@substrat-run/contract-tests 0.87.0 → 0.89.0

package/dist/concurrency-suite.d.ts

@@ -0,0 +1,3 @@
+import type { ScopeHostFixture } from './scope-host-suite.js';
+export declare function concurrencyContractSuite(adapterName: string, makeFixture: () => Promise<ScopeHostFixture>): void;
+//# sourceMappingURL=concurrency-suite.d.ts.map

package/dist/concurrency-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-suite.d.ts","sourceRoot":"","sources":["../src/concurrency-suite.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAK9D,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC3C,IAAI,CAgPN"}

package/dist/concurrency-suite.js

@@ -0,0 +1,228 @@
+/**
+ * Contract suite for optimistic concurrency — `If-Match` and the 412 (#129).
+ *
+ * What it pins: **the comparison belongs to the HOST, and it happens inside the
+ * write's own transaction.** Everything else about this feature is a projection.
+ * The header names are a wire detail `vertical-host` owns, the declaration is a
+ * model detail `contracts` owns, and neither is what makes a write safe — that is
+ * this: a version read and a write committed with nothing able to interleave.
+ *
+ * Behavioural, for the reason the entity-version suite gives one screen over: an
+ * adapter that reads correctly can still be wrong against a real database, and a
+ * string comparison on the emitted SQL would call it a pass. So every case here
+ * provisions a real scope, commits real writes, and asks a real question.
+ *
+ * The cases that matter are not the happy path:
+ *
+ * - **A refused write leaves nothing behind.** The precondition runs before the
+ *   guards and before the handler, so a 412 must not be a partial write with an
+ *   error attached.
+ * - **An `If-Match` on an operation that declares nothing is REFUSED.** Ignoring
+ *   it would leave a caller believing its write was serialised when nothing was
+ *   compared — the failure this whole mechanism exists to prevent, arrived at
+ *   through the mechanism itself.
+ * - **A guarded write that emits nothing does not move the tag.** The documented
+ *   hole, pinned here so it stays a known property of the spine rather than
+ *   something an adapter is tempted to paper over by fabricating a version.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { etagOf, permissionKey, platformActorId, principalId, scopeId, tenantId, errorCodeOf, } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { concurrencyMod } from './modules.js';
+const CONC_USE = permissionKey.parse('conc:use');
+export function concurrencyContractSuite(adapterName, makeFixture) {
+    describe(`optimistic concurrency (If-Match): ${adapterName}`, () => {
+        let fixture;
+        let host;
+        let stub;
+        /** Every tag the host reported, newest last — the `ETag` an HTTP layer would set. */
+        let tags = [];
+        const t1 = tenantId.parse(ulid());
+        const s1 = scopeId.parse(ulid());
+        const alice = principalId.parse(ulid());
+        const staff = platformActorId.parse(ulid());
+        /** The version the host last reported — what a client would be holding. */
+        const lastTag = () => {
+            const version = tags.at(-1);
+            if (typeof version !== 'string')
+                throw new Error('no version was reported');
+            return version;
+        };
+        /**
+         * The reply channel an HTTP mount supplies, collected rather than overwritten
+         * so a case can assert a version was NOT reported as easily as that one was.
+         */
+        const sink = { onEntityVersion: (version) => tags.push(version) };
+        const update = (thingId, label, ifMatch) => stub.invoke('conc/update', { thingId, label }, { ...sink, ...(ifMatch === undefined ? {} : { ifMatch }) });
+        const read = (thingId, ifMatch) => stub.invoke('conc/read', { thingId }, { ...sink, ...(ifMatch === undefined ? {} : { ifMatch }) });
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            host.registerModule(concurrencyMod);
+            await host.admin.createTenant(staff, { id: t1, slug: 'conc-tenant', name: 'Conc Tenant' });
+            await host.admin.grantEntitlement(staff, t1, 'conc');
+            await host.admin.defineRole(staff, t1, {
+                key: 'conc-admin',
+                permissions: [CONC_USE],
+                source: 'vertical',
+            });
+            await host.admin.assignRole(staff, {
+                principalId: alice,
+                roleKey: 'conc-admin',
+                node: { tenantId: t1, scopeId: null },
+            });
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s1, vertical: 'conc-vertical' });
+            await host.admin.activateScope(staff, t1, s1);
+            stub = await host.getScope(alice, t1, s1);
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        it('reports a version for a guarded operation, and none for an unguarded one', async () => {
+            tags = [];
+            await stub.invoke('conc/unguarded', { thingId: 'u1' }, sink);
+            // Nothing declared, nothing read: an operation that opted out must not pay
+            // for a spine query on every invocation.
+            expect(tags).toEqual([]);
+            await read(`t-${ulid()}`);
+            expect(tags).toHaveLength(1);
+        });
+        it('answers a never-written entity with a null version', async () => {
+            tags = [];
+            await read(`t-${ulid()}`);
+            // Absence, not a throw. A read is how a client learns there is nothing to
+            // hold a tag for yet, which is what makes the create-vs-update distinction
+            // visible to it at all.
+            expect(tags).toEqual([null]);
+        });
+        it('admits a write whose tag is current, and hands back the one it created', async () => {
+            const id = `t-${ulid()}`;
+            tags = [];
+            await update(id, 'first');
+            const afterFirst = lastTag();
+            expect(afterFirst).not.toBeNull();
+            await update(id, 'second', etagOf(afterFirst));
+            const afterSecond = lastTag();
+            // The tag returned describes the row as THIS write left it — not as the
+            // caller found it. A client that echoes what it sent would loop forever on
+            // its own stale value.
+            expect(afterSecond).not.toBe(afterFirst);
+            expect(afterSecond > afterFirst).toBe(true);
+        });
+        it('refuses a write whose tag has moved, with `precondition_failed`', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const stale = etagOf(lastTag());
+            // A concurrent writer lands between the read and the write.
+            await update(id, 'from the other tab');
+            await expect(update(id, 'from the stale tab', stale)).rejects.toSatisfy((err) => errorCodeOf(err) === 'precondition_failed');
+        });
+        it('leaves nothing behind when it refuses', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const stale = etagOf(lastTag());
+            await update(id, 'second');
+            const beforeRefusal = lastTag();
+            tags = [];
+            await expect(update(id, 'never lands', stale)).rejects.toThrow();
+            // Two halves of one claim. The row still holds what the winning write left
+            // — the refused handler never ran, so it wrote nothing to roll back — and
+            // no tag was reported, because a version that did not survive its
+            // transaction is not one any client may hold.
+            expect(tags).toEqual([]);
+            await read(id);
+            expect(lastTag()).toBe(beforeRefusal);
+        });
+        it('refuses `If-Match` against an entity that has no version yet', async () => {
+            // Nothing has ever been emitted about this id, so there is no version and
+            // nothing the caller could legitimately be holding. Admitting it because
+            // "there is nothing to conflict with" would make a tag from a rolled-back
+            // write — or from another entity entirely — a free pass.
+            await expect(update(`t-${ulid()}`, 'x', etagOf(ulid()))).rejects.toSatisfy((err) => errorCodeOf(err) === 'precondition_failed');
+        });
+        it('honours `If-Match: *` as "must already exist"', async () => {
+            const id = `t-${ulid()}`;
+            // RFC 9110 §13.1.1: `*` means any current representation. For us that is
+            // "has a version at all", which makes it the update-only guard — the
+            // counterpart to `If-None-Match: *` for create-only.
+            await expect(update(id, 'first', '*')).rejects.toSatisfy((err) => errorCodeOf(err) === 'precondition_failed');
+            await update(id, 'first');
+            await expect(update(id, 'second', '*')).resolves.toBeDefined();
+        });
+        it('accepts a tag from a comma-separated list, and never a weak one', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const current = lastTag();
+            // A list is the client saying "any of these will do" — §13.1.1 permits it,
+            // and a client that has followed a redirect legitimately holds two.
+            await expect(update(id, 'second', `"${ulid()}", ${etagOf(current)}`)).resolves.toBeDefined();
+            // A weak validator means "semantically equivalent", which is a judgement no
+            // generic layer is entitled to make about a domain entity. §13.1.1 requires
+            // the strong comparison for `If-Match`, so this must refuse.
+            await expect(update(id, 'third', `W/${etagOf(lastTag())}`)).rejects.toSatisfy((err) => errorCodeOf(err) === 'precondition_failed');
+        });
+        it('refuses `If-Match` on an operation that declares no concurrency', async () => {
+            // The whole point of refusing rather than ignoring. A caller sending this
+            // believes its write is serialised; a 200 would leave that belief intact
+            // while nothing was compared. It is not a `precondition_failed` — the
+            // precondition was never evaluated — it is a caller error.
+            await expect(stub.invoke('conc/unguarded', { thingId: 'u1' }, { ifMatch: etagOf(ulid()) })).rejects.toThrow(/declares no `concurrency`/);
+        });
+        it('refuses a guarded operation whose id field the caller omitted', async () => {
+            // `conc/keyless` declares `idFrom: 'thingId'` over an optional field. There
+            // is no row to read, so there is nothing to compare — and skipping the
+            // comparison is indistinguishable from passing it.
+            await expect(stub.invoke('conc/keyless', {}, { ifMatch: '*' })).rejects.toThrow(/carries no such id/);
+        });
+        it('answers a permission denial ahead of the precondition', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const stale = etagOf(lastTag());
+            await update(id, 'moved');
+            // `conc/forbidden` checks a key nobody holds. The caller's tag is stale, so
+            // BOTH refusals apply — and the one that must win is the permission.
+            //
+            // The other order makes a guarded operation a version oracle: a principal
+            // with no permission on the entity sends `If-Match: *` and learns whether it
+            // exists, or sends a tag and learns whether it has changed, all without ever
+            // being allowed to read it. The precondition therefore snapshots the version
+            // before the handler and compares AFTER it, so the handler's own
+            // `assertAllowed` is what answers first.
+            //
+            // Found by driving Callout's two-dispatcher scenario over real HTTP as a
+            // principal who lacked `facility:manage`: it answered 412 where it owed 403.
+            await expect(stub.invoke('conc/forbidden', { thingId: id }, { ...sink, ifMatch: stale })).rejects.toSatisfy((err) => errorCodeOf(err) === 'permission_denied');
+        });
+        it('does not move the tag for a guarded write that emits nothing', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const before = lastTag();
+            await stub.invoke('conc/silent', { thingId: id, label: 'quietly changed' }, { ...sink, ifMatch: etagOf(before) });
+            // The documented hole, and the reason `assertConcurrencyMovesVersion`
+            // exists in the model layer rather than here. The write landed, the version
+            // did not move, and the stale tag is still accepted:
+            expect(lastTag()).toBe(before);
+            await expect(stub.invoke('conc/silent', { thingId: id, label: 'again' }, { ...sink, ifMatch: etagOf(before) })).resolves.toBeDefined();
+            // An adapter must NOT try to fix this by inventing a version. The spine
+            // records what was announced; a host that fabricated a tag here would be
+            // reporting a change no consumer, projection or audit ever saw.
+        });
+        it('serialises two writers who both hold the same tag', async () => {
+            const id = `t-${ulid()}`;
+            await update(id, 'first');
+            const shared = etagOf(lastTag());
+            // The scenario in one assertion: both read, both submit, and exactly one
+            // may land. Invokes are serialised per scope, so this pins the OUTCOME —
+            // that the second is refused on the version rather than admitted by an
+            // ordering accident — rather than pretending to test parallelism.
+            const results = await Promise.allSettled([
+                update(id, 'writer A', shared),
+                update(id, 'writer B', shared),
+            ]);
+            expect(results.filter((r) => r.status === 'fulfilled')).toHaveLength(1);
+            const refused = results.find((r) => r.status === 'rejected');
+            expect(errorCodeOf(refused.reason)).toBe('precondition_failed');
+        });
+    });
+}
+//# sourceMappingURL=concurrency-suite.js.map

package/dist/concurrency-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-suite.js","sourceRoot":"","sources":["../src/concurrency-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,MAAM,EACN,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,EACR,WAAW,GAEZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAkC,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAEjD,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,WAA4C;IAE5C,QAAQ,CAAC,sCAAsC,WAAW,EAAE,EAAE,GAAG,EAAE;QACjE,IAAI,OAAyB,CAAC;QAC9B,IAAI,IAAe,CAAC;QACpB,IAAI,IAAe,CAAC;QACpB,qFAAqF;QACrF,IAAI,IAAI,GAAsB,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,2EAA2E;QAC3E,MAAM,OAAO,GAAG,GAAW,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5E,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF;;;WAGG;QACH,MAAM,IAAI,GAAG,EAAE,eAAe,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,OAAgB,EAAE,EAAE,CAClE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAgB,EAAE,EAAE,CACjD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAEpG,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE;gBACrC,GAAG,EAAE,YAAY;gBACjB,WAAW,EAAE,CAAC,QAAQ,CAAC;gBACvB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;gBACjC,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;YACxF,IAAI,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7D,2EAA2E;YAC3E,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAEzB,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,IAAI,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,0EAA0E;YAC1E,2EAA2E;YAC3E,wBAAwB;YACxB,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,IAAI,GAAG,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAElC,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;YAC9B,wEAAwE;YACxE,2EAA2E;YAC3E,uBAAuB;YACvB,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAEhC,4DAA4D;YAC5D,MAAM,MAAM,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAEvC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CACrE,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,qBAAqB,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3B,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC;YAEhC,IAAI,GAAG,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAEjE,2EAA2E;YAC3E,0EAA0E;YAC1E,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CACxE,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,qBAAqB,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,yEAAyE;YACzE,qEAAqE;YACrE,qDAAqD;YACrD,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CACtD,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,qBAAqB,CAC7D,CAAC;YACF,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;YAE1B,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAE7F,4EAA4E;YAC5E,4EAA4E;YAC5E,6DAA6D;YAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAC3E,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,qBAAqB,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,MAAM,CACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,4EAA4E;YAC5E,uEAAuE;YACvE,mDAAmD;YACnD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7E,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAE1B,4EAA4E;YAC5E,qEAAqE;YACrE,EAAE;YACF,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,6EAA6E;YAC7E,iEAAiE;YACjE,yCAAyC;YACzC,EAAE;YACF,yEAAyE;YACzE,6EAA6E;YAC7E,MAAM,MAAM,CACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5E,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;YAEzB,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAElH,sEAAsE;YACtE,4EAA4E;YAC5E,qDAAqD;YACrD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,MAAM,CACV,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAClG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,wEAAwE;YACxE,yEAAyE;YACzE,gEAAgE;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAEjC,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC;gBAC9B,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAA0B,CAAC;YACtF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/conformance.d.ts

@@ -0,0 +1,85 @@
+/**
+ * What a package CLAIMS about its entity checks, in one importable object (#866).
+ *
+ * The conformance kit next door proves a handler honours the check its operation
+ * declared. That proof runs inside vitest and vanishes with the process. The
+ * trust page kernel-design §11.2 committed to — *"the §10 table above, run
+ * adversarially; results published"* — needs the same facts at emit time, and a
+ * tool cannot import a test file: its top-level `describe` throws outside a
+ * runner.
+ *
+ * So the claim moves out of the test and into `test/conformance.ts`, which the
+ * test file and `tools/conformance-emit.mts` both import. That is the whole
+ * design, and the reason for it is the one PERMISSIONS.md is built on: an
+ * artifact rendered from a SECOND copy of the facts is an artifact that can
+ * disagree with what runs. Here it cannot — `planEntityCheckCoverage` is handed
+ * the same `inputs` and `refEntityType` the suite is driven with, so the
+ * covered/uncovered partition in `CONFORMANCE.md` is the partition the suite
+ * asserts, by construction.
+ *
+ * ## Three kinds, because there are three strengths of evidence
+ *
+ * A report that renders all three as "assessed" would be the overclaim this
+ * whole thread exists to avoid. They are not equal:
+ *
+ *  - `driven` — the operation set is declared AND the pair runs against the
+ *    handler. A wrong implementation fails. This is evidence.
+ *  - `declared` — the operation set is declared and its plan is empty: nothing
+ *    narrows, and the declaration is what says so. Nothing is driven because
+ *    there is nothing to drive, and the day an operation narrows, the plan stops
+ *    being empty and the assertion goes red.
+ *  - `asserted` — there is no declared operation set, so the claim is a lexical
+ *    tripwire over the module's own source (`nodeOnlySuite`). It proves an
+ *    absence on the obvious path and nothing more. Weakest of the three, and the
+ *    report says so rather than letting a reader assume otherwise.
+ *
+ * The kind is stamped by the helper rather than written by the caller: a package
+ * cannot label itself `driven` without handing over an operation registry.
+ */
+import type { EntityCheckSuiteOptions } from './entity-check-plan.js';
+/** Common to all three: who is claiming, and the prose a reviewer reads. */
+interface ConformanceBase {
+    /** The name the suite registers under — `'meridian'`, `'engine-booking'`. */
+    readonly subject: string;
+    /**
+     * Why this claim is the right one, in the author's own words.
+     *
+     * Required on the two node-only kinds and optional on `driven`, for the same
+     * reason `alsoGrant.because` is required: an assessment with no reasoning is
+     * indistinguishable from nobody having thought about it. The emitter prints it
+     * verbatim, so it is written for a reader outside the repo.
+     */
+    readonly because?: string;
+}
+/** A package whose declared entity checks are driven by the conformance kit. */
+export interface DrivenConformance extends ConformanceBase, EntityCheckSuiteOptions {
+    readonly kind: 'driven';
+    /** The declared operation set — the same object the suite and the host read. */
+    readonly operations: Readonly<Record<string, object>>;
+}
+/** A package with a declared operation set that narrows nowhere. */
+export interface DeclaredNodeOnlyConformance extends ConformanceBase {
+    readonly kind: 'declared';
+    readonly operations: Readonly<Record<string, object>>;
+    readonly because: string;
+}
+/** A package with no declared operation set, claiming node-only lexically. */
+export interface AssertedNodeOnlyConformance extends ConformanceBase {
+    readonly kind: 'asserted';
+    /** Absolute paths to the module source the claim covers. */
+    readonly sources: readonly string[];
+    readonly because: string;
+}
+export type ConformanceDeclaration = DrivenConformance | DeclaredNodeOnlyConformance | AssertedNodeOnlyConformance;
+/**
+ * Declare a driven surface. The result IS an `EntityCheckSuiteOptions`, so the
+ * test passes this same object straight through as the suite's options — there
+ * is no second place for `inputs` or `uncovered` to live and drift.
+ */
+export declare function declareEntityChecks(d: Omit<DrivenConformance, 'kind'>): DrivenConformance;
+/** Declare a node-only surface whose emptiness the DECLARATION establishes. */
+export declare function declareNodeOnly(d: Omit<DeclaredNodeOnlyConformance, 'kind'>): DeclaredNodeOnlyConformance;
+/** Declare a node-only surface established only by a tripwire over source. */
+export declare function assertNodeOnly(d: Omit<AssertedNodeOnlyConformance, 'kind'>): AssertedNodeOnlyConformance;
+export {};
+//# sourceMappingURL=conformance.d.ts.map

package/dist/conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.d.ts","sourceRoot":"","sources":["../src/conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,4EAA4E;AAC5E,UAAU,eAAe;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAkB,SAAQ,eAAe,EAAE,uBAAuB;IACjF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AAED,oEAAoE;AACpE,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,2BAA2B,GAC3B,2BAA2B,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GACjC,iBAAiB,CAEnB;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,GAC3C,2BAA2B,CAE7B;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAC5B,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,GAC3C,2BAA2B,CAE7B"}

package/dist/conformance.js

@@ -0,0 +1,17 @@
+/**
+ * Declare a driven surface. The result IS an `EntityCheckSuiteOptions`, so the
+ * test passes this same object straight through as the suite's options — there
+ * is no second place for `inputs` or `uncovered` to live and drift.
+ */
+export function declareEntityChecks(d) {
+    return { ...d, kind: 'driven' };
+}
+/** Declare a node-only surface whose emptiness the DECLARATION establishes. */
+export function declareNodeOnly(d) {
+    return { ...d, kind: 'declared' };
+}
+/** Declare a node-only surface established only by a tripwire over source. */
+export function assertNodeOnly(d) {
+    return { ...d, kind: 'asserted' };
+}
+//# sourceMappingURL=conformance.js.map

package/dist/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.js","sourceRoot":"","sources":["../src/conformance.ts"],"names":[],"mappings":"AAkFA;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,CAAkC;IAElC,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,CAA4C;IAE5C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAC5B,CAA4C;IAE5C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC"}

package/dist/entity-check-plan.d.ts

@@ -0,0 +1,138 @@
+/**
+ * The pure half of the conformance kit: what CAN be driven, and what cannot.
+ *
+ * Split out of `entity-check-suite.ts` so the classification is reachable
+ * without a test runner (#866). The suite next door imports `vitest` at module
+ * load, which makes it unimportable outside vitest — and the trust-page emitter
+ * (`tools/conformance-emit.mts`) needs exactly this partition and none of the
+ * assertions. The suite's own note already said why this belongs on its own:
+ * *"Exported and pure so the classification is testable on its own. It is the
+ * part that decides what counts as covered, and a bug here is invisible in the
+ * worst way."*
+ *
+ * Nothing here imports a runner, a host or a filesystem. It reads a declared
+ * operation set and returns two lists.
+ */
+import type { EntityRef } from '@substrat-run/contracts';
+/** What a vertical supplies so the kit can drive its operations. */
+export interface EntityCheckFixture {
+    /**
+     * Create one entity of this declared type and return its id.
+     *
+     * Called for each case, so every case gets a world nobody else has touched —
+     * the operation under test may well delete the thing it is given.
+     */
+    createEntity(entityType: string): Promise<string>;
+    /**
+     * Grant `permission` to the probe principal, narrowed to exactly this entity.
+     *
+     * Deliberately NOT the vertical's own sharing operation: using `share-list` to
+     * set up the test for `share-list` would prove only that it agrees with
+     * itself. Reach for the admin grant.
+     */
+    grantOnEntity(permission: string, entity: EntityRef): Promise<void>;
+    /** Invoke as the probe principal — the one holding only narrowed grants. */
+    invoke(operation: string, input: Record<string, unknown>): Promise<unknown>;
+    /**
+     * Is this error a permission denial? Defaults to `PermissionDenied`, which is
+     * what a stub throws; a fixture driving HTTP would test for its 403 instead.
+     */
+    isDenial?(error: unknown): boolean;
+}
+export interface EntityCheckSuiteOptions {
+    /**
+     * Extra input fields per operation, beyond the entity id the kit supplies.
+     *
+     * Only needed where the operation's schema has REQUIRED fields besides the id
+     * — the kit reads the schema to find out, so an operation taking nothing but
+     * an id needs no entry here.
+     */
+    readonly inputs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    /**
+     * Permissions an operation needs BEYOND the one it declares, granted on the
+     * same target entity — with the reason it needs them.
+     *
+     * The first vertical this kit ran against produced one immediately.
+     * `todo/share-list` declares `list:manage` and honours it, then calls
+     * `ctx.grant` to hand `list:contribute` to the invitee — and delegation only
+     * works for a permission the caller HOLDS. A principal granted `list:manage`
+     * alone is refused, correctly, by the second gate.
+     *
+     * So an operation's declared permission is the gate it opens with, not
+     * necessarily the whole authority it exercises. That gap is invisible in
+     * production here only because todo's bootstrap grant hands every owner both
+     * keys on their own entity, so nobody ever holds one without the other.
+     *
+     * `because` is required rather than a comment: this is the one place the gap
+     * gets written down, and an entry without a reason is indistinguishable from
+     * someone widening the grant until the test went green.
+     */
+    readonly alsoGrant?: Readonly<Record<string, {
+        readonly permissions: readonly string[];
+        readonly because: string;
+    }>>;
+    /**
+     * The in-scope operations this kit cannot generate, each with its reason.
+     *
+     * Asserted EXACTLY: an operation that becomes uncoverable, or one that stops
+     * being, fails until this list is updated. That is the point — it is the
+     * coverage gap made reviewable rather than invisible.
+     */
+    readonly uncovered?: Readonly<Record<string, string>>;
+    /**
+     * The entity type to drive a `refFrom` check with (#896).
+     *
+     * An engine narrowing to a ref the caller supplies whole has no type of its own
+     * to name — that is the shape, not a gap in it. So the HARNESS names one and
+     * `createEntity` makes it. Which type is deliberately not the engine's
+     * business: an engine promising to honour whatever noun it is handed should not
+     * care which one a test picked, and if it does care, that is the finding.
+     *
+     * Needed only where the operation set holds a `refFrom` check. Without it those
+     * operations are reported as uncovered — never silently skipped.
+     */
+    readonly refEntityType?: string;
+}
+/** One operation the kit can drive, with the declaration it was read from. */
+export interface PlannedCheck {
+    readonly name: string;
+    readonly key: string;
+    readonly entity: string;
+    /**
+     * Where the kit writes the target into the input.
+     *
+     * `{ kind: 'id' }` writes the bare id at `path` — the `idFrom` case. `{ kind:
+     * 'ref' }` writes the whole `{ entityType, entityId }` there instead, which is
+     * the `refFrom` case (#896); `path` may then be two segments, for a ref that
+     * travels inside a larger object.
+     */
+    readonly target: {
+        readonly kind: 'id' | 'ref';
+        readonly path: readonly string[];
+    };
+    /** Input fields the schema fixes to one value, supplied by the kit (#890). */
+    readonly fixed: Record<string, unknown>;
+}
+/**
+ * Partition an operation set into what this kit can drive and what it cannot.
+ *
+ * Exported and pure so the classification is testable on its own. It is the part
+ * that decides what counts as covered, and a bug here is invisible in the worst
+ * way — it would drop an operation from the suite while every remaining test
+ * still passed.
+ *
+ * Out of scope entirely (neither covered nor uncovered): an operation with a
+ * bare-key node check, or one declaring `narrows`. Neither claims an entity
+ * check, so neither has one to honour.
+ *
+ * An `entityFrom` operation appears ONCE PER ADMISSIBLE TYPE (#890) — the pair is
+ * what tells a correct check from a node check, and it is worth no less for the
+ * second type than for the first. So `callout/timeline` is driven twice, over a
+ * work order and over a protocol, and a handler that honoured the check for one
+ * and not the other has nowhere left to hide.
+ */
+export declare function planEntityCheckCoverage(operations: Readonly<Record<string, object>>, inputs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>, refEntityType?: string): {
+    covered: PlannedCheck[];
+    uncovered: Record<string, string>;
+};
+//# sourceMappingURL=entity-check-plan.d.ts.map

package/dist/entity-check-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-check-plan.d.ts","sourceRoot":"","sources":["../src/entity-check-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAC3B,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CACtF,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AA8FD,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACnF,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAM,EACxE,aAAa,CAAC,EAAE,MAAM,GACrB;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CA4FhE"}