@kernhq/module-inventory 0.2.0 → 0.4.0

package/src/client/components/TimelineText.svelte

@@ -0,0 +1,124 @@
+<script lang="ts">
+import { t } from '../i18n.js'
+
+/**
+ * The two versions of a long-text field, behind a disclosure.
+ *
+ * A description is up to eight thousand characters, and the timeline rendered a change to one as
+ * "Description changed from … to …" with both versions inline: sixteen kilobytes of somebody's
+ * prose in one row of a 440px panel, with every entry below it pushed off the screen. The line
+ * above this now says only *that* it changed, and the text lives here.
+ *
+ * **A component rather than a bare `<details>` in the timeline, for one reason:** `{#if open}`.
+ * `<details>` keeps its content in the document whether or not it is open, so fifty entries would
+ * still be four hundred kilobytes of text nodes the browser has to build and lay out. Binding
+ * `open` and gating on it means the prose exists only while somebody is reading it, and the
+ * disclosure is still a real `<details>` — keyboard-reachable, announced as a disclosure, and
+ * open by default in a printed page. Nothing is hidden: it is one keystroke away and shown whole,
+ * because truncating what somebody deliberately opened would be the same defect one layer down.
+ *
+ * `before` is null when there was nothing there — a description filled in for the first time has
+ * no previous version, and an empty "Before" block would invent one.
+ */
+interface Props {
+  before: string | null
+  after: string
+}
+const { before, after }: Props = $props()
+
+let open = $state(false)
+</script>
+
+<details class="disclosure" bind:open>
+  <summary>{t('history_show_text')}</summary>
+  {#if open}
+    <div class="body">
+      {#if before !== null}
+        <p class="label">{t('history_text_before')}</p>
+        <!-- `pre-wrap`, so the paragraphs somebody typed are the paragraphs they read back. -->
+        <blockquote class="text was">{before}</blockquote>
+      {/if}
+      <p class="label">{t('history_text_after')}</p>
+      <blockquote class="text">{after}</blockquote>
+    </div>
+  {/if}
+</details>
+
+<style>
+  .disclosure {
+    margin-top: 3px;
+    font-size: 12px;
+  }
+  summary {
+    /* `list-style` on the summary is what removes the native marker in Firefox; the ::-webkit rule
+       below is what removes it in Safari and Chrome. Neither alone does both. */
+    list-style: none;
+    display: inline-flex;
+    align-items: center;
+    gap: 4px;
+    width: fit-content;
+    cursor: pointer;
+    color: var(--kern-ink-600);
+    /* WCAG 2.5.8 wants 24px and a line of 12px text is about 16. The padding grows the hit area
+       and the equal negative margin gives the space back, so nothing moves. */
+    padding-block: 4px;
+    margin-block: -4px;
+    border-radius: var(--kern-r-sm);
+  }
+  summary::-webkit-details-marker {
+    display: none;
+  }
+  summary:hover {
+    color: var(--kern-ink-900);
+  }
+  /* The disclosure triangle, drawn rather than borrowed, so it turns with the reading direction:
+     `▸` in an Arabic panel points the wrong way, and a rotated glyph does not. */
+  summary::before {
+    content: '';
+    width: 0;
+    height: 0;
+    border-block: 3.5px solid transparent;
+    border-inline-start: 5px solid currentColor;
+    transition: transform 120ms ease;
+  }
+  .disclosure[open] summary::before {
+    /* Logical would be ideal and there is no logical rotation; the sign is flipped in RTL below. */
+    transform: rotate(90deg);
+  }
+  :global([dir='rtl']) .disclosure[open] summary::before {
+    transform: rotate(-90deg);
+  }
+  .body {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    margin-top: 6px;
+  }
+  .label {
+    margin: 4px 0 0;
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.03em;
+    text-transform: uppercase;
+    /* Muted with a colour, never opacity: a faded label is unreadable whatever its token says. */
+    color: var(--kern-ink-500);
+  }
+  .text {
+    margin: 0;
+    padding-inline-start: 8px;
+    border-inline-start: 2px solid var(--kern-border-hairline);
+    font-size: 12.5px;
+    line-height: 1.55;
+    color: var(--kern-ink-700);
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    /* A description somebody typed decides its own direction: `plaintext` takes it from the
+       text's own first strong character, so an English paragraph inside a Persian panel reads
+       left to right and keeps its own punctuation. `isolate` would not — on a block it leaves
+       the paragraph direction inherited. */
+    unicode-bidi: plaintext;
+  }
+  .was {
+    color: var(--kern-ink-500);
+  }
+</style>

package/src/client/core-api.ts

@@ -0,0 +1,71 @@
+/**
+ * The slice of core's API this module reaches for, named by shape rather than imported.
+ *
+ * A module talks to another module through `kernel.call()` on the server; on the client the shell
+ * hands over its own configured core client, and typing the seam structurally keeps the dependency
+ * pointing one way — inventory does not import core's router type, and core does not know inventory
+ * exists.
+ *
+ * Keep it to what is actually called. A wide type here is a promise about core's surface that this
+ * module has no standing to make: `Member` in core carries a role, role ids, group ids, a status
+ * and an invitation trail, and naming any of that here would make this module's screens break when
+ * a field it never reads changes shape. Four procedures are all of it, and each is gated in
+ * `core/src/modules/core/router.ts` — the two settings calls on `core.modules.manage`, the member
+ * list on `core.members.view`, the download URL on the file's own workspace membership.
+ */
+
+/**
+ * A workspace member, as thinly as a picker and an avatar need one.
+ *
+ * `name` is nullable in core — somebody invited and not yet signed in has an email and nothing
+ * else — so every screen here falls back to the email rather than rendering an empty label.
+ */
+export interface CoreMember {
+  userId: string
+  user: {
+    id: string
+    name: string | null
+    email: string
+    avatarUrl?: string | null
+  }
+}
+
+export interface CoreApi {
+  workspaces: {
+    members: {
+      /** Paged in core; this module asks for one large page and keeps the people, not the envelope. */
+      list(input: { workspaceId: string; limit?: number }): Promise<{ items: CoreMember[] }>
+    }
+    modules: {
+      list(input: { workspaceId: string }): Promise<
+        Array<{
+          manifest: { id: string }
+          state: {
+            enabled: boolean
+            settings?: Record<string, unknown>
+          }
+        }>
+      >
+      updateSettings(input: {
+        workspaceId: string
+        moduleId: string
+        settings: Record<string, unknown>
+      }): Promise<unknown>
+    }
+  }
+  /**
+   * Reading a file back.
+   *
+   * This module records that an asset has a file and never touches a byte — the bytes are core's,
+   * the URL is core's to sign, and it is signed for the person asking rather than for this module.
+   * `thumbnail: true` is what the asset photo asks for; a full-size photo in a 440px panel is a
+   * megabyte nobody looks at.
+   */
+  files: {
+    downloadUrl(input: {
+      id: string
+      disposition?: 'inline' | 'attachment'
+      thumbnail?: boolean
+    }): Promise<{ url: string }>
+  }
+}

package/src/client/custody.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { custodyActions } from './custody.js'
+
+/**
+ * What the panel is allowed to offer.
+ *
+ * A decision rather than rendering, and wrong in a way nothing else would catch: a button that
+ * always produces a conflict is a door that will not open. What a stored uuid reads as is the
+ * neighbouring question and lives in `members.test.ts`, beside the file that answers it.
+ */
+describe('custodyActions', () => {
+  it('offers handing over when nobody has it, and handing on or back when somebody does', () => {
+    expect(custodyActions({ held: false, archived: false, may: true })).toEqual(['assign'])
+    expect(custodyActions({ held: true, archived: false, may: true })).toEqual(['transfer', 'return'])
+  })
+
+  it('offers nothing without the permission — hidden, not disabled', () => {
+    expect(custodyActions({ held: false, archived: false, may: false })).toEqual([])
+    expect(custodyActions({ held: true, archived: false, may: false })).toEqual([])
+  })
+
+  it('offers nothing on an archived item, which the server refuses anyway', () => {
+    expect(custodyActions({ held: false, archived: true, may: true })).toEqual([])
+    expect(custodyActions({ held: true, archived: true, may: true })).toEqual([])
+  })
+
+  it('never offers assigning something that is already held', () => {
+    // The one combination that would 409 every single time it was pressed.
+    expect(custodyActions({ held: true, archived: false, may: true })).not.toContain('assign')
+  })
+})

package/src/client/custody.ts

@@ -0,0 +1,34 @@
+/**
+ * Which handover an asset can actually take right now.
+ *
+ * Three verbs and not one, because the server has three procedures and refuses the wrong one with
+ * its own sentence: assigning something somebody already holds is a mistake worth naming, and
+ * handing on something nobody holds is a different mistake. The interface's job is not to offer
+ * either — a button that always produces a conflict is a door that will not open.
+ *
+ * A `.ts` file rather than a `const` inside the panel for the reason `timeline.ts` and `price.ts`
+ * are: this is a fact with a right answer, and a `.svelte` file cannot be unit-tested.
+ */
+export type CustodyAction = 'assign' | 'transfer' | 'return'
+
+export interface CustodyState {
+  /** Somebody is holding it — `assets.custodian_user_id` is set. */
+  held: boolean
+  /** The workspace has taken it out of the register; the server refuses every handover. */
+  archived: boolean
+  /** This person holds `inventory.custody.manage`. */
+  may: boolean
+}
+
+/**
+ * What to offer, in the order the buttons appear.
+ *
+ * Empty for somebody without the permission — hide what a person may never do — and empty for an
+ * archived item, where the panel says *why* instead. An archived item deliberately offers nothing
+ * rather than a disabled row of buttons: the reason is one sentence, and one sentence beats three
+ * controls that cannot be pressed.
+ */
+export function custodyActions(state: CustodyState): CustodyAction[] {
+  if (!state.may || state.archived) return []
+  return state.held ? ['transfer', 'return'] : ['assign']
+}

package/src/client/errors.test.ts

@@ -0,0 +1,395 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { MAX_LIVE_CATEGORIES } from '../contract/models.js'
+import {
+  codeOf,
+  errorLine,
+  errorMessage,
+  isInputValidation,
+  messageOf,
+  reasonKeys,
+  reasonOf,
+} from './errors.js'
+import { en } from './messages.js'
+
+/**
+ * Every actionable failure a person can hit, in a language they chose.
+ *
+ * Eight call sites read `toast.error(error.message || t('common.error'))`, and `error.message` is a
+ * sentence the *server* wrote in English. So a Persian reader losing a race on a handover was shown
+ * "Somebody changed who is holding this a moment before you did. Reload to see where it is now." —
+ * the single most useful sentence this module has, in the wrong language, at the exact moment they
+ * needed to read it.
+ *
+ * Three things are checked here, and the third is the one that lasts:
+ *
+ *   1. the reason token is found wherever a transport puts it, and the code when there is none;
+ *   2. every key this file can name exists in the catalogue, so none renders as its own key;
+ *   3. **every reason the server actually throws has a sentence here** — read out of
+ *      `src/server`, so a refusal added next month fails in this file rather than reaching
+ *      somebody's screen in English.
+ */
+const conflict = (reason: string, message = 'English prose the server wrote.') => ({
+  code: 'CONFLICT',
+  message,
+  data: { reason },
+})
+
+describe('reading what the server sent', () => {
+  it('finds the reason where `kernErrorToORPC` puts it', () => {
+    // The reason is folded into `data` rather than sent beside it, because `data` is what oRPC
+    // already carries to the client.
+    expect(reasonOf(conflict('inventory.custody.conflict'))).toBe('inventory.custody.conflict')
+  })
+
+  it('finds it on the error itself too, which is where the in-memory mock carries it', () => {
+    expect(reasonOf({ code: 'CONFLICT', reason: 'inventory.custody.not_held' })).toBe(
+      'inventory.custody.not_held',
+    )
+  })
+
+  it('has no reason for a plain failure, rather than inventing one', () => {
+    expect(reasonOf(new Error('network'))).toBe(null)
+    expect(reasonOf(null)).toBe(null)
+    expect(reasonOf({ data: { reason: 42 } })).toBe(null)
+  })
+
+  it('reads the code, and keeps the server sentence for the fallback line', () => {
+    expect(codeOf({ code: 'NOT_FOUND' })).toBe('NOT_FOUND')
+    expect(codeOf(new Error('boom'))).toBe(null)
+    expect(messageOf(new Error('  boom  '))).toBe('boom')
+    expect(messageOf({ message: '   ' })).toBe(null)
+  })
+})
+
+describe('which sentence a refusal earns', () => {
+  it('translates the conflict on a handover, which is the message that mattered most', () => {
+    expect(errorLine(conflict('inventory.custody.conflict'))).toEqual({
+      key: 'error_custody_conflict',
+      detail: null,
+    })
+  })
+
+  it('drops the server prose once it has named the failure itself', () => {
+    // Keeping it would print an English sentence under the Persian one, undoing the translation.
+    expect(errorLine(conflict('inventory.category.name_taken')).detail).toBe(null)
+  })
+
+  /**
+   * A **disabled capability answers 404, not 403** — the module contract says so, and the shell has
+   * already hidden the navigation for it. So a workspace that switches `repairs` off mid-session
+   * lands here, and "it is no longer there, reload" is the right sentence for it.
+   */
+  it('falls back to the class of failure when there is no reason', () => {
+    expect(errorLine({ code: 'NOT_FOUND', message: 'Asset not found' })).toEqual({
+      key: 'error_not_found',
+      detail: null,
+    })
+    expect(errorLine({ code: 'MODULE_DISABLED', message: 'Module inventory is disabled' }).key).toBe(
+      'error_module_disabled',
+    )
+    expect(errorLine({ code: 'FORBIDDEN' }).key).toBe('error_forbidden')
+  })
+
+  it('prefers the reason over the code, because it is the more specific fact', () => {
+    expect(errorLine(conflict('inventory.repair.already_open')).key).toBe('error_repair_already_open')
+    expect(errorLine({ code: 'CONFLICT' }).key).toBe('error_conflict')
+  })
+
+  /**
+   * A reason a newer server invented, an error from core, a socket that died. The generic sentence
+   * says what happened and the server's words are kept as the only actionable clue left — as
+   * *detail*, under a sentence that is at least in the reader's language.
+   */
+  it('keeps the server words only for a failure it does not recognise', () => {
+    const unknown = { code: 'CONFLICT', message: 'Some newer refusal.', data: { reason: 'inventory.x.y' } }
+    // A reason nothing here maps falls through to the code, which is still translated.
+    expect(errorLine(unknown).key).toBe('error_conflict')
+    expect(errorLine(new Error('Failed to fetch'))).toEqual({
+      key: 'error_unknown',
+      detail: 'Failed to fetch',
+    })
+  })
+
+  it('says something rather than nothing for a failure with no words at all', () => {
+    expect(errorLine({})).toEqual({ key: 'error_unknown', detail: null })
+    expect(errorMessage({}, (key) => key)).toBe('error_unknown')
+  })
+
+  /**
+   * The four refusals that were told to go and check a form where nothing was wrong.
+   *
+   * `KernError.badRequest` and oRPC's own schema failure both come out as `BAD_REQUEST`, and the
+   * client mapped every one of them to "Something in the form was not accepted. Check what you
+   * entered." The server was actually saying "That person is not a member of this workspace", "That
+   * file has not finished uploading yet", "That file is not one this workspace can attach" and
+   * "That page marker is not one this list issued" — none of which is a field somebody typed
+   * wrong. A confident wrong instruction is worse than a vague right one: nobody finds the mistake,
+   * because there isn't one.
+   *
+   * `data.issues` is the only structural difference between the two, and oRPC always sets it —
+   * `validateInput` throws `ORPCError('BAD_REQUEST', { data: { issues } })`.
+   */
+  describe('a refusal is not a form error', () => {
+    const refusal = (message: string) => ({ code: 'BAD_REQUEST', message })
+
+    it('tells a validation failure from a service refusing', () => {
+      expect(isInputValidation({ code: 'BAD_REQUEST', data: { issues: [{ message: 'too long' }] } })).toBe(
+        true,
+      )
+      expect(isInputValidation(refusal('That file has not finished uploading yet.'))).toBe(false)
+      expect(isInputValidation({ data: { issues: 'nope' } })).toBe(false)
+      expect(isInputValidation(null)).toBe(false)
+    })
+
+    it('keeps "check what you entered" for the failure that really is about the form', () => {
+      expect(
+        errorLine({
+          code: 'BAD_REQUEST',
+          message: 'Input validation failed',
+          data: { issues: [{ message: 'Too long' }] },
+        }),
+      ).toEqual({ key: 'error_bad_request', detail: null })
+      // `VALIDATION` is the code making that claim itself, so it needs no issues to be believed.
+      expect(errorLine({ code: 'VALIDATION' }).key).toBe('error_bad_request')
+    })
+
+    it('does not send anybody to the form for any of the four the server actually refuses', () => {
+      for (const message of [
+        'That person is not a member of this workspace, so nothing can be handed to them.',
+        'That file has not finished uploading yet.',
+        'That file is not one this workspace can attach.',
+        'That page marker is not one this list issued',
+      ]) {
+        expect(errorLine(refusal(message))).toEqual({ key: 'error_refused', detail: message })
+      }
+    })
+
+    /**
+     * Until those four carry a stable `reason`, the server's own sentence is the only thing that
+     * says *which* refusal it was — so it is kept, as detail under a translated line. Dropping it
+     * would leave "That was not accepted." and nothing else.
+     */
+    it('keeps the server’s explanation, because nothing else identifies the refusal', () => {
+      expect(errorMessage(refusal('That file has not finished uploading yet.'), (key) => `<${key}>`)).toBe(
+        '<error_refused> — That file has not finished uploading yet.',
+      )
+      // And says something rather than nothing when there are no words at all.
+      expect(errorLine({ code: 'BAD_REQUEST' })).toEqual({ key: 'error_refused', detail: null })
+    })
+
+    /**
+     * The moment the server does carry one, that reason wins and the sentence is fully translated.
+     * Nothing is required of this file then except an entry in `REASON_KEYS` — this checks the
+     * precedence is already the right way round.
+     */
+    it('prefers a reason over the refusal fallback, once the server carries one', () => {
+      expect(
+        errorLine({
+          code: 'BAD_REQUEST',
+          message: 'This item is archived. Restore it before handing it over.',
+          data: { reason: 'inventory.custody.archived' },
+        }),
+      ).toEqual({ key: 'error_custody_archived', detail: null })
+    })
+  })
+
+  it('joins the sentence and the detail into one line for the toast', () => {
+    expect(errorMessage(new Error('Failed to fetch'), (key) => `<${key}>`)).toBe(
+      '<error_unknown> — Failed to fetch',
+    )
+    expect(errorMessage(conflict('inventory.custody.not_held'), (key) => `<${key}>`)).toBe(
+      '<error_custody_not_held>',
+    )
+  })
+
+  /**
+   * The one refusal whose sentence has a number in it.
+   *
+   * A limit that will not say what it is cannot be planned around, and `KernError.conflict` carries a
+   * reason and no data — so the figure comes from the contract, which is the same constant the server
+   * enforces. Passed through `t`, which puts it through `Intl.NumberFormat`, so the reader sees it in
+   * their own digits rather than in ASCII.
+   */
+  it('hands the category limit its number, from the constant the server enforces', () => {
+    const refusal = conflict('inventory.category.limit_reached')
+    expect(errorLine(refusal)).toEqual({
+      key: 'error_category_limit_reached',
+      detail: null,
+      values: { max: MAX_LIVE_CATEGORIES },
+    })
+    expect(
+      errorMessage(refusal, (key, values) => `${key}:${JSON.stringify(values ?? null)}`),
+      'and the screen is handed the values along with the key',
+    ).toBe(`error_category_limit_reached:{"max":${MAX_LIVE_CATEGORIES}}`)
+    expect(en['inventory.error_category_limit_reached'], 'which the sentence really asks for').toContain(
+      '{max}',
+    )
+  })
+
+  it('leaves values off every key that has no placeholder', () => {
+    expect(errorLine(conflict('inventory.category.order_stale')).values).toBeUndefined()
+    expect(errorLine({ code: 'NOT_FOUND' }).values).toBeUndefined()
+  })
+})
+
+// ------------------------------------------------------- the two lists that have to stay in step
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const SERVER = join(HERE, '..', 'server')
+
+/**
+ * Every reason literal the server passes to a `KernError`, dug out of the source.
+ *
+ * Deliberately not a grep for `'inventory.…'`: permission keys, capability ids and notification
+ * types all look exactly like a reason token, and matching them would demand a sentence for things
+ * that are not refusals. This reads the argument position instead — the second of `conflict` and
+ * `notFound`, the fourth of the constructor — which is the only place a reason can be.
+ */
+function serverReasons(): string[] {
+  const found = new Set<string>()
+  const files = readdirSync(SERVER, { recursive: true, encoding: 'utf8' }).filter(
+    (file) => file.endsWith('.ts') && !file.endsWith('.test.ts'),
+  )
+  for (const file of files) {
+    const source = readFileSync(join(SERVER, file), 'utf8')
+    for (const [call, position] of [
+      ['KernError.conflict(', 1],
+      ['KernError.notFound(', 1],
+      ['new KernError(', 3],
+    ] as const) {
+      let at = source.indexOf(call)
+      while (at !== -1) {
+        const args = argumentsOf(source, at + call.length - 1)
+        const literal = args?.[position]?.trim().match(/^'([^']+)'$/)?.[1]
+        if (literal?.startsWith('inventory.')) found.add(literal)
+        at = source.indexOf(call, at + 1)
+      }
+    }
+  }
+  return [...found].sort()
+}
+
+/**
+ * The arguments of a call, split on the commas that are actually arguments.
+ *
+ * **String-aware, and that is not fussiness.** The first version split on every top-level comma and
+ * missed `inventory.custody.not_held` — because its message is "Nobody is holding this item, so
+ * there is nothing to hand on. Assign it instead." and the comma inside the sentence made the
+ * reason the *third* argument. A scanner that silently finds fewer things than there are is worse
+ * than no scanner: it passes.
+ */
+function argumentsOf(source: string, open: number): string[] | null {
+  const parts: string[] = []
+  let depth = 0
+  let quote: string | null = null
+  let start = open + 1
+  for (let i = open; i < source.length; i++) {
+    const ch = source[i]
+    if (quote) {
+      if (ch === '\\') i++
+      else if (ch === quote) quote = null
+      continue
+    }
+    if (ch === "'" || ch === '"' || ch === '`') quote = ch
+    else if (ch === '(' || ch === '{' || ch === '[') depth++
+    else if (ch === ')' || ch === '}' || ch === ']') {
+      depth--
+      if (depth === 0) {
+        parts.push(source.slice(start, i))
+        return parts
+      }
+    } else if (ch === ',' && depth === 1) {
+      parts.push(source.slice(start, i))
+      start = i + 1
+    }
+  }
+  return null
+}
+
+/**
+ * Every sentence the server passes to `KernError.badRequest`, dug out of the source.
+ *
+ * The same trick `serverReasons` uses and for the same reason: the list grows. It was four when
+ * this was written — a non-member, an unfinished upload, a file from another workspace, a page
+ * marker this list never issued — and by the time it was finished it was six. None of them is a
+ * form-validation failure, and every one of them used to arrive as "check what you entered".
+ */
+function serverBadRequests(): string[] {
+  const found = new Set<string>()
+  const call = 'KernError.badRequest('
+  const files = readdirSync(SERVER, { recursive: true, encoding: 'utf8' }).filter(
+    (file) => file.endsWith('.ts') && !file.endsWith('.test.ts'),
+  )
+  for (const file of files) {
+    const source = readFileSync(join(SERVER, file), 'utf8')
+    let at = source.indexOf(call)
+    while (at !== -1) {
+      const literal = argumentsOf(source, at + call.length - 1)?.[0]
+        ?.trim()
+        .match(/^'((?:[^'\\]|\\.)*)'$/)?.[1]
+      if (literal) found.add(literal)
+      at = source.indexOf(call, at + 1)
+    }
+  }
+  return [...found].sort()
+}
+
+describe('the catalogue keeps up with the server', () => {
+  /**
+   * Not one of the module's own `BAD_REQUEST` refusals is about a field somebody typed, so not one
+   * of them may land on `error_bad_request`. This reads them out of `src/server` rather than
+   * listing them, so a refusal added next month is covered the day it is written — and if one ever
+   * *is* a form error, it fails here and asks for a `reason` instead of a reworded sentence.
+   */
+  it('sends no refusal the server actually throws back to the form', () => {
+    const refusals = serverBadRequests()
+    expect(refusals.length).toBeGreaterThan(3)
+    for (const message of refusals)
+      expect({ message, line: errorLine({ code: 'BAD_REQUEST', message }) }).toEqual({
+        message,
+        line: { key: 'error_refused', detail: message },
+      })
+  })
+
+  it('has a translated sentence for every reason the server throws', () => {
+    // If this fails, a refusal was added to `src/server` without a sentence — and it will reach a
+    // Persian, Arabic, German or Turkish reader as English prose. Add the reason to `REASON_KEYS`
+    // and the sentence to all five bundles.
+    const missing = serverReasons().filter((reason) => !reasonKeys().includes(reason))
+    expect(missing).toEqual([])
+  })
+
+  it('is reading the server rather than passing on an empty sweep', () => {
+    // An empty result would make the check above pass for ever. The services throw eleven of these.
+    expect(serverReasons().length).toBeGreaterThan(8)
+  })
+
+  it('names no reason the server does not throw', () => {
+    // The other direction: a sentence for a refusal that cannot happen is dead weight nobody will
+    // ever notice has gone wrong.
+    const server = serverReasons()
+    expect(reasonKeys().filter((key) => !server.includes(key))).toEqual([])
+  })
+
+  it('names a key the catalogue actually has, for every reason and every code', () => {
+    const keys = new Set<string>()
+    for (const reason of reasonKeys()) keys.add(errorLine(conflict(reason)).key)
+    for (const code of [
+      'NOT_FOUND',
+      'FORBIDDEN',
+      'MODULE_DISABLED',
+      'CONFLICT',
+      'BAD_REQUEST',
+      'VALIDATION',
+      'UNAUTHORIZED',
+      'RATE_LIMITED',
+      'UNAVAILABLE',
+      'INTERNAL',
+    ])
+      keys.add(errorLine({ code }).key)
+    for (const key of keys) expect({ key, has: `inventory.${key}` in en }).toEqual({ key, has: true })
+  })
+})