@suluk/testgen 0.1.0

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@suluk/testgen",
+  "version": "0.1.0",
+  "description": "Generate a DETERMINISTIC conformance test suite from a v4 'Suluk' contract — the executable form of the contract's claims. Asserts the SERVER ENFORCES x-suluk-access on the real wire (anon rejected on non-public ops; public ops reachable), smoke-tests declared statuses, validates 2xx bodies against their declared schemas, and checks every declared cost is well-formed. A pure function of the document — same contract in, same suite out, no network at generate-time. CANDIDATE tooling.",
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MahmoodKhalil57/suluk.git",
+    "directory": "tooling/ts/packages/testgen"
+  },
+  "homepage": "https://github.com/MahmoodKhalil57/suluk#readme",
+  "bugs": "https://github.com/MahmoodKhalil57/suluk/issues",
+  "type": "module",
+  "main": "src/index.ts",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "dependencies": {
+    "@suluk/core": "^0.1.7"
+  },
+  "peerDependencies": {
+    "@cfworker/json-schema": "^4.1.1"
+  },
+  "peerDependenciesMeta": {
+    "@cfworker/json-schema": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@suluk/stripe": "^0.1.2"
+  },
+  "scripts": {
+    "test": "bun test",
+    "typecheck": "tsc --noEmit -p ."
+  }
+}

package/src/generate.ts

@@ -0,0 +1,181 @@
+/**
+ * Generate a DETERMINISTIC conformance test suite from a v4 "Suluk" document — the contract's claims made
+ * EXECUTABLE (council whuovh6gs, L2; the executable form of the C022 access subset-checker). The generated suite,
+ * run against a deployment, asserts:
+ *   • ACCESS ENFORCEMENT, on the REAL WIRE (the ceiling-raiser): the server actually enforces x-suluk-access — anon
+ *     gets NO success on a non-public op; a public op is NOT auth-blocked for anon. x-suluk-access is used only as
+ *     the EXPECTATION; the test passes iff the WIRE agrees with it. It never asserts over a projection, and never
+ *     treats the facet as if it were the enforcement (C022 inv.3).
+ *   • STATUS SMOKE + SCHEMA CONFORMANCE (L1): a public, parameter-free GET returns a declared status, and its 2xx
+ *     body validates against the declared response schema (same generic engine the SDK uses).
+ *   • COST DECLARED (L2, static): every op that prices itself declares a WELL-FORMED x-suluk-cost — never a literal
+ *     µ$ amount (that couples tests to billing internals and goes flaky).
+ * A pure function of the document: same contract in, same suite out, NO network at generate-time. Each op's tests
+ * are LABELLED with its provenance (x-suluk-source) so a failure points at the authoring source.
+ */
+import type { OpenAPIv4Document, SulukSource } from "@suluk/core";
+
+interface AccessFacet { requires?: string; scope?: string }
+interface CostModel { estimateMicroUsd?: number; components?: { microUsd?: number }[] }
+interface RawReq {
+  method: string; summary?: string; contentSchema?: unknown;
+  parameterSchema?: { path?: unknown; query?: unknown; body?: unknown };
+  responses?: Record<string, { status: string | number; contentSchema?: unknown }>;
+  ["x-suluk-cost"]?: CostModel; ["x-suluk-access"]?: AccessFacet; ["x-suluk-source"]?: SulukSource;
+}
+interface OpInfo {
+  name: string; method: string; uri: string; filledPath: string; requires: string;
+  declaredStatuses: number[]; okSchema?: unknown; cost: number | null; source?: SulukSource;
+  hasBody: boolean; paramFree: boolean;
+}
+
+const fillPath = (uri: string) => ("/" + uri.replace(/^\/+/, "")).replace(/\{\+?([^}?&]+)\}/g, "1");
+const requiredKeys = (s: unknown): string[] => (s && typeof s === "object" && Array.isArray((s as { required?: unknown }).required) ? ((s as { required: string[] }).required) : []);
+function costOf(req: RawReq): number | null {
+  const c = req["x-suluk-cost"]; if (!c) return null;
+  return c.estimateMicroUsd ?? (c.components ?? []).reduce((s, x) => s + Number(x.microUsd ?? 0), 0);
+}
+
+function walkOps(doc: OpenAPIv4Document): OpInfo[] {
+  const ops: OpInfo[] = [];
+  for (const [uri, piRaw] of Object.entries(doc.paths ?? {})) {
+    const pi = piRaw as { requests?: Record<string, RawReq> };
+    for (const [name, req] of Object.entries(pi.requests ?? {})) {
+      const method = req.method.toUpperCase();
+      const ps = req.parameterSchema ?? {};
+      const statuses = Object.values(req.responses ?? {}).map((r) => Number(r.status)).filter((n) => Number.isFinite(n));
+      const ok = Object.values(req.responses ?? {}).find((r) => String(r.status).startsWith("2") && r.contentSchema != null);
+      const hasPathParam = /\{/.test(uri);
+      const reqQuery = requiredKeys(ps.query);
+      ops.push({
+        name, method, uri, filledPath: fillPath(uri),
+        requires: req["x-suluk-access"]?.requires ?? "anyone",
+        declaredStatuses: [...new Set(statuses)].sort((a, b) => a - b),
+        okSchema: ok?.contentSchema, cost: costOf(req), source: req["x-suluk-source"],
+        hasBody: req.contentSchema != null || ps.body != null,
+        paramFree: method === "GET" && !hasPathParam && reqQuery.length === 0,
+      });
+    }
+  }
+  return ops.sort((a, b) => (a.uri + a.name).localeCompare(b.uri + b.name));
+}
+
+// Embed a response schema as a self-contained literal: splice components in as $defs + rewrite pointers, so the
+// generic validator resolves $ref without the whole document (same trick @suluk/sdk uses).
+function schemaLiteral(doc: OpenAPIv4Document, s: unknown): string {
+  const defs = (doc.components?.schemas ?? {}) as Record<string, unknown>;
+  const str = JSON.stringify(s ?? {});
+  if (!Object.keys(defs).length || !str.includes("#/components/schemas/")) return str;
+  const merged = { $defs: JSON.parse(JSON.stringify(defs)), ...JSON.parse(str) };
+  return JSON.stringify(merged).replace(/#\/components\/schemas\//g, "#/$defs/");
+}
+
+export interface TestgenOptions {
+  /** the deployment under test; the generated suite reads SULUK_BASE_URL first, then falls back to this. */
+  baseURL?: string;
+  /** which test runner's imports to emit (both share the test/expect/describe API). Default "bun". */
+  framework?: "bun" | "vitest";
+}
+
+const lbl = (s: string) => s.replace(/`/g, "'").replace(/\$\{/g, "\\${");
+
+function emitOp(doc: OpenAPIv4Document, op: OpInfo): string {
+  const src = op.source ? `  ←  ${op.source.file}#${op.source.symbol}` : "";
+  const head = `${op.name}  [${op.method} ${op.uri}]  · ${op.requires}${src}`;
+  const tests: string[] = [];
+  const public_ = op.requires === "anyone";
+
+  // ── L2: access enforcement, on the real wire (the ceiling-raiser) ──────────────────────────────────────────
+  if (public_) {
+    tests.push(`  test("access — public: anon is NOT auth-blocked (x-suluk-access: anyone, verified on the wire)", async () => {
+    const r = await call("${op.method}", "${op.filledPath}"${op.hasBody ? ", { body: {} }" : ""});
+    expect([401, 403], "a public op must be reachable by anon — got " + r.status).not.toContain(r.status);
+  });`);
+  } else {
+    tests.push(`  test("access — ENFORCED: anon gets NO success (x-suluk-access: ${op.requires}, verified on the wire — not the facet)", async () => {
+    const r = await call("${op.method}", "${op.filledPath}"${op.hasBody ? ", { body: {} }" : ""});
+    // the server is the boundary (C022 inv.3): a non-public op must DENY anon. Success here is a real hole.
+    expect([200, 201, 204], "anon succeeded on a ${op.requires} op — the server is NOT enforcing x-suluk-access").not.toContain(r.status);
+  });`);
+    tests.push(`  test("access — admin/owner principal reaches it (positive; skipped without SULUK_${op.requires === "admin" ? "ADMIN" : "USER"}_TOKEN)", async () => {
+    const tok = ${op.requires === "admin" ? "ADMIN" : "USER"};
+    if (!tok) return; // optional: provide a synthetic principal token to assert the positive side
+    const r = await call("${op.method}", "${op.filledPath}", { token: tok${op.hasBody ? ", body: {}" : ""} });
+    expect([401, 403], "a valid principal was rejected (status " + r.status + ")").not.toContain(r.status);
+  });`);
+    // ── error-conformance (B1 envelope): a deny is a well-formed RFC-9457 Problem Details body ────────────────
+    tests.push(`  test("error-conformance — a denied request returns a well-formed Problem Details body (RFC-9457)", async () => {
+    const r = await call("${op.method}", "${op.filledPath}"${op.hasBody ? ", { body: {} }" : ""});
+    if (r.status < 400) return; // a success here is already flagged by the access test above
+    const body = isJson(r) ? await r.json() : {};
+    // the shared @suluk/hono envelope: title (string) + status (number) === HTTP status (isProblemDetails shape).
+    expect(typeof body.title === "string" && body.status === r.status, "deny body is not RFC-9457 Problem Details: " + JSON.stringify(body)).toBe(true);
+  });`);
+  }
+
+  // ── L1: status smoke + schema conformance (public, parameter-free GET) ─────────────────────────────────────
+  if (op.paramFree && public_) {
+    if (op.declaredStatuses.length) tests.push(`  test("status — returns a declared status", async () => {
+    const r = await call("GET", "${op.filledPath}");
+    expect(${JSON.stringify(op.declaredStatuses)}, "undeclared status " + r.status).toContain(r.status);
+  });`);
+    if (op.okSchema != null) tests.push(`  test("conformance — a 2xx body validates against the declared response schema", async () => {
+    const r = await call("GET", "${op.filledPath}");
+    if (r.status >= 300 || !isJson(r)) return;
+    const v = validate(${schemaLiteral(doc, op.okSchema)}, await r.json());
+    expect(v.valid, "response body does not conform: " + JSON.stringify(v.errors?.slice(0, 3))).toBe(true);
+  });`);
+  }
+
+  // ── L2 (static): a declared cost is well-formed (never a literal µ$ amount) ────────────────────────────────
+  if (op.cost != null) tests.push(`  test("cost — declares a well-formed x-suluk-cost", () => {
+    expect(Number.isFinite(${op.cost}) && ${op.cost} >= 0, "x-suluk-cost is malformed").toBe(true);
+  });`);
+
+  return `describe("${lbl(head)}", () => {\n${tests.join("\n")}\n});`;
+}
+
+export function generateTests(doc: OpenAPIv4Document, opts: TestgenOptions = {}): string {
+  const ops = walkOps(doc);
+  const importLine = opts.framework === "vitest" ? `import { test, expect, describe } from "vitest";` : `import { test, expect, describe } from "bun:test";`;
+  const title = doc.info?.title ?? "API";
+  const version = doc.openapi ?? "4.0.0-candidate";
+  const enforced = ops.filter((o) => o.requires !== "anyone").length;
+  const body = ops.map((o) => emitOp(doc, o)).join("\n\n");
+
+  return `/**
+ * ${title} — CONFORMANCE suite. AUTO-GENERATED by @suluk/testgen from the v4 contract (OpenAPI ${version}). Do not edit.
+ *
+ * The contract's claims, made executable. Run it against a deployment:
+ *   SULUK_BASE_URL=${opts.baseURL ?? "https://your.api"} bun test ${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}.conformance.test.ts
+ *
+ * It asserts the SERVER ENFORCES x-suluk-access on the real wire (${enforced}/${ops.length} ops are non-public and must
+ * deny anon), smoke-tests declared statuses, validates 2xx bodies against their declared schemas, and checks every
+ * declared cost is well-formed. x-suluk-access is the EXPECTATION; the WIRE is the truth — a green run proves the
+ * two AGREE. The server is the only authz boundary (C022 inv.3); this never asserts over a projection.
+ *
+ * Optional positive-side checks: set SULUK_ADMIN_TOKEN / SULUK_USER_TOKEN to SYNTHETIC principals (never a
+ * production credential) to also assert that a valid principal IS allowed through.
+ *
+ * Requires: \`npm i @cfworker/json-schema\` (for response-schema conformance) + a fetch-capable runtime.
+ */
+${importLine}
+import { Validator } from "@cfworker/json-schema";
+
+const BASE = (typeof process !== "undefined" && process.env.SULUK_BASE_URL) || ${JSON.stringify(opts.baseURL ?? "")};
+const ADMIN = typeof process !== "undefined" ? process.env.SULUK_ADMIN_TOKEN : undefined;
+const USER = typeof process !== "undefined" ? process.env.SULUK_USER_TOKEN : undefined;
+
+const isJson = (r: Response) => (r.headers.get("content-type") || "").includes("json");
+function validate(schema: unknown, value: unknown) { return new Validator(schema as object, "2020-12").validate(value); }
+async function call(method: string, path: string, opts: { token?: string; body?: unknown } = {}): Promise<Response> {
+  const headers: Record<string, string> = {};
+  if (opts.token) headers.authorization = "Bearer " + opts.token;
+  let body: string | undefined;
+  if (opts.body !== undefined) { headers["content-type"] = "application/json"; body = JSON.stringify(opts.body); }
+  return fetch(BASE + path, { method, headers, body });
+}
+
+${body}
+`;
+}

package/src/index.ts

@@ -0,0 +1,8 @@
+/**
+ * @suluk/testgen — generate a DETERMINISTIC conformance test suite from a v4 "Suluk" contract. The contract's
+ * claims made executable: the server ENFORCES x-suluk-access on the wire, declared statuses hold, 2xx bodies
+ * conform to their schemas, declared costs are well-formed. A pure function of the document. CANDIDATE tooling.
+ */
+export { generateTests, type TestgenOptions } from "./generate";
+// money-correctness conformance (PARITY §2 checkout-resilience over the @suluk/stripe pricing primitives).
+export { generateMoneyTests, type MoneyTestsOptions } from "./money";

package/src/money.ts

@@ -0,0 +1,121 @@
+/**
+ * generateMoneyTests — PARITY §2 "Checkout & E-commerce Resilience" made an EXECUTABLE, in-process conformance
+ * suite over the @suluk/stripe pricing primitives (saastarter-parity Phase 0). Unlike the wire conformance suite,
+ * the money invariants are properties of the SHARED, app-independent primitives (there is nothing in a v4 document
+ * to walk for verifyAmount) — so this is a separate emitter that produces a self-contained `bun test` file an app
+ * commits + runs. No network, no app coupling, no document input.
+ *
+ * Provenance note (honesty, adopt-by-receipt): the anti-tampering + integer-cents + never-over-discount invariants
+ * are faithful encodings of saastarter's checkout intent. The exact-sum proration + deterministic-idempotency
+ * invariants are STRONGER than saastarter's actual code (PARITY records a real cart/order proration drift bug and
+ * an ad-hoc retry path) — they assert what @suluk/stripe was authored to GUARANTEE, an origination inspired by the
+ * parity goal, not a behavioral port. The generated header says so.
+ */
+
+export interface MoneyTestsOptions {
+  /** which runner's imports to emit (both share test/expect/describe). Default "bun". */
+  framework?: "bun" | "vitest";
+  /** the import specifier for the pricing primitives. Default "@suluk/stripe". */
+  stripeModule?: string;
+}
+
+/** Emit the money-correctness conformance suite as a self-contained test-file string. */
+export function generateMoneyTests(opts: MoneyTestsOptions = {}): string {
+  const importLine = opts.framework === "vitest"
+    ? `import { test, expect, describe } from "vitest";`
+    : `import { test, expect, describe } from "bun:test";`;
+  const mod = opts.stripeModule ?? "@suluk/stripe";
+
+  return `/**
+ * Checkout money-correctness — CONFORMANCE suite. AUTO-GENERATED by @suluk/testgen. Do not edit.
+ *
+ * PARITY §2 "Checkout & E-commerce Resilience" made executable over the @suluk/stripe pricing primitives — the
+ * arithmetic that separates a toy cart from one you'd trust with money. In-process, no network: it asserts the
+ * SHARED primitives uphold the invariants, so the cart-drawer total and the order-summary total can never drift.
+ *
+ * Honesty: the exact-sum proration + deterministic-idempotency checks assert what @suluk/stripe GUARANTEES — they
+ * are stronger than saastarter's actual impl (which has a known proration-drift bug), an origination inspired by
+ * the parity goal rather than a behavioral port.
+ *
+ * Run: \`bun test\` (requires ${mod}).
+ */
+${importLine}
+import {
+  subtotal, computeDiscountAmount, validateDiscount, prorateDiscount, orderTotal, verifyAmount,
+  cartFingerprint, idempotencyKey, type CartLine, type Discount,
+} from ${JSON.stringify(mod)};
+
+const sum = (ns: number[]) => ns.reduce((a, b) => a + b, 0);
+
+describe("money — anti-tampering (never trust the amount the browser sends)", () => {
+  const lines: CartLine[] = [{ unitCents: 1999, qty: 2, id: "a" }, { unitCents: 500, qty: 1, id: "b" }];
+  test("verifyAmount accepts the exact recomputed total and rejects a tampered one", () => {
+    const expected = orderTotal(lines, null).totalCents; // 4498
+    expect(verifyAmount(lines, null, expected).ok).toBe(true);
+    const tampered = verifyAmount(lines, null, expected - 100);
+    expect(tampered.ok).toBe(false);
+    expect(tampered.reason).toBe("amount-mismatch");
+  });
+});
+
+describe("money — integer cents only, a discount never exceeds the subtotal", () => {
+  const lines: CartLine[] = [{ unitCents: 1234, qty: 3 }];
+  test("subtotal + total are integers", () => {
+    const t = orderTotal(lines, null);
+    expect(Number.isInteger(t.subtotalCents)).toBe(true);
+    expect(Number.isInteger(t.totalCents)).toBe(true);
+  });
+  test("a fixed discount larger than the subtotal clamps — the total is never negative", () => {
+    const huge: Discount = { type: "fixed", value: 9_999_999 };
+    const sub = subtotal(lines);
+    expect(computeDiscountAmount(sub, huge)).toBe(sub); // clamped to subtotal
+    expect(orderTotal(lines, huge).totalCents).toBe(0); // never below zero
+  });
+  test("a percent discount is rounded to whole cents and clamped to [0, subtotal]", () => {
+    const amt = computeDiscountAmount(1000, { type: "percent", value: 33 });
+    expect(amt).toBe(330);
+    expect(amt).toBeLessThanOrEqual(1000);
+  });
+});
+
+describe("money — proration sums EXACTLY to the order discount (cart drawer ⊨ order summary)", () => {
+  const carts: CartLine[][] = [
+    [{ unitCents: 1999, qty: 2 }, { unitCents: 500, qty: 1 }, { unitCents: 333, qty: 3 }],
+    [{ unitCents: 100, qty: 1 }, { unitCents: 100, qty: 1 }, { unitCents: 100, qty: 1 }],
+    [{ unitCents: 4500, qty: 1 }],
+  ];
+  for (let i = 0; i < carts.length; i++) {
+    for (const d of [101, 333, 777]) {
+      test(\`cart \${i} · discount \${d}¢ prorates to an exact sum, each share within its line\`, () => {
+        const lines = carts[i];
+        const want = Math.min(d, subtotal(lines));
+        const shares = prorateDiscount(lines, want);
+        expect(sum(shares)).toBe(want);                       // exact — no lost/created cent
+        shares.forEach((s, j) => expect(s).toBeLessThanOrEqual(subtotal([lines[j]])));
+      });
+    }
+  }
+});
+
+describe("money — specific discount-rejection reasons (tell the shopper WHY)", () => {
+  test("no-discount / non-positive-value / percent-out-of-range / below-minimum", () => {
+    expect(validateDiscount(1000, null).reason).toBe("no-discount");
+    expect(validateDiscount(1000, { type: "fixed", value: 0 }).reason).toBe("non-positive-value");
+    expect(validateDiscount(1000, { type: "percent", value: 150 }).reason).toBe("percent-out-of-range");
+    expect(validateDiscount(500, { type: "fixed", value: 100, minSubtotalCents: 1000 }).reason).toBe("below-minimum");
+    expect(validateDiscount(2000, { type: "percent", value: 10 }).valid).toBe(true);
+  });
+});
+
+describe("money — deterministic idempotency (a retry reuses one payment intent, never double-charges)", () => {
+  const lines: CartLine[] = [{ unitCents: 1999, qty: 2, id: "a" }, { unitCents: 500, qty: 1, id: "b" }];
+  test("same cart + scope ⇒ same key; a changed cart ⇒ a different key", () => {
+    const k1 = idempotencyKey("user_1", lines);
+    expect(idempotencyKey("user_1", [...lines].reverse())).toBe(k1); // order-independent — same charge
+    expect(idempotencyKey("user_1", [{ unitCents: 1999, qty: 3, id: "a" }, { unitCents: 500, qty: 1, id: "b" }])).not.toBe(k1);
+    expect(idempotencyKey("user_2", lines)).not.toBe(k1);            // a different principal is a different attempt
+    expect(cartFingerprint(lines)).toBe(cartFingerprint([...lines].reverse()));
+  });
+});
+`;
+}

package/test/testgen.test.ts

@@ -0,0 +1,121 @@
+import { test, expect, describe } from "bun:test";
+import { generateTests, generateMoneyTests } from "../src/index";
+import { orderTotal, verifyAmount, prorateDiscount, idempotencyKey } from "@suluk/stripe";
+import type { OpenAPIv4Document } from "@suluk/core";
+
+const doc = {
+  openapi: "4.0.0-candidate",
+  info: { title: "Store API" },
+  paths: {
+    product: {
+      requests: {
+        listProduct: { method: "get", responses: { ok: { status: 200, contentSchema: { type: "array", items: { type: "object", properties: { id: { type: "integer" } }, required: ["id"], additionalProperties: false } } } }, "x-suluk-access": { requires: "anyone" }, "x-suluk-cost": { estimateMicroUsd: 10 }, "x-suluk-source": { file: "src/schema.ts", symbol: "product", kind: "drizzle-table" } },
+        createProduct: { method: "post", contentSchema: { type: "object", properties: { name: { type: "string" } }, required: ["name"] }, responses: { created: { status: 201 } }, "x-suluk-access": { requires: "admin" }, "x-suluk-cost": { estimateMicroUsd: 145 }, "x-suluk-source": { file: "src/schema.ts", symbol: "product", kind: "drizzle-table" } },
+      },
+    },
+    "cart/{id}": { requests: { getCart: { method: "get", responses: { ok: { status: 200 } }, "x-suluk-access": { requires: "authenticated", scope: "owner" }, "x-suluk-source": { file: "src/ops.ts", symbol: "getCart", kind: "operation" } } } },
+  },
+} as unknown as OpenAPIv4Document;
+
+describe("@suluk/testgen — generate a conformance suite from a v4 contract", () => {
+  const suite = generateTests(doc, { baseURL: "https://api.example.com" });
+
+  test("emits a self-contained, fetch-based suite (bun:test default) with the generic validator", () => {
+    expect(suite).toContain('import { test, expect, describe } from "bun:test"');
+    expect(suite).toContain('import { Validator } from "@cfworker/json-schema"');
+    expect(suite).toContain("async function call(method: string, path: string");
+    expect(suite).toContain('process.env.SULUK_BASE_URL');
+    expect(suite).toContain('"https://api.example.com"');
+  });
+
+  test("ACCESS ENFORCEMENT on the wire — non-public ops must DENY anon a success; public ops must be reachable", () => {
+    // a public op: anon must NOT be auth-blocked
+    expect(suite).toContain('access — public: anon is NOT auth-blocked');
+    expect(suite).toMatch(/expect\(\[401, 403\],[^)]*\)\.not\.toContain\(r\.status\)/);
+    // an admin op: anon must get NO 2xx (the server enforces; the facet is only the expectation)
+    expect(suite).toContain('access — ENFORCED: anon gets NO success');
+    expect(suite).toMatch(/expect\(\[200, 201, 204\],[^)]*\)\.not\.toContain\(r\.status\)/);
+    // it tests the WIRE, never a projection
+    expect(suite).toContain("verified on the wire");
+    expect(suite).not.toContain("?as=");
+  });
+
+  test("parameterized paths are filled; the positive side is token-gated (synthetic principal, optional)", () => {
+    expect(suite).toContain('"/cart/1"');                       // {id} → a placeholder
+    expect(suite).toContain("SULUK_USER_TOKEN");                // owner/authenticated positive side
+    expect(suite).toContain("if (!tok) return;");               // skipped without a synthetic principal
+  });
+
+  test("L1 status smoke + schema conformance for a public, parameter-free GET", () => {
+    expect(suite).toContain('status — returns a declared status');
+    expect(suite).toContain("[200]");                            // listProduct's declared status
+    expect(suite).toContain('conformance — a 2xx body validates against the declared response schema');
+    expect(suite).toContain('validate({"type":"array"');        // the response schema, embedded as data
+  });
+
+  test("cost is checked as DECLARED + well-formed, never a literal µ$ amount", () => {
+    expect(suite).toContain("declares a well-formed x-suluk-cost");
+    expect(suite).toContain("145 >= 0");
+    expect(suite).not.toMatch(/toBe\(145\)/);                    // never asserts the literal amount
+  });
+
+  test("each op group is LABELLED with its provenance (x-suluk-source) — a failure points at the source", () => {
+    expect(suite).toContain("createProduct  [POST product]  · admin  ←  src/schema.ts#product");
+    expect(suite).toContain("getCart  [GET cart/{id}]  · authenticated  ←  src/ops.ts#getCart");
+  });
+
+  test("framework toggle emits vitest imports", () => {
+    expect(generateTests(doc, { framework: "vitest" })).toContain('from "vitest"');
+  });
+
+  test("error-conformance: a non-public op asserts the deny body is RFC-9457 Problem Details (the B1 envelope)", () => {
+    expect(suite).toContain("error-conformance — a denied request returns a well-formed Problem Details body");
+    expect(suite).toContain('typeof body.title === "string" && body.status === r.status'); // the @suluk/hono envelope fields
+    // a public op never gets an error-conformance block (it isn't expected to deny)
+    expect(suite.split("access — public").length).toBeGreaterThan(1);
+  });
+});
+
+describe("@suluk/testgen — generateMoneyTests (PARITY §2 checkout-resilience, in-process)", () => {
+  const money = generateMoneyTests();
+
+  test("emits a self-contained bun:test suite importing the @suluk/stripe primitives", () => {
+    expect(money).toContain('import { test, expect, describe } from "bun:test"');
+    expect(money).toContain('} from "@suluk/stripe"');
+    expect(money).toContain("verifyAmount");
+    expect(money).toContain("prorateDiscount");
+    expect(money).toContain("idempotencyKey");
+  });
+
+  test("encodes the load-bearing invariants: anti-tampering, never-over-discount, exact proration, idempotency", () => {
+    expect(money).toContain('expect(tampered.reason).toBe("amount-mismatch")');         // anti-tampering
+    expect(money).toContain("orderTotal(lines, huge).totalCents).toBe(0)");             // never negative
+    expect(money).toContain("expect(sum(shares)).toBe(want)");                          // proration sums exactly
+    expect(money).toContain("idempotencyKey(\"user_1\", [...lines].reverse())).toBe(k1"); // retry reuses the key
+  });
+
+  test("honestly labels the originated (stronger-than-saastarter) invariants", () => {
+    expect(money).toContain("stronger than saastarter");
+    expect(money).toContain("origination inspired by"); // honestly flags the non-ported invariants
+  });
+
+  test("stripeModule + framework are configurable", () => {
+    const v = generateMoneyTests({ framework: "vitest", stripeModule: "../pricing" });
+    expect(v).toContain('from "vitest"');
+    expect(v).toContain('} from "../pricing"');
+  });
+});
+
+// Smoke (closes the loop): the invariants the emitter ENCODES actually hold for the real @suluk/stripe build.
+describe("@suluk/testgen — money smoke against the real @suluk/stripe primitives", () => {
+  test("verifyAmount rejects tampering; proration sums exactly; idempotency is deterministic", () => {
+    const lines = [{ unitCents: 1999, qty: 2, id: "a" }, { unitCents: 500, qty: 1, id: "b" }, { unitCents: 333, qty: 3 }];
+    const exact = orderTotal(lines, null).totalCents;
+    expect(verifyAmount(lines, null, exact).ok).toBe(true);
+    expect(verifyAmount(lines, null, exact - 1).ok).toBe(false);
+    const shares = prorateDiscount(lines, 777);
+    expect(shares.reduce((a, b) => a + b, 0)).toBe(777);
+    expect(idempotencyKey("u1", lines)).toBe(idempotencyKey("u1", [...lines].reverse()));
+    expect(orderTotal(lines, { type: "fixed", value: 9_999_999 }).totalCents).toBe(0);
+  });
+});

package/tsconfig.json

@@ -0,0 +1 @@
+{ "extends": "../../tsconfig.base.json", "compilerOptions": { "types": ["bun"] }, "include": ["src", "test"] }