@kirrosh/zond 0.26.1 → 0.27.0

package/src/core/checks/checks/response_headers_conformance.ts

@@ -1,74 +0,0 @@
-/**
- * `response_headers_conformance` — every response header declared in
- * the OpenAPI `responses[<status>].headers` map must be present, and
- * (when a schema is given) its value must validate. Schemathesis-style.
- *
- * For the check to mean anything, the spec has to declare some
- * headers; if it declares none, the check skips. Validation is shallow
- * here (string presence + simple type/format match) — full ajv
- * validation lands alongside ARV-5/ARV-6 once we cache validators per
- * (status, header) pair without paying compile cost per response.
- */
-import type { OpenAPIV3 } from "openapi-types";
-import type { Check } from "../types.ts";
-
-function getDeclaredHeaders(
-  doc: OpenAPIV3.Document,
-  path: string,
-  method: string,
-  status: number,
-): Record<string, OpenAPIV3.HeaderObject> {
-  const op = (doc.paths?.[path] as OpenAPIV3.PathItemObject | undefined)
-    ?.[method.toLowerCase() as OpenAPIV3.HttpMethods] as OpenAPIV3.OperationObject | undefined;
-  if (!op?.responses) return {};
-  const exact = op.responses[String(status)] as OpenAPIV3.ResponseObject | undefined;
-  const wildcard = op.responses[`${Math.floor(status / 100)}XX`] as OpenAPIV3.ResponseObject | undefined;
-  const fallback = op.responses.default as OpenAPIV3.ResponseObject | undefined;
-  const branch = exact ?? wildcard ?? fallback;
-  return (branch?.headers ?? {}) as Record<string, OpenAPIV3.HeaderObject>;
-}
-
-function valueOk(value: string | undefined, header: OpenAPIV3.HeaderObject): boolean {
-  if (value === undefined) return false;
-  const schema = header.schema as OpenAPIV3.SchemaObject | undefined;
-  if (!schema) return true;
-  if (schema.type === "integer") return /^-?\d+$/.test(value);
-  if (schema.type === "number") return /^-?\d+(\.\d+)?$/.test(value);
-  if (schema.type === "boolean") return value === "true" || value === "false";
-  return true;
-}
-
-export const responseHeadersConformance: Check = {
-  id: "response_headers_conformance",
-  severity: "low",
-  defaultExpected: "All headers declared on the response must be present and shape-valid",
-  references: [{ id: "OAS3-headerObject" }],
-  applies: () => true,
-  run({ case: c, response, doc }) {
-    if (!doc) return { kind: "skip", reason: "spec doc not available" };
-    // ARV-183: use originalPath (pre-ARV-40 rename) for spec lookup.
-    const specPath = c.operation.originalPath ?? c.operation.path;
-    const declared = getDeclaredHeaders(doc, specPath, c.operation.method, response.status);
-    const names = Object.keys(declared);
-    if (names.length === 0) return { kind: "skip", reason: "no declared response headers" };
-    const issues: string[] = [];
-    for (const name of names) {
-      const header = declared[name]!;
-      const required = header.required === true;
-      const got = response.headers[name] ?? response.headers[name.toLowerCase()];
-      if (got === undefined) {
-        if (required) issues.push(`missing required "${name}"`);
-        continue;
-      }
-      if (!valueOk(got, header)) {
-        issues.push(`"${name}" value "${got}" doesn't match declared schema`);
-      }
-    }
-    if (issues.length === 0) return { kind: "pass" };
-    return {
-      kind: "fail",
-      message: `Response headers don't conform: ${issues.join("; ")}`,
-      evidence: { issues, declared: names },
-    };
-  },
-};

package/src/core/checks/checks/response_schema_conformance.ts

@@ -1,30 +0,0 @@
-/**
- * `response_schema_conformance` — body must validate against the JSON
- * Schema declared on the matched response branch. Reuses the existing
- * `runner/schema-validator.ts` so we don't rebuild AJV plumbing
- * (ARV-2 AC #3).
- */
-import type { Check } from "../types.ts";
-
-export const responseSchemaConformance: Check = {
-  id: "response_schema_conformance",
-  severity: "high",
-  defaultExpected: "Response body must validate against the OpenAPI response schema",
-  references: [{ id: "OAS3-schemaObject" }],
-  applies: () => true,
-  run({ case: c, response, schemaValidator }) {
-    if (!schemaValidator) return { kind: "skip", reason: "validator unavailable" };
-    const inspect = schemaValidator.inspect(c.operation.method, c.operation.path, response.status);
-    if (!inspect.matchedEndpoint) return { kind: "skip", reason: "no spec endpoint matched" };
-    if (!inspect.hasJsonSchema) return { kind: "skip", reason: "no JSON Schema on this response branch" };
-    const results = schemaValidator.validate(c.operation.method, c.operation.path, response.status, response.body);
-    const failed = results.filter((r) => !r.passed);
-    if (failed.length === 0) return { kind: "pass" };
-    const messages = failed.slice(0, 5).map((r) => `${r.field}: expected ${JSON.stringify(r.expected)}`);
-    return {
-      kind: "fail",
-      message: `Response body fails schema validation (${failed.length} issue${failed.length === 1 ? "" : "s"})`,
-      evidence: { issues: messages },
-    };
-  },
-};

package/src/core/checks/checks/status_code_conformance.ts

@@ -1,132 +0,0 @@
-/**
- * `status_code_conformance` — schemathesis-equivalent. Fails when the
- * server returns a status code that's not declared in the OpenAPI
- * `responses` for this operation (and no `default` is declared either).
- *
- * Edge: `default` in OpenAPI means "any status not enumerated above" —
- * the presence of `default` makes every status code conforming. ARV-2
- * AC #6 explicitly tests this case.
- *
- * Severity matrix (ARV-285, dispatched per finding via outcome.severity
- * — see `severityFor` below):
- *
- *   - HIGH:   5xx undeclared (no 5XX wildcard, no default). A server-error
- *             on an undocumented branch is concrete evidence of an unhandled
- *             code path — likely a real bug.
- *   - MEDIUM: 4xx undeclared but at least one other 4xx is declared.
- *             Partial contract — the API documents *some* client errors but
- *             missed this one. Concrete gap, actionable for the team.
- *   - LOW:    4xx undeclared + no declared 4xx at all (minimal spec). The
- *             spec only lists 2xx; the 4xx is a real response but the spec
- *             gap could simply be spec-under-documentation, not a real bug.
- *   - LOW:    2xx/3xx undeclared on negative_data / missing_required_header
- *             / unsupported_method probes. The negative probe already surfaces
- *             the acceptance as a finding in its own check — the status gap
- *             is a secondary signal here (spec hygiene, not a fresh breach).
- *   - MEDIUM: 2xx/3xx undeclared on positive probes. A conforming happy-path
- *             response with an undocumented status is a concrete spec gap.
- *
- * Note: `wildcard.get(5)` / `wildcard.get(4)` already gate at the top —
- * those return pass before we reach this dispatch. The 5xx-undeclared case
- * only fires when there is no 5XX wildcard and no default.
- *
- * Per ARV-250's proof-cap principle (no evidence → no high severity):
- * the declared `severity: "low"` is the natural fallback / proof-cap
- * baseline; evidence strength escalates individual findings via
- * `outcome.severity` to override it. The agent re-severitizes from the
- * raw evidence.
- */
-import type { OpenAPIV3 } from "openapi-types";
-
-import type { Check, CheckOutcome, CaseKind } from "../types.ts";
-import type { Severity } from "../../severity/index.ts";
-
-function declaredStatuses(doc: OpenAPIV3.Document, path: string, method: string):
-  { codes: Set<number>; hasDefault: boolean; hasWildcard: Map<number, boolean> } {
-  const codes = new Set<number>();
-  const hasWildcard = new Map<number, boolean>(); // 2,3,4,5 -> declared as 2XX etc.
-  let hasDefault = false;
-  const op = (doc.paths?.[path] as OpenAPIV3.PathItemObject | undefined)
-    ?.[method.toLowerCase() as OpenAPIV3.HttpMethods] as OpenAPIV3.OperationObject | undefined;
-  if (!op?.responses) return { codes, hasDefault, hasWildcard };
-  for (const key of Object.keys(op.responses)) {
-    if (key === "default") { hasDefault = true; continue; }
-    // 2XX / 3XX / 4XX / 5XX wildcard keys are valid OpenAPI 3.0 forms.
-    // Must check before parseInt — parseInt("4XX") === 4 which is finite
-    // and would otherwise be treated as a literal status code 4.
-    const m = /^([1-5])XX$/i.exec(key);
-    if (m) { hasWildcard.set(Number.parseInt(m[1]!, 10), true); continue; }
-    const n = Number.parseInt(key, 10);
-    if (Number.isFinite(n)) codes.add(n);
-  }
-  return { codes, hasDefault, hasWildcard };
-}
-
-/** Negative case kinds — the probe itself already surfaces acceptance; the
- *  status-code gap here is a secondary spec-hygiene signal (LOW). */
-const NEGATIVE_KINDS: ReadonlySet<CaseKind> = new Set([
-  "negative_data",
-  "missing_required_header",
-  "unsupported_method",
-]);
-
-/**
- * Per-finding severity dispatch (ARV-285).
- *
- * @param status   - actual response status
- * @param codes    - set of explicitly declared numeric status codes in spec
- * @param kind     - CheckCase.kind for the current probe
- */
-function severityFor(status: number, codes: Set<number>, kind: CaseKind): Severity {
-  if (status >= 500 && status < 600) return "high";
-  if (status >= 400 && status < 500) {
-    const hasDeclared4xx = [...codes].some((c) => c >= 400 && c < 500);
-    return hasDeclared4xx ? "medium" : "low";
-  }
-  // 2xx / 3xx
-  if (NEGATIVE_KINDS.has(kind)) return "low";
-  return "medium"; // positive case: undocumented success status is a real spec gap
-}
-
-export const statusCodeConformance: Check = {
-  id: "status_code_conformance",
-  // ARV-285: declared severity is the *natural* tier (proof-cap baseline
-  // per ARV-250 — single-signal caps at LOW). Per-finding severity is
-  // dispatched via `outcome.severity` in `run()` below, so summary
-  // tables can show HIGH for 5xx and MEDIUM for partial-4xx-contract
-  // without globally setting the check to HIGH (which masks calibration).
-  severity: "low",
-  defaultExpected: "Response status must be declared in the OpenAPI `responses` (or `default`)",
-  references: [{ id: "OAS3-responsesObject", url: "https://spec.openapis.org/oas/v3.0.3#responses-object" }],
-  // ARV-180: status-code conformance is a property of the response, not
-  // of the input. The check must fire on every case kind — including
-  // negative-data, dropped-header, and unsupported-method probes — so
-  // an undocumented 5xx/404/422 on bad input surfaces as a finding
-  // (matches schemathesis V4 default: the check has no input-kind filter).
-  caseKinds: ["positive", "negative_data", "missing_required_header", "unsupported_method"],
-  applies: () => true,
-  run({ case: c, response, doc }): CheckOutcome {
-    if (!doc) return { kind: "skip", reason: "spec doc not available" };
-    // ARV-183: ARV-40 path-disambiguation renames {id} → {<resource>_id}
-    // in EndpointInfo.path. doc.paths keeps the original — use
-    // originalPath for spec lookup when present.
-    const specPath = c.operation.originalPath ?? c.operation.path;
-    const { codes, hasDefault, hasWildcard } = declaredStatuses(doc, specPath, c.operation.method);
-    if (hasDefault) return { kind: "pass" };
-    if (codes.has(response.status)) return { kind: "pass" };
-    if (hasWildcard.get(Math.floor(response.status / 100))) return { kind: "pass" };
-    // ARV-224: use the actual request method (c.request.method) instead
-    // of the operation's declared method. For unsupported_method probes
-    // the request fires POST/PUT/PATCH against a GET-only endpoint and the
-    // legacy `c.operation.method` would print "for GET" while the
-    // request_signature (downstream SARIF / triage) shows POST — sending
-    // operators in the wrong direction.
-    const reqMethod = c.request.method.toUpperCase();
-    return {
-      kind: "fail",
-      message: `Status ${response.status} not declared in OpenAPI responses for ${reqMethod} ${c.operation.path}`,
-      evidence: { actual: response.status, declared: [...codes].sort((a, b) => a - b) },
-      severity: severityFor(response.status, codes, c.kind),
-    };
-  },
-};

package/src/core/checks/checks/unsupported_method.ts

@@ -1,63 +0,0 @@
-/**
- * `unsupported_method` — the live-running counterpart of the offline
- * `method-probe`. Sends a method that isn't declared on the path; the
- * server must reject with a 405 (or 401/403/404 fallback). Shares the
- * acceptable-status list with the offline probe via `method-shared`
- * (ARV-2 AC #4).
- */
-import type { Check } from "../types.ts";
-import {
-  ACCEPTABLE_UNSUPPORTED_STATUSES,
-  isPermissibleOptionsResponse,
-} from "../../probe/method-shared.ts";
-
-const ACCEPTABLE = new Set<number>(ACCEPTABLE_UNSUPPORTED_STATUSES);
-
-export const unsupportedMethod: Check = {
-  id: "unsupported_method",
-  severity: "medium",
-  defaultExpected: "Server must reject undeclared HTTP methods with 405 (or 401/403/404)",
-  references: [{ id: "RFC-9110-15.5.6", url: "https://www.rfc-editor.org/rfc/rfc9110#name-405-method-not-allowed" }],
-  caseKinds: ["unsupported_method"],
-  applies: () => true,
-  run({ case: c, response, options }) {
-    const status = response.status;
-    const undeclared = String(c.meta?.undeclared_method ?? c.request.method);
-    const strict = options?.strict405 === true;
-
-    // ARV-179: OPTIONS 2xx is legitimate CORS preflight behaviour on
-    // almost every framework. Treat as pass even in strict mode — the
-    // m-18 parity replication explicitly ignores OPTIONS responses too.
-    if (isPermissibleOptionsResponse(undeclared, status)) return { kind: "pass" };
-
-    if (strict) {
-      if (status === 405) return { kind: "pass" };
-      return {
-        kind: "fail",
-        message: `Undeclared method ${undeclared} returned ${status} — strict mode requires 405`,
-        evidence: { undeclared_method: undeclared, status, strict_405: true },
-      };
-    }
-
-    if (ACCEPTABLE.has(status)) return { kind: "pass" };
-    if (status >= 200 && status < 300) {
-      return {
-        kind: "fail",
-        message: `Server accepted undeclared method ${undeclared} on ${c.operation.path} (status ${status})`,
-        evidence: { undeclared_method: undeclared, status },
-      };
-    }
-    if (status >= 500) {
-      return {
-        kind: "fail",
-        message: `Server 5xx'd on undeclared method ${undeclared} for ${c.operation.path} — should be 405`,
-        evidence: { undeclared_method: undeclared, status },
-      };
-    }
-    return {
-      kind: "fail",
-      message: `Undeclared method ${undeclared} returned ${status} — expected 405 (or 401/403/404)`,
-      evidence: { undeclared_method: undeclared, status },
-    };
-  },
-};

package/src/core/checks/checks/use_after_free.ts

@@ -1,78 +0,0 @@
-/**
- * `use_after_free` (m-15 ARV-3) — given a CRUD group with create+read+
- * delete, create a resource, delete it, then GET by id. The server
- * must respond 404/410. Any 2xx means the resource is still readable
- * after a successful DELETE (a classic data-leak / soft-delete bug).
- */
-import type { CrudStatefulCheck } from "../stateful.ts";
-import { extractIdFromCreateResponse, fillPathWithId, fillPathParams, serializeCheckBody, resolveCreateBody } from "./_crud-helpers.ts";
-
-export const useAfterFree: CrudStatefulCheck = {
-  id: "use_after_free",
-  severity: "high",
-  defaultExpected: "GET on a deleted resource must return 404 or 410",
-  references: [{ id: "CWE-672" }],
-  phase: "crud",
-  applies(g) {
-    return Boolean(g.create && g.read && g.delete);
-  },
-  async run(g, h) {
-    if (h.bootstrapCleanupFailed) {
-      return { kind: "skip", reason: "bootstrap-cleanup failed — security checks paused (ARV-3 AC #6)" };
-    }
-    const create = g.create!;
-    const read = g.read!;
-    const del = g.delete!;
-    const baseHeaders = { Accept: "application/json", ...h.authHeaders };
-
-    // 1. create — ARV-191: respect form-urlencoded so Stripe-style APIs
-    // don't silently broken-baseline-skip every CRUD chain.
-    // ARV-187: prefer LLM-authored seed_body when available.
-    const seedBody = h.resourceConfigs?.get(g.resource)?.seedBody;
-    const generated = resolveCreateBody(create, seedBody) ?? {};
-    const { body: createBody, contentType } = serializeCheckBody(
-      create,
-      generated,
-      h.pathVars,
-      seedBody?.contentType,
-    );
-    const createUrl = `${h.baseUrl.replace(/\/+$/, "")}${fillPathParams(create.path, h.pathVars)}`;
-    const createResp = await h.send({
-      method: "POST",
-      url: createUrl,
-      headers: { ...baseHeaders, "Content-Type": contentType },
-      body: createBody,
-    });
-    if (createResp.status < 200 || createResp.status >= 300) {
-      return { kind: "skip", reason: `create returned ${createResp.status} — broken-baseline guard` };
-    }
-    const id = extractIdFromCreateResponse(createResp.body_parsed ?? createResp.body, g.idParam);
-    if (id == null) return { kind: "skip", reason: "could not extract id from create response" };
-
-    // 2. delete
-    const delResp = await h.send({
-      method: "DELETE",
-      url: `${h.baseUrl.replace(/\/+$/, "")}${fillPathWithId(fillPathParams(del.path, h.pathVars), g.idParam, id)}`,
-      headers: baseHeaders,
-    });
-    if (delResp.status < 200 || delResp.status >= 300) {
-      return { kind: "skip", reason: `delete returned ${delResp.status} — broken-baseline guard` };
-    }
-
-    // 3. read after delete
-    const readResp = await h.send({
-      method: "GET",
-      url: `${h.baseUrl.replace(/\/+$/, "")}${fillPathWithId(fillPathParams(read.path, h.pathVars), g.idParam, id)}`,
-      headers: baseHeaders,
-    });
-    if (readResp.status === 404 || readResp.status === 410) return { kind: "pass" };
-    if (readResp.status >= 200 && readResp.status < 300) {
-      return {
-        kind: "fail",
-        message: `GET on resource ${id} after DELETE returned ${readResp.status} — resource still readable`,
-        evidence: { resource: g.resource, id, get_status_after_delete: readResp.status },
-      };
-    }
-    return { kind: "skip", reason: `read after delete returned ${readResp.status} — neither 404/410 nor 2xx` };
-  },
-};

package/src/core/checks/index.ts

@@ -1,30 +0,0 @@
-/**
- * Public entry point for the `core/checks` framework.
- *
- * Importing this module also triggers `checks/index.ts` which registers
- * the built-in checks exactly once.
- */
-export type {
-  Check,
-  CheckCase,
-  CheckContext,
-  CheckFinding,
-  CheckOutcome,
-  CheckResponse,
-  CheckRunData,
-  CheckRunSummary,
-  Phase,
-  Severity,
-} from "./types.ts";
-export { emptySummary } from "./types.ts";
-export {
-  __resetRegistryForTests,
-  getCheck,
-  listChecks,
-  registerCheck,
-  selectChecks,
-  type SelectOptions,
-  type SelectionResult,
-} from "./registry.ts";
-export { runChecks, type RunChecksOptions, type RunChecksResult } from "./runner.ts";
-export { registerBuiltinChecks } from "./checks/index.ts";

package/src/core/checks/mode.ts

@@ -1,82 +0,0 @@
-/**
- * `--mode positive|negative|all` filter (m-15 ARV-7).
- *
- * Splits the registered check catalog along the positive-vs-negative
- * axis so an agent can run *just* contract verification (positive) or
- * *just* malicious-input probes (negative) on the same spec without
- * juggling a long `--check` list.
- *
- * Centralized table — both response-phase `Check`s and stateful
- * security checks declare their mode here. Tests snapshot the table so
- * adding a new check forces an explicit decision rather than letting it
- * silently land in the "all" bucket and surface in both modes.
- */
-import type { Check } from "./types.ts";
-import type { StatefulCheck } from "./stateful.ts";
-
-export type Mode = "positive" | "negative" | "all";
-
-export const MODE_BY_CHECK: Record<string, Mode> = {
-  // Conformance checks fire on every response — both modes.
-  not_a_server_error: "all",
-  status_code_conformance: "all",
-  content_type_conformance: "all",
-  response_headers_conformance: "all",
-  response_schema_conformance: "all",
-  // Probes that *only* make sense as malicious input.
-  missing_required_header: "negative",
-  unsupported_method: "negative",
-  negative_data_rejection: "negative",
-  // The "happy-path didn't break" sanity probe.
-  positive_data_acceptance: "positive",
-  // Security checks (stateful) — they verify a *bad* outcome (auth
-  // bypass, dangling reads). Not part of the positive contract.
-  ignored_auth: "negative",
-  use_after_free: "negative",
-  // Availability is positive-flavored — it asserts the server *can*
-  // serve the listed resource. Useful in `--mode positive` runs.
-  ensure_resource_availability: "all",
-  // ARV-169 (m-20): cross-call drift is a contract-verification check
-  // (does GET reflect POST?), not a malicious-input probe. Positive.
-  cross_call_references: "positive",
-  // ARV-170 (m-20): idempotency replay verifies a *contract* the server
-  // advertises (Idempotency-Key honored). Positive.
-  idempotency_replay: "positive",
-  // ARV-171 (m-20): pagination invariants verify the cursor contract.
-  pagination_invariants: "positive",
-  // ARV-172 (m-20): lifecycle verifies the declared state machine.
-  lifecycle_transitions: "positive",
-  // ARV-256 (m-21): open-CORS check sends an attacker Origin and
-  // inspects response — categorically negative-mode probe.
-  open_cors_on_sensitive: "negative",
-  // ARV-256 (m-21): rate-limit headers check inspects 2xx responses
-  // for advertised rate-limit metadata — runs on the positive path.
-  rate_limit_headers_absent: "positive",
-  // ARV-273 (m-22): cursor-fuzzing sends malformed cursor values and
-  // expects 4xx — classic negative-mode probe.
-  cursor_boundary_fuzzing: "negative",
-};
-
-export function modeFor(checkId: string): Mode {
-  return MODE_BY_CHECK[checkId] ?? "all";
-}
-
-export function filterChecksByMode<T extends Check | StatefulCheck>(
-  checks: T[],
-  mode: Mode,
-): T[] {
-  if (mode === "all") return checks;
-  return checks.filter((c) => {
-    const cm = modeFor(c.id);
-    if (cm === "all") return true;
-    return cm === mode;
-  });
-}
-
-/** True if a built case (with `mode: "positive" | "negative"`) should be
- *  sent in the requested run-mode. The runner uses this to short-circuit
- *  request emission for cases the active mode doesn't care about. */
-export function caseMatchesMode(caseMode: "positive" | "negative", runMode: Mode): boolean {
-  if (runMode === "all") return true;
-  return runMode === caseMode;
-}

package/src/core/checks/recommended-action.ts

@@ -1,68 +0,0 @@
-/**
- * ARV-11 (m-15): per-check `recommended_action` table.
- *
- * Each `CheckFinding` carries one closed-enum action so an agent can
- * route on it without parsing the free-form `message`. The mapping is
- * deterministic — given the check id and (for a couple of fan-out cases)
- * the response status, exactly one action comes out.
- *
- * Keep this file thin and table-driven. The shared enum lives in
- * `core/diagnostics/failure-hints.ts` so `db diagnose` (TASK-294) and
- * `zond checks run` (ARV-11) can never drift.
- */
-import type { RecommendedAction } from "../diagnostics/failure-hints.ts";
-import { classify, type FindingClass } from "../classifier/recommended-action.ts";
-
-/** Check IDs the classifier explicitly recognises. Keeping this typed
- *  guarantees that adding a new check forces a branch in the classifier
- *  switch (tsc errors out at compile time on a stale `STATIC_TABLE` lookup). */
-const CHECK_ID_TO_CLASS: Record<string, FindingClass> = {
-  status_code_conformance: "check:status_code_conformance",
-  content_type_conformance: "check:content_type_conformance",
-  response_headers_conformance: "check:response_headers_conformance",
-  response_schema_conformance: "check:response_schema_conformance",
-  not_a_server_error: "check:not_a_server_error",
-  unsupported_method: "check:unsupported_method",
-  positive_data_acceptance: "check:positive_data_acceptance",
-  use_after_free: "check:use_after_free",
-  ensure_resource_availability: "check:ensure_resource_availability",
-  negative_data_rejection: "check:negative_data_rejection",
-  missing_required_header: "check:missing_required_header",
-  ignored_auth: "check:ignored_auth",
-  cross_call_references: "check:cross_call_references",
-  idempotency_replay: "check:idempotency_replay",
-  pagination_invariants: "check:pagination_invariants",
-  lifecycle_transitions: "check:lifecycle_transitions",
-  open_cors_on_sensitive: "check:open_cors_on_sensitive",
-  rate_limit_headers_absent: "check:rate_limit_headers_absent",
-  cursor_boundary_fuzzing: "check:cursor_boundary_fuzzing",
-  network_error: "check:network_error",
-};
-
-/**
- * ARV-56: thin wrapper that maps a check id + status to the unified
- * classifier. Returns `undefined` when the check id isn't in the table
- * — unknown ids are a bug in this map, not a runtime input to coerce.
- */
-export function recommendForCheck(
-  checkId: string,
-  status?: number,
-  /** ARV-324: true when `.fixture-gaps.yaml` already confirmed this
-   *  operation as a known-empty/inaccessible resource. */
-  unresolvedFixture?: boolean,
-): RecommendedAction | undefined {
-  const findingClass = CHECK_ID_TO_CLASS[checkId];
-  if (!findingClass) return undefined;
-  return classify({ finding_class: findingClass, status: status ?? null, unresolved_fixture: unresolvedFixture });
-}
-
-/** Test-only export — keeps the unit table authoritative without
- *  re-listing entries inside the test file. Derived from classifier
- *  output so the table never drifts from the classifier's switch. */
-export const RECOMMENDED_ACTION_TABLE: Readonly<Record<string, RecommendedAction>> = Object.freeze(
-  Object.fromEntries(
-    Object.entries(CHECK_ID_TO_CLASS)
-      .filter(([id]) => id !== "network_error") // dynamic — depends on status
-      .map(([id, fc]) => [id, classify({ finding_class: fc })!]),
-  ),
-);

package/src/core/checks/registry.ts

@@ -1,78 +0,0 @@
-/**
- * Global registry of `zond checks`. Built-in checks register themselves
- * on first import (see `checks/index.ts`); `selectChecks` resolves the
- * `--check` / `--exclude-check` filters from the CLI into the active
- * subset for a single run.
- */
-import type { Check } from "./types.ts";
-
-const REGISTRY = new Map<string, Check>();
-
-export function registerCheck(check: Check): void {
-  if (REGISTRY.has(check.id)) {
-    throw new Error(`Check "${check.id}" is already registered`);
-  }
-  REGISTRY.set(check.id, check);
-}
-
-export function getCheck(id: string): Check | undefined {
-  return REGISTRY.get(id);
-}
-
-export function listChecks(): Check[] {
-  return [...REGISTRY.values()].sort((a, b) => a.id.localeCompare(b.id));
-}
-
-export interface SelectOptions {
-  include?: string[];
-  exclude?: string[];
-}
-
-export interface SelectionResult {
-  selected: Check[];
-  unknown: string[];
-}
-
-/**
- * Resolve include/exclude id lists into the active set of checks.
- * Unknown ids are returned separately so the caller can surface them as
- * envelope warnings (and decide whether to fail or continue).
- */
-export function selectChecks(opts: SelectOptions = {}): SelectionResult {
-  const all = listChecks();
-  const knownIds = new Set(all.map(c => c.id));
-  const unknown: string[] = [];
-
-  for (const id of [...(opts.include ?? []), ...(opts.exclude ?? [])]) {
-    if (!knownIds.has(id)) unknown.push(id);
-  }
-
-  let pool = all;
-  if (opts.include && opts.include.length > 0) {
-    const includeSet = new Set(opts.include);
-    pool = pool.filter(c => includeSet.has(c.id));
-  }
-  if (opts.exclude && opts.exclude.length > 0) {
-    const excludeSet = new Set(opts.exclude);
-    pool = pool.filter(c => !excludeSet.has(c.id));
-  }
-  return { selected: pool, unknown };
-}
-
-/** Test-only escape hatch — wipes the registry between unit tests. */
-export function __resetRegistryForTests(): void {
-  REGISTRY.clear();
-}
-
-/** Test-only snapshot/restore. Use when a test wants a clean slate but the
- *  rest of the suite still needs the side-effect-registered built-ins
- *  (otherwise wiping the registry leaks across files because the modules
- *  that registered them are already cached and won't re-fire on re-import).
- */
-export function __snapshotRegistryForTests(): () => void {
-  const saved = new Map(REGISTRY);
-  return () => {
-    REGISTRY.clear();
-    for (const [k, v] of saved) REGISTRY.set(k, v);
-  };
-}