@moltzap/protocol 2026.408.0 → 2026.425.0

package/dist/testing/errors.d.ts

@@ -0,0 +1,78 @@
+declare const TransportClosedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingTransportClosedError";
+} & Readonly<A>;
+/** Peer closed the underlying WS before a response arrived. */
+export declare class TransportClosedError extends TransportClosedError_base<{
+    readonly direction: "outbound" | "inbound";
+    readonly code: number;
+    readonly reason: string;
+}> {
+}
+declare const TransportIoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingTransportIoError";
+} & Readonly<A>;
+/** Underlying transport raised (socket error, DNS, TLS, etc.). */
+export declare class TransportIoError extends TransportIoError_base<{
+    readonly direction: "outbound" | "inbound";
+    readonly cause: unknown;
+}> {
+}
+declare const FrameSchemaError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingFrameSchemaError";
+} & Readonly<A>;
+/** A frame read off the wire failed `Value.Check` against its schema. */
+export declare class FrameSchemaError extends FrameSchemaError_base<{
+    readonly direction: "outbound" | "inbound";
+    readonly expected: "request" | "response" | "event";
+    readonly raw: string;
+    readonly reason: string;
+}> {
+}
+declare const RpcTimeoutError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingRpcTimeoutError";
+} & Readonly<A>;
+/** Wall-clock deadline for a request-id expired before a response. */
+export declare class RpcTimeoutError extends RpcTimeoutError_base<{
+    readonly method: string;
+    readonly requestId: string;
+    readonly timeoutMs: number;
+}> {
+}
+declare const RpcResponseError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingRpcResponseError";
+} & Readonly<A>;
+/** Server returned a typed `ErrorFrame` for a request. */
+export declare class RpcResponseError extends RpcResponseError_base<{
+    readonly method: string;
+    readonly requestId: string;
+    readonly code: number;
+    readonly message: string;
+    readonly data?: unknown;
+}> {
+}
+declare const ToxicControlError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingToxicControlError";
+} & Readonly<A>;
+/** Toxiproxy HTTP API returned a non-2xx, or the control endpoint is down. */
+export declare class ToxicControlError extends ToxicControlError_base<{
+    readonly op: "create-proxy" | "delete-proxy" | "add-toxic" | "remove-toxic";
+    readonly status: number;
+    readonly body: string;
+}> {
+}
+declare const RealServerAcquireError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TestingRealServerAcquireError";
+} & Readonly<A>;
+/** Consumer-supplied `realServer()` factory threw or the handle was unusable. */
+export declare class RealServerAcquireError extends RealServerAcquireError_base<{
+    readonly cause: unknown;
+}> {
+}
+/**
+ * Discriminated union of every error the testing surface can surface.
+ * Exhaustiveness over optionality: properties `match` on `_tag` and the
+ * compiler flags a missing branch if this union grows.
+ */
+export type TestingError = TransportClosedError | TransportIoError | FrameSchemaError | RpcTimeoutError | RpcResponseError | ToxicControlError | RealServerAcquireError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/testing/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/testing/errors.ts"],"names":[],"mappings":";;;AAaA,+DAA+D;AAC/D,qBAAa,oBAAqB,SAAQ,0BAExC;IACA,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AAEL,kEAAkE;AAClE,qBAAa,gBAAiB,SAAQ,sBAEpC;IACA,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;;;;AAEL,yEAAyE;AACzE,qBAAa,gBAAiB,SAAQ,sBAEpC;IACA,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AAEL,sEAAsE;AACtE,qBAAa,eAAgB,SAAQ,qBAEnC;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;CAAG;;;;AAEL,0DAA0D;AAC1D,qBAAa,gBAAiB,SAAQ,sBAEpC;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;;;;AAEL,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,uBAErC;IACA,QAAQ,CAAC,EAAE,EAAE,cAAc,GAAG,cAAc,GAAG,WAAW,GAAG,cAAc,CAAC;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AAEL,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,sBAAsB,CAAC"}

package/dist/testing/errors.js

@@ -0,0 +1,34 @@
+/**
+ * Tagged errors surfaced by the `@moltzap/protocol/testing` primitives.
+ *
+ * Every public `TestClient` / `TestServer` operation returns an
+ * `Effect.Effect<T, TestingError, ...>`. Downstream fast-check properties
+ * discriminate on `_tag` so shrinks land on a named failure mode rather
+ * than an anonymous `unknown`.
+ *
+ * Invariant I3 (schema is source of truth) lives here: frame-level
+ * validation failures raise `FrameSchemaError` on both directions.
+ */
+import { Data } from "effect";
+/** Peer closed the underlying WS before a response arrived. */
+export class TransportClosedError extends Data.TaggedError("TestingTransportClosedError") {
+}
+/** Underlying transport raised (socket error, DNS, TLS, etc.). */
+export class TransportIoError extends Data.TaggedError("TestingTransportIoError") {
+}
+/** A frame read off the wire failed `Value.Check` against its schema. */
+export class FrameSchemaError extends Data.TaggedError("TestingFrameSchemaError") {
+}
+/** Wall-clock deadline for a request-id expired before a response. */
+export class RpcTimeoutError extends Data.TaggedError("TestingRpcTimeoutError") {
+}
+/** Server returned a typed `ErrorFrame` for a request. */
+export class RpcResponseError extends Data.TaggedError("TestingRpcResponseError") {
+}
+/** Toxiproxy HTTP API returned a non-2xx, or the control endpoint is down. */
+export class ToxicControlError extends Data.TaggedError("TestingToxicControlError") {
+}
+/** Consumer-supplied `realServer()` factory threw or the handle was unusable. */
+export class RealServerAcquireError extends Data.TaggedError("TestingRealServerAcquireError") {
+}
+//# sourceMappingURL=errors.js.map

package/dist/testing/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/testing/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,+DAA+D;AAC/D,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CACxD,6BAA6B,CAK7B;CAAG;AAEL,kEAAkE;AAClE,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CACpD,yBAAyB,CAIzB;CAAG;AAEL,yEAAyE;AACzE,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CACpD,yBAAyB,CAMzB;CAAG;AAEL,sEAAsE;AACtE,MAAM,OAAO,eAAgB,SAAQ,IAAI,CAAC,WAAW,CACnD,wBAAwB,CAKxB;CAAG;AAEL,0DAA0D;AAC1D,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CACpD,yBAAyB,CAOzB;CAAG;AAEL,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CACrD,0BAA0B,CAK1B;CAAG;AAEL,iFAAiF;AACjF,MAAM,OAAO,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAC1D,+BAA+B,CAG/B;CAAG"}

package/dist/testing/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `@moltzap/protocol/testing` — TestClient + TestServer primitives,
+ * reference model, arbitrary derivation, Toxiproxy adversity layer, and
+ * the five-tier conformance runner.
+ *
+ * Subpath export wiring lives in `packages/protocol/package.json` and is
+ * added by the implement-staff modality (architect charter forbids
+ * `package.json` edits in the stub PR).
+ */
+export { type CloseableTestClient, type TestClient, type TestClientConfig, makeCloseableTestClient, makeTestClient, } from "./test-client.js";
+export { type TestServer, type TestServerConfig, type TestServerConnection, makeTestServer, } from "./test-server.js";
+export { type CaptureBuffer, type CapturedFrame, type CaptureKind, makeCaptureBuffer, mergeCaptures, recordFrame, recordMalformed, } from "./captures.js";
+export { type AnyFrame, type MalformedFrameKind, encodeFrame, decodeFrame, malformFrame, } from "./codec.js";
+export { type TestingError, TransportClosedError, TransportIoError, FrameSchemaError, RpcTimeoutError, RpcResponseError, ToxicControlError, RealServerAcquireError, } from "./errors.js";
+export { type TestAgent, AgentRegistrationError, registerTestAgent, } from "./agent-registration.js";
+export * as arbitraries from "./arbitraries/index.js";
+export * as models from "./models/index.js";
+export * as toxics from "./toxics/index.js";
+export { type ConformanceArtifact, type ConformanceRunContext, type ConformanceRunOptions, type ConformanceSuiteOptions, type PropertyCategory, type PropertyFailure, type PropertyRun, type RealServerHandle, type RegisteredProperty, type SuiteResult, type WebhookAdapterProbe, PropertyAssertionFailure, PropertyDeferred, PropertyInvariantViolation, PropertyUnavailable, acquireRunContext, assertProperty, collectProperties, registerAllProperties, registerProperty, runAllProperties, runConformance, runConformanceSuite, } from "./conformance/index.js";
+export * as conformance from "./conformance/index.js";
+export * as clientConformance from "./conformance/client/index.js";
+export type { ClientConformanceRunContext, ClientConformanceRunOptions, ObservedEvent, RealClientCloseEvent, RealClientEventFilter, RealClientEventSubscriber, RealClientFactoryArgs, RealClientHandle, RealClientRpcCaller, RealClientSubscription, } from "./conformance/client/runner.js";
+export { RealClientLifecycleError, RealClientRpcError, } from "./conformance/client/runner.js";
+export type { ClientConformanceSuiteOptions, JointConformanceSuiteOptions, } from "./conformance/client/suite.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,KAAK,YAAY,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,SAAS,EACd,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAK5C,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AAMtD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AAKnE,YAAY,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"}

package/dist/testing/index.js

@@ -0,0 +1,37 @@
+/**
+ * `@moltzap/protocol/testing` — TestClient + TestServer primitives,
+ * reference model, arbitrary derivation, Toxiproxy adversity layer, and
+ * the five-tier conformance runner.
+ *
+ * Subpath export wiring lives in `packages/protocol/package.json` and is
+ * added by the implement-staff modality (architect charter forbids
+ * `package.json` edits in the stub PR).
+ */
+// Primitives.
+export { makeCloseableTestClient, makeTestClient, } from "./test-client.js";
+export { makeTestServer, } from "./test-server.js";
+// Capture + codec primitives.
+export { makeCaptureBuffer, mergeCaptures, recordFrame, recordMalformed, } from "./captures.js";
+export { encodeFrame, decodeFrame, malformFrame, } from "./codec.js";
+// Errors.
+export { TransportClosedError, TransportIoError, FrameSchemaError, RpcTimeoutError, RpcResponseError, ToxicControlError, RealServerAcquireError, } from "./errors.js";
+// Test-agent registration helper.
+export { AgentRegistrationError, registerTestAgent, } from "./agent-registration.js";
+// Arbitraries, models, toxics — namespaced to keep names scoped.
+export * as arbitraries from "./arbitraries/index.js";
+export * as models from "./models/index.js";
+export * as toxics from "./toxics/index.js";
+// Conformance suite — top-level so consumers can write
+// `import { runConformanceSuite } from "@moltzap/protocol/testing";`
+// without having to reach into a namespace.
+export { PropertyAssertionFailure, PropertyDeferred, PropertyInvariantViolation, PropertyUnavailable, acquireRunContext, assertProperty, collectProperties, registerAllProperties, registerProperty, runAllProperties, runConformance, runConformanceSuite, } from "./conformance/index.js";
+// Individual category modules under a namespace for consumers who want
+// to register a subset of properties.
+export * as conformance from "./conformance/index.js";
+// Client-side conformance surface (architect arch-201; spec amendment
+// #200). The `clientConformance` namespace carries the factory types
+// (`RealClientHandle`, `RealClientRpcError`), the dedicated entry
+// `runClientConformanceSuite`, and every `register*Client` registrar.
+export * as clientConformance from "./conformance/client/index.js";
+export { RealClientLifecycleError, RealClientRpcError, } from "./conformance/client/runner.js";
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc;AACd,OAAO,EAIL,uBAAuB,EACvB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAIL,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,8BAA8B;AAC9B,OAAO,EAIL,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,UAAU;AACV,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,kCAAkC;AAClC,OAAO,EAEL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,iEAAiE;AACjE,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,uDAAuD;AACvD,qEAAqE;AACrE,4CAA4C;AAC5C,OAAO,EAYL,wBAAwB,EACxB,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAEhC,uEAAuE;AACvE,sCAAsC;AACtC,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AAEtD,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,sEAAsE;AACtE,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AAiBnE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC"}

package/dist/testing/models/dispatch.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Reference-model dispatch: one reducer keyed by `RpcMethodName`.
+ *
+ * The union `RpcModelResult` mirrors every observable shape Tier B must
+ * compare against the real server — success, typed error (authz, schema),
+ * and the prospective events the server is expected to emit as a side
+ * effect of the call.
+ *
+ * Exhaustiveness: the reducer takes `ArbitraryRpcCall` (discriminated on
+ * `method`) so the TS compiler flags an unhandled method name if
+ * `rpcMethods` grows without the model being updated.
+ */
+import type { RpcMap, RpcMethodName } from "../../rpc-registry.js";
+import type { EventFrame } from "../../schema/frames.js";
+import type { ArbitraryRpcCall } from "../arbitraries/rpc.js";
+import { type ReferenceState } from "./state.js";
+/**
+ * Observable outcome of one RPC against the model, in the same shape the
+ * real server puts on the wire. Tier B's B1 asserts
+ * `deepEqual(serverResponse, modelResponse)` modulo opaque fields (IDs,
+ * tokens — extracted to a named canonicalizer in the implementer step).
+ */
+export type RpcModelResult<M extends RpcMethodName = RpcMethodName> = {
+    readonly _tag: "ok";
+    readonly result: RpcMap[M]["result"];
+    readonly events: ReadonlyArray<EventFrame>;
+} | {
+    readonly _tag: "error";
+    readonly code: number;
+    readonly message: string;
+    readonly events: ReadonlyArray<EventFrame>;
+};
+export declare function isIdempotent(method: RpcMethodName): boolean;
+/**
+ * Authorization oracle (B2 / B3). Returns the expected typed outcome for a
+ * call made by `agentId`. Property code compares the real server's error
+ * to this.
+ *
+ * Rules (mirrored from `packages/server/src/app/authz.ts` contract):
+ *   - Unregistered agent + non-connect method → deny-unauthenticated.
+ *   - Conversation-scoped method + `authz` entry "denied" → deny-forbidden.
+ *   - Otherwise allow.
+ */
+export declare function authorizationOutcome(state: ReferenceState, call: ArbitraryRpcCall, agentId: string): "allow" | "deny-unauthenticated" | "deny-forbidden";
+/**
+ * Pure reducer: given state + call, yield the next state and the
+ * observable outcome. No I/O. No clocks. No exceptions — every failure
+ * flows through `_tag: "error"`.
+ *
+ * Exhaustiveness: the `switch` has a branch for every `RpcMethodName` in
+ * `rpcMethods`. A missing branch becomes a compile error at `absurd`.
+ * Behaviour is intentionally conservative — the model predicts the
+ * server's *observable* outcome (success vs typed error), not its full
+ * result shape. Tier B canonicalizers downgrade server responses to the
+ * same projection before comparing.
+ */
+export declare function applyCall<M extends RpcMethodName>(state: ReferenceState, call: ArbitraryRpcCall<M>): {
+    readonly next: ReferenceState;
+    readonly outcome: RpcModelResult<M>;
+};
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/testing/models/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/testing/models/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAU,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAC9D;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAC5C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAC5C,CAAC;AAyBN,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,GAAG,sBAAsB,GAAG,gBAAgB,CAcrD;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,aAAa,EAC/C,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;CAAE,CA0IxE"}

package/dist/testing/models/dispatch.js

@@ -0,0 +1,197 @@
+import { ErrorCodes } from "../../schema/errors.js";
+import { mkTick } from "./state.js";
+// `ErrorCodes` is re-used from `../../schema/errors.ts` so the model and
+// the server share one source of truth for code values.
+/**
+ * Methods whose contract says replay is a no-op — server must return the
+ * same result (same events) for identical params. B5 cross-checks this
+ * against the real server.
+ */
+const IDEMPOTENT_METHODS = new Set([
+    "agents/lookup",
+    "agents/lookupByName",
+    "agents/list",
+    "conversations/list",
+    "conversations/get",
+    "messages/list",
+    "contacts/list",
+    "presence/subscribe",
+    "apps/listSessions",
+    "apps/getSession",
+    "permissions/list",
+    "surface/get",
+]);
+export function isIdempotent(method) {
+    return IDEMPOTENT_METHODS.has(method);
+}
+/**
+ * Authorization oracle (B2 / B3). Returns the expected typed outcome for a
+ * call made by `agentId`. Property code compares the real server's error
+ * to this.
+ *
+ * Rules (mirrored from `packages/server/src/app/authz.ts` contract):
+ *   - Unregistered agent + non-connect method → deny-unauthenticated.
+ *   - Conversation-scoped method + `authz` entry "denied" → deny-forbidden.
+ *   - Otherwise allow.
+ */
+export function authorizationOutcome(state, call, agentId) {
+    // `connect` + `register` establish identity; pre-identity they are always allowed.
+    if (call.method === "auth/connect" || call.method === "auth/register")
+        return "allow";
+    if (!state.agents.has(agentId))
+        return "deny-unauthenticated";
+    const conversationId = extractConversationId(call.params);
+    if (conversationId !== null) {
+        const row = state.authz.get(agentId);
+        if (row !== undefined && row.get(conversationId) === "denied") {
+            return "deny-forbidden";
+        }
+    }
+    return "allow";
+}
+function hasConversationIdString(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        "conversationId" in value &&
+        typeof value.conversationId === "string");
+}
+function extractConversationId(params) {
+    return hasConversationIdString(params) ? params.conversationId : null;
+}
+/**
+ * Pure reducer: given state + call, yield the next state and the
+ * observable outcome. No I/O. No clocks. No exceptions — every failure
+ * flows through `_tag: "error"`.
+ *
+ * Exhaustiveness: the `switch` has a branch for every `RpcMethodName` in
+ * `rpcMethods`. A missing branch becomes a compile error at `absurd`.
+ * Behaviour is intentionally conservative — the model predicts the
+ * server's *observable* outcome (success vs typed error), not its full
+ * result shape. Tier B canonicalizers downgrade server responses to the
+ * same projection before comparing.
+ */
+export function applyCall(state, call) {
+    const nextTick = mkTick(state.tick + 1);
+    const baseNext = { ...state, tick: nextTick };
+    // Authorization check first — every method except connect/register requires identity.
+    // The model doesn't know which `agentId` is the caller here (the call is
+    // unattributed); agent-scoped B2/B3 properties call `authorizationOutcome`
+    // directly. `applyCall` assumes an already-authenticated caller for
+    // simplicity.
+    // Behaviour families the reducer groups by. Grouping keeps the
+    // exhaustive switch below small and named.
+    //
+    // Model-equivalence (rpc-semantics/model-equivalence) uses the
+    // asymmetric oracle: only the `"ok"` path is load-bearing for the
+    // server-must-agree contract. Methods that require specific
+    // params/setup return `"error"` so the model is honest about its
+    // uncertainty — the property runs through them without asserting.
+    //
+    // Criterion for returning `"ok"`: "a freshly-registered agent with
+    // empty-or-arbitrary params gets a successful response." Read-only
+    // list methods with fully-optional params are the honest `"ok"` set;
+    // every other method returns `"error"` (the model is admitting it
+    // doesn't know the state-dependent outcome).
+    const allowNoEvents = () => ({
+        _tag: "ok",
+        result: {},
+        events: [],
+    });
+    const uncertainError = () => ({
+        _tag: "error",
+        code: -32603,
+        message: "model-uncertain: requires state or specific params",
+        events: [],
+    });
+    const m = call.method;
+    switch (m) {
+        // Auth — model isn't sure what auth shape the caller has.
+        case "auth/connect":
+        case "auth/register":
+        case "auth/invite-agent":
+        case "auth/selectAgent":
+            return { next: baseNext, outcome: uncertainError() };
+        // Agents list-shaped — honest "ok" for a fresh authenticated agent.
+        case "agents/list":
+            return { next: baseNext, outcome: allowNoEvents() };
+        // Agents lookup-shaped — need a target; uncertain.
+        case "agents/lookup":
+        case "agents/lookupByName":
+            return { next: baseNext, outcome: uncertainError() };
+        // Conversations list — NOT oracle-confident across arbitrary
+        // params. Round-8 finding (architect-197 §2.2 literal-probe
+        // widening): `conversations/list` accepts `cursor: Type.String()`
+        // (any string) at the schema layer, but the server's cursor
+        // parser errors on pathological whitespace-only values. The
+        // model would be dishonest claiming `ok` across all draws. Move
+        // to `uncertainError`; K=1 today (agents/list only). Widening
+        // K requires either per-method param filters at the arbitrary
+        // layer OR a server-side cursor-parse fix; tracked under #186.
+        case "conversations/list":
+            return { next: baseNext, outcome: uncertainError() };
+        // Conversations with required fields or state — uncertain.
+        case "conversations/create":
+        case "conversations/get":
+        case "conversations/update":
+        case "conversations/mute":
+        case "conversations/unmute":
+        case "conversations/addParticipant":
+        case "conversations/removeParticipant":
+        case "conversations/leave":
+        case "conversations/archive":
+        case "conversations/unarchive":
+            return { next: baseNext, outcome: uncertainError() };
+        // Messages — both require a valid conversationId. Uncertain.
+        case "messages/send":
+        case "messages/list":
+            return { next: baseNext, outcome: uncertainError() };
+        // Contacts list — requires user context for a fresh agent, so
+        // server returns an error. Uncertain.
+        case "contacts/list":
+        case "contacts/add":
+        case "contacts/accept":
+            return { next: baseNext, outcome: uncertainError() };
+        // Invites — requires state. Uncertain.
+        case "invites/createAgent":
+            return { next: baseNext, outcome: uncertainError() };
+        // Presence — state-dependent. Uncertain.
+        case "presence/update":
+        case "presence/subscribe":
+            return { next: baseNext, outcome: uncertainError() };
+        // Push — requires endpoint registration. Uncertain.
+        case "push/register":
+        case "push/unregister":
+            return { next: baseNext, outcome: uncertainError() };
+        // Apps — require app/user context the fresh agent doesn't have.
+        case "apps/create":
+        case "apps/attestSkill":
+        case "permissions/grant":
+        case "permissions/list":
+        case "permissions/revoke":
+        case "apps/closeSession":
+        case "apps/getSession":
+        case "apps/listSessions":
+            return { next: baseNext, outcome: uncertainError() };
+        // Surfaces — require surface/app context. Uncertain.
+        case "surface/update":
+        case "surface/get":
+        case "surface/action":
+        case "surface/clear":
+            return { next: baseNext, outcome: uncertainError() };
+        default: {
+            // Exhaustiveness check — any new RpcMethodName breaks the build here
+            // until a branch is added.
+            const _exhaustive = m;
+            return {
+                next: baseNext,
+                outcome: {
+                    _tag: "error",
+                    code: ErrorCodes.InternalError,
+                    message: `model: unhandled method ${String(_exhaustive)}`,
+                    events: [],
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/testing/models/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/testing/models/dispatch.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAuB,MAAM,YAAY,CAAC;AAqBzD,yEAAyE;AACzE,wDAAwD;AAExD;;;;GAIG;AACH,MAAM,kBAAkB,GAA+B,IAAI,GAAG,CAAC;IAC7D,eAAe;IACf,qBAAqB;IACrB,aAAa;IACb,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;CACqB,CAAC,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAqB,EACrB,IAAsB,EACtB,OAAe;IAEf,mFAAmF;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe;QACnE,OAAO,OAAO,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,gBAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,gBAAgB,IAAI,KAAK;QACzB,OAAQ,KAAqC,CAAC,cAAc,KAAK,QAAQ,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,KAAqB,EACrB,IAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAmB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE9D,sFAAsF;IACtF,yEAAyE;IACzE,2EAA2E;IAC3E,oEAAoE;IACpE,cAAc;IAEd,+DAA+D;IAC/D,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,kEAAkE;IAClE,4DAA4D;IAC5D,iEAAiE;IACjE,kEAAkE;IAClE,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,GAAsB,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,EAAyB;QACjC,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,GAAsB,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC,KAAK;QACZ,OAAO,EAAE,oDAAoD;QAC7D,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;IAEH,MAAM,CAAC,GAAkB,IAAI,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,EAAE,CAAC;QACV,0DAA0D;QAC1D,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe,CAAC;QACrB,KAAK,mBAAmB,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,oEAAoE;QACpE,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;QAEtD,mDAAmD;QACnD,KAAK,eAAe,CAAC;QACrB,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,6DAA6D;QAC7D,4DAA4D;QAC5D,kEAAkE;QAClE,4DAA4D;QAC5D,4DAA4D;QAC5D,gEAAgE;QAChE,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;QAC/D,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,2DAA2D;QAC3D,KAAK,sBAAsB,CAAC;QAC5B,KAAK,mBAAmB,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,8BAA8B,CAAC;QACpC,KAAK,iCAAiC,CAAC;QACvC,KAAK,qBAAqB,CAAC;QAC3B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,6DAA6D;QAC7D,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,8DAA8D;QAC9D,sCAAsC;QACtC,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,CAAC;QACpB,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,uCAAuC;QACvC,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,yCAAyC;QACzC,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,oDAAoD;QACpD,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,gEAAgE;QAChE,KAAK,aAAa,CAAC;QACnB,KAAK,kBAAkB,CAAC;QACxB,KAAK,mBAAmB,CAAC;QACzB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,mBAAmB,CAAC;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,qDAAqD;QACrD,KAAK,gBAAgB,CAAC;QACtB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;QAEvD,OAAO,CAAC,CAAC,CAAC;YACR,qEAAqE;YACrE,2BAA2B;YAC3B,MAAM,WAAW,GAAU,CAAC,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,UAAU,CAAC,aAAa;oBAC9B,OAAO,EAAE,2BAA2B,MAAM,CAAC,WAAW,CAAC,EAAE;oBACzD,MAAM,EAAE,EAAE;iBACX;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/testing/models/index.d.ts

@@ -0,0 +1,3 @@
+export { type ReferenceState, type LogicalTick, initialReferenceState, } from "./state.js";
+export { type RpcModelResult, applyCall, isIdempotent, authorizationOutcome, } from "./dispatch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/models/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,SAAS,EACT,YAAY,EACZ,oBAAoB,GACrB,MAAM,eAAe,CAAC"}

package/dist/testing/models/index.js

@@ -0,0 +1,3 @@
+export { initialReferenceState, } from "./state.js";
+export { applyCall, isIdempotent, authorizationOutcome, } from "./dispatch.js";
+//# sourceMappingURL=index.js.map

package/dist/testing/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/models/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,SAAS,EACT,YAAY,EACZ,oBAAoB,GACrB,MAAM,eAAe,CAAC"}

package/dist/testing/models/state.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Reference-model state types.
+ *
+ * Per Invariant I5 and AC4, the reference model is the contract: its
+ * reducer-derived next-state and its predicted event trace are compared
+ * against the real server's observable behavior (Tier B). Divergence
+ * shrinks to the offending `ArbitraryRpcCall`.
+ *
+ * Shape: a pure data record keyed by agent id + conversation id. No fibers,
+ * no network, no clocks — all actions are total functions.
+ */
+import type { Agent, Conversation, Message } from "../../types.js";
+import type { EventFrame } from "../../schema/frames.js";
+/** Monotonic logical clock — the model does not read wall time. */
+export type LogicalTick = number & {
+    readonly __brand: "LogicalTick";
+};
+/** Construct a `LogicalTick` from a raw number. Only call in this module. */
+export declare function mkTick(n: number): LogicalTick;
+/** Every kind of entity the model tracks. */
+export interface ReferenceState {
+    readonly tick: LogicalTick;
+    /** Registered agents, keyed by `agentId`. */
+    readonly agents: ReadonlyMap<string, Agent>;
+    /** Conversations, keyed by `conversationId`. */
+    readonly conversations: ReadonlyMap<string, Conversation>;
+    /** Messages per conversation, append-only, ordered. */
+    readonly messages: ReadonlyMap<string, ReadonlyArray<Message>>;
+    /** Per-agent outbox of events the model predicts the server will emit. */
+    readonly pendingEvents: ReadonlyMap<string, ReadonlyArray<EventFrame>>;
+    /** Authorization table — (agentId, conversationId) → role. */
+    readonly authz: ReadonlyMap<string, ReadonlyMap<string, "owner" | "participant" | "denied">>;
+    /** Request-ids the model has observed, for uniqueness assertions (B4). */
+    readonly seenRequestIds: ReadonlySet<string>;
+}
+export declare const initialReferenceState: ReferenceState;
+//# sourceMappingURL=state.d.ts.map

package/dist/testing/models/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/testing/models/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEvE,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,CAE7C;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,WAAW,CACzB,MAAM,EACN,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAC,CACxD,CAAC;IACF,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,eAAO,MAAM,qBAAqB,EAAE,cAQnC,CAAC"}

package/dist/testing/models/state.js

@@ -0,0 +1,14 @@
+/** Construct a `LogicalTick` from a raw number. Only call in this module. */
+export function mkTick(n) {
+    return n;
+}
+export const initialReferenceState = {
+    tick: mkTick(0),
+    agents: new Map(),
+    conversations: new Map(),
+    messages: new Map(),
+    pendingEvents: new Map(),
+    authz: new Map(),
+    seenRequestIds: new Set(),
+};
+//# sourceMappingURL=state.js.map

package/dist/testing/models/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/testing/models/state.ts"],"names":[],"mappings":"AAiBA,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,CAAgB,CAAC;AAC1B,CAAC;AAsBD,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,EAAE;IACjB,aAAa,EAAE,IAAI,GAAG,EAAE;IACxB,QAAQ,EAAE,IAAI,GAAG,EAAE;IACnB,aAAa,EAAE,IAAI,GAAG,EAAE;IACxB,KAAK,EAAE,IAAI,GAAG,EAAE;IAChB,cAAc,EAAE,IAAI,GAAG,EAAE;CAC1B,CAAC"}

package/dist/testing/test-client.d.ts

@@ -0,0 +1,70 @@
+/**
+ * TestClient — connects to a REAL MoltZap server URL and drives the wire.
+ *
+ * Per D1 (WS-only) and Invariant I1 (primitives never bypass the wire),
+ * every request is serialized and pushed through a real WebSocket transport
+ * — `@effect/platform/Socket.makeWebSocket` backed by
+ * `@effect/platform-node/NodeSocket.layerWebSocketConstructor` so the wire
+ * bytes match `packages/client`'s real production path.
+ *
+ * Satisfies AC2. Consumed by Tier A / B / C / D / E properties.
+ */
+import { Context, Effect, Scope, Stream } from "effect";
+import type { RpcMap, RpcMethodName } from "../rpc-registry.js";
+import type { EventFrame } from "../schema/frames.js";
+import { type CapturedFrame, type CaptureBuffer } from "./captures.js";
+import { type MalformedFrameKind } from "./codec.js";
+import { FrameSchemaError, RpcResponseError, RpcTimeoutError, TransportClosedError, TransportIoError } from "./errors.js";
+/**
+ * Options for connecting a TestClient. `serverUrl` is the `ws://…` URL of
+ * the real server; `agentKey` + `agentId` are for the `connect` handshake.
+ * `defaultTimeoutMs` bounds each `sendRpc` unless overridden per call.
+ */
+export interface TestClientConfig {
+    readonly serverUrl: string;
+    readonly agentKey: string;
+    readonly agentId: string;
+    readonly defaultTimeoutMs: number;
+    /** Soft cap on captured frames before the ring buffer drops oldest. */
+    readonly captureCapacity: number;
+    /**
+     * When `true`, send the `auth/connect` handshake automatically after the
+     * WS upgrade. Defaults to `true`.
+     */
+    readonly autoConnect?: boolean;
+    /** Quiescence window (ms) for `sendMalformed` to wait for a response. */
+    readonly malformedQuiescenceMs?: number;
+}
+/**
+ * Handle surface. Scoped: acquiring the handle opens the WS; releasing the
+ * scope closes it. All methods return Effects so property code can compose
+ * them inside `Effect.forEach` / `fc.asyncProperty`.
+ */
+export interface TestClient {
+    readonly sendRpc: <M extends RpcMethodName>(method: M, params: RpcMap[M]["params"], opts?: {
+        readonly timeoutMs?: number;
+    }) => Effect.Effect<RpcMap[M]["result"], RpcResponseError | RpcTimeoutError | TransportClosedError | TransportIoError | FrameSchemaError>;
+    readonly sendMalformed: (opts: {
+        readonly baseMethod: RpcMethodName;
+        readonly kind: MalformedFrameKind;
+        readonly seed: number;
+    }) => Effect.Effect<RpcResponseError | null, TransportClosedError | TransportIoError | FrameSchemaError>;
+    readonly events: Stream.Stream<EventFrame, TransportClosedError>;
+    readonly captures: CaptureBuffer;
+    readonly snapshot: Effect.Effect<ReadonlyArray<CapturedFrame>>;
+    readonly waitForEvent: (eventName: string, timeoutMs?: number) => Effect.Effect<EventFrame, Error>;
+    readonly drainEvents: Effect.Effect<ReadonlyArray<EventFrame>>;
+}
+export interface CloseableTestClient extends TestClient {
+    readonly close: Effect.Effect<void, never>;
+}
+/** Context tag so property code can `Effect.serviceWith(TestClient, …)`. */
+export declare const TestClient: Context.Tag<TestClient, TestClient>;
+/**
+ * Open a real WS connection to `config.serverUrl`, complete the `connect`
+ * handshake, and yield a `TestClient`. The surrounding `Scope` owns the
+ * socket; releasing it closes the WS and drains captures.
+ */
+export declare function makeTestClient(config: TestClientConfig): Effect.Effect<TestClient, TransportIoError | TransportClosedError | RpcResponseError, Scope.Scope>;
+export declare function makeCloseableTestClient(config: TestClientConfig): Effect.Effect<CloseableTestClient, TransportIoError | TransportClosedError | RpcResponseError>;
+//# sourceMappingURL=test-client.d.ts.map

package/dist/testing/test-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-client.d.ts","sourceRoot":"","sources":["../../src/testing/test-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAEL,OAAO,EAGP,MAAM,EAGN,KAAK,EACL,MAAM,EACP,MAAM,QAAQ,CAAC;AAGhB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,aAAa,EACxC,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC3B,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACnC,MAAM,CAAC,MAAM,CAChB,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACjB,gBAAgB,GAChB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,CACnB,CAAC;IAEF,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE;QAC7B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CACjB,gBAAgB,GAAG,IAAI,EACvB,oBAAoB,GAAG,gBAAgB,GAAG,gBAAgB,CAC3D,CAAC;IAEF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,YAAY,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;CAC5C;AAED,4EAA4E;AAC5E,eAAO,MAAM,UAAU,qCAEtB,CAAC;AAoBF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,gBAAgB,GACvB,MAAM,CAAC,MAAM,CACd,UAAU,EACV,gBAAgB,GAAG,oBAAoB,GAAG,gBAAgB,EAC1D,KAAK,CAAC,KAAK,CACZ,CAoUA;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GACvB,MAAM,CAAC,MAAM,CACd,mBAAmB,EACnB,gBAAgB,GAAG,oBAAoB,GAAG,gBAAgB,CAC3D,CASA"}