@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/run/entity/self.js

@@ -0,0 +1,24 @@
+import { runSelfIdentity } from "../../self/identity.js";
+import { SELF_CHECK_ID, selfOperationIds } from "../../self/operations.js";
+import { guardedClient } from "../../own-record.js";
+import { ownRecordsOf } from "../own-records.js";
+import { graded, startedTest } from "./direct.js";
+/** An entity that is the caller: nothing to list, and register is not a create. */
+export async function selfIdentity(ctx, entity) {
+    const { principals, client, findings, model, nonce, seed, hooks } = ctx;
+    startedTest(ctx, entity, SELF_CHECK_ID);
+    const ownRecords = ownRecordsOf(ctx);
+    const outcome = await runSelfIdentity({
+        client: guardedClient(client, ownRecords, model),
+        entity,
+        findings,
+        model,
+        nonce,
+        ownRecords,
+        principal: principals.alpha.id,
+        ...(hooks.resolveInput === undefined ? {} : { resolveInput: hooks.resolveInput }),
+        seed,
+    });
+    graded(ctx, selfOperationIds(entity, model), SELF_CHECK_ID, outcome);
+}
+//# sourceMappingURL=self.js.map

package/dist/api/runtime/run/entity/state.d.ts

@@ -0,0 +1,59 @@
+import type { EntityModel, OperationModel } from "../../../spec/graph/types.ts";
+import type { Client } from "../../../client/client.ts";
+import type { FindingCollector } from "../../finding.ts";
+import type { Record_ } from "../../world/records.ts";
+import type { AncestorCache, Scope } from "../../world/types.ts";
+import type { RunContext } from "../context.ts";
+/** One entity under test: what it is, and what its seeding has learned so far. */
+export interface EntityRun {
+    ctx: RunContext;
+    entity: EntityModel;
+    /** The entity's place in the model: half of what keeps one check run's salts its own. */
+    index: number;
+    /** The entity's list; `undefined` for one whose cohort is its creates alone. */
+    listOp: OperationModel | undefined;
+    /**
+     * The route the entity's records live under: its list, else its create. Its path names the
+     * parents a principal's scope needs.
+     */
+    collectionOp: OperationModel;
+    createOp: OperationModel | undefined;
+    /** Findings about seeding land on the targets this entity's checks grade. */
+    findings: FindingCollector;
+    /** Every configured root, then the first principal's own. */
+    roots: Record<string, string>;
+    /** Everything this entity's world-building sends is seeding, attributed to the entity. */
+    seeding: Client;
+    /**
+     * This entity's own scratch parents, shared by its records and its principals' scopes but by
+     * no other entity: entities whose parent chains are disjoint run side by side, and one that
+     * shares a parent record with another could see that entity's writes through it.
+     */
+    ancestors: AncestorCache;
+    /** Identities this entity's collection is known to hold; no create the API tester sends may reuse one. */
+    taken: Set<string>;
+    /**
+     * Cohort variants the backend refused. A check that stands down for want of cohort data says
+     * which variants never arrived, so the gap points at the seed rather than the API.
+     */
+    lostVariants: string[];
+}
+/** The records the entity's checks run against, and what the API tester knows about them. */
+export interface World {
+    scope: Scope;
+    records: Record_[];
+    /** Records the API tester did not write: every write-path check sits out rather than assert against them. */
+    degraded: boolean;
+    /** Adopted after a unique conflict: the unique-conflict checks still run against the row. */
+    uniqueAdopted: boolean;
+    /** The create answered with an acknowledgment rather than the record. */
+    createAcknowledged: boolean;
+    /** The records are the bodies the API tester sent: no read showed what the server stored. */
+    recordsUnverified?: true;
+}
+/** A world of records the API tester did not create: read from what the list already returns. */
+export declare function degradedWorld(existing: {
+    records: Record_[];
+    scope: Record<string, string>;
+}): World;
+//# sourceMappingURL=state.d.ts.map

package/dist/api/runtime/run/entity/state.js

@@ -0,0 +1,11 @@
+/** A world of records the API tester did not create: read from what the list already returns. */
+export function degradedWorld(existing) {
+    return {
+        createAcknowledged: false,
+        degraded: true,
+        records: existing.records,
+        scope: { created: [], values: existing.scope },
+        uniqueAdopted: false,
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/api/runtime/run/entity/test-entity.d.ts

@@ -0,0 +1,17 @@
+import type { EntityModel, OperationModel } from "../../../spec/graph/types.ts";
+import type { RunContext } from "../context.ts";
+import type { EntityRun } from "./state.ts";
+/**
+ * Tests one entity: seeds its world, gives every principal its scope, resolves what its list can
+ * query, and runs its checks. An entity with no list is tested by its root read, as the caller, or,
+ * with a create, through the records its creates return.
+ */
+export declare function testEntity(ctx: RunContext, entity: EntityModel): Promise<void>;
+/** The routes an entity's records are listed by, if any, and live under. */
+export interface CollectionRoutes {
+    listOp: OperationModel | undefined;
+    collectionOp: OperationModel;
+}
+/** One entity under test, before its seeding: its routes, its targets, and its own scratch state. */
+export declare function entityRun(ctx: RunContext, entity: EntityModel, { collectionOp, listOp }: CollectionRoutes): EntityRun;
+//# sourceMappingURL=test-entity.d.ts.map

package/dist/api/runtime/run/entity/test-entity.js

@@ -0,0 +1,91 @@
+import { rootReadIds } from "../../root-read.js";
+import { createIsAuthProvisioned, staticSubjects } from "../../scope/entities.js";
+import { entityIsSelf } from "../../self/operations.js";
+import { takenOf } from "../state.js";
+import { actorsOf } from "./actors.js";
+import { checkContext } from "./check-context.js";
+import { runChecks } from "./check-loop.js";
+import { rootRead } from "./root-read.js";
+import { seedWorld } from "./seed.js";
+import { selfIdentity } from "./self.js";
+/**
+ * Tests one entity: seeds its world, gives every principal its scope, resolves what its list can
+ * query, and runs its checks. An entity with no list is tested by its root read, as the caller, or,
+ * with a create, through the records its creates return.
+ */
+export async function testEntity(ctx, entity) {
+    const listOp = ctx.model.byOperationId.get(entity.list ?? "");
+    if (listOp === undefined) {
+        if (rootReadIds(entity).length > 0)
+            return rootRead(ctx, entity);
+        if (entityIsSelf(entity))
+            return selfIdentity(ctx, entity);
+    }
+    /* With no list, each record its creates return is found again by its item read. */
+    const collectionOp = listOp ?? (entity.read === undefined ? undefined : ctx.model.byOperationId.get(entity.create ?? ""));
+    if (collectionOp === undefined || ctx.network.gate.exhausted)
+        return;
+    /* No fallback for a list route itself: every other check on this entity is reached through
+     * it, so its exclusion is the whole entity's, not one operation's. */
+    if (ctx.exclusion.excludeOp(entity, listOp))
+        return;
+    const run = entityRun(ctx, entity, { collectionOp, listOp });
+    ctx.progress.check = undefined;
+    ctx.progress.tick({
+        entity: entity.name,
+        entityIndex: ctx.progress.entityIndex,
+        entityTotal: ctx.progress.entityTotal,
+        message: "seeding",
+        phase: "seed",
+        requests: ctx.progress.requests,
+    });
+    const world = await seedWorld(run, seedPlan(run));
+    if (world === null)
+        return;
+    const context = await checkContext(run, world, await actorsOf(run, world));
+    ctx.state.entitiesTested.push(entity.name);
+    await runChecks(run, context);
+}
+/** One entity under test, before its seeding: its routes, its targets, and its own scratch state. */
+export function entityRun(ctx, entity, { collectionOp, listOp }) {
+    const { model, scope, findings, principals, state } = ctx;
+    const createOp = model.byOperationId.get(entity.create ?? "");
+    /* Targets this entity's checks can grade. Seeding findings land on them: under --ops a seed
+     * that fails leaves exactly these ungraded, and the report has to say which. */
+    const targets = scope.mode === "full"
+        ? createOp === undefined
+            ? []
+            : [createOp.operationId]
+        : [...staticSubjects(entity, model)].filter((id) => scope.inScope(id));
+    const taken = takenOf(state, entity.name);
+    return {
+        ancestors: { creating: new Map(), made: new Map() },
+        collectionOp,
+        createOp,
+        ctx,
+        entity,
+        findings: targets.length === 0 ? findings : findings.attributed(targets),
+        index: [...model.entities.keys()].indexOf(entity.name),
+        listOp,
+        lostVariants: [],
+        roots: { ...principals.alpha.scope },
+        seeding: ctx.client.view({ purpose: "seed", subject: entity.name }),
+        taken,
+    };
+}
+function seedPlan({ ctx, entity, createOp }) {
+    const inviteOnly = entity.invite !== null && createOp === undefined;
+    return {
+        authProvisioned: createOp !== undefined && createIsAuthProvisioned(createOp, ctx.authCreates),
+        inviteOnly,
+        /* A listable entity with no create can still run an action that declares x-effects. The
+         * owner row is already there; the action's x-before makes the row it needs. */
+        needsListedCohort: createOp === undefined &&
+            !inviteOnly &&
+            entity.actions.some((id) => {
+                const action = ctx.model.byOperationId.get(id);
+                return action !== undefined && action.effects.length > 0 && ctx.scope.inScope(id);
+            }),
+    };
+}
+//# sourceMappingURL=test-entity.js.map

package/dist/api/runtime/run/errors.d.ts

@@ -0,0 +1,8 @@
+/**
+ * An unexpected error as a report states it: its message, named when it is not a plain `Error`.
+ *
+ * Never its stack. Every caller files the text as a finding, and `FindingCollector` makes a
+ * finding's text fit to share (no stack frame, no absolute path), so that rule lives there alone.
+ */
+export declare function errorText(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/api/runtime/run/errors.js

@@ -0,0 +1,11 @@
+import { messageOf } from "../../errors/message.js";
+/**
+ * An unexpected error as a report states it: its message, named when it is not a plain `Error`.
+ *
+ * Never its stack. Every caller files the text as a finding, and `FindingCollector` makes a
+ * finding's text fit to share (no stack frame, no absolute path), so that rule lives there alone.
+ */
+export function errorText(error) {
+    return error instanceof Error && error.name !== "Error" ? `${error.name}: ${error.message}` : messageOf(error);
+}
+//# sourceMappingURL=errors.js.map

package/dist/api/runtime/run/exclusion.d.ts

@@ -0,0 +1,3 @@
+import type { Exclusion, Loaded } from "./context.ts";
+export declare function createExclusion({ model, profile, state, findings }: Loaded): Exclusion;
+//# sourceMappingURL=exclusion.d.ts.map

package/dist/api/runtime/run/exclusion.js

@@ -0,0 +1,29 @@
+import { excludedByProfile } from "../profile.js";
+export function createExclusion({ model, profile, state, findings }) {
+    return {
+        excludeOp(entity, op) {
+            if (op === undefined)
+                return false;
+            const reason = excludedByProfile(op, profile.spec);
+            if (reason === null)
+                return false;
+            if (state.excludedIds.has(op.operationId))
+                return true;
+            state.excludedIds.add(op.operationId);
+            state.profileExclusions.push({ entity: entity.name, operationId: op.operationId, reason });
+            findings.attributed([op.operationId]).gap("profile.skip", entity.name, {
+                summary: `${op.operationId} excluded by profile "${profile.name}"`,
+                detail: `${reason}, under --profile ${profile.name}. Checks that depend on this operation stand ` +
+                    "down rather than run against data the API tester did not create through it.",
+            });
+            return true;
+        },
+        /* An operation the API tester never sends (TRACE) is out under every profile; doctor names it as a gap. */
+        excludes(operationId) {
+            const op = model.byOperationId.get(operationId);
+            return op !== undefined && (op.unsendable !== null || excludedByProfile(op, profile.spec) !== null);
+        },
+        readable: (op) => op.unsendable === null && excludedByProfile(op, profile.spec) === null,
+    };
+}
+//# sourceMappingURL=exclusion.js.map

package/dist/api/runtime/run/floor-credentials.d.ts

@@ -0,0 +1,15 @@
+import type { Recipe } from "../../config/types/security.ts";
+import type { FloorCredentials } from "../contract/types.ts";
+import type { RunContext } from "./context.ts";
+type FloorContext = Pick<RunContext, "store" | "model" | "options">;
+/** The floor's credential operations, and a dedicated actor of `principal`'s for each. */
+export declare function floorCredentials(ctx: FloorContext, principal: string): FloorCredentials;
+/**
+ * Every operation a principal's effective recipe names, however a step names it (by operationId, or by
+ * method and path): its login and refresh steps, its revokes, and its mint. No probe sends one.
+ */
+export declare function credentialOperations(ctx: FloorContext): Set<string>;
+/** Every principal's effective recipe, for every scheme the config covers. */
+export declare function recipesOf({ options, store }: FloorContext): Partial<Recipe>[];
+export {};
+//# sourceMappingURL=floor-credentials.d.ts.map

package/dist/api/runtime/run/floor-credentials.js

@@ -0,0 +1,91 @@
+/*
+ * Who the contract floor sends a credential operation as. An operation a recipe names (a login or
+ * refresh step, a revoke, a mint) can end, rotate or spend the session it is sent with, so it is
+ * never sent with a principal's own: a dedicated credential sends it, or nobody where the operation
+ * needs none. What a recipe names is the whole class; a route's name says nothing. A sign-in step's
+ * fields that name the principal are listed too: the floor fills them with an identity no account holds.
+ */
+import { revokeOperationId } from "../../credentials/anchors.js";
+import { effectiveRecipe } from "../../credentials/effective.js";
+import { probeCredentials, stepOperation } from "./probe-credentials.js";
+/** The floor's credential operations, and a dedicated actor of `principal`'s for each. */
+export function floorCredentials(ctx, principal) {
+    const probe = probeCredentials(ctx);
+    return {
+        actorFor: (op) => actorFor(probe, principal, op),
+        identityFields: identityFieldsOf(recipesOf(ctx), stepOperation(ctx.model)),
+        operations: credentialOperations(ctx),
+    };
+}
+/**
+ * Every operation a principal's effective recipe names, however a step names it (by operationId, or by
+ * method and path): its login and refresh steps, its revokes, and its mint. No probe sends one.
+ */
+export function credentialOperations(ctx) {
+    const operationOf = stepOperation(ctx.model);
+    return new Set(recipesOf(ctx).flatMap((recipe) => namedBy(recipe, operationOf)));
+}
+/** Every principal's effective recipe, for every scheme the config covers. */
+export function recipesOf({ options, store }) {
+    return Object.entries(options.security ?? {}).flatMap(([scheme, base]) => 
+    /* A configured base always yields a recipe. */
+    Object.values(store.principals).map((entry) => effectiveRecipe(base, entry.security?.[scheme])));
+}
+/* The body fields each sign-in step (a login or refresh step) fills from the principal, by its operation. */
+function identityFieldsOf(recipes, operationOf) {
+    const fields = new Map();
+    for (const step of recipes.flatMap((recipe) => [...(recipe.login?.steps ?? []), ...(recipe.refresh?.steps ?? [])])) {
+        const id = operationOf(step);
+        if (id === undefined || !("body" in step))
+            continue;
+        const known = fields.get(id) ?? new Map();
+        /* A body that is one string, a form say, has no field to fill. */
+        for (const path of principalPaths(step.body, []))
+            if (path.length > 0)
+                known.set(JSON.stringify(path), path);
+        if (known.size > 0)
+            fields.set(id, known);
+    }
+    return new Map([...fields].map(([id, known]) => [id, [...known.values()]]));
+}
+/* The paths, through plain objects, of every string that reads a `{principal.<key>}`. */
+function principalPaths(value, at) {
+    if (typeof value === "string")
+        return value.includes("{principal.") ? [at] : [];
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return [];
+    return Object.entries(value).flatMap(([key, item]) => principalPaths(item, [...at, key]));
+}
+/* The operations one recipe names: its login and refresh steps, its revokes, and its mint. */
+function namedBy(recipe, operationOf) {
+    const steps = [...(recipe.login?.steps ?? []), ...(recipe.refresh?.steps ?? [])];
+    const ids = [
+        ...steps.map(operationOf),
+        revokeOperationId(recipe.login?.revoke),
+        recipe.mint?.operationId,
+        recipe.mint?.revoke,
+    ];
+    return ids.filter((id) => id !== undefined);
+}
+/* Nobody, for an operation that admits it; else a dedicated credential for the first alternative that can have one. */
+async function actorFor(probe, principal, op) {
+    const { alternatives } = op.security;
+    if (alternatives.some((alternative) => alternative.length === 0))
+        return { as: { anonymous: true } };
+    const reasons = [];
+    for (const alternative of alternatives) {
+        const [only] = alternative;
+        if (alternative.length > 1) {
+            reasons.push(`${alternative.map((r) => r.scheme).join(" + ")}: a dedicated credential holds one scheme`);
+            continue;
+        }
+        const held = await probe.dedicated({ principal, scheme: only.scheme, scopes: only.scopes });
+        if (!("untested" in held))
+            return { as: { principal: held.actor.principal, scheme: held.scheme } };
+        reasons.push(`${only.scheme}: ${held.untested}`);
+    }
+    return {
+        untested: `a credential operation is sent with a dedicated credential, never ${principal}'s own session, and none could be had: ${reasons.join("; ")}`,
+    };
+}
+//# sourceMappingURL=floor-credentials.js.map

package/dist/api/runtime/run/fresh.d.ts

@@ -0,0 +1,31 @@
+import type { PrincipalEntry } from "../../config/types/security.ts";
+import type { Exchange } from "../exchange.ts";
+import type { Connected } from "./context.ts";
+/** A principal signed up by the run, and what its signup sent and answered, by name. */
+export interface Provisioned {
+    id: string;
+    /** The body sent and the answer's top-level strings: a later body field of the same name gets them. */
+    known: Record<string, unknown>;
+}
+/** Who to sign up: its id, its config entry, and the label that keeps its generated values its own. */
+export interface FreshRequest {
+    id: string;
+    entry: PrincipalEntry;
+    label: string;
+}
+/** Signs `request.id` up and binds it in the run's store; BLOCKED with the reason when it cannot. */
+export declare function provision(ctx: Connected, request: FreshRequest): Promise<Provisioned | {
+    blocked: string;
+}>;
+/**
+ * Binds the account a sign-up made as principal `id`: what the body sent becomes its identity, and a
+ * credential the answer carries at a recipe's `from` is held for it; otherwise its recipe acquires
+ * one. What the body sent and the answer's top-level strings, by name.
+ */
+export declare function bindSignUp(ctx: Connected, made: {
+    id: string;
+    entry: PrincipalEntry;
+    body: Record<string, unknown>;
+    signup: Exchange;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=fresh.d.ts.map

package/dist/api/runtime/run/fresh.js

@@ -0,0 +1,87 @@
+/*
+ * A fresh principal, signed up by the run (D7): the operation the document marks
+ * `x-fresh-principal`, sent a body generated from its schema. The body's values bind into the
+ * principal's identity, never its tenant or scope, so its login recipe can read `{principal.email}`;
+ * a tenant or a scope parameter comes only from a login's claims. When the answer carries a value at
+ * the effective login recipe's `from`, that is the credential; otherwise the recipe acquires one.
+ * A configured `fresh: true` principal and every disposable session are made this way, and bound in
+ * the store as principals of their own, so they refresh and retry a 401 like any other.
+ */
+import { effectiveRecipe } from "../../credentials/effective.js";
+import { readAnswer } from "../../credentials/read.js";
+import { requestSchema } from "../../spec/collection/request.js";
+import { buildCohort } from "../fixture.js";
+import { applyResolveInput } from "../input.js";
+import { answerOf } from "../steps/engine.js";
+/* Keys that grade or authenticate a principal: a signup body's values never set them. */
+const RESERVED = /* @__PURE__ */ new Set([
+    "created",
+    "fresh",
+    "inviteAs",
+    "rank",
+    "readOnly",
+    "scope",
+    "security",
+    "tenant",
+]);
+/** Signs `request.id` up and binds it in the run's store; BLOCKED with the reason when it cannot. */
+export async function provision(ctx, request) {
+    const { id, entry } = request;
+    const register = ctx.model.operations.find((op) => op.freshPrincipal);
+    if (register === undefined) {
+        return { blocked: `signup for ${id}: the document marks no x-fresh-principal operation` };
+    }
+    const body = await signupBody(ctx, register, request.label);
+    const signup = await ctx.client.view({ purpose: "auth" }).request(register.method, register.path, {
+        as: { anonymous: true },
+        body,
+        operationId: register.operationId,
+    });
+    if (signup.status < 200 || signup.status >= 300) {
+        return { blocked: `signup for ${id} by ${register.operationId}: answered ${signup.status}` };
+    }
+    return { id, known: await bindSignUp(ctx, { body, entry, id, signup }) };
+}
+/**
+ * Binds the account a sign-up made as principal `id`: what the body sent becomes its identity, and a
+ * credential the answer carries at a recipe's `from` is held for it; otherwise its recipe acquires
+ * one. What the body sent and the answer's top-level strings, by name.
+ */
+export async function bindSignUp(ctx, made) {
+    const { id, entry, body, signup } = made;
+    const identity = Object.fromEntries(Object.entries(body).filter(([key]) => !RESERVED.has(key)));
+    ctx.store.enroll(id, { ...entry, ...identity });
+    const answer = answerOf(signup);
+    /* What the signup answered beside the credential, a refresh_token say, is what its refresh runs from. */
+    const saved = stringsOf(signup.responseBody);
+    for (const [scheme, base] of Object.entries(ctx.options.security ?? {})) {
+        const from = effectiveRecipe(base, entry.security?.[scheme])?.login?.from;
+        const value = from === undefined ? undefined : readAnswer(answer, from);
+        /* A value the scheme cannot place is not held, and the recipe's own acquire says why. */
+        if (value !== undefined)
+            await ctx.store.adopt({ principal: id, scheme, scope: saved, value });
+    }
+    return { ...saved, ...body };
+}
+/* The register operation's body: one baseline member of its schema, then `resolveInput`. */
+async function signupBody(ctx, register, label) {
+    /* Every operation of a built model has its raw operation. */
+    const raw = ctx.model.rawOperations.get(register.operationId);
+    const schema = requestSchema(raw);
+    if (schema === null)
+        return {};
+    /* One variant asked for, one member back, and its body is always an object. */
+    const [member] = buildCohort(schema, ctx.seed, {
+        nonce: `${ctx.nonce}${label}`,
+        operationId: register.operationId,
+        variants: ["baseline"],
+    });
+    return applyResolveInput(member.body, ctx.hooks.resolveInput, { operationId: register.operationId, schema });
+}
+/* The top-level strings of an answer's body. */
+function stringsOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return {};
+    return Object.fromEntries(Object.entries(body).filter((entry) => typeof entry[1] === "string"));
+}
+//# sourceMappingURL=fresh.js.map

package/dist/api/runtime/run/identity.d.ts

@@ -0,0 +1,9 @@
+/** A principal's identity, split into its tenant, its scope and the data recipes interpolate. */
+export interface Bound {
+    identity: Record<string, unknown>;
+    tenant?: string;
+    scope: Record<string, string>;
+}
+/** The tenant, scope and identity data of what the store holds for a principal. */
+export declare function boundOf(held: Readonly<Record<string, unknown>>): Bound;
+//# sourceMappingURL=identity.d.ts.map

package/dist/api/runtime/run/identity.js

@@ -0,0 +1,28 @@
+/*
+ * A principal's identity as the credential store holds it: its config data, a fresh signup's values
+ * and what a login's `claims` bound. `tenant` and `scope` grade and place it; the rest is what
+ * recipes interpolate as `{principal.<key>}`. A claim binds a parameter as a `scope.<param>` key,
+ * which wins over the config's `scope`.
+ */
+const SCOPED = "scope.";
+/** The tenant, scope and identity data of what the store holds for a principal. */
+export function boundOf(held) {
+    const identity = {};
+    const scope = { ...strings(held["scope"]) };
+    for (const [key, value] of Object.entries(held)) {
+        if (key.startsWith(SCOPED)) {
+            if (typeof value === "string")
+                scope[key.slice(SCOPED.length)] = value;
+        }
+        else if (key !== "scope" && key !== "tenant")
+            identity[key] = value;
+    }
+    return typeof held["tenant"] === "string" ? { identity, scope, tenant: held["tenant"] } : { identity, scope };
+}
+/* The string entries of a plain object; anything else binds none. */
+function strings(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+//# sourceMappingURL=identity.js.map

package/dist/api/runtime/run/index.d.ts

@@ -0,0 +1,4 @@
+export { entityLanes } from "./lanes.ts";
+export { run } from "./pipeline.ts";
+export type { CheckTiming, RunOptions, RunResult } from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/runtime/run/index.js

@@ -0,0 +1,3 @@
+export { entityLanes } from "./lanes.js";
+export { run } from "./pipeline.js";
+//# sourceMappingURL=index.js.map

package/dist/api/runtime/run/interrupt.d.ts

@@ -0,0 +1,6 @@
+import type { RunContext } from "./context.ts";
+/** Whether the run should stop: stopped from outside, or the network is gone for good. */
+export declare function stopped({ options, network }: RunContext): boolean;
+/** A stop that came after every entity had started still stopped something: say so. */
+export declare function noteLateStop({ options, state, findings, progress }: RunContext): void;
+//# sourceMappingURL=interrupt.d.ts.map

package/dist/api/runtime/run/interrupt.js

@@ -0,0 +1,15 @@
+/** Whether the run should stop: stopped from outside, or the network is gone for good. */
+export function stopped({ options, network }) {
+    return options.signal?.aborted === true || network.gate.exhausted;
+}
+/** A stop that came after every entity had started still stopped something: say so. */
+export function noteLateStop({ options, state, findings, progress }) {
+    if (options.signal?.aborted !== true || state.interrupted)
+        return;
+    state.interrupted = true;
+    findings.gap("run.interrupted", "run", {
+        summary: `stopped during the ${progress.phase} phase`,
+        detail: "the run was interrupted; what was tested is reported, and what the API tester created is removed",
+    });
+}
+//# sourceMappingURL=interrupt.js.map

package/dist/api/runtime/run/lanes.d.ts

@@ -0,0 +1,23 @@
+import type { EntityModel, SpecModel } from "../../spec/graph/types.ts";
+import type { RunContext } from "./context.ts";
+/**
+ * Tests every entity in scope, lane by lane.
+ *
+ * Checks inside an entity stay ordered because cascade suppression consults findings already
+ * reported for it — concurrent checks would let a root cause and its consequences race and both
+ * be reported. Nested graphs couple entities too: a child create in flight while a parent
+ * page-walk runs invents pagination findings. So entities that can observe each other share a
+ * lane and run in series, and only lanes run side by side.
+ */
+export declare function runLanes(ctx: RunContext): Promise<void>;
+/**
+ * Entities grouped into lanes that can be tested side by side.
+ *
+ * Two entities share a lane when one can observe the other's writes: one's collection lives
+ * under the other's (a child, created inside a parent the API tester also makes), an operation of one
+ * invalidates a route of the other, or one's effects, waits or async polls land on the other.
+ * Inside a lane entities keep their order and run one after another; lanes share nothing, so
+ * nothing one does can turn up as a finding in another.
+ */
+export declare function entityLanes(model: SpecModel, entities: readonly EntityModel[]): EntityModel[][];
+//# sourceMappingURL=lanes.d.ts.map