@substrat-run/contract-tests 0.72.0 → 0.73.0

package/dist/entity-check-suite.d.ts

@@ -0,0 +1,102 @@
+import type { EntityRef } from '@substrat-run/contracts';
+/** What a vertical supplies so the kit can drive its operations. */
+export interface EntityCheckFixture {
+    /**
+     * Create one entity of this declared type and return its id.
+     *
+     * Called for each case, so every case gets a world nobody else has touched —
+     * the operation under test may well delete the thing it is given.
+     */
+    createEntity(entityType: string): Promise<string>;
+    /**
+     * Grant `permission` to the probe principal, narrowed to exactly this entity.
+     *
+     * Deliberately NOT the vertical's own sharing operation: using `share-list` to
+     * set up the test for `share-list` would prove only that it agrees with
+     * itself. Reach for the admin grant.
+     */
+    grantOnEntity(permission: string, entity: EntityRef): Promise<void>;
+    /** Invoke as the probe principal — the one holding only narrowed grants. */
+    invoke(operation: string, input: Record<string, unknown>): Promise<unknown>;
+    /**
+     * Is this error a permission denial? Defaults to `PermissionDenied`, which is
+     * what a stub throws; a fixture driving HTTP would test for its 403 instead.
+     */
+    isDenial?(error: unknown): boolean;
+}
+export interface EntityCheckSuiteOptions {
+    /**
+     * Extra input fields per operation, beyond the entity id the kit supplies.
+     *
+     * Only needed where the operation's schema has REQUIRED fields besides the id
+     * — the kit reads the schema to find out, so an operation taking nothing but
+     * an id needs no entry here.
+     */
+    readonly inputs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    /**
+     * Permissions an operation needs BEYOND the one it declares, granted on the
+     * same target entity — with the reason it needs them.
+     *
+     * The first vertical this kit ran against produced one immediately.
+     * `todo/share-list` declares `list:manage` and honours it, then calls
+     * `ctx.grant` to hand `list:contribute` to the invitee — and delegation only
+     * works for a permission the caller HOLDS. A principal granted `list:manage`
+     * alone is refused, correctly, by the second gate.
+     *
+     * So an operation's declared permission is the gate it opens with, not
+     * necessarily the whole authority it exercises. That gap is invisible in
+     * production here only because todo's bootstrap grant hands every owner both
+     * keys on their own entity, so nobody ever holds one without the other.
+     *
+     * `because` is required rather than a comment: this is the one place the gap
+     * gets written down, and an entry without a reason is indistinguishable from
+     * someone widening the grant until the test went green.
+     */
+    readonly alsoGrant?: Readonly<Record<string, {
+        readonly permissions: readonly string[];
+        readonly because: string;
+    }>>;
+    /**
+     * The in-scope operations this kit cannot generate, each with its reason.
+     *
+     * Asserted EXACTLY: an operation that becomes uncoverable, or one that stops
+     * being, fails until this list is updated. That is the point — it is the
+     * coverage gap made reviewable rather than invisible.
+     */
+    readonly uncovered?: Readonly<Record<string, string>>;
+}
+/** One operation the kit can drive, with the declaration it was read from. */
+export interface PlannedCheck {
+    readonly name: string;
+    readonly key: string;
+    readonly entity: string;
+    readonly idFrom: string;
+}
+/**
+ * Partition an operation set into what this kit can drive and what it cannot.
+ *
+ * Exported and pure so the classification is testable on its own. It is the part
+ * that decides what counts as covered, and a bug here is invisible in the worst
+ * way — it would drop an operation from the suite while every remaining test
+ * still passed.
+ *
+ * Out of scope entirely (neither covered nor uncovered): an operation with a
+ * bare-key node check, or one declaring `narrows`. Neither claims an entity
+ * check, so neither has one to honour.
+ */
+export declare function planEntityCheckCoverage(operations: Readonly<Record<string, object>>, inputs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>): {
+    covered: PlannedCheck[];
+    uncovered: Record<string, string>;
+};
+/**
+ * Generate the conformance pair for every operation declaring an entity check.
+ *
+ * ```ts
+ * entityCheckConformanceSuite('todo', todoOperations, makeFixture, {
+ *   inputs: { 'todo/rename-list': { name: 'renamed' } },
+ *   uncovered: { 'todo/set-item-done': 'resolved — the id is not in the input' },
+ * });
+ * ```
+ */
+export declare function entityCheckConformanceSuite(subjectName: string, operations: Readonly<Record<string, object>>, makeFixture: () => Promise<EntityCheckFixture>, options?: EntityCheckSuiteOptions): void;
+//# sourceMappingURL=entity-check-suite.d.ts.map

package/dist/entity-check-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-check-suite.d.ts","sourceRoot":"","sources":["../src/entity-check-suite.ts"],"names":[],"mappings":"AA6DA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGzD,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAC3B,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CACtF,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AA0CD,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAM,GACvE;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAuBhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,WAAW,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAC9C,OAAO,GAAE,uBAA4B,GACpC,IAAI,CAkGN"}

package/dist/entity-check-suite.js

@@ -0,0 +1,215 @@
+/**
+ * Does the HANDLER honour the entity check its operation DECLARED? (#747)
+ *
+ * #746 made an operation say what its permission checks against — `{ key,
+ * entity, idFrom }` for one entity, a bare key for the node. Nothing verified
+ * it. A declaration of `entity: 'list'` beside a handler calling
+ * `ctx.check(perm)` typechecks perfectly and fails open: everyone holding the
+ * key anywhere in the scope passes, which in a sharing app is every member
+ * against every record.
+ *
+ * This generates the behavioural pair that tells the two apart, from the
+ * declaration itself, for every operation that declares one.
+ *
+ * ## The two cases, and exactly what each one catches
+ *
+ * Both use a probe principal who holds the key ONLY through entity-narrowed
+ * grants — never scope-wide.
+ *
+ * **Case 1 — grant on A, invoke against A. Expect no denial.**
+ * A correct entity check resolves the grant on A and allows. A node check asks
+ * whether the principal holds the key at the scope, and a narrowed grant does
+ * not widen (`permission-suite`: *"No node-level access: the narrow grant does
+ * not widen"*), so it denies. **This is the case that catches the node-check
+ * bug** — and note which way round it fails: the broken implementation is MORE
+ * restrictive for this principal, so in the wild it surfaces as a baffling
+ * denial rather than as a breach. It is the direction nobody files a security
+ * bug about.
+ *
+ * **Case 2 — grant on A, invoke against B. Expect a denial.**
+ * The breach direction: a member reaching a record that is not theirs. Catches a
+ * handler that checks nothing, one that checks a constant entity, and one that
+ * reads the id from the wrong input field.
+ *
+ * **What case 2 does NOT catch, stated because a kit that overclaims is worse
+ * than no kit:** it does not catch the node-check bug. Against B the correct
+ * implementation denies, and so does the node check — for a different reason,
+ * with the same outcome. Only case 1 separates them. Neither case, on its own,
+ * is the test; the pair is.
+ *
+ * ## Why case 1 tolerates a non-permission failure
+ *
+ * It asserts "was not denied", not "succeeded". The harness supplies plausible
+ * input, not a valid domain state — `protocol/sign` on a fresh instance may
+ * legitimately refuse for a business reason. That refusal is not a permission
+ * answer and must not be read as one. Case 2 is the opposite and is strict: it
+ * demands a permission denial specifically, so a business error there is a
+ * FAILURE, not a pass. That strictness also pins the ordering the platform
+ * requires — the check is the operation's first line, so it answers before a
+ * not-found ever can.
+ *
+ * ## Nothing is skipped quietly
+ *
+ * An operation declaring `resolved` cannot be generated: the id is not in the
+ * input, so the harness has no way to reach the entity. An operation whose input
+ * needs required fields the caller did not supply cannot be generated either.
+ * Both are reported as UNCOVERED and asserted against a list the caller writes
+ * down, so losing coverage — switching an `idFrom` to a `resolved`, say — turns
+ * CI red and appears in the diff. A conformance kit that quietly covers the easy
+ * half reads as "checked" when it is not.
+ */
+import { describe, expect, it } from 'vitest';
+import { PermissionDenied } from '@substrat-run/kernel';
+/** An operation declaring an entity-narrowed check — the ones in scope here. */
+function entityCheckOf(op) {
+    const permission = op.permission;
+    if (!permission || typeof permission === 'string')
+        return undefined;
+    return permission.entity ? permission : undefined;
+}
+/**
+ * The input fields an operation REQUIRES, beyond the one carrying the entity id.
+ *
+ * Read off the schema rather than asked for: an operation taking only an id
+ * needs no fixture entry, and one that needs more says so precisely instead of
+ * failing later as a validation error the reader has to decode.
+ */
+function requiredExtras(op, idField) {
+    const shape = op.input?.shape;
+    if (!shape)
+        return [];
+    return Object.entries(shape)
+        .filter(([field]) => field !== idField)
+        .filter(([, schema]) => {
+        const parse = schema.safeParse;
+        // No `safeParse` means we cannot tell — treat it as required, because
+        // guessing "optional" is the answer that silently drops the operation.
+        return typeof parse !== 'function' || !parse.call(schema, undefined).success;
+    })
+        .map(([field]) => field);
+}
+/**
+ * Partition an operation set into what this kit can drive and what it cannot.
+ *
+ * Exported and pure so the classification is testable on its own. It is the part
+ * that decides what counts as covered, and a bug here is invisible in the worst
+ * way — it would drop an operation from the suite while every remaining test
+ * still passed.
+ *
+ * Out of scope entirely (neither covered nor uncovered): an operation with a
+ * bare-key node check, or one declaring `narrows`. Neither claims an entity
+ * check, so neither has one to honour.
+ */
+export function planEntityCheckCoverage(operations, inputs = {}) {
+    const covered = [];
+    const uncovered = {};
+    for (const [name, raw] of Object.entries(operations).sort(([a], [b]) => a.localeCompare(b))) {
+        const op = raw;
+        const check = entityCheckOf(op);
+        if (!check)
+            continue;
+        if (!check.idFrom) {
+            uncovered[name] =
+                `declares 'resolved' (${check.resolved ?? 'no reason given'}) — the entity id is not ` +
+                    'in the input, so the harness cannot reach the entity';
+            continue;
+        }
+        const missing = requiredExtras(op, check.idFrom).filter((f) => inputs[name]?.[f] === undefined);
+        if (missing.length > 0) {
+            uncovered[name] = `no sample input for required field(s): ${missing.join(', ')}`;
+            continue;
+        }
+        covered.push({ name, key: check.key, entity: check.entity, idFrom: check.idFrom });
+    }
+    return { covered, uncovered };
+}
+/**
+ * Generate the conformance pair for every operation declaring an entity check.
+ *
+ * ```ts
+ * entityCheckConformanceSuite('todo', todoOperations, makeFixture, {
+ *   inputs: { 'todo/rename-list': { name: 'renamed' } },
+ *   uncovered: { 'todo/set-item-done': 'resolved — the id is not in the input' },
+ * });
+ * ```
+ */
+export function entityCheckConformanceSuite(subjectName, operations, makeFixture, options = {}) {
+    const declaredUncovered = options.uncovered ?? {};
+    const supplied = options.inputs ?? {};
+    // Partitioned at collection time so the generated tests can be named.
+    const { covered, uncovered } = planEntityCheckCoverage(operations, supplied);
+    describe(`declared entity checks are honoured: ${subjectName}`, () => {
+        it('covers every entity check it can, and names every one it cannot', () => {
+            // The whole partition asserted at once. A new operation with an entity
+            // check joins `covered` silently (it is simply tested); one the kit cannot
+            // drive has to be written down here, where a reviewer sees it.
+            expect(uncovered).toEqual(declaredUncovered);
+        });
+        it('grants nothing extra to an operation it does not drive', () => {
+            // An `alsoGrant` entry naming an operation that is uncovered or absent is
+            // either a stale note or a grant widened against the wrong name. Both read
+            // as coverage that is not there.
+            const driven = new Set(covered.map((c) => c.name));
+            expect(Object.keys(options.alsoGrant ?? {}).filter((n) => !driven.has(n))).toEqual([]);
+        });
+        it('generated a pair for at least one operation', () => {
+            // A suite that generated nothing passes every assertion above it. This is
+            // the zero guard: silence must not read as success.
+            expect(covered.length).toBeGreaterThan(0);
+        });
+        for (const { name, key, entity, idFrom } of covered) {
+            describe(`${name} — ${key} on ${entity}, id from '${idFrom}'`, () => {
+                const extras = supplied[name] ?? {};
+                const extraKeys = options.alsoGrant?.[name]?.permissions ?? [];
+                /**
+                 * The declared key on the target, plus anything the operation needs to
+                 * delegate. All of them NARROWED to the one entity — never scope-wide,
+                 * which is what keeps case 1 able to catch a node check.
+                 */
+                const grantAllOn = async (fixture, entityId) => {
+                    const ref = { entityType: entity, entityId };
+                    await fixture.grantOnEntity(key, ref);
+                    for (const extra of extraKeys)
+                        await fixture.grantOnEntity(extra, ref);
+                };
+                const denialFrom = async (fixture, input) => {
+                    const isDenial = fixture.isDenial ?? ((e) => e instanceof PermissionDenied);
+                    try {
+                        await fixture.invoke(name, input);
+                        return undefined;
+                    }
+                    catch (error) {
+                        if (isDenial(error))
+                            return error;
+                        // Not a permission answer. Case 1 tolerates it; case 2 must not, so
+                        // it is handed back rather than swallowed.
+                        return { notADenial: error };
+                    }
+                };
+                it('allows a principal granted on THAT entity (the node-check catcher)', async () => {
+                    const fixture = await makeFixture();
+                    const target = await fixture.createEntity(entity);
+                    await grantAllOn(fixture, target);
+                    const outcome = await denialFrom(fixture, { ...extras, [idFrom]: target });
+                    const denied = outcome !== undefined && !outcome.notADenial;
+                    expect(denied, `${name} denied a principal holding ${key} on the very ${entity} it was ` +
+                        'invoked against — the handler is checking the node, not the entity').toBe(false);
+                });
+                it('denies the same principal against an entity they were NOT granted', async () => {
+                    const fixture = await makeFixture();
+                    // Granted somewhere, so the denial below is about THIS entity rather
+                    // than about a principal who holds nothing at all.
+                    const granted = await fixture.createEntity(entity);
+                    await grantAllOn(fixture, granted);
+                    const other = await fixture.createEntity(entity);
+                    const outcome = await denialFrom(fixture, { ...extras, [idFrom]: other });
+                    const notADenial = outcome?.notADenial;
+                    expect(outcome, `${name} allowed a principal to reach a ${entity} they hold no grant on`).toBeDefined();
+                    expect(notADenial, `${name} failed against an ungranted ${entity}, but not with a permission ` +
+                        'denial — the check must answer before anything else can').toBeUndefined();
+                });
+            });
+        }
+    });
+}
+//# sourceMappingURL=entity-check-suite.js.map

package/dist/entity-check-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-check-suite.js","sourceRoot":"","sources":["../src/entity-check-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiFxD,gFAAgF;AAChF,SAAS,aAAa,CAAC,EAAc;IACnC,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,EAAc,EAAE,OAAe;IACrD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE;QACrB,MAAM,KAAK,GAAI,MAA+D,CAAC,SAAS,CAAC;QACzF,sEAAsE;QACtE,uEAAuE;QACvE,OAAO,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC;IAC/E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAA4C,EAC5C,MAAM,GAAgE,EAAE;IAExE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,EAAE,GAAG,GAAiB,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,SAAS,CAAC,IAAI,CAAC;gBACb,wBAAwB,KAAK,CAAC,QAAQ,IAAI,iBAAiB,2BAA2B;oBACtF,sDAAsD,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,GAAG,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,UAA4C,EAC5C,WAA8C,EAC9C,OAAO,GAA4B,EAAE;IAErC,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IAEtC,sEAAsE;IACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE7E,QAAQ,CAAC,wCAAwC,WAAW,EAAE,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,uEAAuE;YACvE,2EAA2E;YAC3E,+DAA+D;YAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,0EAA0E;YAC1E,2EAA2E;YAC3E,iCAAiC;YACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,0EAA0E;YAC1E,oDAAoD;YACpD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACpD,QAAQ,CAAC,GAAG,IAAI,MAAM,GAAG,OAAO,MAAM,cAAc,MAAM,GAAG,EAAE,GAAG,EAAE;gBAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;gBAE/D;;;;mBAIG;gBACH,MAAM,UAAU,GAAG,KAAK,EAAE,OAA2B,EAAE,QAAgB,EAAE,EAAE;oBACzE,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;oBAC7C,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACtC,KAAK,MAAM,KAAK,IAAI,SAAS;wBAAE,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACzE,CAAC,CAAC;gBAEF,MAAM,UAAU,GAAG,KAAK,EACtB,OAA2B,EAC3B,KAA8B,EACA,EAAE;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,YAAY,gBAAgB,CAAC,CAAC;oBACrF,IAAI,CAAC;wBACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAClC,OAAO,SAAS,CAAC;oBACnB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,QAAQ,CAAC,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAClC,oEAAoE;wBACpE,2CAA2C;wBAC3C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;oBAC/B,CAAC;gBACH,CAAC,CAAC;gBAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;oBAClF,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAClD,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAElC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3E,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,IAAI,CAAE,OAAoC,CAAC,UAAU,CAAC;oBAC1F,MAAM,CACJ,MAAM,EACN,GAAG,IAAI,+BAA+B,GAAG,gBAAgB,MAAM,UAAU;wBACvE,oEAAoE,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;oBACjF,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;oBACpC,qEAAqE;oBACrE,mDAAmD;oBACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAEjD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1E,MAAM,UAAU,GAAI,OAAgD,EAAE,UAAU,CAAC;oBACjF,MAAM,CACJ,OAAO,EACP,GAAG,IAAI,mCAAmC,MAAM,wBAAwB,CACzE,CAAC,WAAW,EAAE,CAAC;oBAChB,MAAM,CACJ,UAAU,EACV,GAAG,IAAI,gCAAgC,MAAM,8BAA8B;wBACzE,yDAAyD,CAC5D,CAAC,aAAa,EAAE,CAAC;gBACpB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export { scopeHostContractSuite } from './scope-host-suite.js';
 export type { ScopeHostFixture, ScopeHostSuiteOptions } from './scope-host-suite.js';
 export { permissionContractSuite } from './permission-suite.js';
 export { scheduleContractSuite } from './schedule-suite.js';
+export { entityCheckConformanceSuite, planEntityCheckCoverage } from './entity-check-suite.js';
+export type { EntityCheckFixture, EntityCheckSuiteOptions, PlannedCheck } from './entity-check-suite.js';
 export { billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, scheduleMod, } from './modules.js';
 export { connectorCalls, connectorTestFetch, resetConnectorCalls, type ConnectorCall, } from './connector-fixture.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { scopeHostContractSuite } from './scope-host-suite.js';
 export { permissionContractSuite } from './permission-suite.js';
 export { scheduleContractSuite } from './schedule-suite.js';
+export { entityCheckConformanceSuite, planEntityCheckCoverage } from './entity-check-suite.js';
 export { billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, scheduleMod, } from './modules.js';
 export { connectorCalls, connectorTestFetch, resetConnectorCalls, } from './connector-fixture.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAE/F,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contract-tests",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "description": "The suite every scope-host adapter must pass, forever (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,18 +22,24 @@
     "dist"
   ],
   "dependencies": {
-    "vitest": "^3.0.0",
-    "@substrat-run/contracts": "^0.72.0",
-    "@substrat-run/kernel": "^0.72.0"
+    "vitest": "^3.2.7",
+    "@substrat-run/kernel": "^0.73.0",
+    "@substrat-run/contracts": "^0.73.0"
   },
   "devDependencies": {
-    "typescript": "^7.0.0"
+    "@types/node": "^22.0.0",
+    "typescript": "^7.0.0",
+    "zod": "^4.4.3"
   },
   "publishConfig": {
     "access": "public"
   },
+  "peerDependencies": {
+    "zod": "^4.4.0"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run"
   }
 }