@fuzdev/fuz_app 0.147.0 → 0.149.0

package/dist/testing/admin_integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAavE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm5BF,CAAC"}
+{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA4B1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAavE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAw+BF,CAAC"}

package/dist/testing/admin_integration.js

@@ -32,10 +32,11 @@ import { DEFAULT_TEST_PASSWORD } from './test_credentials.js';
 import { role_grant_offer_and_accept } from './role_grant_helpers.js';
 import { find_auth_route } from './integration_helpers.js';
 import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE } from './error_coverage.js';
-import { rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
+import { find_rpc_action, rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
 import { role_grant_offer_create_action_spec, role_grant_revoke_action_spec } from '../auth/role_grant_offer_action_specs.js';
-import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec } from '../auth/admin_action_specs.js';
-import { account_token_create_action_spec, account_verify_action_spec } from '../auth/account_action_specs.js';
+import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, app_settings_get_action_spec, app_settings_update_action_spec, AUDIT_LOG_LIST_LIMIT_MAX, invite_create_action_spec, invite_delete_action_spec, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec } from '../auth/admin_action_specs.js';
+import { account_session_list_action_spec, account_session_revoke_action_spec, account_token_create_action_spec, account_token_revoke_action_spec, account_verify_action_spec } from '../auth/account_action_specs.js';
+import { assert_audit_event_metadata } from './audit_drift_guard.js';
 import { to_route_content_type } from './schema_generators.js';
 /**
  * How long a failure-audit read waits for the pool-routed row to land.
@@ -151,6 +152,11 @@ export const describe_standard_admin_integration_tests = (options) => {
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(audit_res.ok, 'audit_log_list should succeed');
+                for (const event of audit_res.result.events) {
+                    assert_audit_event_metadata(event, {
+                        reject_unknown_keys: fixture.reject_unknown_audit_metadata_keys ?? false
+                    });
+                }
                 const failure = audit_res.result.events.find((e) => e.outcome === 'failure');
                 if (failure || Date.now() >= deadline)
                     return failure;
@@ -632,6 +638,58 @@ export const describe_standard_admin_integration_tests = (options) => {
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(token_res.ok, `account_token_create failed: ${token_res.ok ? '' : JSON.stringify(token_res.error)}`);
+                /** Call `spec` on the keeper's session, asserting success. */
+                const call_ok = async (spec, params, headers = fixture.create_session_headers()) => {
+                    const res = await rpc_call_for_spec({
+                        app: { request: fixture.transport },
+                        path: rpc_path,
+                        spec,
+                        params,
+                        headers
+                    });
+                    if (!res.ok)
+                        assert.fail(`${spec.method} failed: ${JSON.stringify(res.error)}`);
+                    return res.result;
+                };
+                // Steps 5a–5d each drive actions a consumer surface may not mount;
+                // a step whose actions are missing is skipped, and its event isn't
+                // expected.
+                const mounted = (...specs) => specs.every((spec) => find_rpc_action(rpc_endpoints_for_setup, spec.method));
+                const driven_types = [];
+                // 5a. revoke that token (RPC)
+                if (mounted(account_token_revoke_action_spec)) {
+                    const token_revoked = await call_ok(account_token_revoke_action_spec, {
+                        token_id: token_res.result.id
+                    });
+                    assert.strictEqual(token_revoked.revoked, true);
+                    driven_types.push('token_revoke');
+                }
+                // 5b. user_two revokes its own session — the last use of that session
+                if (mounted(account_session_list_action_spec, account_session_revoke_action_spec)) {
+                    const user_two_headers = user_two.create_session_headers();
+                    const { sessions } = await call_ok(account_session_list_action_spec, undefined, user_two_headers);
+                    assert.ok(sessions[0], 'user_two has a session to revoke');
+                    const session_revoked = await call_ok(account_session_revoke_action_spec, { session_id: sessions[0].id }, user_two_headers);
+                    assert.strictEqual(session_revoked.revoked, true);
+                    driven_types.push('session_revoke');
+                }
+                // 5c. an invite created and deleted unclaimed
+                if (mounted(invite_create_action_spec, invite_delete_action_spec)) {
+                    const { invite } = await call_ok(invite_create_action_spec, {
+                        email: 'audit_invitee@example.com',
+                        username: 'audit_invitee'
+                    });
+                    await call_ok(invite_delete_action_spec, { invite_id: invite.id });
+                    driven_types.push('invite_create', 'invite_delete');
+                }
+                // 5d. open signup flipped and restored
+                if (mounted(app_settings_get_action_spec, app_settings_update_action_spec)) {
+                    const { settings } = await call_ok(app_settings_get_action_spec, {});
+                    for (const open_signup of [!settings.open_signup, settings.open_signup]) {
+                        await call_ok(app_settings_update_action_spec, { open_signup });
+                    }
+                    driven_types.push('app_settings_update');
+                }
                 // 6. password change
                 await fixture.transport(password_route.path, {
                     method: 'POST',
@@ -670,14 +728,23 @@ export const describe_standard_admin_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: audit_log_list_action_spec,
-                    params: {},
+                    params: { limit: AUDIT_LOG_LIST_LIMIT_MAX },
                     headers: relogin_headers
                 });
                 assert.ok(audit_res.ok, `audit_log_list failed: ${audit_res.ok ? '' : JSON.stringify(audit_res.error)}`);
                 const events = audit_res.result.events;
+                // every row's metadata holds to its event type's schema — the
+                // wire leaves it a loose record
+                for (const event of events) {
+                    assert_audit_event_metadata(event, {
+                        reject_unknown_keys: fixture.reject_unknown_audit_metadata_keys ?? false
+                    });
+                }
                 // check that each operation produced at least one event.
                 // `role_grant_offer_create` fires on the admin RPC; `role_grant_create`
                 // fires when the recipient accepts (driven by offer_and_accept).
+                // No `signup` is expected: in-process, `create_account` inserts
+                // user_two directly, writing no audit row.
                 const expected_types = [
                     'login',
                     'logout',
@@ -686,7 +753,8 @@ export const describe_standard_admin_integration_tests = (options) => {
                     'role_grant_create',
                     'role_grant_revoke',
                     'token_create',
-                    'password_change'
+                    'password_change',
+                    ...driven_types
                 ];
                 for (const event_type of expected_types) {
                     const found = events.filter((e) => e.event_type === event_type);

package/dist/testing/adversarial_input.d.ts

@@ -1,51 +1,5 @@
 import './assert_dev_env.js';
-import { z } from 'zod';
-import { ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
 import type { AdversarialTestOptions } from './attack_surface.js';
-interface InputTestCase {
-    label: string;
-    body: unknown;
-    expected_error: typeof ERROR_INVALID_REQUEST_BODY | typeof ERROR_INVALID_JSON_BODY;
-}
-interface ParamsTestCase {
-    label: string;
-    params: Record<string, string>;
-}
-interface QueryTestCase {
-    label: string;
-    query: Record<string, string>;
-}
-/**
- * Generate adversarial test cases for a route's input schema.
- *
- * Produces focused, non-redundant cases:
- * - Whole-body: send array instead of object, extra unknown key
- * - Missing required fields (without defaults)
- * - One wrong-type value per field
- * - Null for required non-nullable fields
- * - One format violation per constrained field
- *
- * @throws Error if the seed body built by `generate_valid_value` fails
- *   `input_schema.safeParse` — surfaces broken generation logic with the
- *   Zod issues path rather than producing nonsense adversarial cases.
- */
-export declare const generate_input_test_cases: (input_schema: z.ZodType) => Array<InputTestCase>;
-/**
- * Generate adversarial test cases for a route's params schema.
- *
- * Params are always strings from URL segments. Only generates cases for
- * format-constrained fields (uuid, pattern) since unconstrained string
- * params accept any string value.
- */
-export declare const generate_params_test_cases: (params_schema: z.ZodObject) => Array<ParamsTestCase>;
-/**
- * Generate adversarial test cases for a route's query schema.
- *
- * Query params are always strings from the URL. Generates cases for:
- * - Missing required fields
- * - Format violations on constrained fields (uuid, pattern)
- */
-export declare const generate_query_test_cases: (query_schema: z.ZodObject) => Array<QueryTestCase>;
 /**
  * Generate adversarial input validation test suites.
  *
@@ -54,5 +8,4 @@ export declare const generate_query_test_cases: (query_schema: z.ZodObject) => A
  * middleware is actually exercised.
  */
 export declare const describe_adversarial_input: (options: AdversarialTestOptions) => void;
-export {};
 //# sourceMappingURL=adversarial_input.d.ts.map

package/dist/testing/adversarial_input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAmDlE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAyN5E,CAAC"}
+{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA2BlE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAyN5E,CAAC"}

package/dist/testing/adversarial_input.js

@@ -2,353 +2,17 @@ import './assert_dev_env.js';
 /**
  * Adversarial input validation testing for route specs.
  *
- * Walks Zod schemas directly to generate payloads that must fail validation.
- * Fires requests against a test app and asserts 400 responses before handlers
- * are reached.
- *
- * Tests are focused: one representative wrong-type value per field, one format
- * violation per constrained field, one null and one missing test per required
- * field, plus whole-body structural attacks (non-object body, extra unknown keys).
+ * Fires the payloads `adversarial_input_cases.ts` generates against a test
+ * app and asserts 400 responses before handlers are reached.
  *
  * @module
  */
 import { test, assert, describe } from 'vitest';
-import { z } from 'zod';
-import { zod_unwrap_to_object, zod_extract_fields } from '../zod.js';
-import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS } from '../http/error_schemas.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { detect_format, generate_valid_value, resolve_valid_path, to_route_content_type } from './schema_generators.js';
-// --- Payload generation ---
-/** One wrong-type value per base type — one representative is sufficient. */
-const wrong_type_for = (base_type) => {
-    switch (base_type) {
-        case 'string':
-        case 'uuid':
-        case 'email':
-            return { label: 'number instead of string', value: 42 };
-        case 'number':
-        case 'int':
-            return { label: 'string instead of number', value: 'not_a_number' };
-        case 'boolean':
-            return { label: 'number instead of boolean', value: 42 };
-        case 'array':
-            return { label: 'string instead of array', value: 'not_an_array' };
-        case 'object':
-            return { label: 'string instead of object', value: 'not_an_object' };
-        case 'enum':
-            return { label: 'number instead of enum', value: 42 };
-        default:
-            return null;
-    }
-};
-/** Format violation payloads — one per constraint type. */
-const format_violation = (format) => {
-    switch (format) {
-        case 'uuid':
-            return { label: 'malformed uuid', value: 'not-a-uuid' };
-        case 'email':
-            return { label: 'malformed email', value: 'not-an-email' };
-        case 'date-time':
-            return { label: 'malformed datetime', value: 'not-a-date' };
-        case 'pattern':
-            return { label: 'pattern violation', value: "'; DROP TABLE --" };
-        default:
-            return null;
-    }
-};
-// --- Input test case generation ---
-/**
- * Generate adversarial test cases for a route's input schema.
- *
- * Produces focused, non-redundant cases:
- * - Whole-body: send array instead of object, extra unknown key
- * - Missing required fields (without defaults)
- * - One wrong-type value per field
- * - Null for required non-nullable fields
- * - One format violation per constrained field
- *
- * @throws Error if the seed body built by `generate_valid_value` fails
- *   `input_schema.safeParse` — surfaces broken generation logic with the
- *   Zod issues path rather than producing nonsense adversarial cases.
- */
-export const generate_input_test_cases = (input_schema) => {
-    if (is_null_schema(input_schema))
-        return [];
-    const object_schema = zod_unwrap_to_object(input_schema);
-    if (!object_schema)
-        return [];
-    const fields = zod_extract_fields(object_schema);
-    const cases = [];
-    // build a base object with valid-ish values — must pass validation itself
-    // skip optional fields without defaults to avoid generating invalid nested values
-    const base = {};
-    for (const field of fields) {
-        if (!field.required && !field.has_default)
-            continue;
-        base[field.name] = generate_valid_value(field, object_schema.shape[field.name]);
-    }
-    let base_result = input_schema.safeParse(base);
-    if (!base_result.success) {
-        // Fallback for schemas with a top-level `.refine()` that requires at
-        // least one of N optional fields. Fill optional fields until the base
-        // satisfies validation; surfaces a clear error if no combination works.
-        for (const field of fields) {
-            if (field.required || field.has_default || field.name in base)
-                continue;
-            base[field.name] = generate_valid_value(field, object_schema.shape[field.name]);
-            base_result = input_schema.safeParse(base);
-            if (base_result.success)
-                break;
-        }
-    }
-    if (!base_result.success) {
-        throw new Error(`adversarial_input: generated base object fails validation for schema — ` +
-            `fix generate_valid_value for: ${base_result.error.issues
-                .map((i) => `${i.path.join('.')}: ${i.message}`)
-                .join(', ')}`);
-    }
-    // whole-body structural: send array instead of object
-    cases.push({
-        label: 'non-object body (array)',
-        body: [1, 2, 3],
-        expected_error: ERROR_INVALID_JSON_BODY
-    });
-    // whole-body structural: extra unknown key (enforces strictObject)
-    // only emit if the schema rejects unknown keys (i.e. uses z.strictObject)
-    const extra_key_result = input_schema.safeParse({ ...base, __adversarial_extra: 'rejected' });
-    if (!extra_key_result.success) {
-        cases.push({
-            label: 'extra unknown key',
-            body: { ...base, __adversarial_extra: 'should_be_rejected' },
-            expected_error: ERROR_INVALID_REQUEST_BODY
-        });
-    }
-    for (const field of fields) {
-        const field_schema = object_schema.shape[field.name];
-        // missing required field (skip fields with defaults — Zod fills them)
-        if (field.required && !field.has_default) {
-            const without = {};
-            for (const [k, v] of Object.entries(base)) {
-                if (k !== field.name)
-                    without[k] = v;
-            }
-            cases.push({
-                label: `missing: ${field.name}`,
-                body: without,
-                expected_error: ERROR_INVALID_REQUEST_BODY
-            });
-        }
-        // one wrong-type value
-        const wrong = wrong_type_for(field.base_type);
-        if (wrong) {
-            cases.push({
-                label: `wrong type: ${field.name} (${wrong.label})`,
-                body: { ...base, [field.name]: wrong.value },
-                expected_error: ERROR_INVALID_REQUEST_BODY
-            });
-        }
-        // null for required non-nullable fields
-        if (field.required && !field.nullable && field.base_type !== 'null') {
-            cases.push({
-                label: `null: ${field.name}`,
-                body: { ...base, [field.name]: null },
-                expected_error: ERROR_INVALID_REQUEST_BODY
-            });
-        }
-        // format violation for constrained string fields
-        const format = detect_format(field_schema);
-        if (format) {
-            const violation = format_violation(format);
-            if (violation) {
-                cases.push({
-                    label: `format: ${field.name} (${violation.label})`,
-                    body: { ...base, [field.name]: violation.value },
-                    expected_error: ERROR_INVALID_REQUEST_BODY
-                });
-            }
-        }
-        // --- Boundary cases via JSON Schema introspection ---
-        try {
-            const json = z.toJSONSchema(field_schema);
-            // string length boundaries
-            if (field.base_type === 'string' ||
-                field.base_type === 'uuid' ||
-                field.base_type === 'email') {
-                if (typeof json.minLength === 'number' && json.minLength > 0) {
-                    cases.push({
-                        label: `empty string: ${field.name}`,
-                        body: { ...base, [field.name]: '' },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maxLength === 'number') {
-                    cases.push({
-                        label: `over maxLength: ${field.name} (${json.maxLength + 1} chars)`,
-                        body: { ...base, [field.name]: 'x'.repeat(json.maxLength + 1) },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-            }
-            // numeric boundaries
-            if (field.base_type === 'number' || field.base_type === 'int') {
-                if (typeof json.minimum === 'number') {
-                    cases.push({
-                        label: `below minimum: ${field.name} (${json.minimum - 1})`,
-                        body: { ...base, [field.name]: json.minimum - 1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maximum === 'number') {
-                    cases.push({
-                        label: `above maximum: ${field.name} (${json.maximum + 1})`,
-                        body: { ...base, [field.name]: json.maximum + 1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.exclusiveMinimum === 'number') {
-                    cases.push({
-                        label: `at exclusive minimum: ${field.name} (${json.exclusiveMinimum})`,
-                        body: { ...base, [field.name]: json.exclusiveMinimum },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.exclusiveMaximum === 'number') {
-                    cases.push({
-                        label: `at exclusive maximum: ${field.name} (${json.exclusiveMaximum})`,
-                        body: { ...base, [field.name]: json.exclusiveMaximum },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                // 0 and negative for positive-only fields
-                if (typeof json.minimum === 'number' && json.minimum > 0) {
-                    cases.push({
-                        label: `zero for positive-only: ${field.name}`,
-                        body: { ...base, [field.name]: 0 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                    cases.push({
-                        label: `negative for positive-only: ${field.name}`,
-                        body: { ...base, [field.name]: -1 },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-            }
-            // array length boundaries
-            if (field.base_type === 'array') {
-                if (typeof json.minItems === 'number' && json.minItems > 0) {
-                    cases.push({
-                        label: `empty array for minItems > 0: ${field.name}`,
-                        body: { ...base, [field.name]: [] },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-                if (typeof json.maxItems === 'number') {
-                    // generate an array one item over the max (items are null — schema-agnostic)
-                    cases.push({
-                        label: `over maxItems: ${field.name} (${json.maxItems + 1} items)`,
-                        body: { ...base, [field.name]: Array.from({ length: json.maxItems + 1 }, () => null) },
-                        expected_error: ERROR_INVALID_REQUEST_BODY
-                    });
-                }
-            }
-        }
-        catch {
-            // schema can't be converted to JSON Schema, skip boundary cases
-        }
-    }
-    return cases;
-};
-// --- Params test case generation ---
-/**
- * Generate adversarial test cases for a route's params schema.
- *
- * Params are always strings from URL segments. Only generates cases for
- * format-constrained fields (uuid, pattern) since unconstrained string
- * params accept any string value.
- */
-export const generate_params_test_cases = (params_schema) => {
-    const fields = zod_extract_fields(params_schema);
-    const cases = [];
-    // build base params with valid-ish values
-    const base_params = {};
-    for (const field of fields) {
-        const field_schema = params_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (format === 'uuid' || field.base_type === 'uuid') {
-            base_params[field.name] = '00000000-0000-0000-0000-000000000000';
-        }
-        else {
-            base_params[field.name] = 'test_value';
-        }
-    }
-    for (const field of fields) {
-        const field_schema = params_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (!format)
-            continue; // unconstrained string — any value passes
-        const violation = format_violation(format);
-        if (violation) {
-            cases.push({
-                label: `${violation.label}: param ${field.name}`,
-                params: { ...base_params, [field.name]: violation.value }
-            });
-        }
-    }
-    return cases;
-};
-// --- Query test case generation ---
-/**
- * Generate adversarial test cases for a route's query schema.
- *
- * Query params are always strings from the URL. Generates cases for:
- * - Missing required fields
- * - Format violations on constrained fields (uuid, pattern)
- */
-export const generate_query_test_cases = (query_schema) => {
-    const fields = zod_extract_fields(query_schema);
-    const cases = [];
-    // build base query with valid-ish values
-    const base_query = {};
-    for (const field of fields) {
-        const field_schema = query_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (format === 'uuid' || field.base_type === 'uuid') {
-            base_query[field.name] = '00000000-0000-0000-0000-000000000000';
-        }
-        else {
-            base_query[field.name] = 'test_value';
-        }
-    }
-    for (const field of fields) {
-        // missing required field
-        if (field.required && !field.has_default) {
-            const without = {};
-            for (const [k, v] of Object.entries(base_query)) {
-                if (k !== field.name)
-                    without[k] = v;
-            }
-            cases.push({
-                label: `missing query: ${field.name}`,
-                query: without
-            });
-        }
-        // format violation for constrained string fields
-        const field_schema = query_schema.shape[field.name];
-        const format = detect_format(field_schema);
-        if (!format)
-            continue;
-        const violation = format_violation(format);
-        if (violation) {
-            cases.push({
-                label: `${violation.label}: query ${field.name}`,
-                query: { ...base_query, [field.name]: violation.value }
-            });
-        }
-    }
-    return cases;
-};
+import { resolve_valid_path, to_route_content_type } from './schema_generators.js';
+import { generate_input_test_cases, generate_params_test_cases, generate_query_test_cases } from './adversarial_input_cases.js';
 // --- URL helpers ---
 /** Build a URL path with adversarial param values. */
 const build_fuzz_url = (route_path, params) => {

package/dist/testing/adversarial_input_cases.d.ts

@@ -0,0 +1,124 @@
+import './assert_dev_env.js';
+/**
+ * Schema-walk generation of adversarial inputs — payloads that must fail
+ * validation.
+ *
+ * Focused cases: one representative wrong-type value per field, one format
+ * violation per constrained field, one null and one missing case per required
+ * field, plus whole-body structural attacks (non-object body, extra unknown
+ * keys). Hono-free, so the cross-process suites reuse the generators the
+ * in-process `describe_adversarial_input` and `describe_rpc_attack_surface_tests`
+ * run.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
+/** One adversarial body for an input schema, and the error code it owes. */
+export interface InputTestCase {
+    label: string;
+    body: unknown;
+    /**
+     * The one top-level field the case breaks; absent on a whole-body case (a
+     * non-object body, an extra unknown key). An RPC refusal of the case owes
+     * the field's declared `invalid_reason` (`expected_invalid_reason`).
+     */
+    field?: string;
+    expected_error: typeof ERROR_INVALID_REQUEST_BODY | typeof ERROR_INVALID_JSON_BODY;
+}
+/** One adversarial params set for a route's params schema. */
+export interface ParamsTestCase {
+    label: string;
+    params: Record<string, string>;
+}
+/** One adversarial query for a route's query schema. */
+export interface QueryTestCase {
+    label: string;
+    query: Record<string, string>;
+}
+/** Options for `generate_input_test_cases`. */
+export interface InputTestCaseOptions {
+    /**
+     * A valid body to build the cases from, in place of the generated one —
+     * for an input whose valid shape the generator can't reach, or one whose
+     * generated body the handler can't run. Each case is this body with one
+     * field broken, so it must pass the input schema itself: one that doesn't
+     * throws.
+     */
+    base?: Record<string, unknown>;
+    /** Names the input in error messages — the RPC method or route it belongs to. */
+    label?: string;
+}
+/**
+ * Generate adversarial test cases for a route's input schema.
+ *
+ * Produces focused, non-redundant cases:
+ * - Whole-body: send array instead of object, extra unknown key
+ * - Missing required fields (without defaults)
+ * - One wrong-type value per field
+ * - Null for required non-nullable fields
+ * - One format violation per constrained field
+ * - String length (empty, one under `minLength`, one over `maxLength`), numeric
+ *   (out of range, non-integer, off a `multipleOf` grid) and array-length
+ *   (empty, one under `minItems`, one over `maxItems`) boundaries
+ *
+ * Format and boundaries come from the field's input-side JSON Schema
+ * (`to_field_json_schema`), so a field carrying a `.transform()` or pipe and a
+ * `.nullable()` / `.nullish()` field get them too. A bound only a `.refine()`
+ * enforces generates nothing — JSON Schema can't express it.
+ *
+ * Each per-field case is single-fault: valid except for the field it breaks.
+ * It changes one field of a valid base body — `options.base` when given, else
+ * one built by `generate_valid_object` — or, for a field that base omits, of
+ * the valid body `generate_valid_object_with_field` builds around it, so a case
+ * can't also break an object-level rule (adding `scope_kind` without its
+ * paired `scope_id`, or `slug` beside an exactly-one-of `id`). A field no valid
+ * body carries keeps its wrong-type and null cases on the base and gets no
+ * format or boundary cases, which would test no bound. A per-field case is
+ * emitted only when the field refuses its value, so no case is accidentally
+ * valid.
+ *
+ * @param input_schema - the input schema to attack
+ * @param options - a base body to seed the cases, and a label for errors
+ * @throws Error if the base body fails `input_schema.safeParse` — a seeded
+ *   base the schema refuses, or a generated one that surfaces broken
+ *   generation logic — naming the issues rather than producing nonsense
+ *   adversarial cases.
+ */
+export declare const generate_input_test_cases: (input_schema: z.ZodType, options?: InputTestCaseOptions) => Array<InputTestCase>;
+/**
+ * The `error.data.reason` an RPC refusal of `test_case` owes: the declared
+ * `invalid_reason` of the field it breaks, resolved as the dispatcher resolves
+ * a failure on that field (`resolve_invalid_reason`), or `undefined` — no
+ * reason — for an undeclared field or a whole-body case.
+ *
+ * @param input_schema - the input schema the case was generated from
+ * @param test_case - a case `generate_input_test_cases` produced from it
+ * @returns the owed reason, or `undefined` when the refusal carries none
+ */
+export declare const expected_invalid_reason: (input_schema: z.ZodType, test_case: InputTestCase) => string | undefined;
+/**
+ * Generate adversarial test cases for a route's params schema.
+ *
+ * Params are always strings from URL segments. Only generates cases for
+ * format-constrained fields (uuid, pattern) since unconstrained string
+ * params accept any string value, and only a violation the field refuses.
+ * Each case breaks one field of a valid params record.
+ *
+ * @throws Error if no valid params record can be generated
+ */
+export declare const generate_params_test_cases: (params_schema: z.ZodObject) => Array<ParamsTestCase>;
+/**
+ * Generate adversarial test cases for a route's query schema.
+ *
+ * Query params are always strings from the URL. Generates cases for:
+ * - Missing required fields the field refuses to go without (a preprocessed
+ *   field with a default accepts its absence)
+ * - Format violations on constrained fields (uuid, pattern) the field refuses
+ *
+ * Each case breaks one field of a valid query record.
+ *
+ * @throws Error if no valid query record can be generated
+ */
+export declare const generate_query_test_cases: (query_schema: z.ZodObject) => Array<QueryTestCase>;
+//# sourceMappingURL=adversarial_input_cases.d.ts.map