@kirrosh/zond 0.23.0 → 0.26.0

package/src/core/anti-fp/bootstrap.ts

@@ -1,34 +0,0 @@
-/**
- * ARV-124: register every shipped anti-FP rule.
- *
- * Mirrors `core/probe/bootstrap.ts` — called once at CLI startup so
- * checks/probes can rely on the registry being populated. Idempotent:
- * repeated calls are no-ops. Tests should pair `resetAntiFpBootstrap()`
- * with `reset()` from the registry to start from a clean slate.
- */
-import { register, reset } from "./registry.ts";
-import { SCHEMATHESIS_RULES } from "./rules/schemathesis/index.ts";
-import { SUBSCRIPTION_GATED_RULES } from "./rules/subscription-gated/index.ts";
-import { BASELINE_ECHO_RULE } from "./rules/baseline-echo.ts";
-
-let bootstrapped = false;
-
-export function bootstrapAntiFp(): void {
-  if (bootstrapped) return;
-  for (const rule of SCHEMATHESIS_RULES) register(rule);
-  // ARV-125: subscription/scope-gated 403 wontfix tail in mass-assignment
-  // baseline summaries.
-  for (const rule of SUBSCRIPTION_GATED_RULES) register(rule);
-  // ARV-126: probe:security baseline-echo FP guard. The
-  // coverage-phase-boundary rule is shared with checks via its
-  // canonical re-export and is already covered by SCHEMATHESIS_RULES.
-  register(BASELINE_ECHO_RULE);
-  bootstrapped = true;
-}
-
-/** Test helper — clears the registry and the bootstrap flag so the
- *  next call re-registers from scratch. */
-export function resetAntiFpBootstrap(): void {
-  reset();
-  bootstrapped = false;
-}

package/src/core/anti-fp/index.ts

@@ -1,33 +0,0 @@
-/**
- * ARV-123 (m-19): public surface of the anti-FP registry.
- *
- * Callers (checks / probes) interact with a single helper —
- * `applyAntiFp(ctx, scope)` — which walks every rule registered for
- * `scope`, returns the first suppression that fires, or null. The
- * suppression object carries the rule id, the resolved scope, a
- * human reason, and the upstream references the rule was attributed
- * to.
- *
- * The registry itself is exported for migration tooling (ARV-124..126)
- * and for tests; production callers should prefer the helper.
- */
-export type { FpRule, FpScope, FpSuppression } from "./types.ts";
-export { register, get, list, reset, matchesScope } from "./registry.ts";
-
-import { list } from "./registry.ts";
-import type { FpScope, FpSuppression } from "./types.ts";
-
-export function applyAntiFp<Ctx>(ctx: Ctx, scope: FpScope): FpSuppression | null {
-  for (const rule of list(scope)) {
-    const hit = rule.applies(ctx);
-    if (hit) {
-      return {
-        ruleId: hit.ruleId || rule.id,
-        scope,
-        reason: hit.reason,
-        references: hit.references ?? rule.references,
-      };
-    }
-  }
-  return null;
-}

package/src/core/anti-fp/registry.ts

@@ -1,44 +0,0 @@
-/**
- * ARV-123 (m-19): in-process registry for anti-FP rules.
- *
- * Module-level mutable state on purpose — rules are registered at
- * bootstrap time (similar to `core/probe/bootstrap.ts`) and read by
- * checks/probes during a run. `reset()` exists for tests; production
- * code never calls it.
- */
-import type { FpRule, FpScope, FpSuppression } from "./types.ts";
-
-const rules = new Map<string, FpRule<unknown>>();
-
-/** Register a rule. Re-registering with the same `id` replaces the
- *  prior entry — this keeps test setups simple (swap in a stub) and
- *  matches how the probe-bootstrap pattern handles dedup. */
-export function register<Ctx>(rule: FpRule<Ctx>): void {
-  rules.set(rule.id, rule as FpRule<unknown>);
-}
-
-/** Lookup by id. Used mostly by tests and the `list` filter. */
-export function get(id: string): FpRule<unknown> | undefined {
-  return rules.get(id);
-}
-
-/** List rules in registration order. Optional scope filter keeps the
- *  hot path (checks/probes) from re-implementing the scope-match
- *  predicate. Pass a `scope` like `"check:positive_data_acceptance"`
- *  to get only rules that declared that scope. */
-export function list(scope?: FpScope): FpRule<unknown>[] {
-  const all = Array.from(rules.values());
-  if (!scope) return all;
-  return all.filter(r => matchesScope(r, scope));
-}
-
-/** Drop every registered rule. Call only from test setup. */
-export function reset(): void {
-  rules.clear();
-}
-
-export function matchesScope(rule: FpRule<unknown>, scope: FpScope): boolean {
-  if (Array.isArray(rule.scope)) return rule.scope.includes(scope);
-  return rule.scope === scope;
-}
-

package/src/core/anti-fp/rules/baseline-echo.ts

@@ -1,74 +0,0 @@
-/**
- * ARV-126: baseline-echo FP guard for `probe:security`.
- *
- * Context: the live security probe sends a mutated body against a
- * 2xx-able baseline. When the response body is byte-for-byte identical
- * to the baseline response — same URL bouncing back unchanged — the
- * server effectively ignored the mutation. classifyInner currently
- * lands such findings at `severity: "low"` with the reason "2xx
- * accepted but no echo observed — verify side-effects manually",
- * which floods the digest with sites that have nothing to verify.
- *
- * This rule consumes a `{responseBody, baselineBody}` context and
- * fires when the two bodies are deeply equal. The probe consults
- * `applyAntiFp(ctx, "probe:security")` after classifyInner returns a
- * low-severity 2xx no-echo finding and, on a hit, downgrades the
- * finding to OK with the rule's reason as the wontfix banner.
- *
- * The deep-equality check is intentionally narrow — referential or
- * shape-only matches would over-suppress (a generic "ok: true" body
- * trivially equals across many endpoints). The probe is responsible
- * for passing the *full* parsed response, not a digest.
- */
-import type { FpRule } from "../types.ts";
-
-export interface BaselineEchoCtx {
-  /** Parsed response body for the mutated request. */
-  responseBody: unknown;
-  /** Parsed response body for the pre-mutation baseline. May be
-   *  `undefined` when the probe didn't retain a baseline (in which
-   *  case the rule never fires — fail-open). */
-  baselineBody: unknown;
-}
-
-function deepEqual(a: unknown, b: unknown): boolean {
-  if (a === b) return true;
-  if (a === null || b === null) return false;
-  if (typeof a !== typeof b) return false;
-  if (typeof a !== "object") return false;
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    if (a.length !== b.length) return false;
-    for (let i = 0; i < a.length; i++) {
-      if (!deepEqual(a[i], b[i])) return false;
-    }
-    return true;
-  }
-  const ao = a as Record<string, unknown>;
-  const bo = b as Record<string, unknown>;
-  const keys = Object.keys(ao);
-  if (keys.length !== Object.keys(bo).length) return false;
-  for (const k of keys) {
-    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-    if (!deepEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-
-export const BASELINE_ECHO_RULE: FpRule<BaselineEchoCtx> = {
-  id: "baseline-echo",
-  scope: "probe:security",
-  references: ["ARV-126"],
-  applies(ctx) {
-    if (ctx.baselineBody === undefined) return null;
-    if (!deepEqual(ctx.responseBody, ctx.baselineBody)) return null;
-    return {
-      ruleId: "baseline-echo",
-      scope: "probe:security",
-      reason:
-        "response body identical to the pre-mutation baseline — server " +
-        "ignored the attack payload; no side-effect to verify",
-      references: ["ARV-126"],
-    };
-  },
-};

package/src/core/anti-fp/rules/schemathesis/body_negation_becomes_valid.ts

@@ -1,52 +0,0 @@
-/**
- * ARV-124: migrated from `src/core/checks/checks/_anti_fp.ts` (guard #1).
- *
- * Form-encoded / multipart bodies often *re-validate* after wire
- * serialisation: empty strings round-trip as missing, dropped optional
- * fields default at the server, numeric strings coerce. When the
- * mutation is a drop/empty-string on a form-shaped request, the
- * negative_data_rejection finding would be a false positive — the
- * mutation is a no-op on the wire.
- *
- * Sources: schemathesis #2482, #2726, #3712.
- */
-import type { CheckCase } from "../../../checks/types.ts";
-import type { MutationMeta } from "../../../checks/checks/_negative_mutator.ts";
-import type { FpRule } from "../../types.ts";
-
-function getMutation(c: CheckCase): MutationMeta | undefined {
-  const m = c.meta as { mutation?: MutationMeta["mutation"] } | undefined;
-  if (!m || typeof m.mutation !== "string") return undefined;
-  return c.meta as unknown as MutationMeta;
-}
-
-function isFormLike(contentType: string | undefined): boolean {
-  if (!contentType) return false;
-  const ct = contentType.toLowerCase();
-  return (
-    ct.includes("application/x-www-form-urlencoded") ||
-    ct.includes("multipart/form-data")
-  );
-}
-
-export const bodyNegationBecomesValidRule: FpRule<CheckCase> = {
-  id: "_body_negation_becomes_valid_after_serialization",
-  scope: "check:negative_data_rejection",
-  references: ["#2482", "#2726", "#3712"],
-  applies(c) {
-    const m = getMutation(c);
-    if (!m) return null;
-    const ct =
-      c.request.headers["Content-Type"] ?? c.request.headers["content-type"];
-    if (!isFormLike(ct)) return null;
-    if (m.mutation === "drop_required" || m.mutation === "constraint_violation") {
-      return {
-        ruleId: "_body_negation_becomes_valid_after_serialization",
-        scope: "check:negative_data_rejection",
-        reason: `mutation "${m.mutation}" on a ${ct} body re-validates after wire serialisation`,
-        references: ["#2482", "#2726", "#3712"],
-      };
-    }
-    return null;
-  },
-};

package/src/core/anti-fp/rules/schemathesis/coverage_phase_boundary_positive.ts

@@ -1,38 +0,0 @@
-/**
- * ARV-124: migrated from `src/core/checks/checks/_anti_fp.ts` (guard #4).
- *
- * `--phase coverage` enumerates boundary values across the body schema:
- *   - shortest/longest string, min/max int, every enum option, ...
- * Those bodies are JSON-Schema-valid but semantically synthetic — they
- * sit on the contract edge. Real APIs reject them with 422 for reasons
- * that have nothing to do with the contract:
- *   - "from" email must be on a verified-sending-domain,
- *   - "broadcast.from_audience_id" must exist on this tenant,
- *   - rate-limited resource (a plan_limit).
- * Treating each one as `positive_data_acceptance` fail floods the
- * report (171/349 findings on a benchmark run) and drowns real depth
- * signal. Skip when the case is a coverage-phase positive — keep the
- * examples-phase positive (one realistic baseline body) as the strict
- * signal.
- *
- * Source: feedback round-03 F20 / ARV-77.
- */
-import type { CheckCase } from "../../../checks/types.ts";
-import type { FpRule } from "../../types.ts";
-
-export const coveragePhaseBoundaryPositiveRule: FpRule<CheckCase> = {
-  id: "_coverage_phase_boundary_positive",
-  scope: "check:positive_data_acceptance",
-  references: ["ARV-77"],
-  applies(c) {
-    const meta = c.meta as { phase?: string } | undefined;
-    if (!meta || meta.phase !== "coverage") return null;
-    if (c.kind !== "positive") return null;
-    return {
-      ruleId: "_coverage_phase_boundary_positive",
-      scope: "check:positive_data_acceptance",
-      reason:
-        "boundary-positive bodies are synthetic — server may reject for semantic reasons unrelated to the contract",
-    };
-  },
-};

package/src/core/anti-fp/rules/schemathesis/has_unverifiable_mutations.ts

@@ -1,35 +0,0 @@
-/**
- * ARV-124: migrated from `src/core/checks/checks/_anti_fp.ts` (guard #3).
- *
- * Multiple disjoint mutations make accept/reject ambiguous: the server
- * might accept due to one site even while rejecting another. Our
- * single-site mutator emits exactly one mutation, so the guard fires
- * only when callers attach `mutation_count > 1` to `case.meta` — used
- * by future shrinkers / batched probes.
- *
- * Scope covers both data-rejection checks so a multi-site mutation
- * payload that survives into either side gets suppressed consistently.
- *
- * Source: schemathesis #2713.
- */
-import type { CheckCase } from "../../../checks/types.ts";
-import type { FpRule } from "../../types.ts";
-
-export const hasUnverifiableMutationsRule: FpRule<CheckCase> = {
-  id: "_has_unverifiable_mutations",
-  scope: ["check:negative_data_rejection", "check:positive_data_acceptance"],
-  references: ["#2713"],
-  applies(c) {
-    const meta = c.meta as { mutation_count?: number } | undefined;
-    if (!meta) return null;
-    if (typeof meta.mutation_count === "number" && meta.mutation_count > 1) {
-      return {
-        ruleId: "_has_unverifiable_mutations",
-        scope: "check:negative_data_rejection",
-        reason: `${meta.mutation_count} mutations on disjoint sites — finding can't be attributed`,
-        references: ["#2713"],
-      };
-    }
-    return null;
-  },
-};

package/src/core/anti-fp/rules/schemathesis/index.ts

@@ -1,24 +0,0 @@
-/**
- * ARV-124: schemathesis-attributed rule bundle. Each export is a
- * standalone FpRule for testing/introspection; the side-effect-free
- * list is re-exported as `SCHEMATHESIS_RULES` so the bootstrap can
- * register them in one batch.
- */
-import { bodyNegationBecomesValidRule } from "./body_negation_becomes_valid.ts";
-import { coveragePhaseBoundaryPositiveRule } from "./coverage_phase_boundary_positive.ts";
-import { hasUnverifiableMutationsRule } from "./has_unverifiable_mutations.ts";
-import { stringTypeMutationBecomesValidRule } from "./string_type_mutation_becomes_valid.ts";
-
-export {
-  bodyNegationBecomesValidRule,
-  coveragePhaseBoundaryPositiveRule,
-  hasUnverifiableMutationsRule,
-  stringTypeMutationBecomesValidRule,
-};
-
-export const SCHEMATHESIS_RULES = [
-  bodyNegationBecomesValidRule,
-  stringTypeMutationBecomesValidRule,
-  hasUnverifiableMutationsRule,
-  coveragePhaseBoundaryPositiveRule,
-] as const;

package/src/core/anti-fp/rules/schemathesis/string_type_mutation_becomes_valid.ts

@@ -1,53 +0,0 @@
-/**
- * ARV-124: migrated from `src/core/checks/checks/_anti_fp.ts` (guard #2).
- *
- * The classic "stringified primitive" trap: schema says `integer`, our
- * mutation flips to `"42"` (string), but servers using Express,
- * FastAPI, Rails coerce the string back to int. The mutation is a
- * no-op on the wire, so a 2xx isn't a real silent-accept.
- *
- * Sources: schemathesis #2312, #2978.
- */
-import type { CheckCase } from "../../../checks/types.ts";
-import type { MutationMeta } from "../../../checks/checks/_negative_mutator.ts";
-import type { FpRule } from "../../types.ts";
-
-function getMutation(c: CheckCase): MutationMeta | undefined {
-  const m = c.meta as { mutation?: MutationMeta["mutation"] } | undefined;
-  if (!m || typeof m.mutation !== "string") return undefined;
-  return c.meta as unknown as MutationMeta;
-}
-
-export const stringTypeMutationBecomesValidRule: FpRule<CheckCase> = {
-  id: "_string_type_mutation_becomes_valid_after_serialization",
-  scope: "check:negative_data_rejection",
-  references: ["#2312", "#2978"],
-  applies(c) {
-    const m = getMutation(c);
-    if (!m || m.mutation !== "type_mutation") return null;
-    const fromNumeric = m.from_type === "integer" || m.from_type === "number";
-    const fromBoolean = m.from_type === "boolean";
-    const toString = m.to_type === "string" || typeof m.to_value === "string";
-    if (!toString) return null;
-    if (fromNumeric || fromBoolean) {
-      const v = String(m.to_value);
-      if (fromNumeric && /^-?\d+(\.\d+)?$/.test(v)) {
-        return {
-          ruleId: "_string_type_mutation_becomes_valid_after_serialization",
-          scope: "check:negative_data_rejection",
-          reason: `value "${v}" is numerically coerceable — server may auto-cast`,
-          references: ["#2312", "#2978"],
-        };
-      }
-      if (fromBoolean && (v === "true" || v === "false")) {
-        return {
-          ruleId: "_string_type_mutation_becomes_valid_after_serialization",
-          scope: "check:negative_data_rejection",
-          reason: `value "${v}" is boolean-coerceable — server may auto-cast`,
-          references: ["#2312"],
-        };
-      }
-    }
-    return null;
-  },
-};

package/src/core/anti-fp/rules/subscription-gated/index.ts

@@ -1,11 +0,0 @@
-/**
- * ARV-125 / ARV-126: subscription/scope-gated anti-FP rule bundle.
- * Same pattern as `rules/schemathesis/index.ts` — each rule is
- * exported individually for tests, the side-effect-free list is
- * consumed by `bootstrapAntiFp`.
- */
-import { PAID_PLAN_403_RULE } from "./paid-plan-403.ts";
-
-export { PAID_PLAN_403_RULE };
-
-export const SUBSCRIPTION_GATED_RULES = [PAID_PLAN_403_RULE] as const;

package/src/core/anti-fp/rules/subscription-gated/paid-plan-403.ts

@@ -1,75 +0,0 @@
-/**
- * ARV-125: migrated from `core/probe/mass-assignment-probe.ts` —
- * inline pattern match for subscription/scope-gated 403 responses.
- *
- * Background (ARV-104 / F9): mass-assignment probing against a
- * paid-plan-gated API slice produced an INCONCLUSIVE baseline on
- * every gated endpoint. The default `inconclusiveBaselineSummary`
- * tail tells the triage agent to "fix fixture / FK / path-params
- * and re-probe" — but there's nothing to fix: the endpoint is gated
- * by subscription/scope, and the agent will crank-turn fixture edits
- * forever. The pattern match swaps the tail to a wontfix banner.
- *
- * Lives in the anti-FP registry as `subscription-gated/paid-plan-403`.
- * Scope is `probe:mass-assignment` (with `probe:security` listed too —
- * the live security probe hits the same surface and surfaces the same
- * gated bodies through ARV-126's migration of its baseline-echo check).
- *
- * Context payload: `{ status, message }`. The mass-assignment probe
- * already extracts the hint string from the response body; passing
- * the extracted string keeps the rule body-format-agnostic so future
- * callers (security probe) can reuse it without replicating the
- * extractor.
- */
-import type { FpRule } from "../../types.ts";
-
-export interface PaidPlan403Ctx {
-  /** HTTP status of the baseline response. Rule applies only at 403. */
-  status: number;
-  /** Server-supplied message extracted from the response body. The
-   *  rule does not parse JSON — callers extract their preferred field
-   *  (commonly `detail` / `message`) and pass the string. */
-  message?: string;
-}
-
-/** Lower-cased anchored fragments for the SaaS-flavoured wordings we
- *  encounter in the wild. Each entry is one independent signal — a
- *  body matching any one of them is treated as subscription-gated. */
-export const SUBSCRIPTION_GATED_PATTERNS: RegExp[] = [
-  /\bpaid plan\b/i,
-  /\bsubscription (?:required|needed)\b/i,
-  /\bnot (?:available|enabled) (?:on|for) your\b/i,
-  /\bplan (?:does not include|doesn['']?t include)\b/i,
-  /\brequires? (?:the )?[\w:-]+ scope\b/i,
-  /\bmissing (?:the )?[\w:-]+ scope\b/i,
-  /\bfeature (?:is )?(?:not enabled|disabled|not available)\b/i,
-  /\binsufficient (?:permissions?|scope)\b/i,
-];
-
-/** Exported predicate for callers that want a quick yes/no without
- *  composing an `applyAntiFp` call (the probe still exposes its own
- *  re-export of this for back-compat with pre-ARV-125 tests). */
-export function matchesSubscriptionGated(message: string): boolean {
-  for (const re of SUBSCRIPTION_GATED_PATTERNS) {
-    if (re.test(message)) return true;
-  }
-  return false;
-}
-
-export const PAID_PLAN_403_RULE: FpRule<PaidPlan403Ctx> = {
-  id: "subscription-gated/paid-plan-403",
-  scope: ["probe:mass-assignment", "probe:security"],
-  references: ["ARV-104"],
-  applies(ctx) {
-    if (ctx.status !== 403) return null;
-    if (!ctx.message || !matchesSubscriptionGated(ctx.message)) return null;
-    return {
-      ruleId: "subscription-gated/paid-plan-403",
-      scope: "probe:mass-assignment",
-      reason:
-        "endpoint is env/subscription-gated (paid plan, role/scope, feature flag); " +
-        "not a fixture issue — wontfix unless scope changes",
-      references: ["ARV-104"],
-    };
-  },
-};

package/src/core/anti-fp/types.ts

@@ -1,68 +0,0 @@
-/**
- * ARV-123 (m-19): typed registry for anti-FP guards.
- *
- * Background: anti-FP logic is scattered across the codebase —
- *   - `core/checks/checks/_anti_fp.ts` ships 4 schemathesis-attributed
- *     guards for the data-rejection family;
- *   - `core/probe/mass-assignment-probe.ts` carries inline regex
- *     suppressions (paid-plan / subscription / scope-gating);
- *   - `core/probe/security-probe.ts` does a baseline-echo / boundary
- *     check inline.
- *
- * They share the same shape — "given a finding plus its context, return
- * a structured suppression with attribution" — but each has its own
- * ad-hoc API, which makes it hard to (a) discover the full set, (b)
- * attribute a suppression to its source (schemathesis #N, vendor
- * plan-limit doc, etc.), and (c) test rules in isolation.
- *
- * This module gives them a common contract. Migration of existing rules
- * lives in ARV-124/125/126 — this task only ships the registry.
- */
-
-/**
- * Scope identifies the family of checks/probes a rule applies to.
- * Convention: `<kind>:<name>`. Examples:
- *   - `check:negative_data_rejection` / `check:positive_data_acceptance`
- *   - `probe:mass-assignment`
- *   - `probe:security` (baseline-echo / boundary)
- *
- * A rule may declare a single scope or an array of scopes. `applyAntiFp`
- * filters the registry by the caller's scope before running rules, so
- * a mass-assignment-only rule never gets evaluated against a data
- * rejection finding.
- */
-export type FpScope = string;
-
-export interface FpRule<Ctx = unknown> {
-  /** Stable identifier — used for dedup, logs, and downstream
-   *  attribution. Convention mirrors schemathesis: snake_case prefixed
-   *  with the family (`_body_negation_becomes_valid_after_serialization`).
-   *  Last-writer wins on re-register, so test setups can swap rules. */
-  id: string;
-  /** Single scope or set of scopes this rule covers. */
-  scope: FpScope | FpScope[];
-  /** Decide whether the rule fires for a given context. Return a
-   *  populated suppression to claim the finding, or null to pass. */
-  applies(ctx: Ctx): FpSuppression | null;
-  /** Static reason used when the rule's logic just wants to flag the
-   *  context without composing a runtime string. Optional — most rules
-   *  prefer to build a context-specific reason inside `applies`. */
-  reason?: string;
-  /** Backing evidence — schemathesis issue numbers, vendor docs, etc.
-   *  Surfaced verbatim in the suppression so an agent reading the
-   *  output can locate the upstream debate. */
-  references?: string[];
-}
-
-export interface FpSuppression {
-  /** The rule that fired. */
-  ruleId: string;
-  /** The scope under which the rule fired (resolved scope, not the
-   *  rule's declared scope set). */
-  scope: FpScope;
-  /** Human-readable reason. Built by the rule's `applies` function. */
-  reason: string;
-  /** Copied through from the rule definition unless the rule overrode
-   *  it inside `applies`. */
-  references?: string[];
-}

package/src/core/generator/create-body.ts

@@ -1,89 +0,0 @@
-/**
- * Build a request body for a POST/create endpoint that can actually pass
- * the API's validators on a live target.
- *
- * `generateFromSchema` is purely schema-driven: it emits `{{$uuid}}` for
- * `audience_id`-shaped fields, so when `prepare-fixtures --seed` POSTs a
- * generated body the API replies 422 ("audience aud_xyz not found") and
- * the seed loop quits with no progress (F1-14 in feedback-round 14).
- *
- * `buildCreateRequestBody` wraps `generateFromSchema` and walks the
- * resulting object: any property name that looks like a foreign-key id
- * (`*_id` / `*Id` / `*_uuid`) AND has a real value in `knownFixtures`
- * (typically loaded from `.env.yaml` plus values captured earlier in the
- * same cascade pass) gets that real value substituted in. Random
- * placeholders only survive when no env value exists.
- *
- * Used by `prepare-fixtures --seed --apply` (former `bootstrap`) so each
- * cascade step that POSTs a child resource pulls its parent ids from
- * what discover already filled. Without this, every nested resource is
- * a guaranteed 422.
- */
-
-import type { OpenAPIV3 } from "openapi-types";
-import { generateFromSchema } from "./data-factory.ts";
-import { canonicalVarName } from "./fixtures-builder.ts";
-
-const FK_FIELD_RE = /(?:_id|Id|_uuid)$/;
-
-function substituteFkFields(value: unknown, knownFixtures: Record<string, string>): unknown {
-  if (Array.isArray(value)) {
-    return value.map(v => substituteFkFields(v, knownFixtures));
-  }
-  if (value && typeof value === "object") {
-    const obj = value as Record<string, unknown>;
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(obj)) {
-      // Recurse first — nested objects may carry their own FKs.
-      const recursed = substituteFkFields(v, knownFixtures);
-      if (FK_FIELD_RE.test(k)) {
-        // ARV-138: look up by raw field name first (back-compat with envs
-        // that still key off `issueId`), then by canonical snake_case form
-        // (`issue_id`) — which is the only form the manifest emits since
-        // ARV-138. This keeps both old `.env.yaml`s and new ones working
-        // during the rollout window.
-        const fixture = knownFixtures[k] ?? knownFixtures[canonicalVarName(k)];
-        if (typeof fixture === "string" && fixture.length > 0) {
-          out[k] = fixture;
-          continue;
-        }
-      }
-      out[k] = recursed;
-    }
-    return out;
-  }
-  return value;
-}
-
-export interface BuildCreateRequestBodyOptions {
-  /**
-   * Real values from `.env.yaml` (and prior cascade captures) keyed by
-   * variable name. When a body field's name matches a key here AND the
-   * field looks FK-shaped, that value replaces the schema-derived random
-   * placeholder.
-   */
-  knownFixtures?: Record<string, string>;
-}
-
-/**
- * Spec-aware body builder for live-API seed POSTs. Returns a JSON-shaped
- * object ready to `JSON.stringify` and send.
- *
- *  - Schema → object via `generateFromSchema(forRequest: true)`. This
- *    already strips `readOnly` and bare `id` fields the server assigns.
- *  - Walks the result and swaps FK-shaped fields for `knownFixtures`
- *    values when present.
- *
- *  Tokens like `{{$randomEmail}}` / `{{$uuid}}` produced by the schema
- *  layer are intentionally left in place — the live runner resolves them
- *  via `substituteDeep` right before the request is sent.
- */
-export function buildCreateRequestBody(
-  schema: OpenAPIV3.SchemaObject,
-  options: BuildCreateRequestBodyOptions = {},
-): unknown {
-  const generated = generateFromSchema(schema, undefined, { forRequest: true });
-  const known = options.knownFixtures ?? {};
-  if (Object.keys(known).length === 0) return generated;
-  return substituteFkFields(generated, known);
-}