 500) return;
+      // During a cold vite compile /api/* falls back to the SPA's 200 HTML —
+      // expectRedirect waits for the real handler (302) instead.
+      if (options.expectRedirect ? response.status === 302 : response.status < 500) return;
       lastError = new Error(`status ${response.status}`);
     } catch (error) {
       lastError = error;

e2e/setup/cloud.globalsetup.ts+45−21

-// Boot the cloud target: the app's OWN dev stack (PGlite dev-db + vite dev)
+// Boot the cloud target: WorkOS + Autumn EMULATORS (in this process, from the
-// with EXECUTOR_E2E_STUB=1 — the one flag that makes `vite dev` a logged-in,
+// vendored emulate fork) plus the app's own dev stack (PGlite dev-db + vite
-// fully-stubbed instance (multi-user WorkOS stub, free-plan Autumn, no
+// dev) pointed at them via WORKOS_API_URL / AUTUMN_API_URL. The app runs its
-// network). Set E2E_CLOUD_URL to attach to an already-running instance
+// REAL auth/billing code — real SDKs, real sealed-session crypto, real JWKS —
-// instead (e.g. while iterating on a scenario).
+// against emulated services. Set E2E_CLOUD_URL to attach to a running stack.
 import { rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+// Vendored fork import (same pattern as mcporter).
+import { createEmulator } from "@executor-js/emulate";
 import { bootProcesses, waitForHttp } from "./boot";
-import { CLOUD_BASE_URL, CLOUD_DB_PORT, CLOUD_PORT } from "../targets/cloud";
+import {
+  CLOUD_BASE_URL,
+  CLOUD_DB_PORT,
+  CLOUD_PORT,
+  WORKOS_EMULATOR_PORT,
+  AUTUMN_EMULATOR_PORT,
+  E2E_WORKOS_CLIENT_ID,
+  E2E_COOKIE_PASSWORD,
+} from "../targets/cloud";
 const cloudDir = fileURLToPath(new URL("../../apps/cloud/", import.meta.url));
     return;
   }
-  // Fresh stub DB per suite run — hermetic, like the selfhost data dir. The
+  // Fresh dev DB per suite run — hermetic, like the selfhost data dir. The
-  // WorkOS stub mints org ids from a per-process counter, so a persisted DB
+  // WorkOS emulator mints org ids from a per-process counter, so a persisted
-  // from a previous invocation collides with the new boot's ids (identities
+  // DB from a previous invocation collides with the new boot's ids (identities
   // land in polluted orgs / org creation 500s).
   const dbPath = resolve(cloudDir, ".e2e-stub-db");
   rmSync(dbPath, { recursive: true, force: true });
+  // MCP access tokens minted by the emulator's OAuth server must carry the
+  // app's client id as audience (what the resource server verifies).
+  process.env.EMULATE_WORKOS_AUDIENCE = E2E_WORKOS_CLIENT_ID;
+  const workos = await createEmulator({ service: "workos", port: WORKOS_EMULATOR_PORT });
+  const autumn = await createEmulator({ service: "autumn", port: AUTUMN_EMULATOR_PORT });
   const env = {
-    EXECUTOR_E2E_STUB: "1",
+    // Real client, emulated service.
-    // The harness boots loopback MCP/OAuth test servers and points the
+    WORKOS_API_URL: workos.url,
-    // instance at them; the hosted SSRF guard would otherwise block outbound
+    AUTUMN_API_URL: autumn.url,
-    // probes/dials to localhost. Hermetic stub instance only.
+    WORKOS_API_KEY: "sk_test_emulate",
-    ALLOW_LOCAL_NETWORK: "true",
+    WORKOS_CLIENT_ID: E2E_WORKOS_CLIENT_ID,
-    // Stub creds — never contacted; the stub layers replace the clients.
+    WORKOS_COOKIE_PASSWORD: E2E_COOKIE_PASSWORD,
-    WORKOS_API_KEY: "sk_e2e_stub",
+    AUTUMN_SECRET_KEY: "am_test_emulate",
-    WORKOS_CLIENT_ID: "client_e2e_stub",
-    WORKOS_COOKIE_PASSWORD: "e2e_cookie_password_0123456789abcdef0123456789abcdef",
-    AUTUMN_SECRET_KEY: "am_e2e_stub",
     ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
     DATABASE_URL: `postgresql://postgres:postgres@127.0.0.1:${CLOUD_DB_PORT}/postgres`,
     EXECUTOR_DIRECT_DATABASE_URL: "true",
     CLOUDFLARE_INCLUDE_PROCESS_ENV: "true",
     VITE_PUBLIC_SITE_URL: CLOUD_BASE_URL,
-    MCP_AUTHKIT_DOMAIN: "https://example.com",
+    // The AuthKit domain (MCP OAuth metadata + JWKS) is the emulator too.
+    MCP_AUTHKIT_DOMAIN: workos.url,
     MCP_RESOURCE_ORIGIN: CLOUD_BASE_URL,
+    ALLOW_LOCAL_NETWORK: "true",
     // Throwaway PGlite on its own port + dir so it never fights `bun dev`.
     DEV_DB_PORT: String(CLOUD_DB_PORT),
     DEV_DB_PATH: dbPath,
   try {
     await waitForHttp(CLOUD_BASE_URL);
+    // The API plane is ready when login actually redirects to AuthKit.
+    await waitForHttp(`${CLOUD_BASE_URL}/api/auth/login`, { expectRedirect: true });
   } catch (error) {
     await procs.teardown();
+    await workos.close();
+    await autumn.close();
     throw error;
   }
-  return procs.teardown;
+  return async () => {
+    await procs.teardown();
+    await workos.close();
+    await autumn.close();
+  };
 }

e2e/src/surfaces/mcp.ts+1−1

@@ -8,7 +8,7 @@ import { join } from "node:path"; · 7 unmodified lines
8		8
9	import { Effect } from "effect";	9	import { Effect } from "effect";
10		10
11	import { createRuntime, type Runtime } from "../../../vendor/mcporter/dist/index.js";	11	import { createRuntime, type Runtime } from "@executor-js/mcporter";
12		12
13	import type { Identity, Target } from "../target";	13	import type { Identity, Target } from "../target";
14		14

e2e/targets/cloud.ts+70−25

-// The cloud app as a target: the stubbed dev server (`vite dev` +
+// The cloud app as a target: its real dev server with the real WorkOS and
-// EXECUTOR_E2E_STUB=1) — real SSR, real routes, real PGlite-backed DB, WorkOS
+// Autumn SDKs pointed at emulators (WORKOS_API_URL / AUTUMN_API_URL — see
-// and Autumn stubbed in-memory. Isolation: the stub resolves the user FROM the
+// setup/cloud.globalsetup.ts). Identities are minted through the REAL login
-// wos-session cookie value, so every identity is a fresh user (and org) on the
+// flow: /api/auth/login → emulator hosted AuthKit (headless via login_hint) →
-// one shared instance — no resets. Boot lives in setup/cloud.globalsetup.ts.
+// /api/auth/callback → genuine sealed-session cookie. Isolation: every
+// identity is a fresh user (and org) — no resets.
 import { randomUUID } from "node:crypto";
 import { Effect } from "effect";
 export const CLOUD_PORT = Number(process.env.E2E_CLOUD_PORT ?? 4798);
 export const CLOUD_DB_PORT = Number(process.env.E2E_CLOUD_DB_PORT ?? 5436);
 export const CLOUD_BASE_URL = process.env.E2E_CLOUD_URL ?? `http://127.0.0.1:${CLOUD_PORT}`;
+export const WORKOS_EMULATOR_PORT = Number(process.env.E2E_WORKOS_EMULATOR_PORT ?? 4914);
+export const AUTUMN_EMULATOR_PORT = Number(process.env.E2E_AUTUMN_EMULATOR_PORT ?? 4915);
+export const E2E_WORKOS_CLIENT_ID = "client_e2e_emulate";
+export const E2E_COOKIE_PASSWORD = "e2e_cookie_password_0123456789abcdef0123456789abcdef";
-const freshId = () => randomUUID().slice(0, 8);
+const cookiePair = (response: Response, name: string): string | undefined => {
+  for (const header of response.headers.getSetCookie?.() ?? []) {
+    if (header.startsWith(`${name}=`)) return header.split(";")[0];
+  }
+  return undefined;
+};
+/** The real product login, headless: login → hosted AuthKit → callback. */
+const signIn = async (email: string): Promise<string> => {
+  const login = await fetch(new URL("/api/auth/login", CLOUD_BASE_URL), { redirect: "manual" });
+  const stateCookie = cookiePair(login, "wos-login-state");
+  const authorizeUrl = new URL(login.headers.get("location") ?? "");
+  if (!stateCookie || !authorizeUrl.searchParams.get("state")) {
+    throw new Error(`cloud signIn: login did not redirect to AuthKit (${login.status})`);
+  }
+  // The emulator's hosted login signs in headlessly via login_hint (creating
+  // the user if new) and redirects back with a code.
+  authorizeUrl.searchParams.set("login_hint", email);
+  const consent = await fetch(authorizeUrl, { redirect: "manual" });
+  const callbackUrl = consent.headers.get("location");
+  if (consent.status !== 302 || !callbackUrl) {
+    throw new Error(`cloud signIn: AuthKit emulator did not redirect (${consent.status})`);
+  }
+  const callback = await fetch(callbackUrl, {
+    redirect: "manual",
+    headers: { cookie: stateCookie },
+  });
+  const session = cookiePair(callback, "wos-session");
+  if (!session) throw new Error(`cloud signIn: callback set no session (${callback.status})`);
+  return session; // "wos-session=<sealed>"
+};
 export const cloudTarget = (): Target => ({
   name: "cloud",
   baseUrl: CLOUD_BASE_URL,
   mcpUrl: `${CLOUD_BASE_URL}/mcp`,
-  capabilities: new Set(["api", "browser", "billing"]),
+  capabilities: new Set(["api", "browser", "billing", "mcp-oauth"]),
   newIdentity: ({ org = true } = {}) =>
     Effect.promise(async (): Promise<Identity> => {
-      const user = `user_${freshId()}`;
+      const label = `user-${randomUUID().slice(0, 8)}`;
-      // The stub WorkOS resolves the user FROM the cookie value; a bare value
+      const email = `${label}@e2e.test`;
-      // is a fresh signed-in user with no organization yet.
+      let session = await signIn(email);
-      let value = user;
       if (org) {
-        // Go through the REAL product flow: create the org via the session
+        // The real create-organization flow; the refreshed sealed session in
-        // route and adopt the refreshed `<user>|org:<org>` cookie it sets —
+        // the response carries the new org.
-        // membership and session state come from the same path real users take.
         const response = await fetch(new URL("/api/auth/create-organization", CLOUD_BASE_URL), {
           method: "POST",
           headers: {
             "content-type": "application/json",
             origin: new URL(CLOUD_BASE_URL).origin,
-            cookie: `wos-session=${value}`,
+            cookie: session,
           },
-          body: JSON.stringify({ name: `Org ${user}` }),
+          body: JSON.stringify({ name: `Org ${label}` }),
         });
         if (!response.ok) {
-          throw new Error(`cloud newIdentity: create-organization → ${response.status}`);
+          throw new Error(`cloud newIdentity: create-organization failed (${response.status})`);
         }
-        const refreshed = (response.headers.getSetCookie?.() ?? [])
+        session = cookiePair(response, "wos-session") ?? session;
-          .map((cookie) => /^wos-session=([^;]+)/.exec(cookie)?.[1])
-          .find(Boolean);
-        if (!refreshed) throw new Error("cloud newIdentity: no refreshed session cookie");
-        value = decodeURIComponent(refreshed);
       }
+      const [name, value] = session.split(/=(.*)/s);
       return {
-        label: user,
+        label: email,
-        headers: { cookie: `wos-session=${value}` },
+        headers: { cookie: session },
-        cookies: [{ name: "wos-session", value }],
+        cookies: [{ name: name!, value: value! }],
+        credentials: { email, password: "emulated" },
       };
     }),
+  // MCP OAuth against the emulator's authorization server: complete the
+  // hosted flow headlessly as this identity.
+  mcpConsent: (identity) => async (request) => {
+    const authorizeUrl = new URL(request.authorizationUrl);
+    authorizeUrl.searchParams.set("login_hint", identity.credentials?.email ?? "mcp@e2e.test");
+    const response = await fetch(authorizeUrl, { redirect: "manual" });
+    const location = response.headers.get("location");
+    if (response.status !== 302 || !location) {
+      throw new Error(`cloud mcpConsent: authorize did not redirect (${response.status})`);
+    }
+    const code = new URL(location).searchParams.get("code");
+    if (!code) throw new Error("cloud mcpConsent: no code in redirect");
+    return { code };
+  },
 });

e2e/targets/selfhost.ts+1−1

@@ -4,7 +4,7 @@ · 3 unmodified lines
4	// in setup/selfhost.globalsetup.ts.	4	// in setup/selfhost.globalsetup.ts.
5	import { Effect } from "effect";	5	import { Effect } from "effect";
6		6
7	import { cookieConsentStrategy } from "../../vendor/mcporter/dist/index.js";	7	import { cookieConsentStrategy } from "@executor-js/mcporter";
8		8
9	import type { Identity, Target } from "../src/target";	9	import type { Identity, Target } from "../src/target";
10		10

packages/plugins/workos-vault/src/sdk/client.ts+15−0

@@ -96,8 +96,22 @@ export interface WorkOSVaultPromiseApi { · 95 unmodified lines
96	export interface WorkOSVaultCredentials {	96	export interface WorkOSVaultCredentials {
97	readonly apiKey: string;	97	readonly apiKey: string;
98	readonly clientId: string;	98	readonly clientId: string;
		99	/** Optional WorkOS API base-URL override (e.g. a WorkOS emulator in tests). */
		100	readonly apiUrl?: string;
99	}	101	}
100		102
		103	const apiUrlOptions = (
		104	url: string \| undefined,
		105	): { apiHostname?: string; port?: number; https?: boolean } => {
		106	if (!url) return {};
		107	const parsed = new URL(url);
		108	return {
		109	apiHostname: parsed.hostname,
		110	...(parsed.port ? { port: Number(parsed.port) } : {}),
		111	https: parsed.protocol === "https:",
		112	};
		113	};
		114
101	interface WorkOSVaultUseOptions {	115	interface WorkOSVaultUseOptions {
102	readonly expectedErrorStatuses?: readonly number[];	116	readonly expectedErrorStatuses?: readonly number[];
103	readonly expectedErrorOutcome?: string;	117	readonly expectedErrorOutcome?: string;
@@ -205,6 +219,7 @@ export const makeConfiguredWorkOSVaultClient = ( · 101 unmodified lines
205	new WorkOSClient({	219	new WorkOSClient({
206	apiKey: credentials.apiKey,	220	apiKey: credentials.apiKey,
207	clientId: credentials.clientId,	221	clientId: credentials.clientId,
		222	...apiUrlOptions(credentials.apiUrl),
208	}),	223	}),
209	),	224	),
210	catch: (cause) => new WorkOSVaultClientInstantiationError({ cause }),	225	catch: (cause) => new WorkOSVaultClientInstantiationError({ cause }),

vendor/emulate+1−1

@@ -1 +1 @@
1	Subproject commit a42fe29889c8a11aa752fc848af5ed71a76fa26e	1	Subproject commit 41f09e973c174d4d64c60b9f4ec271cf7ef9c2eb