@hypequery/protocol-conformance 0.9.0 → 0.9.2

package/README.md

@@ -1,40 +1,56 @@
 # @hypequery/protocol-conformance
 
-Cross-language conformance runner and TypeScript reference adapter for the
-Hypequery security protocol. It drives any implementation of the protocol
-against the language-neutral fixtures in `specs/security-protocol/fixtures/`
-and checks the results against the pinned expectations.
+`@hypequery/protocol-conformance` checks TypeScript, Python, or any other implementation of the Hypequery security protocol against the same language-neutral fixtures. It includes a command-line runner and the TypeScript reference adapter.
 
-See [RFC 0012](../../specs/security-protocol/rfc/0012-cross-language-conformance.md)
-for the manifest schema, the adapter wire protocol, and the pass criteria.
+The manifest, adapter wire format, and pass rules are defined in [RFC 0012](../../specs/security-protocol/rfc/0012-cross-language-conformance.md).
 
-## Usage
+## Run the reference adapter
 
-```sh
-# Run the whole suite against the bundled TypeScript reference adapter.
-hypequery-protocol-conformance run -- hypequery-protocol-reference-adapter
+```bash
+hypequery-protocol-conformance run -- \
+  hypequery-protocol-reference-adapter
+```
+
+## Test another language
+
+Everything after `--` is the adapter command. The runner starts it directly, without a shell:
 
-# Run against another implementation (any language). Everything after `--`
-# is the adapter command, spawned without a shell.
-hypequery-protocol-conformance run --fixtures ./fixtures -- python -m my_impl.adapter
+```bash
+hypequery-protocol-conformance run \
+  --fixtures ./specs/security-protocol/fixtures \
+  -- python -m my_implementation.adapter
+```
+
+Useful options include:
 
-# Restrict to families, skip or isolate the fuzz corpus, emit JSON.
-hypequery-protocol-conformance run --families sql-portability-v1 --skip-fuzz \
-  --report json -- node ./adapter.mjs
+```bash
+# Run selected fixture families and emit JSON.
+hypequery-protocol-conformance run \
+  --families sql-portability-v1 \
+  --skip-fuzz \
+  --report json \
+  -- node ./adapter.mjs
 
-# List the enumerated case counts per family.
+# Show case counts by family.
 hypequery-protocol-conformance list
 ```
 
-Exit codes: `0` all cases passed, `1` conformance failures, `2` setup or
-protocol error.
+Exit code `0` means every case passed, `1` means conformance failures, and `2` means the runner or adapter protocol could not be set up correctly.
+
+## Adapter shape
+
+An adapter reads newline-delimited JSON from stdin and writes newline-delimited JSON to stdout. It answers the initial `hello` with supported fixture families, then returns one `result` for every `case`.
+
+The exported `createStdioAdapter` helper handles the loop. Your handler maps `(family, role, case)` to one of:
+
+```ts
+{ ok: true, output? }
+{ ok: false, code }
+{ skipped: true, reason }
+```
+
+The package includes a pinned fixture snapshot, so a pinned package version is also a pinned conformance target. Pass `--fixtures` to test local or newer specifications.
 
-## Writing an adapter
+## License
 
-An adapter reads newline-delimited JSON on stdin and writes it on stdout. It
-answers a `hello` with the families it supports, then one `result` per `case`.
-The `createStdioAdapter` helper implements the loop; a handler maps
-`(family, role, case)` to `{ ok: true, output? }`, `{ ok: false, code }`, or
-`{ skipped: true, reason }`. The bundled fixture snapshot means a pinned
-package version is a pinned conformance target; pass `--fixtures` to test
-against newer or local specs.
+Apache-2.0.

package/fixtures/deployment-bundles-v1/README.md

@@ -1,61 +1,9 @@
 # Deployment bundle manifest v1 fixtures
 
-- `success.json` contains complete manifests accepted by the v1 validator.
-- `rejections.json` maps generated invalid inputs to stable failure codes.
-- `identity.json` fixes the RFC 8785 canonical bytes and domain-separated
-  SHA-256 identity for matching success fixture ids.
+These fixtures pin the closed bundle rules in RFC 0007.
 
-The fixtures exercise RFC 0007. Artifact byte verification is covered by the
-CLI reference verifier because these language-neutral fixtures describe the
-manifest rather than a filesystem.
+- `success.json` contains accepted manifests.
+- `rejections.json` describes invalid manifests and required failure codes.
+- `identity.json` pins canonical bytes and domain-separated SHA-256 identities.
 
-## Generated rejection semantics
-
-Every rejection is a deterministic transform of this pinned base manifest
-(RFC 0012), where `artifact(index)` denotes (with `<sha256>` the 64-digit
-lowercase hexadecimal form of `index`, zero-padded):
-
-```json
-{
-  "runtime": "node",
-  "path": "artifacts/<sha256>.mjs",
-  "sha256": "<sha256>",
-  "byteLength": 1
-}
-```
-
-and the base is:
-
-```json
-{
-  "kind": "hypequery-deployment-bundle",
-  "version": 1,
-  "deployment": {
-    "path": "deployment.json",
-    "identity": "1111111111111111111111111111111111111111111111111111111111111111",
-    "sha256": "2222222222222222222222222222222222222222222222222222222222222222",
-    "byteLength": 1
-  },
-  "artifacts": [artifact(0)]
-}
-```
-
-Generator types expand as follows:
-
-- `wrong-root-type`: an empty array instead of an object;
-- `unknown-root-field`: the base plus `"extra": true`;
-- `unsupported-version`: the base with `"version": 2`;
-- `malformed-digest`: the base with `deployment.identity` replaced by
-  `"bad"`;
-- `traversal-path`: the base with `deployment.path` replaced by
-  `"../deployment.json"`;
-- `duplicate-path`: the base with its only artifact's `path` replaced by
-  `"deployment.json"`, colliding with the deployment path;
-- `too-many-artifacts`: the base with 101 artifacts `artifact(0)` through
-  `artifact(100)`;
-- `deployment-too-large`: the base with `deployment.byteLength` replaced by
-  16777217 (16 MiB plus one byte);
-- `unsafe-accessor`: the base with `kind` served by an enumerable computed
-  accessor returning `"hypequery-deployment-bundle"` instead of a plain
-  data property. Host-model conditional (RFC 0012): implementations whose
-  input model cannot express computed accessors skip this case.
+Rejections cover root shape, unknown fields, versions, digests, traversal, duplicate paths, artifact and byte limits, and unsafe host-language accessors. Filesystem byte verification is tested by the deployment verifier because this family describes manifests, not directories.

package/fixtures/deployment-releases-v1/README.md

@@ -1,36 +1,9 @@
-# Deployment release envelope v1 fixtures
+# Deployment release v1 fixtures
 
-- `success.json` contains complete envelopes accepted by the v1 validator.
-- `rejections.json` maps generated invalid inputs to stable failure codes.
-- `identity.json` fixes the RFC 8785 canonical bytes and domain-separated
-  SHA-256 identity for matching success fixture ids.
+These fixtures pin RFC 0008 release envelopes, which bind one verified bundle identity to an explicit project and environment.
 
-These fixtures exercise RFC 0008. Bundle filesystem verification remains part
-of RFC 0007 and is intentionally not duplicated here.
+- `success.json` contains accepted envelopes.
+- `rejections.json` maps invalid or generated inputs to stable error codes.
+- `identity.json` pins canonical bytes and release identities.
 
-## Generated rejection semantics
-
-Every rejection is a deterministic transform of this pinned base envelope
-(RFC 0012):
-
-```json
-{
-  "kind": "hypequery-deployment-release",
-  "version": 1,
-  "bundleIdentity": "0000000000000000000000000000000000000000000000000000000000000000",
-  "target": { "project": "project_1", "environment": "production" }
-}
-```
-
-Generator types expand as follows:
-
-- `wrong-root-type`: an empty array instead of an object;
-- `unknown-root-field`: the base plus `"extra": true`;
-- `unsupported-version`: the base with `"version": 2`;
-- `malformed-bundle-identity`: the base with `"bundleIdentity": "bad"`;
-- `target-too-large`: the base with `target.project` replaced by `p`
-  followed by 128 repetitions of `a` (129 bytes);
-- `unsafe-accessor`: the base with `kind` served by an enumerable computed
-  accessor returning `"hypequery-deployment-release"` instead of a plain
-  data property. Host-model conditional (RFC 0012): implementations whose
-  input model cannot express computed accessors skip this case.
+The family covers closed fields, version handling, bundle digests, target limits, and unsafe accessors. Bundle filesystem verification remains in the bundle contract.

package/fixtures/deployments-v1/README.md

@@ -1,77 +1,9 @@
 # Deployment contract v1 fixtures
 
-- `success.json` contains complete contracts accepted by the v1 validator.
-- `rejections.json` maps generated invalid inputs to stable failure codes.
-- `identity.json` fixes the RFC 8785 canonical bytes and domain-separated
-  SHA-256 identity for matching success fixture ids.
+These fixtures exercise RFC 0006 deployment envelopes containing datasets, named queries, endpoint policy, and runtime artifact references.
 
-These fixtures exercise RFC 0006 deployment envelopes. `success.json`
-contains language-neutral accepted values. `rejections.json` identifies
-deterministic generated inputs and the stable error code every conforming
-implementation must return.
+- `success.json` contains accepted language-neutral deployments.
+- `rejections.json` pins generated invalid inputs and stable error codes.
+- `identity.json` pins canonical bytes and deployment identities.
 
-## Generated rejection semantics
-
-Every rejection is a deterministic transform of this pinned base deployment
-(RFC 0012), where `dataset(name)` denotes:
-
-```json
-{
-  "name": "<name>",
-  "source": "orders",
-  "tenant": { "kind": "not-required" },
-  "dimensions": [],
-  "measures": [],
-  "filters": [],
-  "metrics": [],
-  "relationships": []
-}
-```
-
-and the base is:
-
-```json
-{
-  "kind": "hypequery-deployment",
-  "version": 1,
-  "datasets": [dataset("orders")],
-  "queries": [],
-  "artifacts": []
-}
-```
-
-Generator types expand as follows:
-
-- `wrong-root-type`: an empty array instead of an object;
-- `unknown-root-field`: the base plus `"extra": true`;
-- `unsupported-version`: the base with `"version": 2`;
-- `invalid-dataset-identifier`: the base with its only dataset replaced by
-  `dataset("bad-name")` (hyphens are not valid identifier characters);
-- `invalid-relationship-queryability`: the base with its only dataset given
-  one relationship
-  `{ "name": "items", "kind": "hasMany", "target": "orders", "from": "id",
-  "to": "order_id", "queryable": true }` (a `hasMany` relationship must not
-  be queryable);
-- `missing-runtime-artifact`: the base plus one named query `health` with
-  input `{ "kind": "any" }`, output `{ "kind": "any" }`, implementation
-  `{ "kind": "runtime-reference", "runtime": "node", "artifactSha256":
-  <64 zeros>, "entrypoint": "queries.health" }`, endpoint
-  `{ "access": { "kind": "public" }, "tenant": { "kind": "not-required" },
-  "method": "GET", "path": "/health" }`, and `"tags": []` — while
-  `artifacts` stays empty, so the referenced artifact does not exist;
-- `ambiguous-query-route`: the base plus two named queries `first` and
-  `second`, each with input `{ "kind": "void" }`, output
-  `{ "kind": "void" }`, implementation `{ "kind": "semantic-plan",
-  "query": { "kind": "dataset", "dataset": "orders", "dimensions": [],
-  "measures": [], "filters": [], "orderBy": [] } }`, endpoint
-  `{ "access": { "kind": "public" }, "tenant": { "kind": "not-required" },
-  "method": "GET", "path": "/same" }`, and `"tags": []` — both share one
-  method and path;
-- `too-many-datasets`: the base with 101 datasets `dataset("dataset_0")`
-  through `dataset("dataset_100")`;
-- `source-too-large`: the base with its only dataset's `source` replaced by
-  1025 repetitions of `a`;
-- `unsafe-accessor`: the base with `kind` served by an enumerable computed
-  accessor returning `"hypequery-deployment"` instead of a plain data
-  property. Host-model conditional (RFC 0012): implementations whose input
-  model cannot express computed accessors skip this case.
+Coverage includes closed fields, versions, identifiers, relationship queryability, missing runtime artifacts, ambiguous routes, collection limits, source limits, and unsafe accessors.

package/fixtures/expressions-v1/README.md

@@ -1,25 +1,7 @@
-# Portable expression fixtures, version 1
+# Portable expression v1 fixtures
 
-These fixtures accompany RFC 0003. `success.json` exercises every closed
-operator registry and both semantic query envelopes. `rejections.json` covers
-every stable failure code; generator entries describe inputs that are awkward
-or unsafe to encode directly as JSON.
+This family accompanies RFC 0003 and covers the closed semantic expression registry plus metric and dataset query envelopes.
 
-## Generated rejection semantics
+`success.json` exercises accepted expressions and queries. `rejections.json` pins every stable failure code, including generated depth, width, node-count, and unsafe-accessor cases.
 
-Rejection entries carry exactly one of `value` or `generator`, a `mode`
-(`expression` or `query`) selecting the validated surface, and the required
-stable `error` code. Generator types expand as follows (RFC 0012), where
-`literal` denotes `{ "kind": "literal", "value": false }`:
-
-- `nested-not`: wraps `literal` in
-  `{ "kind": "logical", "operator": "not", "operand": ... }` `depth` times;
-- `logical-operands`: one
-  `{ "kind": "logical", "operator": "and", "operands": [...] }` node whose
-  operands are `count` copies of `literal`;
-- `logical-tree`: one `and` node whose operands are 10 `and` nodes, each
-  with 100 copies of `literal` as operands (1011 nodes total);
-- `unsafe-accessor`: `{ "kind": "reference" }` with `name` served by an
-  enumerable computed accessor returning `"orders"` instead of a plain data
-  property. Host-model conditional (RFC 0012): implementations whose input
-  model cannot express computed accessors skip this case.
+Each rejection selects the `expression` or `query` validation surface and contains exactly one literal value or deterministic generator.

package/fixtures/fuzz-seeds-v1/README.md

@@ -1,29 +1,9 @@
-# Fuzz seed corpus, version 1
+# Deterministic fuzz seed corpus v1
 
-Deterministic adversarial seeds replayed verbatim on every conformance run
-(RFC 0012). A mutating fuzzer is out of scope; this corpus is the foundation
-it would grow. Any input that later crashes an implementation must be
-minimized and added here as a seed.
+These adversarial inputs replay on every conformance run under RFC 0012. An implementation may accept a seed within documented limits or reject it with a stable `HQ_*` code; it must never crash, hang, partially execute input, or allocate without bounds.
 
-For every seed an implementation must, within the runner timeout, either
-accept the input or reject it with a stable code matching
-`^HQ_[A-Z0-9_]+$`. It must never crash, hang, or partially execute the
-input, and must enforce documented limits before unbounded allocation.
+- `value-sources.json` targets duplicate-aware JSON decoding and tagged values.
+- `structured-values.json` targets selected structural validator families.
+- `sql-expressions.json` targets the SQL portability compiler.
 
-## Files
-
-- `value-sources.json` targets the tagged-values-v1 decode and validation
-  path. Entries carry an `id` and exactly one of `sourceUtf8` (exact JSON
-  source for a duplicate-aware parser) or `generator` (expanded per the
-  tagged-values-v1 README).
-- `structured-values.json` targets structural validators. Entries carry an
-  `id`, a `value`, and a `targets` array of family names; the seed is
-  replayed once per target family through that family's validate operation.
-- `sql-expressions.json` targets the sql-portability-v1 compiler. Entries
-  carry an `id` and either `sql` (the exact source) or `sqlRepeat`
-  (`{ "value": ..., "count": ... }`, expanded by concatenating `count`
-  copies of `value`, optionally between `prefix` and `suffix`).
-
-Seed ids are unique within one file. Seeds carry no expected code: any
-stable rejection is conforming, and an implementation that accepts a seed
-within its limits also conforms.
+Minimize any newly discovered crashing input and add it here with a unique ID.

package/fixtures/identifiers-v1/README.md

@@ -1,15 +1,7 @@
-# Portable identifier version 1 fixtures
+# Portable identifier v1 fixtures
 
-These draft language-neutral fixtures accompany RFC 0002.
+These draft fixtures accompany RFC 0002.
 
-Success entries contain an `id`, a `mode` (`simple` or `qualified`), the exact
-`value`, and the expected `segments`. Rejection entries contain exactly one of
-`value` or `generator` and the required stable `error` code.
+Success cases pin simple or qualified identifiers and their exact segments. Rejection cases contain a literal value or deterministic repeat/segment generator plus the required error code.
 
-Generators expand as follows:
-
-- `repeat-string`: concatenates `count` copies of `value`;
-- `qualified-segments`: joins `count` copies of `segment` with `.`.
-
-Fixture consumers must preserve accepted strings exactly. They must not trim,
-case-fold, normalize, or reinterpret qualified identifiers as SQL names.
+Conforming implementations preserve accepted strings exactly: no trimming, case folding, Unicode normalization, or reinterpretation as SQL identifiers.

package/fixtures/query-diagnostics-v1/README.md

@@ -1,49 +1,8 @@
 # Query diagnostics v1 fixtures
 
-- `success.json` contains complete diagnostics projections accepted by the v1
-  validator.
-- `rejections.json` maps generated invalid inputs to stable failure codes.
+These fixtures exercise the privileged diagnostics projection in RFC 0011.
 
-These fixtures exercise RFC 0011. The diagnostics projection is privileged
-(RFC 0009): it may carry the non-executable RFC 0010 debug form
-(`debugQuery`), terminal reason, attempt count, runtime identity, and a safe
-message. Rejections prove result rows (`unknown-result-field`) and
-credentials (`unknown-credentials-field`) have no representable field, and
-that `newer-version` fails closed for older consumers. Note that
-`full-diagnostics.debugQuery` uses the deliberately non-executable
-placeholder syntax of RFC 0010 and carries no parameter values.
+- `success.json` contains accepted diagnostic records.
+- `rejections.json` maps invalid or generated records to stable failure codes.
 
-## Generated rejection semantics
-
-Every rejection is a deterministic transform of this pinned base projection
-(RFC 0012):
-
-```json
-{
-  "kind": "hypequery-query-diagnostics",
-  "version": 1,
-  "eventId": "0000000000000000000000000000000000000000000000000000000000000000",
-  "queryId": "1111111111111111111111111111111111111111111111111111111111111111",
-  "terminalReason": "completed",
-  "attempts": 1
-}
-```
-
-Generator types expand as follows:
-
-- `wrong-root-type`: an empty array instead of an object;
-- `missing-required-field`: the base without `attempts`;
-- `unknown-result-field`: the base plus `"rows": [[1, 2]]`;
-- `unknown-credentials-field`: the base plus `"password": "hunter2"`;
-- `newer-version`: the base with `"version": 2`;
-- `malformed-query-id`: the base with `"queryId": "bad"`;
-- `unknown-terminal-reason`: the base with `"terminalReason": "exploded"`;
-- `zero-attempts`: the base with `"attempts": 0`;
-- `control-character-message`: the base plus a `safeMessage` of `bad`,
-  U+0007 (BEL), then `message`;
-- `oversized-debug-query`: the base plus a `debugQuery` of 4097 repetitions
-  of `x`;
-- `unsafe-accessor`: the base with `kind` served by an enumerable computed
-  accessor returning `"hypequery-query-diagnostics"` instead of a plain
-  data property. Host-model conditional (RFC 0012): implementations whose
-  input model cannot express computed accessors skip this case.
+Coverage includes required fields, versions, IDs, terminal reasons, attempt counts, safe-message controls, debug-query limits, unknown result or credential fields, and unsafe accessors. Debug queries are deliberately non-executable and contain no parameter values.

package/fixtures/query-events-v1/README.md

@@ -1,60 +1,8 @@
 # Query event v1 fixtures
 
-- `success.json` contains complete events accepted by the v1 validator.
-- `rejections.json` maps generated invalid inputs to stable failure codes.
+This RFC 0011 family pins bounded, non-sensitive analytics query events.
 
-These fixtures exercise RFC 0011. Rejections include payloads attempting to
-carry SQL text (`unknown-sql-field`), parameter values
-(`unknown-parameters-field`), and a raw tenant identifier
-(`unknown-raw-tenant-field`): the default event has no field that can accept
-them, so each fails closed as an unknown field. `newer-version` proves an
-older consumer rejects an unknown version cleanly; consumers may skip such
-records without failing an event stream.
+- `success.json` contains accepted events.
+- `rejections.json` maps invalid or generated events to stable codes.
 
-## Generated rejection semantics
-
-Every rejection is a deterministic transform of this pinned base event
-(RFC 0012):
-
-```json
-{
-  "kind": "hypequery-query-event",
-  "version": 1,
-  "eventId": "0000000000000000000000000000000000000000000000000000000000000000",
-  "occurredAt": "2026-07-20T12:34:56.789Z",
-  "target": { "project": "project_1", "environment": "production" },
-  "queryName": "daily_revenue",
-  "operation": "query",
-  "outcome": "success",
-  "durationMs": 182
-}
-```
-
-Generator types expand as follows:
-
-- `wrong-root-type`: an empty array instead of an object;
-- `missing-required-field`: the base without `durationMs`;
-- `unknown-sql-field`: the base plus `"sql": "SELECT 1"`;
-- `unknown-parameters-field`: the base plus
-  `"parameters": { "start": "2026-01-01" }`;
-- `unknown-raw-tenant-field`: the base plus `"tenantId": "acme"`;
-- `newer-version`: the base with `"version": 2`;
-- `malformed-event-id`: the base with `"eventId": "bad"`;
-- `invalid-occurred-at`: the base with
-  `"occurredAt": "2026-13-40T99:99:99Z"`;
-- `failure-without-category`: the base with `"outcome": "failure"` and no
-  `errorCategory`;
-- `success-with-category`: the base plus `"errorCategory": "internal"`
-  while `outcome` stays `"success"`;
-- `unknown-error-category`: the base with `"outcome": "failure"` plus
-  `"errorCategory": "exploded"`;
-- `negative-duration`: the base with `"durationMs": -1`;
-- `invalid-target`: the base with
-  `"target": { "project": "has space", "environment": "production" }`;
-- `invalid-query-name`: the base with `"queryName": "not an identifier"`;
-- `oversized-correlation-id`: the base plus a `correlationId` of 2049
-  repetitions of `x`;
-- `unsafe-accessor`: the base with `kind` served by an enumerable computed
-  accessor returning `"hypequery-query-event"` instead of a plain data
-  property. Host-model conditional (RFC 0012): implementations whose input
-  model cannot express computed accessors skip this case.
+The default event cannot represent SQL, parameter values, or raw tenant IDs. Coverage also includes versions, event IDs, timestamps, outcomes, error categories, durations, targets, query names, correlation limits, and unsafe accessors.

package/fixtures/query-implementations-v1/README.md

@@ -1,33 +1,7 @@
-# Query implementation extension 1 fixtures
+# Query implementation v1 fixtures
 
-`success.json` contains trusted SQL expressions and all three closed named-query
-implementation kinds. `rejections.json` maps invalid artifacts to stable RFC
-0005 failure codes. Generator entries create values that JSON cannot represent
-concisely or safely.
+This family covers RFC 0005 trusted SQL expressions and the closed named-query implementation kinds.
 
-These fixtures validate artifact structure only. They do not assert that SQL is
-valid ClickHouse SQL or authorize it for execution; the trusted ClickHouse
-adapter performs those checks.
+`success.json` contains accepted structures. `rejections.json` selects either the SQL-expression or implementation surface and pins invalid values, bounded generators, and stable error codes.
 
-## Generated rejection semantics
-
-Rejection entries carry a `surface` (`sql-expression` or `implementation`)
-selecting the validated artifact kind, exactly one of `value` or
-`generator`, and the required stable `error` code. Generator types expand as
-follows (RFC 0012):
-
-- `parameters`: a compiled SQL implementation
-  `{ "kind": "compiled-sql", "dialect": "clickhouse", "operation":
-  "select", "statement": "SELECT 1", "parameters": [...], "readSources":
-  [], "tenant": { "kind": "not-required" } }` whose parameters are `count`
-  entries `{ "name": "param<i>", "source": { "kind": "input", "path":
-  "param<i>" }, "clickHouseType": "String" }` for `i` from 0 to
-  `count - 1`;
-- `sql-expression`: `{ "kind": "sql-expression", "dialect": "clickhouse",
-  "sql": ..., "output": { "kind": "string" }, "dependencies": [] }` with a
-  `sql` of `bytes` repetitions of `a`;
-- `unsafe-accessor`: an object with `kind` served by an enumerable computed
-  accessor returning `"semantic-plan"` instead of a plain data property,
-  and no other properties. Host-model conditional (RFC 0012):
-  implementations whose input model cannot express computed accessors skip
-  this case.
+Structural validation does not prove SQL is valid or authorize execution. The trusted database adapter owns those checks.

package/fixtures/query-schemas-v1/README.md

@@ -1,25 +1,7 @@
-# Portable query schema fixtures, version 1
+# Portable query schema v1 fixtures
 
-These fixtures accompany RFC 0004. Success fixtures cover every schema kind
-and every currently portable Serve/Zod feature. Rejection fixtures cover every
-stable failure code; generators describe oversized or unsafe inputs that
-cannot be represented directly in JSON.
+These RFC 0004 fixtures cover the declarative Serve/Zod schema features that can travel between runtimes without executable transforms.
 
-## Generated rejection semantics
+`success.json` exercises every portable schema kind. `rejections.json` pins stable errors for invalid values plus generated depth, width, description-size, and unsafe-accessor boundaries.
 
-Rejection entries carry exactly one of `value` or `generator` and the
-required stable `error` code. Generator types expand as follows (RFC 0012):
-
-- `nested-array`: wraps `{ "kind": "any" }` in
-  `{ "kind": "array", "items": ... }` `depth` times;
-- `union-tree`: one `{ "kind": "union", "variants": [...] }` node whose
-  variants are 10 union nodes, each with 100 `{ "kind": "any" }` variants
-  (1011 nodes total);
-- `enum-values`: `{ "kind": "enum", "values": [...] }` with `count` values
-  `v0` through `v<count - 1>`;
-- `description`: `{ "kind": "string", "description": ... }` with a
-  description of `bytes` repetitions of `a`;
-- `unsafe-accessor`: an object with `kind` served by an enumerable computed
-  accessor returning `"string"` instead of a plain data property, and no
-  other properties. Host-model conditional (RFC 0012): implementations
-  whose input model cannot express computed accessors skip this case.
+Every rejection contains exactly one literal value or deterministic generator.

package/fixtures/sql-portability-v1/README.md

@@ -1,15 +1,6 @@
 # SQL portability v1 fixtures
 
-- `portable.json` maps SQL expression fragments in the supported subset to
-  their RFC 0003 expression AST and sorted dependency identifiers.
-- `non-portable.json` maps inputs outside the subset to the first
-  incompatibility issue code and its start offset.
+- `portable.json` maps accepted SQL expression fragments to RFC 0003 expression trees and sorted dependencies.
+- `non-portable.json` maps unsupported input to the first issue code and source offset.
 
-These fixtures exercise the R1A-07 SQL portability compiler. The supported
-subset is deliberately small: qualified and backtick-quoted identifiers,
-numeric/string/boolean/null literals, `+ - * /`, the comparison operators,
-literal `IN`/`NOT IN` lists, `BETWEEN` with literal bounds, `LIKE`,
-`AND`/`OR`/`NOT`, parentheses, and the RFC 0003 function allowlist
-(`nullIfZero`, `coalesce`, `round`, `floor`, `ceil`). Statements, casts,
-subqueries, lambdas, comments, unlisted functions, backslash escapes, and
-non-literal `IN`/`BETWEEN` operands are non-portable by construction.
+The portable subset covers identifiers, literals, arithmetic, comparisons, literal `IN` lists, literal `BETWEEN`, `LIKE`, boolean logic, parentheses, and the approved formula functions. Statements, subqueries, casts, lambdas, comments, unapproved functions, and dynamic list/range operands remain non-portable by construction.

package/fixtures/tagged-values-v1/README.md

@@ -1,44 +1,8 @@
-# Tagged value version 1 fixtures
+# Tagged value v1 fixtures
 
-These draft language-neutral fixtures accompany RFC 0001. They become
-normative when the RFC is accepted.
+These draft fixtures accompany RFC 0001 and pin canonical values before they become a stable wire contract.
 
-## Success manifest
+- `success.json` contains parsed values, exact RFC 8785 UTF-8 bytes as hex, and SHA-256 integrity hashes.
+- `rejections.json` contains exact JSON source, parsed values, or deterministic boundary generators with required error codes.
 
-Each entry in `success.json` contains:
-
-- `id`: stable fixture identifier;
-- `value`: the parsed canonical value before JCS;
-- `canonicalHex`: exact RFC 8785 canonical UTF-8 bytes as lowercase hex;
-- `sha256`: lowercase SHA-256 of those exact bytes.
-
-The hash is a fixture integrity check, not a deployment digest or cache key.
-
-## Rejection manifest
-
-Entries in `rejections.json` use one of:
-
-- `sourceUtf8`: exact JSON source presented to a duplicate-aware parser;
-- `value`: an already parsed value presented to model validation;
-- `generator`: a deterministic boundary case that would be wasteful to store
-  expanded.
-
-`declaredClickHouseType`, when present, supplies the containing schema type
-needed to validate integer-tag requirements and exact tag/type compatibility.
-
-Generators expand as follows:
-
-- `non-finite-float`: creates the host-language non-finite number named by
-  `value` (`NaN`, `Infinity`, or `-Infinity`) after JSON parsing;
-- `nested-array`: wraps `leaf` in the tagged array form `depth` times;
-- `array`: creates one tagged array containing `items` copies of `value`;
-- `array-tree`: creates one tagged array containing `branches` tagged arrays,
-  each containing `itemsPerBranch` copies of `value`;
-- `repeat-string`: concatenates `count` copies of the UTF-8 string `utf8`.
-
-`error` is the required stable failure code. `phase` identifies the earliest
-stage that must reject the input. A consumer may reject earlier only when it
-returns the same code and does not partially execute or hash the value.
-
-Fixture runners must not pass `sourceUtf8` through an ordinary JSON dictionary
-parser before duplicate-key detection.
+The hash here verifies fixture bytes; it is not a deployment or cache identity. Duplicate-key cases must reach a duplicate-aware parser before ordinary object decoding. Generated cases cover non-finite numbers, nested and wide arrays, repeated strings, and integer tag/type compatibility.

package/package.json

@@ -1,7 +1,15 @@
 {
   "name": "@hypequery/protocol-conformance",
-  "version": "0.9.0",
-  "description": "Cross-language conformance runner and TypeScript reference adapter for the Hypequery security protocol",
+  "version": "0.9.2",
+  "description": "Cross-language conformance runner for the Hypequery analytics security protocol",
+  "keywords": [
+    "hypequery",
+    "protocol",
+    "conformance",
+    "analytics",
+    "typescript",
+    "testing"
+  ],
   "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +31,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@hypequery/protocol": "^0.9.0"
+    "@hypequery/protocol": "^0.10.2"
   },
   "devDependencies": {
     "@types/node": "^22.5.0",
@@ -32,10 +40,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/hypequery/hypequery.git",
+    "url": "git+https://github.com/hypequery/hypequery.git",
     "directory": "packages/protocol-conformance"
   },
-  "homepage": "https://github.com/hypequery/hypequery/tree/main/packages/protocol-conformance",
+  "homepage": "https://hypequery.com",
   "bugs": {
     "url": "https://github.com/hypequery/hypequery/issues"
   },