@nage-api/testing 1.0.0-beta.2

package/dist/fixtures/builders.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Fixture builders (PLAN.md §19).
+ *
+ * Each one returns a valid, boring value with every required field filled, and
+ * takes an override object. That combination is what stops a test from being a
+ * wall of setup: `authUser({ roles: ['admin'] })` says the test is about being
+ * an admin, and nothing else.
+ *
+ * They are typed against `@nage-api/contracts`, so a field renamed in a contract
+ * breaks every fixture at compile time rather than at run time — which is the
+ * point of having contracts at the bottom of the graph.
+ */
+import type { AuthUser, BaseEntity, Job, JobAction, Paginated, PaginationMeta, QueueJob, RequestContext, SecurityFinding, SessionRecord, SuccessResponse, TokenPair } from '@nage-api/contracts';
+import { Deterministic } from './deterministic.js';
+/** Every builder takes the same shape: a partial override of the result. */
+export type Override<T> = Partial<T>;
+/** An authenticated principal. Member-level by default: the boring case. */
+export declare function authUser(overrides?: Override<AuthUser>): AuthUser;
+/** An administrator, for the "should be allowed" half of an authorization test. */
+export declare function adminUser(overrides?: Override<AuthUser>): AuthUser;
+/** A request context, as the CLS middleware would have built it. */
+export declare function requestContext(overrides?: Override<RequestContext>): RequestContext;
+/** The id, audit and soft-delete columns every framework-managed entity carries. */
+export declare function baseEntity(overrides?: Override<BaseEntity>): BaseEntity;
+/**
+ * An entity of the caller's own type, with the managed columns filled in.
+ *
+ * ```ts
+ * const product = entity<Product>({ name: 'Widget', price: 10 });
+ * ```
+ */
+export declare function entity<TEntity extends BaseEntity>(fields: Omit<TEntity, keyof BaseEntity> & Partial<BaseEntity>): TEntity;
+export interface JobOverrides<TEntity> {
+    readonly action?: JobAction;
+    readonly owner?: AuthUser;
+    readonly body?: Partial<TEntity>;
+    readonly where?: Record<string, unknown>;
+    readonly requestId?: string;
+}
+/**
+ * A `Job<TEntity>` — the retained lifecycle-hook payload (§14.2, §26).
+ *
+ * Cast at the boundary rather than typed structurally: `Job` is generic over an
+ * entity the kit cannot know, and the alternative is every caller writing the
+ * same cast.
+ */
+export declare function job<TEntity>(overrides?: JobOverrides<TEntity>): Job<TEntity>;
+/** A queue job, with the correlation id a real publisher would have attached. */
+export declare function queueJob<TName extends string, TPayload>(name: TName, payload: TPayload, overrides?: Override<QueueJob<TName, TPayload>>): QueueJob<TName, TPayload>;
+/** Offset pagination metadata. */
+export declare function paginationMeta(overrides?: Override<PaginationMeta>): PaginationMeta;
+/**
+ * A page whose metadata actually matches its records.
+ *
+ * `count` defaults to the number of records rather than being accepted blind,
+ * so a fixture cannot describe an impossible page and a test asserting on
+ * pagination cannot lie to itself.
+ */
+export declare function paginated<T>(records: readonly T[], overrides?: Override<PaginationMeta>): Paginated<T>;
+/** A success envelope, as `ResponseInterceptor` would have produced it. */
+export declare function successResponse<TData>(data: TData): SuccessResponse<TData>;
+/** A stored refresh session, hashed and live. */
+export declare function sessionRecord(overrides?: Override<SessionRecord>): SessionRecord;
+/** A token pair, as login would have returned it. */
+export declare function tokenPair(overrides?: Override<TokenPair>): TokenPair;
+/** A security finding, for testing a report renderer or a gate. */
+export declare function securityFinding(overrides?: Override<SecurityFinding>): SecurityFinding;
+/** A fixture set with its own sequence, so two suites cannot interfere. */
+export declare function fixtures(seed: number): {
+    readonly random: Deterministic;
+    authUser: (overrides?: Override<AuthUser>) => AuthUser;
+    requestContext: (overrides?: Override<RequestContext>) => RequestContext;
+};
+//# sourceMappingURL=builders.d.ts.map

package/dist/fixtures/builders.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Fixture builders (PLAN.md §19).
+ *
+ * Each one returns a valid, boring value with every required field filled, and
+ * takes an override object. That combination is what stops a test from being a
+ * wall of setup: `authUser({ roles: ['admin'] })` says the test is about being
+ * an admin, and nothing else.
+ *
+ * They are typed against `@nage-api/contracts`, so a field renamed in a contract
+ * breaks every fixture at compile time rather than at run time — which is the
+ * point of having contracts at the bottom of the graph.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authUser = authUser;
+exports.adminUser = adminUser;
+exports.requestContext = requestContext;
+exports.baseEntity = baseEntity;
+exports.entity = entity;
+exports.job = job;
+exports.queueJob = queueJob;
+exports.paginationMeta = paginationMeta;
+exports.paginated = paginated;
+exports.successResponse = successResponse;
+exports.sessionRecord = sessionRecord;
+exports.tokenPair = tokenPair;
+exports.securityFinding = securityFinding;
+exports.fixtures = fixtures;
+const deterministic_js_1 = require("./deterministic.js");
+/** An authenticated principal. Member-level by default: the boring case. */
+function authUser(overrides = {}) {
+    return {
+        id: deterministic_js_1.deterministic.id('u'),
+        email: deterministic_js_1.deterministic.email(),
+        roles: ['member'],
+        permissions: [],
+        ...overrides,
+    };
+}
+/** An administrator, for the "should be allowed" half of an authorization test. */
+function adminUser(overrides = {}) {
+    return authUser({
+        roles: ['admin'],
+        permissions: ['user:read', 'user:write'],
+        ...overrides,
+    });
+}
+/** A request context, as the CLS middleware would have built it. */
+function requestContext(overrides = {}) {
+    return {
+        requestId: deterministic_js_1.deterministic.id('req'),
+        ip: '203.0.113.7',
+        userAgent: 'nage-testing/1.0',
+        startedAt: deterministic_js_1.FIXTURE_EPOCH_MS,
+        ...overrides,
+    };
+}
+/** The id, audit and soft-delete columns every framework-managed entity carries. */
+function baseEntity(overrides = {}) {
+    return {
+        id: deterministic_js_1.deterministic.id('e'),
+        created_at: (0, deterministic_js_1.fixtureDate)(),
+        updated_at: (0, deterministic_js_1.fixtureDate)(),
+        created_by: null,
+        updated_by: null,
+        deleted_at: null,
+        deleted_by: null,
+        ...overrides,
+    };
+}
+/**
+ * An entity of the caller's own type, with the managed columns filled in.
+ *
+ * ```ts
+ * const product = entity<Product>({ name: 'Widget', price: 10 });
+ * ```
+ */
+function entity(fields) {
+    return { ...baseEntity(), ...fields };
+}
+/**
+ * A `Job<TEntity>` — the retained lifecycle-hook payload (§14.2, §26).
+ *
+ * Cast at the boundary rather than typed structurally: `Job` is generic over an
+ * entity the kit cannot know, and the alternative is every caller writing the
+ * same cast.
+ */
+function job(overrides = {}) {
+    return {
+        action: overrides.action ?? 'findAll',
+        owner: overrides.owner ?? authUser(),
+        requestId: overrides.requestId ?? deterministic_js_1.deterministic.id('req'),
+        ...(overrides.body === undefined ? {} : { body: overrides.body }),
+        ...(overrides.where === undefined ? {} : { where: overrides.where }),
+    };
+}
+/** A queue job, with the correlation id a real publisher would have attached. */
+function queueJob(name, payload, overrides = {}) {
+    return { name, payload, requestId: deterministic_js_1.deterministic.id('req'), ...overrides };
+}
+/** Offset pagination metadata. */
+function paginationMeta(overrides = {}) {
+    return { offset: 0, limit: 20, count: 0, ...overrides };
+}
+/**
+ * A page whose metadata actually matches its records.
+ *
+ * `count` defaults to the number of records rather than being accepted blind,
+ * so a fixture cannot describe an impossible page and a test asserting on
+ * pagination cannot lie to itself.
+ */
+function paginated(records, overrides = {}) {
+    return {
+        records: [...records],
+        pagination: paginationMeta({ count: records.length, ...overrides }),
+    };
+}
+/** A success envelope, as `ResponseInterceptor` would have produced it. */
+function successResponse(data) {
+    return {
+        success: true,
+        data,
+        meta: { requestId: deterministic_js_1.deterministic.id('req'), timestamp: (0, deterministic_js_1.fixtureDate)() },
+    };
+}
+/** A stored refresh session, hashed and live. */
+function sessionRecord(overrides = {}) {
+    const issuedAt = deterministic_js_1.FIXTURE_EPOCH_MS;
+    return {
+        id: deterministic_js_1.deterministic.id('s'),
+        familyId: deterministic_js_1.deterministic.id('fam'),
+        userId: deterministic_js_1.deterministic.id('u'),
+        hashedToken: deterministic_js_1.deterministic.hex(43),
+        issuedAt,
+        expiresAt: issuedAt + 30 * 24 * 60 * 60 * 1000,
+        ...overrides,
+    };
+}
+/** A token pair, as login would have returned it. */
+function tokenPair(overrides = {}) {
+    return {
+        accessToken: `header.${deterministic_js_1.deterministic.hex(24)}.signature`,
+        refreshToken: deterministic_js_1.deterministic.hex(43),
+        expiresIn: 900,
+        tokenType: 'Bearer',
+        ...overrides,
+    };
+}
+/** A security finding, for testing a report renderer or a gate. */
+function securityFinding(overrides = {}) {
+    return {
+        code: 'SEC_LEGACY_PATTERN',
+        severity: 'medium',
+        location: 'config.example',
+        message: 'An example finding.',
+        remediation: 'Do the safe thing instead.',
+        ...overrides,
+    };
+}
+/** A fixture set with its own sequence, so two suites cannot interfere. */
+function fixtures(seed) {
+    const random = new deterministic_js_1.Deterministic(seed);
+    return {
+        random,
+        authUser: (overrides = {}) => ({
+            id: random.id('u'),
+            email: random.email(),
+            roles: ['member'],
+            permissions: [],
+            ...overrides,
+        }),
+        requestContext: (overrides = {}) => ({
+            requestId: random.id('req'),
+            startedAt: deterministic_js_1.FIXTURE_EPOCH_MS,
+            ...overrides,
+        }),
+    };
+}
+//# sourceMappingURL=builders.js.map

package/dist/fixtures/deterministic.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Deterministic values for fixtures (PLAN.md §19: "deterministic seed fixtures;
+ * no shared state").
+ *
+ * A fixture that calls `Math.random()` or `Date.now()` produces a test that
+ * passes 999 times and fails once, at 23:59 on the last day of the month, on
+ * someone else's machine. Everything here is a pure function of a seed.
+ *
+ * The generator is a counter-based hash rather than a stateful PRNG on purpose:
+ * `sequence(3)` gives the same value whether it is the first call or the
+ * thousandth, so a test that adds a fixture above another one does not shift
+ * every id below it.
+ */
+/** Fixed epoch for every timestamp a fixture produces: 2026-01-01T12:00:00Z. */
+export declare const FIXTURE_EPOCH_MS: number;
+/**
+ * A 32-bit integer hash of `(seed, index)`.
+ *
+ * This is the SplitMix32 finaliser: cheap, well-distributed, and — the property
+ * that matters here — completely stateless.
+ */
+export declare function hash32(seed: number, index: number): number;
+/** A counter-based source of stable pseudo-random values. */
+export declare class Deterministic {
+    #private;
+    constructor(seed?: number);
+    /** The next value in the sequence, as an unsigned 32-bit integer. */
+    next(): number;
+    /** An integer in `[min, max]`, inclusive. */
+    int(min: number, max: number): number;
+    /** A hex string of `length` characters, for ids and tokens. */
+    hex(length?: number): string;
+    /** One element of `values`. Throws on an empty array rather than returning undefined. */
+    pick<T>(values: readonly T[]): T;
+    /** A stable id like `u-3f9a12`, readable in a failure message. */
+    id(prefix?: string): string;
+    /**
+     * A stable, obviously-fake email.
+     *
+     * `.test` is reserved by RFC 2606, so a fixture can never accidentally send
+     * mail to a real address.
+     */
+    email(local?: string): string;
+    /** Restart the sequence, so two fixture sets can be built independently. */
+    reset(): this;
+    get seed(): number;
+}
+/** The shared default sequence. Call `reset()` in a `beforeEach` if order matters. */
+export declare const deterministic: Deterministic;
+/** An ISO timestamp `offsetMs` from the fixture epoch. */
+export declare function fixtureDate(offsetMs?: number): string;
+//# sourceMappingURL=deterministic.d.ts.map

package/dist/fixtures/deterministic.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Deterministic values for fixtures (PLAN.md §19: "deterministic seed fixtures;
+ * no shared state").
+ *
+ * A fixture that calls `Math.random()` or `Date.now()` produces a test that
+ * passes 999 times and fails once, at 23:59 on the last day of the month, on
+ * someone else's machine. Everything here is a pure function of a seed.
+ *
+ * The generator is a counter-based hash rather than a stateful PRNG on purpose:
+ * `sequence(3)` gives the same value whether it is the first call or the
+ * thousandth, so a test that adds a fixture above another one does not shift
+ * every id below it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deterministic = exports.Deterministic = exports.FIXTURE_EPOCH_MS = void 0;
+exports.hash32 = hash32;
+exports.fixtureDate = fixtureDate;
+/** Fixed epoch for every timestamp a fixture produces: 2026-01-01T12:00:00Z. */
+exports.FIXTURE_EPOCH_MS = Date.UTC(2026, 0, 1, 12, 0, 0);
+/**
+ * A 32-bit integer hash of `(seed, index)`.
+ *
+ * This is the SplitMix32 finaliser: cheap, well-distributed, and — the property
+ * that matters here — completely stateless.
+ */
+function hash32(seed, index) {
+    let value = (seed + index * 0x9e37_79b9) | 0;
+    value = Math.imul(value ^ (value >>> 16), 0x21f0_aaad);
+    value = Math.imul(value ^ (value >>> 15), 0x735a_2d97);
+    return (value ^ (value >>> 15)) >>> 0;
+}
+/** A counter-based source of stable pseudo-random values. */
+class Deterministic {
+    #seed;
+    #index = 0;
+    constructor(seed = 1) {
+        this.#seed = seed;
+    }
+    /** The next value in the sequence, as an unsigned 32-bit integer. */
+    next() {
+        this.#index += 1;
+        return hash32(this.#seed, this.#index);
+    }
+    /** An integer in `[min, max]`, inclusive. */
+    int(min, max) {
+        if (max < min)
+            throw new RangeError(`max (${String(max)}) is below min (${String(min)})`);
+        return min + (this.next() % (max - min + 1));
+    }
+    /** A hex string of `length` characters, for ids and tokens. */
+    hex(length = 12) {
+        let out = '';
+        while (out.length < length)
+            out += this.next().toString(16).padStart(8, '0');
+        return out.slice(0, length);
+    }
+    /** One element of `values`. Throws on an empty array rather than returning undefined. */
+    pick(values) {
+        if (values.length === 0)
+            throw new RangeError('pick() needs at least one value');
+        // Non-null: the index is taken modulo a non-zero length.
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- bounded by the guard above
+        return values[this.next() % values.length];
+    }
+    /** A stable id like `u-3f9a12`, readable in a failure message. */
+    id(prefix = 'id') {
+        return `${prefix}-${this.hex(6)}`;
+    }
+    /**
+     * A stable, obviously-fake email.
+     *
+     * `.test` is reserved by RFC 2606, so a fixture can never accidentally send
+     * mail to a real address.
+     */
+    email(local = 'user') {
+        return `${local}-${this.hex(4)}@example.test`;
+    }
+    /** Restart the sequence, so two fixture sets can be built independently. */
+    reset() {
+        this.#index = 0;
+        return this;
+    }
+    get seed() {
+        return this.#seed;
+    }
+}
+exports.Deterministic = Deterministic;
+/** The shared default sequence. Call `reset()` in a `beforeEach` if order matters. */
+exports.deterministic = new Deterministic();
+/** An ISO timestamp `offsetMs` from the fixture epoch. */
+function fixtureDate(offsetMs = 0) {
+    return new Date(exports.FIXTURE_EPOCH_MS + offsetMs).toISOString();
+}
+//# sourceMappingURL=deterministic.js.map

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `@nage-api/testing` — the shared test kit (PLAN.md §19, §24 Phase 9).
+ *
+ * Four things, in rough order of how much they save:
+ *
+ *  1. **security packs** — the cases a whole class of implementation must pass,
+ *     parameterised over an injected harness. When someone finds a new bypass,
+ *     one case here protects every implementation at once.
+ *  2. **`expectNoSecrets`** — the leak check, done properly: non-enumerable
+ *     `Error` fields, base64 and URL encodings, cyclic objects.
+ *  3. **fixtures** — deterministic builders, so a suite cannot fail once a month
+ *     at midnight.
+ *  4. **port doubles** — real implementations of the framework's ports, because
+ *     a stub agrees with whatever the code does and therefore tests nothing.
+ *
+ * The package depends only on `@nage-api/contracts`, and on no test runner: the
+ * framework standardises on Vitest while generated apps may use Jest (§27.3), so
+ * the runner is injected as a `TestApi`.
+ */
+export type * from '@nage-api/contracts';
+export type { Expectation, Pack, TestApi } from './test-api.js';
+export { Deterministic, FIXTURE_EPOCH_MS, deterministic, fixtureDate, hash32, } from './fixtures/deterministic.js';
+export { adminUser, authUser, baseEntity, entity, fixtures, job, paginated, paginationMeta, queueJob, requestContext, securityFinding, sessionRecord, successResponse, tokenPair, type JobOverrides, type Override, } from './fixtures/builders.js';
+export { FakeClock, MemoryKeyValueStore, MemoryRateLimitStore, RecordingLogger, StubSecretProvider, type CapturedLog, } from './doubles/index.js';
+export { COMMON_TEST_SECRETS, expectNoSecrets, mask, scanForLeaks, serialiseDeep, type LeakScanResult, } from './packs/no-leak.js';
+export { describeAuthzBypass, type AttemptResult, type AuthzBypassHarness, } from './packs/authz-bypass.pack.js';
+export { describeQueryAllowList, type QueryAllowListHarness, } from './packs/query-allow-list.pack.js';
+export { MALICIOUS_UPLOADS, describeUploadValidation, type MaliciousFile, type UploadValidationHarness, } from './packs/upload-validation.pack.js';
+export { describeErrorNonLeakage, type ErrorNonLeakageHarness, } from './packs/error-non-leakage.pack.js';
+export { assertCorrelated, assertErrorEnvelope, assertPaginated, assertSuccessEnvelope, } from './assertions/envelope.js';
+export { ContainerHarness, IMAGES, INTERNAL_PORTS, describeWithContainers, unavailableRuntime, urlFor, type ContainerHarnessOptions, type ContainerRuntime, type ContainerService, type ContainerSuiteApi, type StartedContainer, } from './containers/harness.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * `@nage-api/testing` — the shared test kit (PLAN.md §19, §24 Phase 9).
+ *
+ * Four things, in rough order of how much they save:
+ *
+ *  1. **security packs** — the cases a whole class of implementation must pass,
+ *     parameterised over an injected harness. When someone finds a new bypass,
+ *     one case here protects every implementation at once.
+ *  2. **`expectNoSecrets`** — the leak check, done properly: non-enumerable
+ *     `Error` fields, base64 and URL encodings, cyclic objects.
+ *  3. **fixtures** — deterministic builders, so a suite cannot fail once a month
+ *     at midnight.
+ *  4. **port doubles** — real implementations of the framework's ports, because
+ *     a stub agrees with whatever the code does and therefore tests nothing.
+ *
+ * The package depends only on `@nage-api/contracts`, and on no test runner: the
+ * framework standardises on Vitest while generated apps may use Jest (§27.3), so
+ * the runner is injected as a `TestApi`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.urlFor = exports.unavailableRuntime = exports.describeWithContainers = exports.INTERNAL_PORTS = exports.IMAGES = exports.ContainerHarness = exports.assertSuccessEnvelope = exports.assertPaginated = exports.assertErrorEnvelope = exports.assertCorrelated = exports.describeErrorNonLeakage = exports.describeUploadValidation = exports.MALICIOUS_UPLOADS = exports.describeQueryAllowList = exports.describeAuthzBypass = exports.serialiseDeep = exports.scanForLeaks = exports.mask = exports.expectNoSecrets = exports.COMMON_TEST_SECRETS = exports.StubSecretProvider = exports.RecordingLogger = exports.MemoryRateLimitStore = exports.MemoryKeyValueStore = exports.FakeClock = exports.tokenPair = exports.successResponse = exports.sessionRecord = exports.securityFinding = exports.requestContext = exports.queueJob = exports.paginationMeta = exports.paginated = exports.job = exports.fixtures = exports.entity = exports.baseEntity = exports.authUser = exports.adminUser = exports.hash32 = exports.fixtureDate = exports.deterministic = exports.FIXTURE_EPOCH_MS = exports.Deterministic = void 0;
+// Fixtures.
+var deterministic_js_1 = require("./fixtures/deterministic.js");
+Object.defineProperty(exports, "Deterministic", { enumerable: true, get: function () { return deterministic_js_1.Deterministic; } });
+Object.defineProperty(exports, "FIXTURE_EPOCH_MS", { enumerable: true, get: function () { return deterministic_js_1.FIXTURE_EPOCH_MS; } });
+Object.defineProperty(exports, "deterministic", { enumerable: true, get: function () { return deterministic_js_1.deterministic; } });
+Object.defineProperty(exports, "fixtureDate", { enumerable: true, get: function () { return deterministic_js_1.fixtureDate; } });
+Object.defineProperty(exports, "hash32", { enumerable: true, get: function () { return deterministic_js_1.hash32; } });
+var builders_js_1 = require("./fixtures/builders.js");
+Object.defineProperty(exports, "adminUser", { enumerable: true, get: function () { return builders_js_1.adminUser; } });
+Object.defineProperty(exports, "authUser", { enumerable: true, get: function () { return builders_js_1.authUser; } });
+Object.defineProperty(exports, "baseEntity", { enumerable: true, get: function () { return builders_js_1.baseEntity; } });
+Object.defineProperty(exports, "entity", { enumerable: true, get: function () { return builders_js_1.entity; } });
+Object.defineProperty(exports, "fixtures", { enumerable: true, get: function () { return builders_js_1.fixtures; } });
+Object.defineProperty(exports, "job", { enumerable: true, get: function () { return builders_js_1.job; } });
+Object.defineProperty(exports, "paginated", { enumerable: true, get: function () { return builders_js_1.paginated; } });
+Object.defineProperty(exports, "paginationMeta", { enumerable: true, get: function () { return builders_js_1.paginationMeta; } });
+Object.defineProperty(exports, "queueJob", { enumerable: true, get: function () { return builders_js_1.queueJob; } });
+Object.defineProperty(exports, "requestContext", { enumerable: true, get: function () { return builders_js_1.requestContext; } });
+Object.defineProperty(exports, "securityFinding", { enumerable: true, get: function () { return builders_js_1.securityFinding; } });
+Object.defineProperty(exports, "sessionRecord", { enumerable: true, get: function () { return builders_js_1.sessionRecord; } });
+Object.defineProperty(exports, "successResponse", { enumerable: true, get: function () { return builders_js_1.successResponse; } });
+Object.defineProperty(exports, "tokenPair", { enumerable: true, get: function () { return builders_js_1.tokenPair; } });
+// Port doubles.
+var index_js_1 = require("./doubles/index.js");
+Object.defineProperty(exports, "FakeClock", { enumerable: true, get: function () { return index_js_1.FakeClock; } });
+Object.defineProperty(exports, "MemoryKeyValueStore", { enumerable: true, get: function () { return index_js_1.MemoryKeyValueStore; } });
+Object.defineProperty(exports, "MemoryRateLimitStore", { enumerable: true, get: function () { return index_js_1.MemoryRateLimitStore; } });
+Object.defineProperty(exports, "RecordingLogger", { enumerable: true, get: function () { return index_js_1.RecordingLogger; } });
+Object.defineProperty(exports, "StubSecretProvider", { enumerable: true, get: function () { return index_js_1.StubSecretProvider; } });
+// Leak detection.
+var no_leak_js_1 = require("./packs/no-leak.js");
+Object.defineProperty(exports, "COMMON_TEST_SECRETS", { enumerable: true, get: function () { return no_leak_js_1.COMMON_TEST_SECRETS; } });
+Object.defineProperty(exports, "expectNoSecrets", { enumerable: true, get: function () { return no_leak_js_1.expectNoSecrets; } });
+Object.defineProperty(exports, "mask", { enumerable: true, get: function () { return no_leak_js_1.mask; } });
+Object.defineProperty(exports, "scanForLeaks", { enumerable: true, get: function () { return no_leak_js_1.scanForLeaks; } });
+Object.defineProperty(exports, "serialiseDeep", { enumerable: true, get: function () { return no_leak_js_1.serialiseDeep; } });
+// Security packs.
+var authz_bypass_pack_js_1 = require("./packs/authz-bypass.pack.js");
+Object.defineProperty(exports, "describeAuthzBypass", { enumerable: true, get: function () { return authz_bypass_pack_js_1.describeAuthzBypass; } });
+var query_allow_list_pack_js_1 = require("./packs/query-allow-list.pack.js");
+Object.defineProperty(exports, "describeQueryAllowList", { enumerable: true, get: function () { return query_allow_list_pack_js_1.describeQueryAllowList; } });
+var upload_validation_pack_js_1 = require("./packs/upload-validation.pack.js");
+Object.defineProperty(exports, "MALICIOUS_UPLOADS", { enumerable: true, get: function () { return upload_validation_pack_js_1.MALICIOUS_UPLOADS; } });
+Object.defineProperty(exports, "describeUploadValidation", { enumerable: true, get: function () { return upload_validation_pack_js_1.describeUploadValidation; } });
+var error_non_leakage_pack_js_1 = require("./packs/error-non-leakage.pack.js");
+Object.defineProperty(exports, "describeErrorNonLeakage", { enumerable: true, get: function () { return error_non_leakage_pack_js_1.describeErrorNonLeakage; } });
+// Envelope assertions.
+var envelope_js_1 = require("./assertions/envelope.js");
+Object.defineProperty(exports, "assertCorrelated", { enumerable: true, get: function () { return envelope_js_1.assertCorrelated; } });
+Object.defineProperty(exports, "assertErrorEnvelope", { enumerable: true, get: function () { return envelope_js_1.assertErrorEnvelope; } });
+Object.defineProperty(exports, "assertPaginated", { enumerable: true, get: function () { return envelope_js_1.assertPaginated; } });
+Object.defineProperty(exports, "assertSuccessEnvelope", { enumerable: true, get: function () { return envelope_js_1.assertSuccessEnvelope; } });
+// Container harness.
+var harness_js_1 = require("./containers/harness.js");
+Object.defineProperty(exports, "ContainerHarness", { enumerable: true, get: function () { return harness_js_1.ContainerHarness; } });
+Object.defineProperty(exports, "IMAGES", { enumerable: true, get: function () { return harness_js_1.IMAGES; } });
+Object.defineProperty(exports, "INTERNAL_PORTS", { enumerable: true, get: function () { return harness_js_1.INTERNAL_PORTS; } });
+Object.defineProperty(exports, "describeWithContainers", { enumerable: true, get: function () { return harness_js_1.describeWithContainers; } });
+Object.defineProperty(exports, "unavailableRuntime", { enumerable: true, get: function () { return harness_js_1.unavailableRuntime; } });
+Object.defineProperty(exports, "urlFor", { enumerable: true, get: function () { return harness_js_1.urlFor; } });
+//# sourceMappingURL=index.js.map

package/dist/packs/authz-bypass.pack.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The authorization-bypass pack (PLAN.md §15.2, §19).
+ *
+ * Every case here is an attack that works against a plausible implementation.
+ * They are collected in the kit rather than in `@nage-api/auth` so that anything
+ * else making an access decision — a realtime room policy, a driver's ownership
+ * scoping, a generated resource's guard — is held to the same standard.
+ *
+ * The harness is deliberately abstract: `attempt(credential, target)` returns
+ * whether access was granted. That reduces every authorization surface to the
+ * one question the pack cares about, and keeps the pack free of HTTP.
+ */
+import type { AuthUser } from '@nage-api/contracts';
+import type { Pack } from '../test-api.js';
+/** The outcome of one attempt. */
+export interface AttemptResult {
+    readonly allowed: boolean;
+    /** What the caller was told. Scanned for information disclosure. */
+    readonly message?: string;
+}
+export interface AuthzBypassHarness {
+    readonly name: string;
+    /** A principal that legitimately has access, for the control case. */
+    readonly authorised: AuthUser;
+    /** A principal that legitimately does not. */
+    readonly unauthorised: AuthUser;
+    /** What the authorised principal may reach. */
+    readonly target: string;
+    /**
+     * Attempt access. `undefined` means "no credential at all".
+     *
+     * Should resolve rather than throw; map a refusal to `{ allowed: false }` so
+     * the pack can inspect the message too.
+     */
+    attempt(principal: AuthUser | undefined, target: string): Promise<AttemptResult>;
+    /**
+     * A principal whose *claims* say they are authorised but whose stored record
+     * does not.
+     *
+     * Optional, because not every surface reads a store — but where one exists,
+     * this is the case that separates "checks the token" from "checks the truth".
+     *
+     * Supply this for a surface that re-derives grants from a store rather than
+     * reading them off the credential. The pack detects that shape and skips its
+     * look-alike cases there, because the grants it can vary are not the ones being
+     * compared — this case is what covers such a surface instead.
+     */
+    readonly forgedClaims?: AuthUser;
+    /** A target the unauthorised principal owns, if ownership applies. */
+    readonly ownTarget?: string;
+}
+export declare const describeAuthzBypass: Pack<AuthzBypassHarness>;
+//# sourceMappingURL=authz-bypass.pack.d.ts.map