@acid-cat/cli 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hebilicious
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,56 @@
-# Temporary Holding Version
+# @acid-cat/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The AcidCat command line. npm package: `@acid-cat/cli`. It gives the `acid-cat` command. Use it at build time, in CI or by hand, to check catalogs and to test implementations. Do not use it in an application at run time.
+
+```sh
+acid-cat check [--strict] <catalog.json ...>  # check catalogs
+acid-cat format [--write] <catalog.json ...>  # write catalogs in canonical form
+acid-cat view <catalog.json> <target>         # write the view of one target
+acid-cat conform --mcp <url> --http <url> --cli "<command>" --webmcp <url>  # test an implementation
+```
+
+Install it as a development dependency, and run it with `pnpm exec acid-cat …`:
+
+```sh
+pnpm add -D @acid-cat/cli
+```
+
+It needs Node.js 24 or later. `acid-cat conform --webmcp <url>` also needs [Playwright](https://playwright.dev) and Chromium.
+
+## check
+
+`check` tests a catalog against [`schemas/catalog.schema.json`](../../schemas/catalog.schema.json) and against the [catalog rules](../../spec/conformance.md#catalog) that the schema cannot express.
+
+- An **error** is a broken rule. Example: an audience that names an unknown target.
+- A **warning** is a broken recommendation. Examples: a file that is not in [canonical form](../../spec/catalog.md#canonical-form), or a member with no `x-` prefix.
+
+The exit code is 0 if there are no errors. It is 1 if there are errors. With `--strict`, warnings also give the exit code 1.
+
+## format
+
+`format` writes a catalog in canonical form. Use it for catalogs that a catalog library did not write: Pkl output, generated files, or files that you edit by hand.
+
+## conform
+
+`conform` tests a running implementation of the [conformance fixture](conformance/fixture.pkl) through its bindings (see [Conformance](../../spec/conformance.md#acid-cat-conform)):
+
+- **MCP:** the official MCP client, with revision `2026-07-28`, for tools and outcomes; raw requests for rejections.
+- **HTTP** and **CLI:** each outcome, each kind of call failure, availability, and rejections. For the CLI, an interrupt (`SIGINT`) during a call gives exit code 130.
+- **WebMCP:** the checks act as the WebMCP host. `--webmcp <url>` opens a page that serves the `app` target in Chromium, through [Playwright](https://playwright.dev), with a test `modelContext`. Install Playwright to use it: `pnpm add -D playwright`, then `pnpm exec playwright install chromium`. In code, `webmcp` can also be a function that installs the implementation on a host in the same process.
+- **Properties:** with fast-check, through each remote binding: concurrent calls each get exactly their own outcome, and a cancellation changes only its own call.
+
+The exit code is 1 if a check fails. Both AcidCat cores run `conform` in their tests. In code, use `conform()` and `serve()` from `@acid-cat/cli`. `createTestHost()` gives the WebMCP host of the checks.
+
+## Implementation
+
+The command line is an [Effect](https://effect.website) program that uses `effect/cli`. It validates catalogs with Effect Schema. It imports `schemas/catalog.schema.json` and each schema in the catalog as Effect schemas.
+
+| File | Contents |
+| --- | --- |
+| `src/catalog.ts` | The catalog rules, views and bundling |
+| `src/main.ts` | The commands |
+| `src/conform/` | The conformance checks, and `serve`, which serves web handlers on a local port |
+| `conformance/` | The conformance fixture, in Pkl and in JSON |
+| `test/` | Tests. Run them with `moon run cli:test` |
+
+The canonical writer comes from [`@acid-cat/catalog`](../catalog/typescript).

package/conformance/fixture.acidcat.json

@@ -0,0 +1,152 @@
+{
+  "acidcat": "0.1",
+  "title": "AcidCat conformance fixture",
+  "targets": {
+    "api": {
+      "bindings": [
+        "http"
+      ]
+    },
+    "app": {
+      "bindings": [
+        "typescript",
+        "webmcp"
+      ]
+    },
+    "cli": {
+      "bindings": [
+        "cli"
+      ]
+    },
+    "mcp": {
+      "bindings": [
+        "mcp"
+      ]
+    }
+  },
+  "capabilities": {
+    "fixture.crash": {
+      "description": "Always fail with a defect.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ]
+    },
+    "fixture.echo": {
+      "description": "Return the input text.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ],
+      "input": {
+        "properties": {
+          "text": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "text"
+        ],
+        "type": "object"
+      },
+      "output": {
+        "properties": {
+          "text": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "text"
+        ],
+        "type": "object"
+      },
+      "readOnly": true
+    },
+    "fixture.hidden": {
+      "description": "Only the app target can use this capability.",
+      "audience": [
+        "app"
+      ]
+    },
+    "fixture.refuse": {
+      "description": "Always return the failure Refused.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ],
+      "failures": {
+        "Refused": {
+          "properties": {
+            "_tag": {
+              "const": "Refused",
+              "type": "string"
+            },
+            "reason": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "_tag",
+            "reason"
+          ],
+          "type": "object"
+        }
+      }
+    },
+    "fixture.slow": {
+      "description": "Wait for some milliseconds, then return null.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ],
+      "input": {
+        "properties": {
+          "milliseconds": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "milliseconds"
+        ],
+        "type": "object"
+      }
+    },
+    "fixture.switch.set": {
+      "description": "Turn the switch on or off. The switch controls the availability of fixture.toggle.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ],
+      "input": {
+        "properties": {
+          "on": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "on"
+        ],
+        "type": "object"
+      }
+    },
+    "fixture.toggle": {
+      "description": "Available only while the switch is on.",
+      "audience": [
+        "app",
+        "mcp",
+        "cli",
+        "api"
+      ]
+    }
+  }
+}

package/dist/catalog.d.ts

@@ -0,0 +1,11 @@
+import { bundle, viewOf } from "@acid-cat/spec-ts";
+import type { CatalogDocument as Catalog } from "@acid-cat/spec-ts";
+export { bundle, viewOf };
+export type { Catalog };
+/** The result of a check. An error breaks a rule. A warning breaks a recommendation. */
+export interface Report {
+    readonly errors: readonly string[];
+    readonly warnings: readonly string[];
+}
+/** Check a catalog. When `text` is given, the file must also be in canonical form. */
+export declare function check(document: unknown, text?: string): Report;

package/dist/catalog.js

@@ -0,0 +1,111 @@
+import catalog_schema_default from "./json/catalog.schema.json.js";
+import { canonicalText } from "@acid-cat/catalog";
+import { REFERENCE, bundle, schemasOf, viewOf as viewOf$1, visitObjects } from "@acid-cat/spec-ts";
+import { Result, Schema, SchemaIssue, SchemaRepresentation } from "effect";
+//#region src/catalog.ts
+/**
+* The catalog operations that the specification defines: the catalog rules, views and bundling.
+* See spec/catalog.md and spec/conformance.md.
+*/
+const KNOWN_MEMBERS = {
+	catalog: [
+		"acidcat",
+		"title",
+		"description",
+		"targets",
+		"$defs",
+		"capabilities"
+	],
+	target: [
+		"bindings",
+		"description",
+		"options"
+	],
+	capability: [
+		"description",
+		"audience",
+		"input",
+		"output",
+		"failures",
+		"readOnly",
+		"state"
+	]
+};
+/** The catalog schema (schemas/catalog.schema.json), imported as an Effect schema. */
+const decodeCatalog = (() => {
+	const { $defs, $schema: _schema, $id: _id, ...root } = catalog_schema_default;
+	const schema = SchemaRepresentation.fromJsonSchemaDocument({
+		dialect: "draft-2020-12",
+		schema: root,
+		definitions: $defs ?? {}
+	}, { patterns: "apply" });
+	return Schema.decodeUnknownResult(schema);
+})();
+const formatIssues = SchemaIssue.makeFormatterStandardSchemaV1();
+/** Check a catalog. When `text` is given, the file must also be in canonical form. */
+function check(document, text) {
+	const decoded = decodeCatalog(document);
+	if (Result.isFailure(decoded)) return {
+		errors: formatIssues(decoded.failure.issue).issues.map((issue) => `${(issue.path ?? []).map((key) => `[${JSON.stringify(key)}]`).join("") || "the catalog"}: ${issue.message}`),
+		warnings: []
+	};
+	const catalog = document;
+	const errors = ruleErrors(catalog);
+	const warnings = [...unknownMembers(catalog), ...errors.length === 0 ? schemaWarnings(catalog) : []];
+	if (text !== void 0 && text !== canonicalText(catalog)) warnings.push("the file is not in canonical form: run `acid-cat format --write`");
+	return {
+		errors,
+		warnings
+	};
+}
+/** The catalog rules that the catalog schema cannot express. */
+function ruleErrors(catalog) {
+	const errors = [];
+	const types = catalog.$defs ?? {};
+	for (const [name, type] of Object.entries(types)) errors.push(...referenceErrors(type, types).map((error) => `type ${name} ${error}`));
+	for (const [id, capability] of Object.entries(catalog.capabilities)) {
+		for (const target of capability.audience ?? []) if (!(target in catalog.targets)) errors.push(`${id}: the audience names ${target}, which is not a target`);
+		for (const [member, schema] of schemasOf(capability)) {
+			const references = referenceErrors(schema, types);
+			errors.push(...references.map((error) => `${id} ${member} ${error}`));
+			if (member === "input" && references.length === 0 && bundle(schema, types).type !== "object") errors.push(`${id}: the input is not an object`);
+		}
+	}
+	return errors;
+}
+/** Members that the specification does not define and that have no `x-` prefix. */
+function unknownMembers(catalog) {
+	const unknown = (where, value, known) => Object.keys(value).filter((key) => !known.includes(key) && !key.startsWith("x-")).map((key) => `${where}: unknown member ${key}; give extensions an x- prefix`);
+	return [
+		...unknown("the catalog", catalog, KNOWN_MEMBERS.catalog),
+		...Object.entries(catalog.targets).flatMap(([name, target]) => unknown(`target ${name}`, target, KNOWN_MEMBERS.target)),
+		...Object.entries(catalog.capabilities).flatMap(([id, capability]) => unknown(id, capability, KNOWN_MEMBERS.capability))
+	];
+}
+/** Schemas that cannot be imported as Effect schemas. They can still be valid JSON Schema, so this is a warning. */
+function schemaWarnings(catalog) {
+	const definitions = catalog.$defs ?? {};
+	const warnings = [];
+	for (const [id, capability] of Object.entries(catalog.capabilities)) for (const [member, schema] of schemasOf(capability)) try {
+		SchemaRepresentation.fromJsonSchemaMultiDocument({
+			dialect: "draft-2020-12",
+			schemas: [schema],
+			definitions
+		}, { patterns: "ignore" });
+	} catch (cause) {
+		warnings.push(`${id} ${member}: cannot check this schema: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	return warnings;
+}
+function referenceErrors(schema, types) {
+	const errors = [];
+	visitObjects(schema, (node) => {
+		if ("$defs" in node) errors.push("has its own $defs; put shared types in the catalog's $defs");
+		if (node.$ref === void 0) return;
+		const name = typeof node.$ref === "string" ? REFERENCE.exec(node.$ref)?.[1] : void 0;
+		if (name === void 0 || !(name in types)) errors.push(`references ${String(node.$ref)}, which is not a type`);
+	});
+	return errors;
+}
+//#endregion
+export { bundle, check, viewOf$1 as viewOf };

package/dist/conform/check.d.ts

@@ -0,0 +1,28 @@
+import type { CatalogDocument } from "@acid-cat/spec-ts";
+export interface Check {
+    readonly binding: string;
+    readonly name: string;
+    /** The part of the specification that the check tests, for example `spec/bindings/mcp.md#tools`. */
+    readonly rule: string;
+    readonly passed: boolean;
+    readonly detail?: string | undefined;
+}
+/** The conformance fixture: the catalog that each implementation serves. */
+export declare const fixture: CatalogDocument;
+/** The ids of the capabilities in the view of a target of the fixture. */
+export declare const idsOf: (target: string) => string[];
+/** Collects checks for one binding. */
+export declare class Checks {
+    readonly results: Check[];
+    readonly binding: string;
+    constructor(binding: string);
+    run(name: string, rule: string, body: () => Promise<void> | void): Promise<void>;
+}
+/** Fail a check unless `condition` is true. */
+export declare function expect(condition: unknown, message: string): asserts condition;
+/** Fail a check unless the two values have the same JSON. */
+export declare function expectEqual(actual: unknown, expected: unknown, what: string): void;
+/** A sorted copy of a list. */
+export declare const sorted: (values: Iterable<string>) => string[];
+/** An origin that no deployment allows. */
+export declare const FORBIDDEN_ORIGIN = "https://not-allowed.acid-cat.invalid";

package/dist/conform/check.js

@@ -0,0 +1,51 @@
+import fixture_acidcat_default from "../json/fixture.acidcat.json.js";
+import { viewOf } from "@acid-cat/spec-ts";
+//#region src/conform/check.ts
+/** The result of one conformance check, and helpers to write checks. */
+/** The conformance fixture: the catalog that each implementation serves. */
+const fixture = fixture_acidcat_default;
+/** The ids of the capabilities in the view of a target of the fixture. */
+const idsOf = (target) => Object.keys(viewOf(fixture, target).capabilities).sort();
+/** Collects checks for one binding. */
+var Checks = class {
+	results = [];
+	binding;
+	constructor(binding) {
+		this.binding = binding;
+	}
+	async run(name, rule, body) {
+		try {
+			await body();
+			this.results.push({
+				binding: this.binding,
+				name,
+				rule,
+				passed: true
+			});
+		} catch (error) {
+			this.results.push({
+				binding: this.binding,
+				name,
+				rule,
+				passed: false,
+				detail: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+};
+/** Fail a check unless `condition` is true. */
+function expect(condition, message) {
+	if (!condition) throw new Error(message);
+}
+/** Fail a check unless the two values have the same JSON. */
+function expectEqual(actual, expected, what) {
+	const a = JSON.stringify(actual);
+	const b = JSON.stringify(expected);
+	if (a !== b) throw new Error(`${what}: expected ${b}, got ${a}`);
+}
+/** A sorted copy of a list. */
+const sorted = (values) => [...values].sort();
+/** An origin that no deployment allows. */
+const FORBIDDEN_ORIGIN = "https://not-allowed.acid-cat.invalid";
+//#endregion
+export { Checks, FORBIDDEN_ORIGIN, expect, expectEqual, fixture, idsOf, sorted };

package/dist/conform/cli.d.ts

@@ -0,0 +1,2 @@
+import { Checks } from "./check.js";
+export declare function checkCli(command: readonly string[]): Promise<Checks>;

package/dist/conform/cli.js

@@ -0,0 +1,112 @@
+import { Checks, expect, expectEqual, idsOf, sorted } from "./check.js";
+import { spawn } from "node:child_process";
+//#region src/conform/cli.ts
+/** Conformance checks for the CLI binding (spec/bindings/cli.md). Each check runs the command line as a process. */
+const RULE = "spec/bindings/cli.md";
+/** The time that a command line has to start before the interrupt, in milliseconds. */
+const INTERRUPT_AFTER = 2e3;
+/** Run the command line. If `interruptAfter` is given, send `SIGINT` after that many milliseconds. */
+function run(command, args, interruptAfter) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command[0], [...command.slice(1), ...args], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		const timer = interruptAfter === void 0 ? void 0 : setTimeout(() => child.kill("SIGINT"), interruptAfter);
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => stdout += chunk.toString());
+		child.stderr.on("data", (chunk) => stderr += chunk.toString());
+		child.on("error", reject);
+		child.on("close", (code, signal) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				signal,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+async function checkCli(command) {
+	const checks = new Checks("cli");
+	const cli = (...args) => run(command, args);
+	await checks.run("a value goes to standard output with exit code 0", `${RULE}#outcomes`, async () => {
+		const result = await cli("fixture", "echo", "--text", "hello");
+		expectEqual(result.code, 0, "exit code");
+		expectEqual(JSON.parse(result.stdout), { text: "hello" }, "standard output");
+	});
+	await checks.run("a failure goes to standard output with exit code 1", `${RULE}#outcomes`, async () => {
+		const result = await cli("fixture", "refuse");
+		expectEqual(result.code, 1, "exit code");
+		expectEqual(JSON.parse(result.stdout)._tag, "Refused", "_tag");
+	});
+	await checks.run("a defect goes to standard error with exit code 5", `${RULE}#outcomes`, async () => {
+		const result = await cli("fixture", "crash");
+		expectEqual(result.code, 5, "exit code");
+		expect(/"kind":"internal"/.test(result.stderr), "standard error must contain the call failure");
+	});
+	for (const [name, args, code] of [
+		[
+			"an unknown command has exit code 2",
+			["fixture", "nothing"],
+			2
+		],
+		[
+			"a capability outside the view has exit code 2",
+			["call", "fixture.hidden"],
+			2
+		],
+		[
+			"a missing required flag has exit code 3",
+			["fixture", "echo"],
+			3
+		],
+		[
+			"a flag that is not valid has exit code 3",
+			[
+				"fixture",
+				"slow",
+				"--milliseconds",
+				"soon"
+			],
+			3
+		],
+		[
+			"invalid input through call has exit code 3",
+			[
+				"call",
+				"fixture.echo",
+				"{\"text\":1}"
+			],
+			3
+		]
+	]) await checks.run(name, `${RULE}#outcomes`, async () => {
+		expectEqual((await cli(...args)).code, code, "exit code");
+	});
+	await checks.run("an interrupt cancels the call with exit code 130", `${RULE}#commands`, async () => {
+		const result = await run(command, [
+			"fixture",
+			"slow",
+			"--milliseconds",
+			"60000"
+		], INTERRUPT_AFTER);
+		expect(result.signal === null, `the process must exit, not end by the signal ${result.signal}`);
+		expectEqual(result.code, 130, "exit code");
+		expectEqual(result.stdout, "", "standard output");
+	});
+	await checks.run("call gives the value of a capability", `${RULE}#commands`, async () => {
+		const result = await cli("call", "fixture.echo", "{\"text\":\"hello\"}");
+		expectEqual(result.code, 0, "exit code");
+		expectEqual(JSON.parse(result.stdout), { text: "hello" }, "standard output");
+	});
+	await checks.run("list gives the view", `${RULE}#commands`, async () => {
+		const result = await cli("list");
+		expectEqual(sorted(JSON.parse(result.stdout).map((entry) => entry.id)), idsOf("cli"), "ids");
+	});
+	return checks;
+}
+//#endregion
+export { checkCli };

package/dist/conform/http.d.ts

@@ -0,0 +1,5 @@
+/** Conformance checks for the HTTP binding (spec/bindings/http.md). */
+import { Checks } from "./check.js";
+export declare function checkHttp(base: string, options: {
+    readonly maximumBytes: number;
+}): Promise<Checks>;

package/dist/conform/http.js

@@ -0,0 +1,97 @@
+import { Checks, FORBIDDEN_ORIGIN, expect, expectEqual, idsOf, sorted } from "./check.js";
+//#region src/conform/http.ts
+/** Conformance checks for the HTTP binding (spec/bindings/http.md). */
+const RULE = "spec/bindings/http.md";
+async function checkHttp(base, options) {
+	const checks = new Checks("http");
+	const post = (id, body, headers = {}) => fetch(`${base}/capabilities/${id}`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...headers
+		},
+		body: typeof body === "string" ? body : body instanceof Uint8Array ? new Blob([body]) : JSON.stringify(body)
+	});
+	const json = async (response) => await response.json();
+	await checks.run("GET /capabilities lists the view with availability", `${RULE}#requests`, async () => {
+		const list = await (await fetch(`${base}/capabilities`)).json();
+		expectEqual(sorted(list.map((entry) => entry.id)), idsOf("api"), "ids");
+		expect(list.every((entry) => typeof entry.available === "boolean"), "each entry must have available");
+	});
+	await checks.run("a value has the status 200", `${RULE}#requests`, async () => {
+		const response = await post("fixture.echo", { text: "hello" });
+		expectEqual(response.status, 200, "status");
+		expectEqual(await json(response), {
+			ok: true,
+			value: { text: "hello" }
+		}, "body");
+	});
+	await checks.run("a failure has the status 200 and ok: false", `${RULE}#requests`, async () => {
+		const response = await post("fixture.refuse", {});
+		const body = await json(response);
+		expectEqual(response.status, 200, "status");
+		expect(body.ok === false && body.error?._tag === "Refused", `got ${JSON.stringify(body)}`);
+	});
+	for (const [name, id, input, status, kind] of [
+		[
+			"invalid input has the status 422",
+			"fixture.echo",
+			{ text: 1 },
+			422,
+			"invalid-input"
+		],
+		[
+			"a capability outside the view has the status 404",
+			"fixture.hidden",
+			{},
+			404,
+			"unknown-capability"
+		],
+		[
+			"a defect has the status 500",
+			"fixture.crash",
+			{},
+			500,
+			"internal"
+		]
+	]) await checks.run(name, `${RULE}#requests`, async () => {
+		const response = await post(id, input);
+		expectEqual(response.status, status, "status");
+		expectEqual((await json(response)).kind, kind, "kind");
+	});
+	await checks.run("an unavailable capability has the status 503", `${RULE}#requests`, async () => {
+		await post("fixture.switch.set", { on: false });
+		try {
+			const toggle = (await (await fetch(`${base}/capabilities`)).json()).find((entry) => entry.id === "fixture.toggle");
+			expect(toggle?.available === false && typeof toggle.reason === "string", "fixture.toggle must be unavailable, with a reason");
+			const response = await post("fixture.toggle", {});
+			expectEqual(response.status, 503, "status");
+			expectEqual((await json(response)).kind, "unavailable", "kind");
+		} finally {
+			await post("fixture.switch.set", { on: true });
+		}
+	});
+	const status = async (response, expected) => expectEqual(response.status, expected, "status");
+	await checks.run("a method that is not accepted is rejected with 405", `${RULE}#requests`, async () => {
+		await status(await fetch(`${base}/capabilities`, { method: "PUT" }), 405);
+	});
+	await checks.run("an origin that is not allowed is rejected with 403", `${RULE}#requests`, async () => {
+		await status(await post("fixture.echo", { text: "x" }, { Origin: FORBIDDEN_ORIGIN }), 403);
+	});
+	await checks.run("a media type other than JSON is rejected with 415", `${RULE}#requests`, async () => {
+		await status(await post("fixture.echo", { text: "x" }, { "Content-Type": "text/plain" }), 415);
+	});
+	await checks.run("a body over the limit is rejected with 413", `${RULE}#requests`, async () => {
+		await status(await post("fixture.echo", " ".repeat(options.maximumBytes + 1)), 413);
+	});
+	await checks.run("a body that is not UTF-8 is rejected with 400", `${RULE}#requests`, async () => {
+		await status(await post("fixture.echo", new Uint8Array([
+			123,
+			255,
+			125
+		])), 400);
+	});
+	return checks;
+}
+//#endregion
+export { checkHttp };