@hypequery/protocol-conformance 0.12.0 → 0.14.0

package/dist/adapters/generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/adapters/generators.ts"],"names":[],"mappings":"AAIA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuC1D;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAMxD;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAoCzD;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA2BrD;AAgBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuB7D;AA4CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAsFjE;AAkBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAyBpD;AAeD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAoB1D;AAmBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAmBrD;AAaD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAgBtD"}
+{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/adapters/generators.ts"],"names":[],"mappings":"AAIA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuC1D;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAMxD;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA0CzD;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA2BrD;AAgBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuB7D;AA4CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAsFjE;AAkBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAyBpD;AAeD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAoB1D;AAmBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAmBrD;AAaD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAgBtD"}

package/dist/adapters/generators.js

@@ -89,6 +89,12 @@ export function materializeExpression(spec) {
                     operands: Array.from({ length: groupIndex === 9 ? spec.lastGroupItems : 100 }, () => ({ ...EXPR_LITERAL })),
                 })),
             };
+        case 'segments':
+            return {
+                kind: 'dataset',
+                dataset: 'orders',
+                segments: Array.from({ length: spec.count }, (_, index) => `s${index}`),
+            };
         case 'unsafe-accessor': {
             const value = { kind: 'reference' };
             Object.defineProperty(value, 'name', { enumerable: true, get: () => 'orders' });

package/dist/adapters/reference.d.ts

@@ -9,7 +9,7 @@ export declare const REFERENCE_HOSTILE_OBJECT_SUITE: {
     readonly count: 7;
     readonly mechanisms: readonly ["getter", "toJSON", "proxy", "custom-prototype", "symbol-key", "sparse-array", "cycle"];
 };
-export declare const REFERENCE_FAMILIES: readonly ["cache-keys-v1", "tagged-values-v1", "identifiers-v1", "expressions-v1", "query-schemas-v1", "query-implementations-v1", "query-events-v1", "query-diagnostics-v1", "deployments-v2", "deployment-bundles-v1", "deployment-releases-v1", "semantic-invocations-v1"];
+export declare const REFERENCE_FAMILIES: readonly ["cache-keys-v1", "cache-preimages-v1", "tagged-values-v1", "identifiers-v1", "expressions-v1", "expressions-v2", "query-schemas-v1", "query-implementations-v1", "query-events-v1", "query-diagnostics-v1", "deployments-v2", "deployments-v3", "deployment-bundles-v1", "deployment-releases-v1", "semantic-invocations-v1", "semantic-invocations-v2"];
 export declare function referenceHandle(family: string, role: FixtureRole, c: Case, section?: string): HandlerResult;
 export {};
 //# sourceMappingURL=reference.d.ts.map

package/dist/adapters/reference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference.d.ts","sourceRoot":"","sources":["../../src/adapters/reference.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc9D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BpC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;CAWjC,CAAC;AAEX,eAAO,MAAM,kBAAkB,+QAarB,CAAC;AAEX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,CAAC,EAAE,IAAI,EACP,OAAO,CAAC,EAAE,MAAM,GACf,aAAa,CAsCf"}
+{"version":3,"file":"reference.d.ts","sourceRoot":"","sources":["../../src/adapters/reference.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc9D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BpC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;CAWjC,CAAC;AAEX,eAAO,MAAM,kBAAkB,oWAiBrB,CAAC;AAEX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,CAAC,EAAE,IAAI,EACP,OAAO,CAAC,EAAE,MAAM,GACf,aAAa,CA8Cf"}

package/dist/adapters/reference.js

@@ -2,7 +2,7 @@
 // root export of @hypequery/protocol and returns a wire result. Every operation
 // goes through the package's supported surface — this is exactly what a second
 // implementation must reproduce.
-import { decodeCanonicalValue, deriveProtocolCacheKey, deriveProtocolCacheNamespaceToken, encodeCanonicalValue, hashCanonicalValue, parseProtocolIdentifier, parseProtocolQualifiedIdentifier, prepareProtocolDeploymentBundleManifest, prepareProtocolDeploymentContract, prepareProtocolDeploymentReleaseEnvelope, splitProtocolQualifiedIdentifier, validateCanonicalValue, validateProtocolDeploymentBundleManifest, validateProtocolDeploymentContract, validateProtocolDeploymentReleaseEnvelope, validateProtocolExpression, validateProtocolQueryDiagnostics, validateProtocolQueryEvent, validateProtocolQueryImplementation, validateProtocolSchema, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationFailure, validateProtocolSemanticInvocationResult, validateProtocolSemanticQuery, validateProtocolSqlExpression, } from '@hypequery/protocol';
+import { buildProtocolCachePreimage, decodeCanonicalValue, deriveProtocolCacheKey, deriveProtocolCacheNamespaceToken, encodeCanonicalValue, hashCanonicalValue, parseProtocolIdentifier, parseProtocolQualifiedIdentifier, prepareProtocolDeploymentBundleManifest, prepareProtocolDeploymentContract, prepareProtocolDeploymentContractV3, prepareProtocolDeploymentReleaseEnvelope, splitProtocolQualifiedIdentifier, validateCanonicalValue, validateProtocolDeploymentBundleManifest, validateProtocolDeploymentContract, validateProtocolDeploymentContractV3, validateProtocolDeploymentReleaseEnvelope, validateProtocolExpression, validateProtocolQueryDiagnostics, validateProtocolQueryEvent, validateProtocolQueryImplementation, validateProtocolSchema, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationFailure, validateProtocolSemanticInvocationResult, validateProtocolSemanticInvocationV2, validateProtocolSemanticQuery, validateProtocolSqlExpression, } from '@hypequery/protocol';
 import { materializeBundle, materializeDiagnostics, materializeEvent, materializeSemanticInvocation, materializeExpression, materializeIdentifier, materializeImplementation, materializeRelease, materializeSchema, materializeTaggedValue, } from './generators.js';
 const STABLE_CODE = /^HQ_[A-Z0-9_]+$/;
 /** Turns a thrown protocol error into a wire rejection; rethrows anything else. */
@@ -44,17 +44,21 @@ export const REFERENCE_HOSTILE_OBJECT_SUITE = {
 };
 export const REFERENCE_FAMILIES = [
     'cache-keys-v1',
+    'cache-preimages-v1',
     'tagged-values-v1',
     'identifiers-v1',
     'expressions-v1',
+    'expressions-v2',
     'query-schemas-v1',
     'query-implementations-v1',
     'query-events-v1',
     'query-diagnostics-v1',
     'deployments-v2',
+    'deployments-v3',
     'deployment-bundles-v1',
     'deployment-releases-v1',
     'semantic-invocations-v1',
+    'semantic-invocations-v2',
 ];
 export function referenceHandle(family, role, c, section) {
     switch (family) {
@@ -63,7 +67,9 @@ export function referenceHandle(family, role, c, section) {
         case 'identifiers-v1':
             return handleIdentifier(role, c);
         case 'expressions-v1':
-            return handleExpression(role, c, section);
+            return handleExpression(role, c, section, 1);
+        case 'expressions-v2':
+            return handleExpression(role, c, section, 2);
         case 'query-schemas-v1':
             return attempt(() => {
                 validateProtocolSchema(validationInput(c, materializeSchema));
@@ -83,14 +89,20 @@ export function referenceHandle(family, role, c, section) {
             });
         case 'deployments-v2':
             return handleDeploymentV2(role, c);
+        case 'deployments-v3':
+            return handleDeploymentV3(role, c);
         case 'deployment-bundles-v1':
             return handleBundle(role, c);
         case 'deployment-releases-v1':
             return handleRelease(role, c);
         case 'semantic-invocations-v1':
-            return handleSemanticInvocation(c);
+            return handleSemanticInvocation(c, 1);
+        case 'semantic-invocations-v2':
+            return handleSemanticInvocation(c, 2);
         case 'cache-keys-v1':
             return handleCacheKey(role, c);
+        case 'cache-preimages-v1':
+            return handleCachePreimage(role, c);
         default:
             throw new Error(`reference adapter does not support family ${family}`);
     }
@@ -99,9 +111,9 @@ export function referenceHandle(family, role, c, section) {
  * One family covers the invocation, result, and failure records, so each case
  * names which one it validates against.
  */
-function handleSemanticInvocation(c) {
+function handleSemanticInvocation(c, version) {
     const validators = {
-        invocation: validateProtocolSemanticInvocation,
+        invocation: version === 2 ? validateProtocolSemanticInvocationV2 : validateProtocolSemanticInvocation,
         result: validateProtocolSemanticInvocationResult,
         failure: validateProtocolSemanticInvocationFailure,
     };
@@ -146,6 +158,18 @@ function handleCacheKey(role, c) {
         };
     });
 }
+function handleCachePreimage(role, c) {
+    return attempt(() => {
+        const preimage = buildProtocolCachePreimage({
+            secret: hexToBytes(c.secretHex),
+            definitionIdentity: c.definitionIdentity,
+            query: c.query,
+            tenant: c.tenant,
+            rowLimit: c.rowLimit,
+        });
+        return role === 'success' ? { ok: true, output: { preimageUtf8: preimage } } : { ok: true };
+    });
+}
 function handleTaggedValue(role, c) {
     if (role === 'success') {
         return attempt(() => ({
@@ -185,17 +209,17 @@ function handleIdentifier(role, c) {
         return ACCEPT;
     });
 }
-function handleExpression(role, c, section) {
+function handleExpression(role, c, section, extension) {
     const isQuery = section === '/queries' || c.mode === 'query';
     const validate = isQuery ? validateProtocolSemanticQuery : validateProtocolExpression;
     if (role === 'success') {
         return attempt(() => {
-            validate(validationInput(c, materializeExpression));
+            validate(validationInput(c, materializeExpression), { extension });
             return ACCEPT;
         });
     }
     return attempt(() => {
-        validate(validationInput(c, materializeExpression));
+        validate(validationInput(c, materializeExpression), { extension });
         return ACCEPT;
     });
 }
@@ -220,6 +244,18 @@ function handleDeploymentV2(role, c) {
         return ACCEPT;
     });
 }
+function handleDeploymentV3(role, c) {
+    if (role === 'identity') {
+        return attempt(() => {
+            const prepared = prepareProtocolDeploymentContractV3(c.value);
+            return { ok: true, output: { canonical: prepared.canonical, sha256: prepared.identity } };
+        });
+    }
+    return attempt(() => {
+        validateProtocolDeploymentContractV3(c.value);
+        return ACCEPT;
+    });
+}
 function handleBundle(role, c) {
     if (role === 'identity') {
         return attempt(() => {

package/dist/compare.js

@@ -121,6 +121,12 @@ function compareSuccessOutput(ec, o) {
             return outcome(ec, 'fail', { expected: 'segments', actual: 'mismatch' });
         }
     }
+    if (ec.family === 'cache-preimages-v1') {
+        // By name only: a preimage holds filter values, so a report never prints one.
+        if (o.preimageUtf8 !== ec.case.preimageUtf8) {
+            return outcome(ec, 'fail', { expected: 'preimageUtf8', actual: 'mismatch' });
+        }
+    }
     if (ec.family === 'cache-keys-v1') {
         // Reported as 'mismatch' rather than by value: a run against non-fixture
         // inputs would otherwise print keys derived from a real secret.

package/fixtures/cache-preimages-v1/README.md

@@ -0,0 +1,74 @@
+# Cache preimage version 1 fixtures
+
+These language-neutral fixtures accompany accepted RFC 0009 ("Tenant
+fingerprint" and "Cache preimage") and are normative for cache preimage
+version 1.
+
+## Success manifest
+
+Each entry in `success.json` contains:
+
+- `id`: stable fixture identifier;
+- `secretHex`: the namespace's RFC 0013 cache-key secret as lowercase hex,
+  used for tenant fingerprints;
+- `definitionIdentity`: 64 lowercase hex characters;
+- `query`: an RFC 0003 semantic query, validated under expression extension 2;
+- `tenant`: the trusted tenant capability, as `{"mode": "none"}`,
+  `{"mode": "scoped", "ids": [...]}` with raw tenant identifiers, or
+  `{"mode": "all"}`. The preimage replaces each identifier with its tenant
+  fingerprint;
+- `rowLimit`: the effective row limit, or `null`;
+- `preimageUtf8`: the exact canonical preimage.
+
+`secretHex`, `tenant` and `rowLimit` describe trusted execution context. They are fixture
+inputs, not request fields.
+
+## Rejection manifest
+
+Entries in `rejections.json` carry the same inputs plus the required stable
+`error` code. The `precedence-*` cases violate several rules at once and pin
+the first failure.
+
+## What the corpus is designed to prove
+
+Equivalent requests must build identical bytes:
+
+- `minimal-dataset`, `empty-collections-equal-omitted`,
+  `offset-zero-equals-omitted` and `include-meta-and-limit-dropped` all build
+  the same preimage;
+- `filters-order-a`, `filters-order-b` and `duplicate-filters-collapse` all
+  build the same preimage;
+- `tenant-scoped-sorted-deduplicated` shows that tenant fingerprints are
+  sorted and deduplicated.
+
+Requests that can return different rows must not:
+
+- `measures-empty-differs-from-omitted`: `[]` selects no measures, while
+  omitting the field selects every measure;
+- `dimension-order-a` and `dimension-order-b`: column order is part of the
+  result;
+- `tenant-scoped` and `tenant-all` differ from each other and from
+  `minimal-dataset`, which is tenant-free. This is the RFC 0009 cache-confusion
+  guarantee;
+- `definition-changes-preimage` and `row-limit-zero` differ from
+  `minimal-dataset`;
+- `tenant-fingerprint-follows-secret`: the same tenant under another secret
+  builds a different preimage.
+
+Raw tenant identifiers never appear in a preimage, and no scoped case's
+preimage contains its raw identifiers. `tenant-id-has-no-length-cap` and
+`tenant-count-has-no-cap` pin that there is no tenant limit beyond RFC 0013's
+1 MiB bound on the preimage.
+
+## How these expectations were produced
+
+The expectations were generated twice, by independent implementations of the
+rules, before any runtime implemented them:
+
+- a Python generator built on the Python RFC 0003 validator, the RFC 8785
+  serializer, and `hmac`;
+- a Node generator built on the TypeScript validator, a separate serializer,
+  and `node:crypto`.
+
+Both produced identical output for all 44 cases. The conformance runner now
+holds `@hypequery/protocol` and the Python package to the same bytes.

package/fixtures/cache-preimages-v1/rejections.json

@@ -0,0 +1,304 @@
+[
+  {
+    "id": "secret-missing",
+    "secretHex": "",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_MISSING"
+  },
+  {
+    "id": "secret-31-bytes",
+    "secretHex": "11111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_TOO_SHORT"
+  },
+  {
+    "id": "definition-uppercase",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "definition-short",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "definition-not-string",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": null,
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "query-unknown-field",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "SELECT 1"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "query-measures-on-metric",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "metric",
+      "dataset": "orders",
+      "metric": "aov",
+      "measures": [
+        "revenue"
+      ]
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "query-duplicate-segments",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "segments": [
+        "vip",
+        "vip"
+      ]
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "tenant-unknown-mode",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-none-with-ids",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none",
+      "ids": [
+        "acme"
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-empty",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": []
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-empty-id",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": [
+        ""
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-non-string-id",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": [
+        7
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "row-limit-negative",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "row-limit-above-safe-integer",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": 9007199254740992,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "row-limit-string",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": "100",
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "precedence-secret-before-definition",
+    "secretHex": "",
+    "definitionIdentity": "nope",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_MISSING"
+  },
+  {
+    "id": "precedence-definition-before-query",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "nope",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "precedence-query-before-tenant",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "precedence-tenant-before-limit",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  }
+]