@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/run/accounts.js

@@ -0,0 +1,215 @@
+/**
+ * Removes every account the run made, and lists by name each one it could not.
+ *
+ * In this order, each tried only when the one before could not: the document's delete-self, sent
+ * as the account itself; the delete of the entity its sign-up creates, by its id, as the configured
+ * principals strongest first; `hooks.teardownPrincipal`. What is left is a leftover, named by the
+ * email or username it was made with, so a person can remove it. An account whose name a
+ * configured principal holds, that this run did not make, is never removed: it is not the API tester's.
+ */
+import { accountLabel } from "../accounts/identity.js";
+import { names } from "../accounts/ledger.js";
+import { accountOps } from "../accounts/ops.js";
+import { fillPath } from "../fill-path.js";
+import { messageOf } from "../../errors/message.js";
+import { signsUp } from "../../credentials/signup.js";
+import { accountMakersOf } from "../../spec/sign-up.js";
+import { borrowed, hookRemoves } from "./account-hook.js";
+import { bindSignUp } from "./fresh.js";
+import { createdByRun, logIn } from "./principals.js";
+import { merged } from "./teardown.js";
+/* A delete that answered this left no account: removed now, or gone already. */
+function gone(exchange) {
+    return (exchange.status >= 200 && exchange.status < 300) || exchange.status === 404 || exchange.status === 410;
+}
+export async function teardownAccounts(ctx) {
+    const { options, accounts, findings } = ctx;
+    if (options.skipPrincipalTeardown === true)
+        return;
+    declareMade(ctx);
+    const owed = accounts.owed();
+    if (owed.length === 0)
+        return;
+    const ops = accountOps(ctx.model);
+    for (const entry of owed) {
+        let verdict;
+        try {
+            verdict = await removeAccount(ctx, ops, entry);
+        }
+        catch (error) {
+            verdict = { note: `teardown stopped on an unexpected error: ${messageOf(error)}`, status: "left" };
+            findings.blocked("world.teardown", "account", {
+                cause: messageOf(error),
+                summary: `could not remove account ${labelOf(entry)}`,
+            });
+        }
+        accounts.settle(entry, verdict);
+    }
+    /* Every account it made, with each one that deleted itself during the run. */
+    const made = accounts.entries().filter((entry) => entry.status !== "refused");
+    ctx.state.teardown = merged(ctx.state.teardown, accountReport(made));
+}
+/* How a person finds the account: by its email, else by how it was made. */
+export function labelOf(entry) {
+    return accountLabel(entry.identity) ?? `#${entry.n} by ${entry.operationId}`;
+}
+/** Each account the run made as its report lists it: removed, or a leftover named so a person can find it. */
+export function accountReport(entries) {
+    const named = entries.map((entry) => ({
+        entry,
+        id: labelOf(entry),
+        principal: entry.principal ?? "(none)",
+    }));
+    return {
+        failed: named
+            .filter(({ entry }) => entry.status !== "removed")
+            .map(({ entry, id, principal }) => ({
+            entity: "account",
+            id,
+            principal,
+            reason: entry.note ?? "teardown did not run",
+        })),
+        records: named.map(({ entry, id, principal }) => ({
+            entity: "account",
+            id,
+            principal,
+            removed: entry.status === "removed",
+        })),
+        removed: named.filter(({ entry }) => entry.status === "removed").length,
+        unidentified: [],
+        unsupported: [],
+    };
+}
+/* A principal declared made by the run (`fresh`, `created`, or a login that signs up) whose sign-up no entry names. */
+function declareMade(ctx) {
+    for (const principal of ctx.principals.all) {
+        if (!createdByRun(ctx, principal.id))
+            continue;
+        const identity = ctx.store.identityOf(principal.id);
+        if (ctx.accounts.entries().some((entry) => names(entry, identity)))
+            continue;
+        ctx.accounts.made(principal.id, identity);
+    }
+}
+async function removeAccount(ctx, ops, entry) {
+    const held = holder(ctx, entry);
+    if (held !== undefined && configuredNotMade(ctx, held)) {
+        return {
+            note: `its name is configured principal ${held}'s, which this run did not make; the API tester removes only accounts it made`,
+            principal: held,
+            status: "left",
+        };
+    }
+    const principal = held ?? (await signIn(ctx, entry));
+    const tried = [];
+    const op = ops.deleteSelf;
+    if (op !== undefined && principal === undefined) {
+        tried.push(`${op.operationId} needs the account signed in, and the run holds no credential for it`);
+    }
+    else if (op !== undefined && principal !== undefined) {
+        const why = await borrowedFor(ctx, principal, op);
+        if (why !== undefined) {
+            tried.push(`${op.operationId} was not sent as the account: ${why}`);
+        }
+        else {
+            const sent = await sendAs(ctx, { as: principal, op, path: op.path, tried, who: "the account" });
+            if (sent !== undefined && gone(sent)) {
+                return { note: `deleted itself by ${op.operationId} (${sent.status})`, principal, status: "removed" };
+            }
+        }
+    }
+    const admin = await adminDelete(ctx, ops, entry, tried);
+    if (admin !== undefined)
+        return admin;
+    const hooked = await hookRemoves(ctx, entry, principal, tried);
+    if (hooked !== undefined)
+        return hooked;
+    if (tried.length === 0)
+        tried.push("the document has no delete-self, and no hooks.teardownPrincipal is configured");
+    return { note: tried.join("; "), status: "left", ...(principal === undefined ? {} : { principal }) };
+}
+/*
+ * Why what `principal` would send on `op` is not its own account's credential, if it is not: a
+ * delete-self sent with it would remove whoever the credential belongs to. Judged on the schemes the
+ * client picks for `op`, not on every credential the principal holds.
+ */
+export async function borrowedFor(ctx, principal, op) {
+    const route = `${op.method.toUpperCase()} ${op.path}`;
+    const resolution = await ctx.client.credentialFor({ actor: { principal }, operationId: op.operationId, route });
+    if (resolution.kind === "unsatisfied" || resolution.kind === "blocked") {
+        return `it holds no credential of its own for ${op.operationId}`;
+    }
+    if (resolution.kind !== "sends")
+        return `${op.operationId} would carry no credential of the account's`;
+    return borrowed(ctx, principal, resolution.schemes.map((scheme) => ({ scheme, value: resolution.sentValues[scheme] })));
+}
+/* The principal the run holds this account as, by the names it was made with. */
+export function holder(ctx, entry) {
+    if (entry.principal !== undefined)
+        return entry.principal;
+    return Object.keys(ctx.store.principals).find((id) => names(entry, ctx.store.identityOf(id)));
+}
+export function configuredNotMade(ctx, id) {
+    return Object.hasOwn(ctx.options.principals, id) && !createdByRun(ctx, id);
+}
+/*
+ * An account no principal holds, a check's sign-up say: held as `account-<n>` from what it sent and
+ * answered. A credential the answer carried is enough; otherwise its recipes sign it in, unless one
+ * of them signs up, which would make another account to remove.
+ */
+export async function signIn(ctx, entry) {
+    const signUp = ctx.accounts.signUpOf(entry);
+    const body = signUp?.body;
+    if (signUp?.answer === undefined || body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    const id = `account-${entry.n}`;
+    await bindSignUp(ctx, { body: body, entry: {}, id, signup: signUp.answer });
+    if ((await ctx.store.snapshot()).some((held) => held.principal === id))
+        return id;
+    const makers = accountMakersOf(ctx.model);
+    if (Object.values(ctx.options.security ?? {}).some((recipe) => signsUp(recipe, makers)))
+        return undefined;
+    return (await logIn(ctx, id, {})) === undefined ? id : undefined;
+}
+/* The delete of the entity the sign-up creates, by the account's id, as each configured principal the run did not make, strongest first. */
+async function adminDelete(ctx, ops, entry, tried) {
+    const admin = ops.adminDelete(entry.operationId);
+    if (admin === undefined || entry.id === undefined)
+        return undefined;
+    const { op } = admin;
+    const param = op.pathParams.at(-1);
+    const path = fillPath(op.path, { [param]: entry.id });
+    const admins = ctx.principals.all.filter((principal) => !createdByRun(ctx, principal.id));
+    for (const principal of admins.toSorted((a, b) => b.rank - a.rank)) {
+        const sent = await sendAs(ctx, { as: principal.id, op, path, tried, who: principal.id });
+        if (sent !== undefined && gone(sent)) {
+            return {
+                note: `deleted by ${op.operationId} as ${principal.id} (${sent.status})`,
+                principal: principal.id,
+                status: "removed",
+            };
+        }
+    }
+    return undefined;
+}
+/*
+ * One teardown request as principal `as`: what it answered, or undefined when it could not be sent,
+ * its credential gone with its session say. Either way `tried` says so, and the next way may still
+ * remove the account.
+ */
+async function sendAs(ctx, send) {
+    const { op, path, tried, who } = send;
+    try {
+        const sent = await ctx.client
+            .view({ purpose: "teardown" })
+            .request(op.method, path, { as: { principal: send.as }, operationId: op.operationId });
+        if (!gone(sent))
+            tried.push(`${op.operationId} as ${who} answered ${sent.status}`);
+        return sent;
+    }
+    catch (error) {
+        tried.push(`${op.operationId} as ${who} was not sent: ${messageOf(error)}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=accounts.js.map

package/dist/api/runtime/run/acting.d.ts

@@ -0,0 +1,5 @@
+import type { Acting } from "../contract/types.ts";
+import type { RunContext } from "./context.ts";
+/** `principal`'s identity, and the credential each operation would carry as it. */
+export declare function actingOf(ctx: Pick<RunContext, "model" | "options" | "store">, principal: string): Acting;
+//# sourceMappingURL=acting.d.ts.map

package/dist/api/runtime/run/acting.js

@@ -0,0 +1,36 @@
+/*
+ * Who a principal is, and what it would send on an operation, resolved over the run's store as the
+ * client would resolve it: what a hook is told in place of the headers it used to get. A hook can
+ * decode the credential, or send it where its scheme places it, and never sees another header.
+ */
+import { createCredentialSource } from "../../client/credentials.js";
+import { boundOf } from "./identity.js";
+/** `principal`'s identity, and the credential each operation would carry as it. */
+export function actingOf(ctx, principal) {
+    const { model, options, store } = ctx;
+    const source = createCredentialSource({
+        model,
+        principals: store.principals,
+        security: options.security ?? {},
+        store,
+    });
+    return {
+        identity: boundOf(store.identityOf(principal)).identity,
+        sending: async (operationId) => {
+            const op = model.byOperationId.get(operationId);
+            const route = op === undefined ? operationId : `${op.method.toUpperCase()} ${op.path}`;
+            const resolved = await source.resolve({ actor: { principal }, operationId, route });
+            if (resolved.kind !== "sends")
+                return undefined;
+            /* An alternative of two schemes sends both; the first one's value is the credential. */
+            const schemes = resolved.schemes.map((scheme) => resolved.sends[scheme]);
+            const sends = schemes.reduce((all, one) => ({
+                cookies: { ...all.cookies, ...one.cookies },
+                headers: { ...all.headers, ...one.headers },
+                query: { ...all.query, ...one.query },
+            }), { cookies: {}, headers: {}, query: {} });
+            return { credential: resolved.sentValues[resolved.schemes[0]], sends };
+        },
+    };
+}
+//# sourceMappingURL=acting.js.map

package/dist/api/runtime/run/check-accounts.d.ts

@@ -0,0 +1,5 @@
+import type { CheckAccounts } from "../checks/core/operation-context.ts";
+import type { RunContext } from "./context.ts";
+/** What the security stage hands its checks: see `CheckAccounts`. */
+export declare function checkAccounts(ctx: RunContext): CheckAccounts;
+//# sourceMappingURL=check-accounts.d.ts.map

package/dist/api/runtime/run/check-accounts.js

@@ -0,0 +1,28 @@
+/*
+ * The accounts a check's own sign-up made, as an operation check reaches them: held as teardown holds
+ * them (`accounts.ts`), so the principal a check reads as is the one teardown later removes the
+ * account as, and never with a credential that is not the account's own.
+ */
+import { borrowedFor, configuredNotMade, holder, labelOf, signIn } from "./accounts.js";
+/** What the security stage hands its checks: see `CheckAccounts`. */
+export function checkAccounts(ctx) {
+    return {
+        signIn: async (signUp, read) => {
+            const { accounts } = ctx;
+            const entry = accounts.entries().find((one) => accounts.signUpOf(one)?.answer?.seq === signUp.seq);
+            if (entry === undefined) {
+                return { untested: `the run's ledger holds no account ${signUp.operationId} #${signUp.seq} made` };
+            }
+            const held = holder(ctx, entry);
+            if (held !== undefined && configuredNotMade(ctx, held)) {
+                return { untested: `its name is configured principal ${held}'s, which this run did not make` };
+            }
+            const principal = held ?? (await signIn(ctx, entry));
+            if (principal === undefined)
+                return { untested: `the run holds no credential for the account ${labelOf(entry)}` };
+            const why = await borrowedFor(ctx, principal, read);
+            return why === undefined ? { principal } : { untested: `${read.operationId} is not sent as the account: ${why}` };
+        },
+    };
+}
+//# sourceMappingURL=check-accounts.js.map

package/dist/api/runtime/run/client-setup.d.ts

@@ -0,0 +1,8 @@
+import type { Connected, Loaded } from "./context.ts";
+export declare function connect(loaded: Loaded): Connected;
+/**
+ * Removes every client's transcript spool: the primary's and each origin's. The run calls it last,
+ * however it ends; a spool that cannot be removed is no reason to lose the run's own outcome.
+ */
+export declare function disposeClients(connected: Pick<Connected, "client" | "originClients">): Promise<void>;
+//# sourceMappingURL=client-setup.d.ts.map

package/dist/api/runtime/run/client-setup.js

@@ -0,0 +1,117 @@
+import { randomBytes } from "node:crypto";
+import { createCredentialSource } from "../../client/credentials.js";
+import { operationResolver } from "../../spec/graph/resolver.js";
+import { Redactor } from "../../security/redact.js";
+import { Client } from "../../client/client.js";
+import { createExchangeJournal } from "../exchanges/journal.js";
+import { resolveBackoff } from "../poll.js";
+import { buildRateLimitRules } from "../rate-limit/rules.js";
+import { RateLimiter } from "../rate-limit/limiter.js";
+import { AccountLedger } from "../accounts/ledger.js";
+import { accountOps } from "../accounts/ops.js";
+import { watchAccounts } from "../accounts/watch.js";
+import { Ledger } from "../teardown/ledger.js";
+import { captureVerdict } from "../checks/families/conformance/schema-verdict.js";
+import { SchemaValidator } from "../validate.js";
+import { createRunNetwork } from "./network.js";
+import { loadOriginClients } from "./origins.js";
+import { runStore } from "./store.js";
+/**
+ * The run's client, and what watches it: one redactor every client, the journal and the report
+ * scrub with, the exchange journal, the network gate, the run's credential store, and the clients of
+ * the secondary origins, each resolving its actors over that store against its own document.
+ */
+/* What the primary client's requests send: over the run's store, mapped as an origin's when this run is one. */
+function primaryCredentials({ model, options }, store) {
+    const shared = options.sharedCredentials;
+    return createCredentialSource({
+        model,
+        principals: store.principals,
+        security: options.security ?? {},
+        store,
+        ...(shared === undefined ? {} : { mapping: shared.mapping, originOnly: shared.originOnly }),
+    });
+}
+export function connect(loaded) {
+    const { options, hooks, model, fence, progress } = loaded;
+    const redactor = new Redactor();
+    for (const name of options.redact?.headers ?? [])
+        redactor.registerHeader(name);
+    const journal = options.exchangeDir === undefined ? null : createExchangeJournal(options.exchangeDir, redactor);
+    const onExchange = answered(journal, progress);
+    const network = createRunNetwork(loaded);
+    /* The ports reach the clients only when they send, by which time both exist. */
+    const store = runStore(loaded, { clients: () => ({ client, origins: originClients }), network, redactor });
+    const validator = new SchemaValidator(model.defs);
+    const client = new Client({
+        baseUrl: options.baseUrl,
+        credentials: primaryCredentials(loaded, store),
+        fence,
+        cacheBypass: options.cache?.bypass ?? true,
+        headers: options.globalHeaders ?? {},
+        httpHooks: progress.httpHooks,
+        maxInFlight: options.maxInFlight ?? 4,
+        network: network.client,
+        onExchange,
+        operationResolver: operationResolver(model),
+        rateLimiter: new RateLimiter(buildRateLimitRules(model, options.rateLimits), options.maxRps === undefined ? {} : { maxRps: options.maxRps }),
+        redactor,
+        resolveHeaders: hooks.resolveHeaders,
+        transcript: options.transcript,
+        validateAtCapture: captureVerdict(validator, model),
+    });
+    progress.countRequests(() => client.transcript.length);
+    /* From the first request: a principal's own sign-up makes an account too. */
+    const accounts = new AccountLedger(options.accountsFile);
+    watchAccounts({
+        client,
+        identityOf: (principal) => store.identityOf(principal),
+        ledger: accounts,
+        ops: accountOps(model),
+    });
+    const originClients = loadOriginClients(loaded, { network: network.client, onExchange, redactor, store });
+    return {
+        ...loaded,
+        accounts,
+        client,
+        journal,
+        ledger: new Ledger(),
+        network,
+        nonce: options.nonce ?? randomBytes(4).toString("hex"),
+        originClients,
+        outOfBand: resolveBackoff(options.outOfBand),
+        seed: options.seed ?? 1,
+        store,
+        validator,
+    };
+}
+/** Each answer, journaled under its own check and entity, then shown as the last one. */
+function answered(journal, progress) {
+    return async (exchange) => {
+        progress.remember(exchange);
+        if (journal !== null) {
+            try {
+                /* The exchange names its own check and entity: a shared "current check" was wrong
+                 * whenever checks ran concurrently, and journaled a whole batch under the last one. */
+                await journal.record(exchange, {
+                    ...(exchange.check === undefined ? {} : { check: exchange.check }),
+                    ...(exchange.subject === undefined ? {} : { entity: exchange.subject }),
+                    phase: progress.phase,
+                });
+            }
+            catch {
+                /* journal is observability — a write error must not fail the request */
+            }
+        }
+        progress.announce();
+    };
+}
+/**
+ * Removes every client's transcript spool: the primary's and each origin's. The run calls it last,
+ * however it ends; a spool that cannot be removed is no reason to lose the run's own outcome.
+ */
+export async function disposeClients(connected) {
+    const clients = [connected.client, ...[...connected.originClients.values()].map((origin) => origin.client)];
+    await Promise.allSettled(clients.map((client) => client.dispose()));
+}
+//# sourceMappingURL=client-setup.js.map

package/dist/api/runtime/run/context.d.ts

@@ -0,0 +1,141 @@
+import type { Hooks } from "../../config/types/hooks.ts";
+import type { EntityModel, OperationModel, SpecModel } from "../../spec/graph/types.ts";
+import type { OpenApiDocument } from "../../spec/types.ts";
+import type { Exchange } from "../exchange.ts";
+import type { ProvenId } from "../proven-id.ts";
+import type { Scenario } from "../../config/types/steps.ts";
+import type { OriginClient } from "../steps/request.ts";
+import type { Client } from "../../client/client.ts";
+import type { ExchangeJournal } from "../exchanges/journal.ts";
+import type { Fence } from "../fence.ts";
+import type { FindingCollector } from "../finding.ts";
+import type { BackoffConfig } from "../poll.ts";
+import type { ResolvedProfile } from "../profile.ts";
+import type { GradeLedger } from "../grades.ts";
+import type { TargetScope } from "../scope/types.ts";
+import type { TargetVersion } from "../target-version.ts";
+import type { AccountLedger } from "../accounts/ledger.ts";
+import type { Ledger } from "../teardown/ledger.ts";
+import type { Created, Owner } from "../teardown/types.ts";
+import type { UploadContext } from "../upload.ts";
+import type { SchemaValidator } from "../validate.ts";
+import type { CredentialStore } from "../../credentials/store.ts";
+import type { RunNetwork } from "./network.ts";
+import type { RunProgress } from "./progress.ts";
+import type { RunState } from "./state.ts";
+import type { RunOptions } from "./types.ts";
+/** The document read and modeled; nothing sent to the API yet. */
+export interface Loaded {
+    options: RunOptions;
+    hooks: Hooks;
+    findings: FindingCollector;
+    profile: ResolvedProfile;
+    progress: RunProgress;
+    fence: Fence | undefined;
+    model: SpecModel;
+    /**
+     * Each secondary origin's document, read and modeled once at load, where the config's
+     * credentials are checked against it. By origin id; each origin's client is built on it.
+     */
+    origins: ReadonlyMap<string, LoadedOrigin>;
+    state: RunState;
+}
+/** A secondary origin's document, after its overlay, and its model. */
+export interface LoadedOrigin {
+    doc: OpenApiDocument;
+    model: SpecModel;
+}
+/** A client to talk to the API with, and what records the run's exchanges and fixtures. */
+export interface Connected extends Loaded {
+    client: Client;
+    /**
+     * The run's credentials, one store for the run: the primary client and each origin's resolve
+     * their actors over it, each against its own document.
+     */
+    store: CredentialStore;
+    journal: ExchangeJournal | null;
+    network: RunNetwork;
+    originClients: Map<string, OriginClient>;
+    ledger: Ledger;
+    /** Every account the run asked a backend to make, ledgered before each request went out. */
+    accounts: AccountLedger;
+    validator: SchemaValidator;
+    seed: number;
+    /** Fresh per run: the seed reproduces a run, the nonce keeps two runs' records apart. */
+    nonce: string;
+    outOfBand: BackoffConfig;
+}
+/** What this run grades, and what it may call. */
+export interface Planned extends Connected {
+    scope: TargetScope;
+    grades: GradeLedger;
+    /** Creates the principals' auth flows send: support, never seeded as fixtures. */
+    authCreates: Set<string>;
+    /** Scenarios of this origin; a secondary origin's run its own. */
+    ownScenarios: Scenario[];
+    /** Operations a scenario covers: the matrix never generates a body for them. */
+    scenarioOwned: Set<string>;
+    uploads: UploadContext;
+}
+/** Everything a stage after authentication may use. */
+export interface RunContext extends Planned {
+    principals: RunPrincipals;
+    exclusion: Exclusion;
+    targetVersion: TargetVersion | undefined;
+}
+/** A principal the run acts as: who it is, its tenant and rank, and the parameters bound for it. */
+export interface RunPrincipal {
+    id: string;
+    /** What its recipes interpolate as `{principal.<key>}`: config data, a fresh signup's values, a login's claims. */
+    identity: Readonly<Record<string, unknown>>;
+    /** From the config, or bound by a login's `claims`. */
+    tenant?: string;
+    /** Higher can do everything a lower rank can. */
+    rank: number;
+    /** Path or query parameters bound for it: the config's `scope`, then a login's `scope.<param>` claims. */
+    scope: Readonly<Record<string, string>>;
+    /** What an owner puts in an invite body for it. */
+    inviteAs?: string;
+    /** The config marks the account read-only: a viewer, whose every write must be refused. */
+    readOnly?: true;
+    /** Signed up by this run through the document's `x-fresh-principal` operation. */
+    fresh: boolean;
+}
+/** The run's principals, who is isolated from whom, and who owns and may remove what they create. */
+export interface RunPrincipals {
+    /** Every principal not BLOCKED, in config order. */
+    all: RunPrincipal[];
+    /** The first: the one the matrix acts as. */
+    alpha: RunPrincipal;
+    byId: ReadonlyMap<string, RunPrincipal>;
+    /** The first principal of a tenant other than `principal`'s: what isolation reads and writes across. */
+    peerOf(principal: RunPrincipal): RunPrincipal | undefined;
+    sameTenant(a: RunPrincipal, b: RunPrincipal): boolean;
+    /** Principals whose login failed, each reported once; the run goes on without them. */
+    blocked: ReadonlyArray<{
+        id: string;
+        reason: string;
+    }>;
+    ownerOf(principal: RunPrincipal): Owner;
+    /** Who else may remove a record its creator could not: a stronger principal of its tenant. */
+    fallbackDeleters(owner: Owner): Owner[];
+    /** Ledgers a record `owner` created. */
+    recorder(owner: Owner): (entity: string, id: ProvenId, values: Record<string, string>) => void;
+    /** Ledgers a record learned of another way, as whoever sent the request that made it. */
+    recordCreated(created: Created, principal?: string): void;
+    unidentified(entity: string, operationId: string, exchange: Exchange): void;
+}
+/** What the active profile lets the run call. */
+export interface Exclusion {
+    /** Whether the API tester may call `op` at all: a read that confirms a create is still a call. */
+    readable(op: OperationModel): boolean;
+    /** Whether the profile excludes the operation by this id. */
+    excludes(operationId: string): boolean;
+    /**
+     * Whether the profile excludes `op` on `entity`. The first time, the exclusion is recorded and
+     * reported as a gap: checks that depend on the operation stand down rather than run against
+     * data the API tester did not create through it.
+     */
+    excludeOp(entity: EntityModel, op: OperationModel | undefined): boolean;
+}
+//# sourceMappingURL=context.d.ts.map

package/dist/api/runtime/run/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/api/runtime/run/contract-floor.d.ts

@@ -0,0 +1,7 @@
+import type { RunContext } from "./context.ts";
+/**
+ * The floor under every operation: what the transcript already proves, deletes confirmed, then a
+ * documented call to each operation no check or scenario reached.
+ */
+export declare function contractFloor(ctx: RunContext): Promise<void>;
+//# sourceMappingURL=contract-floor.d.ts.map

package/dist/api/runtime/run/contract-floor.js

@@ -0,0 +1,51 @@
+import { runContractCalls } from "../contract/calls.js";
+import { madeByRun } from "../contract/made-by-run.js";
+import { confirmDeletes } from "../contract/deletes.js";
+import { proveFromTranscript } from "../evidence.js";
+import { actingOf } from "./acting.js";
+import { floorCredentials } from "./floor-credentials.js";
+import { ownRecordsOf } from "./own-records.js";
+import { stopped } from "./interrupt.js";
+/**
+ * The floor under every operation: what the transcript already proves, deletes confirmed, then a
+ * documented call to each operation no check or scenario reached.
+ */
+export async function contractFloor(ctx) {
+    const { progress, client, grades, model, principals, findings, scope, state } = ctx;
+    const inScope = (operationId) => scope.inScope(operationId);
+    progress.enter("test", "evidence from the transcript");
+    await proveFromTranscript({ client, grades, model });
+    await confirmDeletes({
+        client,
+        findings,
+        grades,
+        inScope,
+        mode: scope.mode,
+        model,
+        principal: principals.alpha.id,
+        stopped: () => stopped(ctx),
+    });
+    progress.enter("contract", "operations no check or scenario reached");
+    await runContractCalls({
+        acting: actingOf(ctx, principals.alpha.id),
+        checksRun: state.checksRun,
+        client,
+        credentials: floorCredentials(ctx, principals.alpha.id),
+        findings,
+        grades,
+        hooks: ctx.hooks,
+        inScope,
+        madeByRun: madeByRun({ client, held: await ctx.store.snapshot(), ledger: ctx.ledger, model }),
+        mode: scope.mode,
+        model,
+        nonce: ctx.nonce,
+        owned: ctx.scenarioOwned,
+        ownRecords: ownRecordsOf(ctx),
+        principal: principals.alpha.id,
+        roots: { ...principals.alpha.scope },
+        seed: ctx.seed,
+        stopped: () => stopped(ctx),
+        validator: ctx.validator,
+    });
+}
+//# sourceMappingURL=contract-floor.js.map

package/dist/api/runtime/run/credential-records.d.ts

@@ -0,0 +1,12 @@
+import type { Client } from "../../client/client.ts";
+import type { CredentialRecords } from "../../credentials/ports.ts";
+import type { SpecModel } from "../../spec/graph/types.ts";
+export interface RecordsWiring {
+    model: SpecModel;
+    /** The run's client, once connected. */
+    client: () => Client;
+    /** The parameters bound for a principal, which a path fills from under the record's own. */
+    scopeOf: (principal: string) => Readonly<Record<string, string>>;
+}
+export declare function credentialRecords(wiring: RecordsWiring): CredentialRecords;
+//# sourceMappingURL=credential-records.d.ts.map