@fougere/testing 0.3.0-alpha.0 → 0.4.0-alpha.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/testing",
-  "version": "0.3.0-alpha.0",
+  "version": "0.4.0-alpha.0",
   "description": "Tests derived from the declaration — cases, stubs and a gradient of realities.",
   "keywords": [
     "fougere",
@@ -29,23 +29,24 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "src"
   ],
   "dependencies": {
     "json-schema-faker": "^0.6.3",
-    "@fougere/container": "0.3.0-alpha.0",
-    "@fougere/defaults": "0.3.0-alpha.0",
-    "@fougere/schema": "0.3.0-alpha.0",
-    "@fougere/core": "0.3.0-alpha.0",
-    "@fougere/transport-http": "0.3.0-alpha.0",
-    "@fougere/app": "0.3.0-alpha.0"
+    "@fougere/core": "0.4.0-alpha.0",
+    "@fougere/container": "0.4.0-alpha.0",
+    "@fougere/schema": "0.4.0-alpha.0",
+    "@fougere/defaults": "0.4.0-alpha.0",
+    "@fougere/transport-http": "0.4.0-alpha.0",
+    "@fougere/app": "0.4.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
     "vitest": ">=2",
-    "@fougere/adapter-graphql": "0.3.0-alpha.0"
+    "@fougere/adapter-graphql": "0.4.0-alpha.0"
   },
   "peerDependenciesMeta": {
     "vitest": {
@@ -57,7 +58,7 @@
   },
   "devDependencies": {
     "vitest": "^4.1.0",
-    "@fougere/adapter-graphql": "0.3.0-alpha.0"
+    "@fougere/adapter-graphql": "0.4.0-alpha.0"
   },
   "scripts": {
     "build": "rm -rf dist && tsc",

package/src/all.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest';
+import type { App } from '@fougere/core';
+import type { SchemaView } from '@fougere/schema';
+import { checkContract, checkOutput, type CheckOptions } from './doors.js';
+import { checkDoors, type DoorOptions } from './comparison.js';
+
+export interface CheckAllOptions extends DoorOptions, CheckOptions {
+  /** Entities to leave out, by name — one whose rows a test cannot seed, typically. */
+  except?: string[];
+  /** Skip the four-door comparison. The contract and the leak are still checked. */
+  doors?: boolean;
+}
+
+/**
+ * Every entity the app SERVES, with its handler.
+ *
+ * Not every entity it scanned: one with no handler has no façade, so there is no door to
+ * ask — the distinction the NOT_FOUND message used to miss. A relation is not followed
+ * either; the entity it points at is checked on its own turn if it has a door.
+ */
+export function servedEntities(app: App): { name: string; entity: SchemaView }[] {
+  const served: { name: string; entity: SchemaView }[] = [];
+  for (const frond of app.fronds) {
+    const addresses = new Set(frond.handlers.filter((handler) => !handler.surface).map((handler) => handler.address));
+    for (const entity of frond.entities) {
+      if (addresses.has(entity.name)) served.push({ name: entity.name, entity: entity.entityClass });
+    }
+  }
+  return served;
+}
+
+/**
+ * The whole suite, for every entity, from a file that names none of them.
+ *
+ * The list comes from the scan rather than from imports, and that is the point: a list of
+ * imports is a second copy of what the project already declares, and it goes stale the day
+ * an entity is added — silently, because a missing test cannot fail.
+ *
+ * An entity whose frond is declared in `remotes:` is not here at all: it is not this app's
+ * to serve, and `testApp` does not follow the topology in the first place.
+ */
+export function checkAll(app: App, options: CheckAllOptions = {}): void {
+  const except = new Set(options.except ?? []);
+  const served = servedEntities(app).filter((one) => !except.has(one.name));
+
+  describe('what this app serves', () => {
+    it('is not empty — an empty suite proves nothing and still passes', () => {
+      expect(served.length).toBeGreaterThan(0);
+    });
+  });
+
+  for (const { entity } of served) {
+    checkContract(app, entity, options);
+    checkOutput(app, entity, options);
+    if (options.doors !== false) checkDoors(app, entity, options);
+  }
+}

package/src/app.ts

@@ -0,0 +1,125 @@
+import { type App } from '@fougere/core';
+import { boot } from '@fougere/core/node';
+import { createContainer } from '@fougere/container';
+import { resolveStorage, type DbConfig } from '@fougere/defaults';
+import { installStubs, type Port, type Stub } from './stub.js';
+import { scopeOfRun } from './scope.js';
+import { lowerFirst } from '@fougere/schema';
+
+export interface TestAppOptions {
+  /**
+   * The project to scan. Read from the test file's own position when absent — a file
+   * under `fronds/blog/tests/` states that its subject is `blog` and that the project
+   * starts above `fronds/`.
+   */
+  root?: string;
+  /** Boot only these fronds, by name. Deduced from the position when absent. */
+  fronds?: string[];
+  /**
+   * The running test file, for hosts other than vitest. Vitest is read automatically
+   * through `expect.getState()`; anything else hands its own path in.
+   */
+  testPath?: string;
+  /**
+   * Where the rows go. `':memory:'` by default — a real SQLite engine, so the DDL, the
+   * `CHECK` constraints, `unique` and real transactions are all exercised, and nothing is
+   * written to disk.
+   *
+   * Not an in-memory ORM: `createMemoryOrm` realizes the axes but is not the engine
+   * production runs, and a tool whose thesis is *the realizations must agree* cannot pick
+   * the one that does not ship.
+   */
+  db?: string;
+  /**
+   * Follow `remotes:` from the config. False by default — a test that meant to exercise
+   * one frond should not silently reach for a process that is not running.
+   */
+  topology?: boolean;
+  /**
+   * Ports answered by a double instead of their realization. A double carries every
+   * method the port declares and returns nothing until the test says what it returns.
+   */
+  stub?: Port[];
+}
+
+/** An app, plus the doubles standing in front of its ports and the facts it announced. */
+export interface TestApp extends App {
+  /** The double installed for a port, to state a return or read what was called. */
+  stub<T>(port: abstract new (...args: never[]) => T): Stub<T>;
+  /**
+   * What was announced under a fact's name, in order.
+   *
+   * Read from the carrier's own seat: `Emissions.announce` hands EVERY announced fact to
+   * `onEmit`, whether or not anything in this process listens. So watching costs nothing
+   * and adds no second dispatcher — the one thing `Emissions` refuses to become.
+   *
+   * Its dual needs no help at all: `app.deliver(fact, payload)` is already the carrier's
+   * door, and it rejects when a subscriber refuses.
+   */
+  announced(fact: { name: string } | string): unknown[];
+}
+
+/**
+ * An app to ask questions of, wired the conventional way.
+ *
+ * Wraps `boot()`, which already loads the config, creates the container, sets the storage
+ * up and seeds — its own comment names tests among the surfaces it serves. What this adds
+ * is the two decisions a test makes differently: the rows live in memory, and the
+ * topology is not followed.
+ *
+ * Storage still goes through `resolveStorage`, the single place that knows a storage
+ * package; calling `setupSqlite` here would be a second one.
+ */
+export async function testApp(options: TestAppOptions = {}): Promise<TestApp> {
+  const db: DbConfig = { dialect: 'sqlite', path: options.db ?? ':memory:' };
+  // The position is consulted only for what the caller did not state: an explicit `root`
+  // or `fronds` wins, the way a config key wins over a convention everywhere else.
+  const scope = (options.root && options.fronds) ? undefined
+    : await scopeOfRun(options.testPath ?? currentTestPath());
+
+  // One entry per announcement, in order. `Emissions.announce` calls the carrier for
+  // every fact, so this sees them all — including those nobody in this process listens to.
+  const heard: { fact: string; payload: unknown }[] = [];
+
+  const app = await boot({
+    onEmit: (fact, payload) => { heard.push({ fact, payload }); },
+    root: options.root ?? scope?.root,
+    createContainer,
+    fronds: options.fronds ?? (scope?.frond ? [scope.frond] : undefined),
+    // `boot` merges this over the file, so a project declaring a real database still
+    // gets the in-memory one here.
+    config: options.topology ? undefined : { remotes: {} },
+    db: () => resolveStorage(db),
+  });
+
+  const doubles = installStubs(app, options.stub ?? []);
+  return Object.assign(app, {
+    announced(fact: { name: string } | string): unknown[] {
+      // A fact travels under its REGISTRATION key — `postPublished`, not `PostPublished`
+      // — the same lowering every entity gets. Both spellings are accepted here and
+      // lowered before comparing, so a caller may hand in the class or the name.
+      const wanted = lowerFirst(typeof fact === 'string' ? fact : fact.name);
+      return heard.filter((one) => lowerFirst(one.fact) === wanted).map((one) => one.payload);
+    },
+    stub<T>(port: abstract new (...args: never[]) => T): Stub<T> {
+      const found = doubles.get(port as Port);
+      if (!found) {
+        throw new Error(
+          `[stub] ${(port as Port).name} was not stubbed — name it: testApp({ stub: [${(port as Port).name}] }).`,
+        );
+      }
+      return found as Stub<T>;
+    },
+  });
+}
+
+/**
+ * Vitest's own answer to "which file is running", or nothing.
+ *
+ * Imported dynamically: a package that imports vitest at the top level stops being
+ * loadable outside a test run, and `testApp` is meant to work under any host.
+ */
+function currentTestPath(): string | undefined {
+  const globals = globalThis as { __vitest_worker__?: { filepath?: string } };
+  return globals.__vitest_worker__?.filepath;
+}

package/src/comparison.ts

@@ -0,0 +1,237 @@
+import { describe, it, expect } from 'vitest';
+import { createLocalRunner, type App } from '@fougere/core';
+import { EMPTY_INVOCATION } from '@fougere/core/contract';
+import { serveRest, serveRpc, tableOf } from '@fougere/app';
+import { lowerFirst, type SchemaView } from '@fougere/schema';
+import { listQuery, findQuery, mutationFor, at } from './gql.js';
+import { sampleInput, type SampleOptions } from './sample.js';
+
+/**
+ * The rows a door hands back, with its own envelope taken off.
+ *
+ * Each door wraps differently by construction — REST answers a page, GraphQL nests under
+ * its field, RPC returns the value — and comparing the wrappers would compare the
+ * protocols. What must agree is what is inside.
+ */
+function rowsOf(value: unknown): unknown {
+  if (Array.isArray(value)) return [...value];
+  const page = value as { items?: unknown } | null;
+  return page && typeof page === 'object' && 'items' in page ? page.items : value;
+}
+
+/** Through the wire and back, so a `Date` and its ISO string are not read as a divergence. */
+const wire = (value: unknown): unknown => JSON.parse(JSON.stringify(value ?? null));
+
+/**
+ * What is the SAME row seen twice, and what is merely a second row.
+ *
+ * A write creates a different row at each door — different id, different `createdAt` —
+ * so comparing values would compare clocks. The generated fields are dropped and what the
+ * caller sent is what remains, which is the part the doors must agree on.
+ */
+function written(value: unknown, sent: Record<string, unknown>): unknown {
+  const row = value as Record<string, unknown> | null;
+  if (!row || typeof row !== 'object') return wire(row);
+  return wire(Object.fromEntries(Object.keys(sent).map((key) => [key, row[key]])));
+}
+
+export interface DoorOptions extends SampleOptions {
+  given?: Record<string, unknown>;
+  /** The audience, when the app serves named surfaces. */
+  surface?: string;
+}
+
+interface Doors {
+  local: (op: string, input?: DoorInput) => Promise<unknown>;
+  rpc: (op: string, input?: DoorInput) => Promise<unknown>;
+  rest: (op: string, input?: DoorInput) => Promise<unknown>;
+  graphql: (op: string, input?: DoorInput) => Promise<unknown>;
+}
+
+export interface DoorInput { id?: string; body?: Record<string, unknown> }
+
+export interface DoorContractCase {
+  /** What this case proves — becomes the test name. */
+  name: string;
+  /** Any declared operation, CRUD or custom. */
+  operation: string;
+  input?: DoorInput;
+  /** The protocol envelopes are removed before this value is compared. */
+  expected: unknown;
+}
+
+/**
+ * One entity, four doors, the same answers.
+ *
+ * The claim runs through the whole repo — a frond runs in-process or behind JSON-RPC with
+ * identical user code, and REST, GraphQL and RPC are three projections of one contract —
+ * and nothing compared REST to GraphQL until now. `transport-swap.test.ts` compares three
+ * TRANSPORTS, which is a different sentence.
+ *
+ * The five CRUD operations, reads and writes. A CUSTOM op is not compared: REST addresses
+ * it by a path the table states, GraphQL by a mutation whose input type is its own, and
+ * matching the two means guessing which is which — a guess this file exists to avoid.
+ */
+export function checkDoors(app: App, entity: SchemaView, options: DoorOptions = {}): void {
+  const name = lowerFirst(entity.name ?? '');
+  const doors = doorsOf(app, entity, name, options.surface);
+  const bodyOf = () => sampleInput(entity, options.given ?? {}, options);
+
+  describe(`${entity.name} — the doors agree`, () => {
+    it('on create, over what the caller sent', async () => {
+      const sent = bodyOf();
+      const answers = await Promise.all(
+        (['local', 'rpc', 'rest', 'graphql'] as const).map((door) => doors[door]('create', { body: sent })),
+      );
+
+      const [local, ...others] = answers.map((answer) => written(answer, sent));
+      for (const [index, other] of others.entries()) {
+        expect(other, `${(['rpc', 'rest', 'graphql'] as const)[index]} ≠ local`).toEqual(local);
+      }
+    });
+
+    it('on list', async () => {
+      await doors.local('create', { body: bodyOf() });
+
+      const local = wire(rowsOf(await doors.local('list')));
+      expect(Array.isArray(local) && local.length > 0, 'nothing to compare').toBe(true);
+
+      expect(wire(rowsOf(await doors.rpc('list'))), 'rpc ≠ local').toEqual(local);
+      expect(wire(rowsOf(await doors.rest('list'))), 'rest ≠ local').toEqual(local);
+      expect(wire(rowsOf(await doors.graphql('list'))), 'graphql ≠ local').toEqual(local);
+    });
+
+    it('on findById', async () => {
+      const row = await doors.local('create', { body: bodyOf() }) as { id: string };
+
+      const local = wire(await doors.local('findById', { id: row.id }));
+
+      expect(wire(await doors.rpc('findById', { id: row.id })), 'rpc ≠ local').toEqual(local);
+      expect(wire(await doors.rest('findById', { id: row.id })), 'rest ≠ local').toEqual(local);
+      expect(wire(await doors.graphql('findById', { id: row.id })), 'graphql ≠ local').toEqual(local);
+    });
+
+    it('on update, over what the caller sent', async () => {
+      const rows = await Promise.all([1, 2, 3, 4].map(() => doors.local('create', { body: bodyOf() }))) as { id: string }[];
+      const patch = bodyOf();
+
+      const answers = await Promise.all(
+        (['local', 'rpc', 'rest', 'graphql'] as const)
+          .map((door, index) => doors[door]('update', { id: rows[index].id, body: patch })),
+      );
+
+      const [local, ...others] = answers.map((answer) => written(answer, patch));
+      for (const [index, other] of others.entries()) {
+        expect(other, `${(['rpc', 'rest', 'graphql'] as const)[index]} ≠ local`).toEqual(local);
+      }
+    });
+
+    it('on delete', async () => {
+      const rows = await Promise.all([1, 2, 3, 4].map(() => doors.local('create', { body: bodyOf() }))) as { id: string }[];
+
+      const answers = await Promise.all(
+        (['local', 'rpc', 'rest', 'graphql'] as const).map((door, index) => doors[door]('delete', { id: rows[index].id })),
+      );
+
+      // REST answers a deletion with no content at all, which is the protocol saying yes.
+      const said = answers.map((answer) => (answer === undefined || answer === null ? true : wire(answer)));
+      expect(new Set(said).size, `the doors disagree: ${JSON.stringify(said)}`).toBe(1);
+    });
+
+    it('on a refusal', async () => {
+      // A refusal is where the doors diverge most, and where each is most tempted to
+      // answer in its own words. What must match is that it WAS refused.
+      const bad = { ...bodyOf(), __unknown__: 'x' };
+      const refusals = await Promise.all(
+        (['local', 'rpc', 'rest', 'graphql'] as const).map((door) => refused(() => doors[door]('create', { body: bad }))),
+      );
+
+      expect(refusals[0], 'local accepted a body outside the contract').toBe(true);
+      expect(refusals, `the doors disagree: ${JSON.stringify(refusals)}`).toEqual([true, true, true, true]);
+    });
+  });
+}
+
+/**
+ * Run one hand-written invocation contract through every door.
+ *
+ * `checkDoors` derives the generic CRUD gradient. This is its small explicit companion
+ * for semantics only the handler can observe — notably omitted versus null input. A new
+ * adapter joins the same harness instead of inventing its own interpretation.
+ */
+export function checkDoorContract(
+  app: App,
+  entity: SchemaView,
+  cases: readonly DoorContractCase[],
+  options: Pick<DoorOptions, 'surface'> = {},
+): void {
+  const name = lowerFirst(entity.name ?? '');
+  const doors = doorsOf(app, entity, name, options.surface);
+  const names = ['local', 'rpc', 'rest', 'graphql'] as const;
+
+  describe(`${entity.name} — its invocation contract crosses every door`, () => {
+    for (const one of cases) {
+      it(one.name, async () => {
+        const answers = await Promise.all(names.map((door) => doors[door](one.operation, one.input)));
+        for (const [index, answer] of answers.entries()) {
+          expect(wire(answer), `${names[index]} disagrees with the canonical invocation`).toEqual(wire(one.expected));
+        }
+      });
+    }
+  });
+}
+
+async function refused(call: () => Promise<unknown>): Promise<boolean> {
+  try { await call(); return false; } catch { return true; }
+}
+
+/** The four doors, each reduced to `(op, input) => answer` so the tests above read alike. */
+function doorsOf(app: App, entity: SchemaView, name: string, surface?: string): Doors {
+  const run = createLocalRunner(app, surface);
+  const state: Record<string, unknown> = {};
+
+  const invocation = (input: DoorInput = {}) => ({
+    ...EMPTY_INVOCATION,
+    ...(input.id !== undefined ? { params: { id: input.id } } : {}),
+    ...(input.body !== undefined ? { body: input.body } : {}),
+  });
+
+  return {
+    local: (op, input) => run({ entity: name, op }, invocation(input)),
+
+    rpc: async (op, input) => {
+      const answer = await serveRpc(app, {
+        path: '',
+        body: { jsonrpc: '2.0', id: 1, method: `${name}.${op}`, params: invocation(input) },
+        state,
+      }) as { result?: unknown; error?: { message: string } };
+      if (answer.error) throw new Error(answer.error.message);
+      return answer.result;
+    },
+
+    rest: async (op, input) => {
+      // The route the REST door itself would match, read from its own table — rebuilding
+      // the path here would be a second opinion on where an entity lives.
+      const route = tableOf(app).find((one) => one.entityName === name && one.operationName === op);
+      if (!route) throw new Error(`[checkDoors] REST serves no ${name}.${op}`);
+      const path = route.segments.map((segment) => (segment.startsWith(':') ? input?.id ?? '' : segment)).join('/');
+
+      const answer = await serveRest(app, { method: route.method, path, query: {}, body: input?.body, state });
+      if (answer.kind !== 'ok') throw new Error(`[checkDoors] REST answered ${answer.kind} on ${name}.${op}`);
+      return answer.body;
+    },
+
+    graphql: async (op, input) => {
+      const { executeOn, schemaOf } = await import('@fougere/adapter-graphql');
+      const schema = schemaOf(app as never) as never;
+      const built = op === 'list' ? listQuery(schema, entity)
+        : op === 'findById' ? findQuery(schema, entity, input?.id ?? '')
+        : mutationFor(schema, entity, op, { id: input?.id, body: input?.body });
+      if (!built) throw new Error(`[checkDoors] GraphQL serves no ${entity.name} ${op}`);
+
+      const answer = await executeOn(app as never, { query: built.query, state });
+      if (answer.errors?.length) throw new Error(`[checkDoors] GraphQL: ${answer.errors[0].message}`);
+      return at(answer.data, built.at);
+    },
+  };
+}

package/src/derive.ts

@@ -0,0 +1,18 @@
+import { Cases, type Case } from '@fougere/schema';
+import type { SchemaView } from '@fougere/schema';
+import { sampleInput, type SampleOptions } from './sample.js';
+
+/**
+ * The cases, with the valid body generated rather than handed in.
+ *
+ * `Cases` lives in `@fougere/schema` because deriving them reads the four axes and
+ * nothing else. This is the half that needs a generator, which is why it is here: a
+ * 426 KB faker has no business in the package a browser loads.
+ */
+export function derivedCases(
+  entity: SchemaView,
+  given: Record<string, unknown> = {},
+  options: SampleOptions = {},
+): readonly Case[] {
+  return Cases.of(entity, sampleInput(entity, given, options)).all;
+}

package/src/doors.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect } from 'vitest';
+import { createLocalRunner, validationErrorsOf, type App } from '@fougere/core';
+import { EMPTY_INVOCATION } from '@fougere/core/contract';
+import { lowerFirst, Visibility, type SchemaView, type ValidationError } from '@fougere/schema';
+import { Cases } from '@fougere/schema';
+import { derivedCases } from './derive.js';
+import { sampleInput, replaySeed, type SampleOptions } from './sample.js';
+
+/** The one shape both the local judge and a door already speak. */
+export interface Verdict {
+  success: boolean;
+  errors?: ValidationError[];
+}
+
+/**
+ * What a door answers, in the shape a verdict is compared in.
+ *
+ * A refusal reaches a caller as a thrown `FougereError` carrying `details`, not as a
+ * returned value — so the translation happens once, here, and every reader below compares
+ * the same thing.
+ */
+export async function verdictOf(call: () => Promise<unknown>): Promise<Verdict> {
+  try {
+    await call();
+    return { success: true };
+  } catch (error) {
+    const refusals = validationErrorsOf(error);
+    if (!refusals) throw error;
+    return { success: false, errors: refusals };
+  }
+}
+
+function opsFor(entity: SchemaView): { create: string; update: string; name: string } {
+  const name = lowerFirst(entity.name ?? '');
+  return { name, create: 'create', update: 'update' };
+}
+
+export interface CheckOptions extends SampleOptions {
+  /** Values the generator cannot invent — the id of a row a `ref()` points at. */
+  given?: Record<string, unknown>;
+}
+
+/**
+ * The declared contract, posed to the façade that will receive it.
+ *
+ * Declares one `it` per case rather than looping inside a single one: a failure names the
+ * case, and a suite that lists what it checked is the point — the list comes from the
+ * entity, not from what the author remembered.
+ */
+export function checkContract(app: App, entity: SchemaView, options: CheckOptions = {}): void {
+  const { name, create, update } = opsFor(entity);
+  const run = createLocalRunner(app);
+  const table = derivedCases(entity, options.given ?? {}, options);
+
+  describe(`${entity.name} — the contract it declares`, () => {
+    for (const one of table) {
+      it(one.why, async () => {
+        const verdict = await verdictOf(() => run(
+          { entity: name, op: one.patch ? update : create },
+          { ...EMPTY_INVOCATION, params: one.patch ? { id: '__absent__' } : {}, body: one.body },
+        ));
+
+        expect(Cases.holds(one.expect, verdict), `${JSON.stringify(verdict)} — replay: ${replaySeed()}`).toBe(true);
+      });
+    }
+  });
+}
+
+/**
+ * What may leave, checked against what the entity says may leave.
+ *
+ * Costs nothing to state: `Visibility.output` already answers it, and a field the boundary
+ * closes has no business in any response. A `password: text({ boundary: 'writeOnly' })`
+ * that reaches a caller is the one leak no reviewer catches by reading a handler.
+ */
+export function checkOutput(app: App, entity: SchemaView, options: CheckOptions = {}): void {
+  const { name, create } = opsFor(entity);
+  const run = createLocalRunner(app);
+  const allowed = new Set(Object.keys(Visibility.of(entity.getFields()).output));
+  const closed = Object.keys(entity.getFields()).filter((field) => !allowed.has(field));
+
+  describe(`${entity.name} — what leaves it`, () => {
+    it(closed.length > 0 ? `keeps ${closed.join(', ')} in` : 'closes no field, and says so', async () => {
+      const row = await run(
+        { entity: name, op: create },
+        { ...EMPTY_INVOCATION, body: sampleInput(entity, options.given ?? {}, options) },
+      ) as Record<string, unknown>;
+
+      expect(Object.keys(row).filter((field) => closed.includes(field))).toEqual([]);
+    });
+
+    it('answers with fields the entity declares, and no others', async () => {
+      const row = await run(
+        { entity: name, op: create },
+        { ...EMPTY_INVOCATION, body: sampleInput(entity, options.given ?? {}, options) },
+      ) as Record<string, unknown>;
+
+      // A computed field from a presenter is declared by the presenter, not the entity,
+      // so this reads the entity's own names as a floor rather than a ceiling.
+      expect(Object.keys(row).every((field) => field in entity.getFields())).toBe(true);
+    });
+  });
+}