@hypequery/protocol-conformance 0.13.0 → 0.15.0

package/dist/adapters/generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/adapters/generators.ts"],"names":[],"mappings":"AAIA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuC1D;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAMxD;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA0CzD;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA2BrD;AAgBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuB7D;AA4CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAsFjE;AAkBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAyBpD;AAeD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAoB1D;AAmBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAmBrD;AAaD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAgBtD"}
+{"version":3,"file":"generators.d.ts","sourceRoot":"","sources":["../../src/adapters/generators.ts"],"names":[],"mappings":"AAIA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuC1D;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAMxD;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA0CzD;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA2BrD;AAgBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAuB7D;AA4CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAsFjE;AAkBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAiCpD;AAeD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAyB1D;AAmBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAmBrD;AAaD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAgBtD"}

package/dist/adapters/generators.js

@@ -331,6 +331,14 @@ export function materializeEvent(spec) {
         case 'invalid-target': return { ...value, target: { project: 'has space', environment: 'production' } };
         case 'invalid-query-name': return { ...value, queryName: 'not an identifier' };
         case 'oversized-correlation-id': return { ...value, correlationId: repeat('x', 2_049) };
+        case 'newer-version-with-new-field': return { ...value, version: 2, sampleRate: 0.5 };
+        case 'wrong-kind-with-unknown-field': return { ...value, kind: 'hypequery-query-log', sql: 'SELECT 1' };
+        case 'impossible-calendar-date': return { ...value, occurredAt: '2026-02-30T00:00:00Z' };
+        case 'hour-twenty-four': return { ...value, occurredAt: '2026-07-20T24:00:00Z' };
+        case 'one-digit-fraction': return { ...value, occurredAt: '2026-07-20T12:34:56.5Z' };
+        case 'fractional-duration': return { ...value, durationMs: 1.5 };
+        case 'correlation-id-one-byte-over': return { ...value, correlationId: `${repeat('\u00e9', 512)}x` };
+        case 'correlation-id-lone-surrogate': return { ...value, correlationId: 'req\ud800id' };
         case 'unsafe-accessor': {
             const unsafe = baseEvent();
             Object.defineProperty(unsafe, 'kind', { enumerable: true, get: () => 'hypequery-query-event' });
@@ -366,6 +374,11 @@ export function materializeDiagnostics(spec) {
         case 'zero-attempts': return { ...value, attempts: 0 };
         case 'control-character-message': return { ...value, safeMessage: 'bad\u0007message' };
         case 'oversized-debug-query': return { ...value, debugQuery: repeat('x', 4_097) };
+        case 'newer-version-with-new-field': return { ...value, version: 2, retryReason: 'transient' };
+        case 'too-many-attempts': return { ...value, attempts: 65 };
+        case 'prefixed-runtime-identity': return { ...value, runtimeIdentity: `sha256:${repeat('d', 64)}` };
+        case 'debug-query-lone-surrogate': return { ...value, debugQuery: 'SELECT \udc00' };
+        case 'debug-query-bell-character': return { ...value, debugQuery: 'SELECT\u00071' };
         case 'unsafe-accessor': {
             const unsafe = baseDiagnostics();
             Object.defineProperty(unsafe, 'kind', { enumerable: true, get: () => 'hypequery-query-diagnostics' });

package/dist/adapters/reference.d.ts

@@ -9,7 +9,7 @@ export declare const REFERENCE_HOSTILE_OBJECT_SUITE: {
     readonly count: 7;
     readonly mechanisms: readonly ["getter", "toJSON", "proxy", "custom-prototype", "symbol-key", "sparse-array", "cycle"];
 };
-export declare const REFERENCE_FAMILIES: readonly ["cache-keys-v1", "tagged-values-v1", "identifiers-v1", "expressions-v1", "expressions-v2", "query-schemas-v1", "query-implementations-v1", "query-events-v1", "query-diagnostics-v1", "deployments-v2", "deployments-v3", "deployment-bundles-v1", "deployment-releases-v1", "semantic-invocations-v1", "semantic-invocations-v2"];
+export declare const REFERENCE_FAMILIES: readonly ["cache-keys-v1", "cache-preimages-v1", "tagged-values-v1", "identifiers-v1", "expressions-v1", "expressions-v2", "query-schemas-v1", "query-implementations-v1", "query-events-v1", "query-diagnostics-v1", "deployments-v2", "deployments-v3", "deployment-bundles-v1", "deployment-releases-v1", "semantic-invocations-v1", "semantic-invocations-v2"];
 export declare function referenceHandle(family: string, role: FixtureRole, c: Case, section?: string): HandlerResult;
 export {};
 //# sourceMappingURL=reference.d.ts.map

package/dist/adapters/reference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference.d.ts","sourceRoot":"","sources":["../../src/adapters/reference.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc9D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BpC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;CAWjC,CAAC;AAEX,eAAO,MAAM,kBAAkB,8UAgBrB,CAAC;AAEX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,CAAC,EAAE,IAAI,EACP,OAAO,CAAC,EAAE,MAAM,GACf,aAAa,CA4Cf"}
+{"version":3,"file":"reference.d.ts","sourceRoot":"","sources":["../../src/adapters/reference.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc9D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BpC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;CAWjC,CAAC;AAEX,eAAO,MAAM,kBAAkB,oWAiBrB,CAAC;AAEX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,CAAC,EAAE,IAAI,EACP,OAAO,CAAC,EAAE,MAAM,GACf,aAAa,CA8Cf"}

package/dist/adapters/reference.js

@@ -2,7 +2,7 @@
 // root export of @hypequery/protocol and returns a wire result. Every operation
 // goes through the package's supported surface — this is exactly what a second
 // implementation must reproduce.
-import { decodeCanonicalValue, deriveProtocolCacheKey, deriveProtocolCacheNamespaceToken, encodeCanonicalValue, hashCanonicalValue, parseProtocolIdentifier, parseProtocolQualifiedIdentifier, prepareProtocolDeploymentBundleManifest, prepareProtocolDeploymentContract, prepareProtocolDeploymentContractV3, prepareProtocolDeploymentReleaseEnvelope, splitProtocolQualifiedIdentifier, validateCanonicalValue, validateProtocolDeploymentBundleManifest, validateProtocolDeploymentContract, validateProtocolDeploymentContractV3, validateProtocolDeploymentReleaseEnvelope, validateProtocolExpression, validateProtocolQueryDiagnostics, validateProtocolQueryEvent, validateProtocolQueryImplementation, validateProtocolSchema, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationFailure, validateProtocolSemanticInvocationResult, validateProtocolSemanticInvocationV2, validateProtocolSemanticQuery, validateProtocolSqlExpression, } from '@hypequery/protocol';
+import { buildProtocolCachePreimage, decodeCanonicalValue, deriveProtocolCacheKey, deriveProtocolCacheNamespaceToken, encodeCanonicalValue, hashCanonicalValue, parseProtocolIdentifier, parseProtocolQualifiedIdentifier, prepareProtocolDeploymentBundleManifest, prepareProtocolDeploymentContract, prepareProtocolDeploymentContractV3, prepareProtocolDeploymentReleaseEnvelope, splitProtocolQualifiedIdentifier, validateCanonicalValue, validateProtocolDeploymentBundleManifest, validateProtocolDeploymentContract, validateProtocolDeploymentContractV3, validateProtocolDeploymentReleaseEnvelope, validateProtocolExpression, validateProtocolQueryDiagnostics, validateProtocolQueryEvent, validateProtocolQueryImplementation, validateProtocolSchema, validateProtocolSemanticInvocation, validateProtocolSemanticInvocationFailure, validateProtocolSemanticInvocationResult, validateProtocolSemanticInvocationV2, validateProtocolSemanticQuery, validateProtocolSqlExpression, } from '@hypequery/protocol';
 import { materializeBundle, materializeDiagnostics, materializeEvent, materializeSemanticInvocation, materializeExpression, materializeIdentifier, materializeImplementation, materializeRelease, materializeSchema, materializeTaggedValue, } from './generators.js';
 const STABLE_CODE = /^HQ_[A-Z0-9_]+$/;
 /** Turns a thrown protocol error into a wire rejection; rethrows anything else. */
@@ -44,6 +44,7 @@ export const REFERENCE_HOSTILE_OBJECT_SUITE = {
 };
 export const REFERENCE_FAMILIES = [
     'cache-keys-v1',
+    'cache-preimages-v1',
     'tagged-values-v1',
     'identifiers-v1',
     'expressions-v1',
@@ -100,6 +101,8 @@ export function referenceHandle(family, role, c, section) {
             return handleSemanticInvocation(c, 2);
         case 'cache-keys-v1':
             return handleCacheKey(role, c);
+        case 'cache-preimages-v1':
+            return handleCachePreimage(role, c);
         default:
             throw new Error(`reference adapter does not support family ${family}`);
     }
@@ -155,6 +158,18 @@ function handleCacheKey(role, c) {
         };
     });
 }
+function handleCachePreimage(role, c) {
+    return attempt(() => {
+        const preimage = buildProtocolCachePreimage({
+            secret: hexToBytes(c.secretHex),
+            definitionIdentity: c.definitionIdentity,
+            query: c.query,
+            tenant: c.tenant,
+            rowLimit: c.rowLimit,
+        });
+        return role === 'success' ? { ok: true, output: { preimageUtf8: preimage } } : { ok: true };
+    });
+}
 function handleTaggedValue(role, c) {
     if (role === 'success') {
         return attempt(() => ({

package/dist/compare.js

@@ -121,6 +121,12 @@ function compareSuccessOutput(ec, o) {
             return outcome(ec, 'fail', { expected: 'segments', actual: 'mismatch' });
         }
     }
+    if (ec.family === 'cache-preimages-v1') {
+        // By name only: a preimage holds filter values, so a report never prints one.
+        if (o.preimageUtf8 !== ec.case.preimageUtf8) {
+            return outcome(ec, 'fail', { expected: 'preimageUtf8', actual: 'mismatch' });
+        }
+    }
     if (ec.family === 'cache-keys-v1') {
         // Reported as 'mismatch' rather than by value: a run against non-fixture
         // inputs would otherwise print keys derived from a real secret.

package/fixtures/cache-preimages-v1/README.md

@@ -0,0 +1,74 @@
+# Cache preimage version 1 fixtures
+
+These language-neutral fixtures accompany accepted RFC 0009 ("Tenant
+fingerprint" and "Cache preimage") and are normative for cache preimage
+version 1.
+
+## Success manifest
+
+Each entry in `success.json` contains:
+
+- `id`: stable fixture identifier;
+- `secretHex`: the namespace's RFC 0013 cache-key secret as lowercase hex,
+  used for tenant fingerprints;
+- `definitionIdentity`: 64 lowercase hex characters;
+- `query`: an RFC 0003 semantic query, validated under expression extension 2;
+- `tenant`: the trusted tenant capability, as `{"mode": "none"}`,
+  `{"mode": "scoped", "ids": [...]}` with raw tenant identifiers, or
+  `{"mode": "all"}`. The preimage replaces each identifier with its tenant
+  fingerprint;
+- `rowLimit`: the effective row limit, or `null`;
+- `preimageUtf8`: the exact canonical preimage.
+
+`secretHex`, `tenant` and `rowLimit` describe trusted execution context. They are fixture
+inputs, not request fields.
+
+## Rejection manifest
+
+Entries in `rejections.json` carry the same inputs plus the required stable
+`error` code. The `precedence-*` cases violate several rules at once and pin
+the first failure.
+
+## What the corpus is designed to prove
+
+Equivalent requests must build identical bytes:
+
+- `minimal-dataset`, `empty-collections-equal-omitted`,
+  `offset-zero-equals-omitted` and `include-meta-and-limit-dropped` all build
+  the same preimage;
+- `filters-order-a`, `filters-order-b` and `duplicate-filters-collapse` all
+  build the same preimage;
+- `tenant-scoped-sorted-deduplicated` shows that tenant fingerprints are
+  sorted and deduplicated.
+
+Requests that can return different rows must not:
+
+- `measures-empty-differs-from-omitted`: `[]` selects no measures, while
+  omitting the field selects every measure;
+- `dimension-order-a` and `dimension-order-b`: column order is part of the
+  result;
+- `tenant-scoped` and `tenant-all` differ from each other and from
+  `minimal-dataset`, which is tenant-free. This is the RFC 0009 cache-confusion
+  guarantee;
+- `definition-changes-preimage` and `row-limit-zero` differ from
+  `minimal-dataset`;
+- `tenant-fingerprint-follows-secret`: the same tenant under another secret
+  builds a different preimage.
+
+Raw tenant identifiers never appear in a preimage, and no scoped case's
+preimage contains its raw identifiers. `tenant-id-has-no-length-cap` and
+`tenant-count-has-no-cap` pin that there is no tenant limit beyond RFC 0013's
+1 MiB bound on the preimage.
+
+## How these expectations were produced
+
+The expectations were generated twice, by independent implementations of the
+rules, before any runtime implemented them:
+
+- a Python generator built on the Python RFC 0003 validator, the RFC 8785
+  serializer, and `hmac`;
+- a Node generator built on the TypeScript validator, a separate serializer,
+  and `node:crypto`.
+
+Both produced identical output for all 44 cases. The conformance runner now
+holds `@hypequery/protocol` and the Python package to the same bytes.

package/fixtures/cache-preimages-v1/rejections.json

@@ -0,0 +1,304 @@
+[
+  {
+    "id": "secret-missing",
+    "secretHex": "",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_MISSING"
+  },
+  {
+    "id": "secret-31-bytes",
+    "secretHex": "11111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_TOO_SHORT"
+  },
+  {
+    "id": "definition-uppercase",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "definition-short",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "definition-not-string",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": null,
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "query-unknown-field",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "SELECT 1"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "query-measures-on-metric",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "metric",
+      "dataset": "orders",
+      "metric": "aov",
+      "measures": [
+        "revenue"
+      ]
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "query-duplicate-segments",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "segments": [
+        "vip",
+        "vip"
+      ]
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "tenant-unknown-mode",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-none-with-ids",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none",
+      "ids": [
+        "acme"
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-empty",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": []
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-empty-id",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": [
+        ""
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "tenant-scoped-non-string-id",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "scoped",
+      "ids": [
+        7
+      ]
+    },
+    "rowLimit": null,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  },
+  {
+    "id": "row-limit-negative",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "row-limit-above-safe-integer",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": 9007199254740992,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "row-limit-string",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "none"
+    },
+    "rowLimit": "100",
+    "error": "HQ_CACHE_PREIMAGE_INVALID_LIMIT"
+  },
+  {
+    "id": "precedence-secret-before-definition",
+    "secretHex": "",
+    "definitionIdentity": "nope",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_SECRET_MISSING"
+  },
+  {
+    "id": "precedence-definition-before-query",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "nope",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_DEFINITION"
+  },
+  {
+    "id": "precedence-query-before-tenant",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders",
+      "sql": "x"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_QUERY"
+  },
+  {
+    "id": "precedence-tenant-before-limit",
+    "secretHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "definitionIdentity": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "query": {
+      "kind": "dataset",
+      "dataset": "orders"
+    },
+    "tenant": {
+      "mode": "public"
+    },
+    "rowLimit": -1,
+    "error": "HQ_CACHE_PREIMAGE_INVALID_TENANT"
+  }
+]