@kirrosh/zond 0.22.0 → 0.26.0

package/src/core/checks/checks/open_cors_on_sensitive.ts

@@ -0,0 +1,160 @@
+/**
+ * `open_cors_on_sensitive` (ARV-256, m-21 pivot) — verify that an
+ * authenticated endpoint does not echo arbitrary Origin values with
+ * Access-Control-Allow-Credentials: true.
+ *
+ * The dangerous combo, in two shapes:
+ *   - `Access-Control-Allow-Origin: *` + `Access-Control-Allow-Credentials: true`
+ *     (illegal per spec but seen in the wild; some servers patch out the
+ *     star and emit just the credentials header — still broken)
+ *   - `Access-Control-Allow-Origin: <reflected attacker Origin>` +
+ *     `Access-Control-Allow-Credentials: true`
+ *
+ * Both let any cross-origin site read authenticated responses on behalf
+ * of a logged-in user — classic CSRF-with-data-exfil surface.
+ *
+ * Sends one request with `Origin: https://evil.zond.test`, then
+ * inspects the response CORS headers. Evidence_chain proof: request
+ * Origin + response headers travel together in the finding.
+ *
+ * Anti-FP: skips endpoints with `security: []` override (intentionally
+ * public). Skips when server doesn't emit any CORS headers (API isn't
+ * configured for cross-origin — no problem to find).
+ */
+import type { AuthStatefulCheck } from "../stateful.ts";
+import type { OpenAPIV3 } from "openapi-types";
+import type { HttpRequest } from "../../runner/types.ts";
+
+const PROBE_ORIGIN = "https://evil.zond.test";
+
+function fillPath(
+  path: string,
+  op: { parameters: OpenAPIV3.ParameterObject[] },
+  pathVars: Record<string, string> | undefined,
+): string {
+  return path.replace(/\{([^}]+)\}/g, (_, name: string) => {
+    const real = pathVars?.[name];
+    if (typeof real === "string" && real.length > 0) return encodeURIComponent(real);
+    const param = op.parameters.find((p) => p.name === name && p.in === "path");
+    const schema = param?.schema as OpenAPIV3.SchemaObject | undefined;
+    if (schema?.format === "uuid") return "00000000-0000-0000-0000-000000000000";
+    if (schema?.type === "integer" || schema?.type === "number") return "1";
+    return "x";
+  });
+}
+
+function getHeader(headers: Record<string, string>, name: string): string | undefined {
+  return headers[name] ?? headers[name.toLowerCase()];
+}
+
+export const openCorsOnSensitive: AuthStatefulCheck = {
+  id: "open_cors_on_sensitive",
+  severity: "high",
+  defaultExpected:
+    "Authenticated endpoints must not echo arbitrary Origin with Allow-Credentials: true (cross-origin read of authed data)",
+  references: [{ id: "OWASP-API-09-CORS" }],
+  phase: "auth",
+  applies(op) {
+    // Same anti-FP as ignored_auth: skip explicit-public endpoints.
+    if (op.security.length === 0) return false;
+    return true;
+  },
+  async run(op, h) {
+    const url = `${h.baseUrl.replace(/\/+$/, "")}${fillPath(op.path, op, h.pathVars)}`;
+    const method = op.method.toUpperCase();
+    // GET-only probe — bursting on POST/PATCH would create resources.
+    // For mutating-only endpoints we still send the actual method with
+    // the OPTIONS preflight-style Origin header, since most CORS
+    // misconfigurations apply to non-preflight responses.
+    const safeMethod = method === "GET" || method === "HEAD" || method === "OPTIONS" ? method : "OPTIONS";
+    const req: HttpRequest = {
+      method: safeMethod,
+      url,
+      headers: {
+        Accept: "application/json",
+        ...h.authHeaders,
+        Origin: PROBE_ORIGIN,
+        // For non-GET probes, advertise the real method as the preflight
+        // would.
+        ...(safeMethod === "OPTIONS"
+          ? {
+              "Access-Control-Request-Method": method,
+              "Access-Control-Request-Headers": "Authorization",
+            }
+          : {}),
+      },
+    };
+    const resp = await h.send(req);
+
+    const allowOrigin = getHeader(resp.headers, "access-control-allow-origin");
+    const allowCreds = getHeader(resp.headers, "access-control-allow-credentials");
+
+    // No CORS headers emitted → endpoint isn't configured for cross-origin.
+    // Nothing to flag.
+    if (!allowOrigin && !allowCreds) {
+      return { kind: "skip", reason: "no CORS headers in response — API not configured for cross-origin" };
+    }
+
+    const credsTrue = (allowCreds ?? "").toLowerCase() === "true";
+    const originIsStar = allowOrigin === "*";
+    const originReflects = allowOrigin === PROBE_ORIGIN;
+
+    // HIGH requires two independent pieces of evidence that authed data is
+    // actually CORS-readable by an attacker site:
+    //
+    // ARV-312: a 2xx response served real content under the reflected
+    //   Origin. On a non-2xx (401/403/4xx/5xx) *this* response exposed no
+    //   authenticated payload. Recording the real status also kills the
+    //   phantom `response_summary.status: 0` (auth checks don't otherwise
+    //   thread their response back to the runner).
+    //
+    // ARV-316: an AMBIENT credential the browser auto-attaches cross-origin
+    //   — i.e. a cookie (apiKey-in-cookie scheme, or a Set-Cookie observed
+    //   on the probe). `Allow-Credentials: true` is only exploitable with
+    //   one: for bearer/header/oauth2 token auth the attacker's page can't
+    //   set the victim's Authorization header, so a reflected Origin is a
+    //   hygiene nit, not a data leak (Stripe et al are bearer-auth).
+    //
+    // Without both, cap at LOW per the m-21 "no evidence → no high" matrix.
+    const status = resp.status;
+    const isTwoXx = status >= 200 && status < 300;
+    const schemes = (h.doc?.components?.securitySchemes ?? {}) as Record<
+      string,
+      OpenAPIV3.SecuritySchemeObject | OpenAPIV3.ReferenceObject
+    >;
+    const usesCookieAuth = op.security.some((name) => {
+      const s = schemes[name];
+      return !!s && !("$ref" in s) && s.type === "apiKey" && s.in === "cookie";
+    });
+    const setCookie = getHeader(resp.headers, "set-cookie");
+    const ambientCredential = usesCookieAuth || setCookie !== undefined;
+    const authExposed = isTwoXx && ambientCredential;
+    const impactNote = authExposed
+      ? "any attacker site can read authed cross-origin responses"
+      : !isTwoXx
+        ? `observed on a ${status} response — cross-origin CORS is misconfigured but authed-data exposure is unproven`
+        : "no ambient (cookie) credential — bearer/token auth isn't auto-attached cross-origin, so the reflection isn't exploitable as a data leak";
+
+    if (credsTrue && (originIsStar || originReflects)) {
+      const variant = originIsStar ? "wildcard+credentials" : "reflected+credentials";
+      const shape = originIsStar
+        ? "Allow-Origin: * with Allow-Credentials: true"
+        : "response reflects arbitrary Origin with Allow-Credentials: true";
+      return {
+        kind: "fail",
+        severity: authExposed ? "high" : "low",
+        responseStatus: status,
+        message: `CORS misconfiguration: ${shape} — ${impactNote}`,
+        evidence: {
+          request_origin: PROBE_ORIGIN,
+          response_status: status,
+          access_control_allow_origin: allowOrigin,
+          access_control_allow_credentials: allowCreds,
+          ambient_credential: ambientCredential,
+          variant,
+        },
+      };
+    }
+    return { kind: "pass" };
+  },
+};

package/src/core/checks/checks/pagination_invariants.ts

@@ -0,0 +1,419 @@
+/**
+ * `pagination_invariants` (m-20 ARV-171, ARV-220 added page-style in m-21)
+ * — list-endpoint pagination consistency.
+ *
+ * Two styles are implemented, gated on the `pagination.type` annotation
+ * (and on auto-detection from the OpenAPI spec query params):
+ *
+ *  ── Cursor style (Stripe / Notion / Linear) ─────────────────────────
+ *   1. GET ?limit=N → page A.
+ *   2. Pick the last item's cursor field (default `id`).
+ *   3. GET ?<cursor_param>=<last_id>&limit=N → page B.
+ *   Invariants:
+ *     • A∩B disjoint by cursor_field — no item appears on both pages.
+ *     • has_more consistency — if B is empty, has_more must be false.
+ *     • A.length == limit when page A advertises has_more=true.
+ *
+ *  ── Page-number style (GitHub / GitLab / Atlassian) ────────────────
+ *   1. GET ?page=START&per_page=N → page A.
+ *   2. GET ?page=START+1&per_page=N → page B.
+ *   Invariants:
+ *     • A∩B disjoint by cursor_field — same data-loss signal.
+ *     • per_page respected — neither page may exceed N items (server bug
+ *       if e.g. per_page=2 returns 5).
+ *   has_more is NOT enforced for page-style: most APIs in this family
+ *   signal end-of-list via Link headers / total_pages rather than a
+ *   body boolean, so a missing has_more field is normal.
+ *
+ * Severity matrix (ARV-288, follow-up to ARV-284 pattern):
+ *
+ *   declared severity = 'low' (proof-cap baseline per ARV-250 — stateful
+ *   two-page probe is single-signal without an out-of-band diff confirmation).
+ *
+ *   Per-finding dispatch via `outcome.severity` (applied in BOTH
+ *   runCursorStyle and runPageStyle):
+ *
+ *     HIGH   — `kinds` contains 'duplicate_items': items overlap on
+ *               consecutive pages → real data-loss / off-by-one evidence
+ *               chain → can reach HIGH (evidence_chain proof).
+ *
+ *     MEDIUM — all other `kinds` only (`has_more_inconsistent`,
+ *               `partial_page_with_has_more`, `per_page_exceeded`):
+ *               protocol bugs / single-signal contract violations per
+ *               ARV-250. Escalated above declared baseline because a
+ *               concrete invariant is broken, but no data-loss evidence.
+ *
+ * References: ARV-250 (proof-cap ladder), ARV-284 (per-finding pattern).
+ *
+ * Anti-FP guards (both styles):
+ *   • Page A empty → skip ("empty collection — no data to paginate").
+ *   • Cursor field missing on last item (cursor style) → skip naming the
+ *     field so the operator can fix the yaml.
+ *   • 4xx/5xx on either page → broken-baseline skip.
+ *   • Concurrent writes can race the probe; MVP doesn't double-sweep.
+ *
+ * Types other than `cursor` / `page` (`offset`, `token`): skip with an
+ * explicit reason so callers know the yaml block parsed but the check
+ * has no logic for them yet.
+ */
+import type { OpenAPIV3 } from "openapi-types";
+import type { CrudStatefulCheck } from "../stateful.ts";
+import type { Severity } from "../../severity/index.ts";
+import type { PaginationConfig } from "../../generator/resources-builder.ts";
+import { fillPathParams } from "./_crud-helpers.ts";
+import { buildUrl as buildUrlBase } from "../../util/url.ts";
+
+/** Cursor-style query params we recognise on auto-detect (Stripe,
+ *  GitHub, Resend, Linear). Lower-cased for case-insensitive match. */
+const CURSOR_QUERY_NAMES = new Set([
+  "starting_after",
+  "after",
+  "cursor",
+  "page_token",
+  "next_cursor",
+]);
+
+const DEFAULT_LIMIT_PARAM_CURSOR = "limit";
+const DEFAULT_LIMIT_PARAM_PAGE = "per_page";
+const DEFAULT_PAGE_PARAM = "page";
+const DEFAULT_START_PAGE = 1;
+const DEFAULT_CURSOR_FIELD = "id";
+const DEFAULT_HAS_MORE_FIELD = "has_more";
+/** Probe page size — small so two requests land fast and (more
+ *  importantly) so the probe doesn't repeatedly hammer a 1000-item
+ *  endpoint just to assert "no duplicates on consecutive pages". */
+const DEFAULT_LIMIT = 2;
+const ITEMS_FIELD_FALLBACKS: ReadonlyArray<string> = ["data", "items", "results", "value"];
+
+/** Query-param names that signal a page-number-style endpoint when no
+ *  yaml annotation is present (GitHub/GitLab/Atlassian/Notion). */
+const PAGE_QUERY_NAMES = new Set(["page", "page_number", "pagenumber"]);
+
+function safeParse(v: unknown): unknown {
+  if (typeof v !== "string") return v;
+  try { return JSON.parse(v); } catch { return v; }
+}
+
+function detectCursorParam(list: { parameters: OpenAPIV3.ParameterObject[] }): string | null {
+  for (const p of list.parameters) {
+    if (p.in !== "query") continue;
+    if (CURSOR_QUERY_NAMES.has(p.name.toLowerCase())) return p.name;
+  }
+  return null;
+}
+
+function detectPageParam(list: { parameters: OpenAPIV3.ParameterObject[] }): string | null {
+  for (const p of list.parameters) {
+    if (p.in !== "query") continue;
+    if (PAGE_QUERY_NAMES.has(p.name.toLowerCase())) return p.name;
+  }
+  return null;
+}
+
+type CursorResolved = {
+  type: "cursor";
+  cursorParam: string;
+  cursorField: string;
+  hasMoreField: string;
+  limitParam: string;
+  limit: number;
+  itemsField: string | null;
+};
+
+type PageResolved = {
+  type: "page";
+  pageParam: string;
+  startPage: number;
+  cursorField: string;
+  limitParam: string;
+  limit: number;
+  itemsField: string | null;
+};
+
+type SkipResolved = { type: PaginationConfig["type"]; reason: string };
+
+function resolveConfig(
+  cfg: PaginationConfig | undefined,
+  list: { parameters: OpenAPIV3.ParameterObject[] },
+): CursorResolved | PageResolved | SkipResolved | null {
+  // Type resolution: explicit yaml wins; otherwise prefer cursor-style
+  // auto-detection (Stripe-shaped APIs are the cleaner default), then
+  // fall back to page-style detection.
+  let type = cfg?.type;
+  if (!type) {
+    if (detectCursorParam(list)) type = "cursor";
+    else if (detectPageParam(list)) type = "page";
+    else type = "cursor"; // no signal — will hit the null-return below
+  }
+
+  if (type === "cursor") {
+    const cursorParam = cfg?.cursorParam ?? detectCursorParam(list);
+    if (!cursorParam) return null;
+    return {
+      type: "cursor",
+      cursorParam,
+      cursorField: cfg?.cursorField ?? DEFAULT_CURSOR_FIELD,
+      hasMoreField: cfg?.hasMoreField ?? DEFAULT_HAS_MORE_FIELD,
+      limitParam: cfg?.limitParam ?? DEFAULT_LIMIT_PARAM_CURSOR,
+      limit: cfg?.defaultLimit ?? DEFAULT_LIMIT,
+      itemsField: cfg?.itemsField ?? null,
+    };
+  }
+
+  if (type === "page") {
+    return {
+      type: "page",
+      pageParam: cfg?.pageParam ?? detectPageParam(list) ?? DEFAULT_PAGE_PARAM,
+      startPage: cfg?.startPage ?? DEFAULT_START_PAGE,
+      cursorField: cfg?.cursorField ?? DEFAULT_CURSOR_FIELD,
+      limitParam: cfg?.limitParam ?? DEFAULT_LIMIT_PARAM_PAGE,
+      limit: cfg?.defaultLimit ?? DEFAULT_LIMIT,
+      itemsField: cfg?.itemsField ?? null,
+    };
+  }
+
+  return { type, reason: `pagination type "${type}" not implemented yet — only cursor and page are supported` };
+}
+
+/** Find the array-of-items in a list response. Tries the explicit
+ *  yaml field first, then a small set of common shapes. Returns null
+ *  when the body shape is not recognisable. */
+function extractItems(body: unknown, itemsField: string | null): unknown[] | null {
+  if (Array.isArray(body)) return body;
+  if (!body || typeof body !== "object") return null;
+  const obj = body as Record<string, unknown>;
+  if (itemsField) {
+    const v = obj[itemsField];
+    return Array.isArray(v) ? v : null;
+  }
+  for (const f of ITEMS_FIELD_FALLBACKS) {
+    const v = obj[f];
+    if (Array.isArray(v)) return v;
+  }
+  return null;
+}
+
+function readHasMore(body: unknown, field: string): boolean | undefined {
+  if (!body || typeof body !== "object") return undefined;
+  const v = (body as Record<string, unknown>)[field];
+  return typeof v === "boolean" ? v : undefined;
+}
+
+function pickCursor(item: unknown, field: string): string | number | null {
+  if (item == null || typeof item !== "object") return null;
+  const v = (item as Record<string, unknown>)[field];
+  if (typeof v === "string" || typeof v === "number") return v;
+  return null;
+}
+
+function buildUrl(base: string, path: string, pathVars: Record<string, string> | undefined, qs: Record<string, string | number>): string {
+  return buildUrlBase(base, fillPathParams(path, pathVars), qs);
+}
+
+export const paginationInvariants: CrudStatefulCheck = {
+  id: "pagination_invariants",
+  // ARV-288: declared severity is the proof-cap baseline (low) per ARV-250.
+  // Per-finding severity is dispatched via outcome.severity in run() below:
+  // duplicate_items (data-loss evidence chain) → high; protocol-only kinds → medium.
+  severity: "low",
+  defaultExpected: "Consecutive cursor pages must be disjoint and has_more must agree with item presence",
+  references: [{ id: "ARV-171" }],
+  phase: "crud",
+  applies(g) {
+    return Boolean(g.list);
+  },
+  async run(g, h) {
+    if (h.bootstrapCleanupFailed) {
+      return { kind: "skip", reason: "bootstrap-cleanup failed — stateful checks paused" };
+    }
+    const list = g.list!;
+
+    const cfg = h.resourceConfigs?.get(g.resource)?.pagination;
+    const resolved = resolveConfig(cfg, list);
+    if (resolved == null) {
+      return { kind: "skip", reason: "no pagination config and no cursor/page query param in spec" };
+    }
+    if ("reason" in resolved) {
+      return { kind: "skip", reason: resolved.reason };
+    }
+
+    if (resolved.type === "cursor") return runCursorStyle(g, h, list, resolved);
+    return runPageStyle(g, h, list, resolved);
+  },
+};
+
+async function runCursorStyle(
+  g: Parameters<CrudStatefulCheck["run"]>[0],
+  h: Parameters<CrudStatefulCheck["run"]>[1],
+  list: NonNullable<typeof g.list>,
+  resolved: CursorResolved,
+): ReturnType<CrudStatefulCheck["run"]> {
+  const baseHeaders = { Accept: "application/json", ...h.authHeaders };
+  const urlA = buildUrl(h.baseUrl, list.path, h.pathVars, { [resolved.limitParam]: resolved.limit });
+
+  const rA = await h.send({ method: "GET", url: urlA, headers: baseHeaders });
+  if (rA.status < 200 || rA.status >= 300) {
+    return { kind: "skip", reason: `page A returned ${rA.status} — broken-baseline guard` };
+  }
+  const bodyA = rA.body_parsed ?? safeParse(rA.body);
+  const itemsA = extractItems(bodyA, resolved.itemsField);
+  if (itemsA == null) {
+    return { kind: "skip", reason: `page A: items array not found (tried items_field="${resolved.itemsField ?? "auto"}" + defaults)` };
+  }
+  if (itemsA.length === 0) {
+    return { kind: "skip", reason: "page A empty — no data to paginate" };
+  }
+
+  const hasMoreA = readHasMore(bodyA, resolved.hasMoreField);
+  const partialPageWithMore = hasMoreA === true && itemsA.length < resolved.limit;
+
+  const lastCursor = pickCursor(itemsA[itemsA.length - 1], resolved.cursorField);
+  if (lastCursor == null) {
+    return { kind: "skip", reason: `cursor field "${resolved.cursorField}" missing on last item of page A` };
+  }
+
+  const urlB = buildUrl(h.baseUrl, list.path, h.pathVars, {
+    [resolved.limitParam]: resolved.limit,
+    [resolved.cursorParam]: lastCursor,
+  });
+  const rB = await h.send({ method: "GET", url: urlB, headers: baseHeaders });
+  if (rB.status < 200 || rB.status >= 300) {
+    return { kind: "skip", reason: `page B returned ${rB.status} — broken-baseline guard` };
+  }
+  const bodyB = rB.body_parsed ?? safeParse(rB.body);
+  const itemsB = extractItems(bodyB, resolved.itemsField);
+  if (itemsB == null) {
+    return { kind: "skip", reason: "page B: items array shape changed between pages" };
+  }
+  const hasMoreB = readHasMore(bodyB, resolved.hasMoreField);
+
+  const duplicates = findDuplicates(itemsA, itemsB, resolved.cursorField);
+
+  // has_more must be false on the page that ran out of items.
+  const inconsistentHasMore = itemsB.length === 0 && hasMoreA === true && hasMoreB !== false;
+
+  if (duplicates.length === 0 && !inconsistentHasMore && !partialPageWithMore) {
+    return { kind: "pass" };
+  }
+
+  const kinds: string[] = [];
+  if (duplicates.length > 0) kinds.push("duplicate_items");
+  if (inconsistentHasMore) kinds.push("has_more_inconsistent");
+  if (partialPageWithMore) kinds.push("partial_page_with_has_more");
+
+  // ARV-288: per-finding severity dispatch.
+  const severity: Severity = kinds.includes("duplicate_items") ? "high" : "medium";
+
+  return {
+    kind: "fail",
+    severity,
+    message:
+      duplicates.length > 0
+        ? `Pagination on ${g.resource}: ${duplicates.length} item id(s) appear on both pages (${duplicates.slice(0, 3).join(", ")}${duplicates.length > 3 ? ", …" : ""})`
+        : inconsistentHasMore
+          ? `Pagination on ${g.resource}: page A advertised has_more=true but page B is empty with has_more!=false`
+          : `Pagination on ${g.resource}: page A has ${itemsA.length}/${resolved.limit} items yet has_more=true (partial page with more)`,
+    evidence: {
+      resource: g.resource,
+      kind: kinds.join("+"),
+      style: "cursor",
+      cursor_param: resolved.cursorParam,
+      cursor_field: resolved.cursorField,
+      page_a_size: itemsA.length,
+      page_b_size: itemsB.length,
+      has_more_a: hasMoreA,
+      has_more_b: hasMoreB,
+      duplicates,
+    },
+  };
+}
+
+async function runPageStyle(
+  g: Parameters<CrudStatefulCheck["run"]>[0],
+  h: Parameters<CrudStatefulCheck["run"]>[1],
+  list: NonNullable<typeof g.list>,
+  resolved: PageResolved,
+): ReturnType<CrudStatefulCheck["run"]> {
+  const baseHeaders = { Accept: "application/json", ...h.authHeaders };
+  const urlA = buildUrl(h.baseUrl, list.path, h.pathVars, {
+    [resolved.pageParam]: resolved.startPage,
+    [resolved.limitParam]: resolved.limit,
+  });
+
+  const rA = await h.send({ method: "GET", url: urlA, headers: baseHeaders });
+  if (rA.status < 200 || rA.status >= 300) {
+    return { kind: "skip", reason: `page A returned ${rA.status} — broken-baseline guard` };
+  }
+  const bodyA = rA.body_parsed ?? safeParse(rA.body);
+  const itemsA = extractItems(bodyA, resolved.itemsField);
+  if (itemsA == null) {
+    return { kind: "skip", reason: `page A: items array not found (tried items_field="${resolved.itemsField ?? "auto"}" + defaults)` };
+  }
+  if (itemsA.length === 0) {
+    return { kind: "skip", reason: "page A empty — no data to paginate" };
+  }
+
+  const urlB = buildUrl(h.baseUrl, list.path, h.pathVars, {
+    [resolved.pageParam]: resolved.startPage + 1,
+    [resolved.limitParam]: resolved.limit,
+  });
+  const rB = await h.send({ method: "GET", url: urlB, headers: baseHeaders });
+  if (rB.status < 200 || rB.status >= 300) {
+    return { kind: "skip", reason: `page B returned ${rB.status} — broken-baseline guard` };
+  }
+  const bodyB = rB.body_parsed ?? safeParse(rB.body);
+  const itemsB = extractItems(bodyB, resolved.itemsField);
+  if (itemsB == null) {
+    return { kind: "skip", reason: "page B: items array shape changed between pages" };
+  }
+
+  const duplicates = findDuplicates(itemsA, itemsB, resolved.cursorField);
+  const perPageBreach = itemsA.length > resolved.limit || itemsB.length > resolved.limit;
+
+  if (duplicates.length === 0 && !perPageBreach) {
+    return { kind: "pass" };
+  }
+
+  const kinds: string[] = [];
+  if (duplicates.length > 0) kinds.push("duplicate_items");
+  if (perPageBreach) kinds.push("per_page_exceeded");
+
+  // ARV-288: per-finding severity dispatch.
+  const severity: Severity = kinds.includes("duplicate_items") ? "high" : "medium";
+
+  return {
+    kind: "fail",
+    severity,
+    message:
+      duplicates.length > 0
+        ? `Pagination on ${g.resource}: ${duplicates.length} item id(s) appear on pages ${resolved.startPage} and ${resolved.startPage + 1} (${duplicates.slice(0, 3).join(", ")}${duplicates.length > 3 ? ", …" : ""})`
+        : `Pagination on ${g.resource}: per_page=${resolved.limit} not respected — server returned ${itemsA.length}/${itemsB.length} items`,
+    evidence: {
+      resource: g.resource,
+      kind: kinds.join("+"),
+      style: "page",
+      page_param: resolved.pageParam,
+      per_page: resolved.limit,
+      page_a_number: resolved.startPage,
+      page_b_number: resolved.startPage + 1,
+      page_a_size: itemsA.length,
+      page_b_size: itemsB.length,
+      cursor_field: resolved.cursorField,
+      duplicates,
+    },
+  };
+}
+
+function findDuplicates(a: unknown[], b: unknown[], cursorField: string): string[] {
+  const ids = new Set<string>();
+  for (const it of a) {
+    const c = pickCursor(it, cursorField);
+    if (c != null) ids.add(String(c));
+  }
+  const dups: string[] = [];
+  for (const it of b) {
+    const c = pickCursor(it, cursorField);
+    if (c != null && ids.has(String(c))) dups.push(String(c));
+  }
+  return dups;
+}

package/src/core/checks/checks/positive_data_acceptance.ts

@@ -0,0 +1,33 @@
+/**
+ * `positive_data_acceptance` (m-15 ARV-4) — schemathesis-equivalent.
+ * Runs against the standard positive case (kind="positive"). When the
+ * server *rejects* a generated-as-valid body with a schema-validation
+ * status (400 / 422), it's either our generator was wrong or the spec
+ * is over-strict — both worth flagging.
+ *
+ * Auth/lookup statuses (401/403/404/409) are skipped: they aren't
+ * schema-validation rejects. 5xx is skipped here too because
+ * `not_a_server_error` already covers it.
+ */
+import type { Check } from "../types.ts";
+
+export const positiveDataAcceptance: Check = {
+  id: "positive_data_acceptance",
+  severity: "medium",
+  defaultExpected: "Server must accept a generated-as-valid body (2xx)",
+  references: [{ id: "OWASP-API-08" }],
+  applies: (op) => Boolean(op.requestBodySchema),
+  run({ response }) {
+    const s = response.status;
+    if (s >= 200 && s < 300) return { kind: "pass" };
+    // Auth / not-found / conflict / server-error → not a schema-rejection signal.
+    if (s === 401 || s === 403 || s === 404 || s === 409) return { kind: "pass" };
+    if (s >= 500) return { kind: "skip", reason: "5xx covered by not_a_server_error" };
+    if (s !== 400 && s !== 422) return { kind: "skip", reason: `status ${s} not a schema-validation reject` };
+    return {
+      kind: "fail",
+      message: `Server rejected a generated-as-valid body with ${s} — generator or spec disagrees with the implementation`,
+      evidence: { status: s },
+    };
+  },
+};

package/src/core/checks/checks/rate_limit_headers_absent.ts

@@ -0,0 +1,77 @@
+/**
+ * `rate_limit_headers_absent` (ARV-256, m-21 pivot) — flag mutating
+ * endpoints (POST/PATCH/PUT/DELETE) whose 2xx responses ship no
+ * rate-limit-* headers at all.
+ *
+ * The full version of this check would burst N requests to detect a
+ * 429, but bursting POST creates real resources — too destructive for
+ * a default-on check. The lightweight header-inspect version is what
+ * Burp/ZAP also do at first pass: detect the absence of standard
+ * rate-limit metadata in the response. If the server emits any of
+ * `X-RateLimit-*` / `RateLimit-*` / `Retry-After`, this check skips —
+ * the server has *some* rate-limit story.
+ *
+ * Reliability category (ARV-251): missing rate-limit on write
+ * endpoints is a production concern (abuse → bill, abuse → DoS), not
+ * a security exploit. Severity MEDIUM by default.
+ *
+ * Anti-FP: skip non-mutating methods. Skip non-2xx responses (a 4xx
+ * doesn't tell us anything about rate-limit behaviour on the happy
+ * path). Skip endpoints with `security: []` override (public read-only
+ * APIs may intentionally omit rate-limit headers).
+ */
+import type { Check } from "../types.ts";
+
+const RATE_LIMIT_PATTERNS: RegExp[] = [
+  /^x-ratelimit-/i,
+  /^x-rate-limit-/i,
+  /^ratelimit-/i,
+  /^retry-after$/i,
+];
+
+function hasRateLimitHeader(headers: Record<string, string>): boolean {
+  for (const name of Object.keys(headers)) {
+    for (const re of RATE_LIMIT_PATTERNS) {
+      if (re.test(name)) return true;
+    }
+  }
+  return false;
+}
+
+const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+export const rateLimitHeadersAbsent: Check = {
+  id: "rate_limit_headers_absent",
+  severity: "medium",
+  defaultExpected:
+    "Mutating endpoints should advertise rate-limit semantics via X-RateLimit-* / RateLimit-* / Retry-After headers",
+  references: [
+    { id: "RFC-9239-rate-limit-headers" },
+    { id: "OWASP-API-04-rate-limit" },
+  ],
+  applies(op) {
+    if (!MUTATING.has(op.method.toUpperCase())) return false;
+    // Skip explicitly-public endpoints (security: [] override) — those
+    // are often abuse-tolerant by design (anonymous feedback forms etc).
+    if (op.security.length === 0) return false;
+    return true;
+  },
+  run({ response }) {
+    if (response.status < 200 || response.status >= 300) {
+      return { kind: "skip", reason: `non-2xx response (${response.status}) — rate-limit semantics only meaningful on success` };
+    }
+    if (hasRateLimitHeader(response.headers)) {
+      return { kind: "pass" };
+    }
+    return {
+      kind: "fail",
+      message:
+        "Mutating endpoint returned 2xx without any rate-limit-* / Retry-After header — no advertised abuse protection on a write path",
+      evidence: {
+        method: "POST/PUT/PATCH/DELETE",
+        response_status: response.status,
+        looked_for: ["X-RateLimit-*", "RateLimit-*", "Retry-After"],
+      },
+    };
+  },
+};