@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/run/result.js

@@ -0,0 +1,98 @@
+import { accountReport } from "./accounts.js";
+import { applyBaseline } from "../baseline.js";
+import { keptCredentials, snapshotPrincipal } from "../principals.js";
+import { buildScopeReport } from "../scope/report.js";
+import {} from "../scope/types.js";
+import { runPrincipal } from "./principals.js";
+/** What the run graded, per operation, from the transcript and the grades as they stand. */
+export function scopeReport({ authCreates, options, findings, grades, model, scope, client }) {
+    return buildScopeReport({
+        authCreates,
+        baseUrl: options.baseUrl,
+        findings: findings.findings,
+        inconclusive: findings.inconclusive,
+        ledger: grades,
+        model,
+        scope,
+        transcript: client.transcript,
+    });
+}
+/**
+ * The run's last writes, once its closing calls are sent: the journal flushed. Returns the principals as they stand for
+ * `principals.json`, the BLOCKED ones with why, holding no credential
+ * value; the values come back only when the run was asked to keep them.
+ */
+export async function settle(ctx) {
+    await ctx.journal?.flush().catch(() => undefined);
+    const { principals, store, client } = ctx;
+    const held = await store.snapshot();
+    /* A BLOCKED principal is kept too, with why: a persisted run says who it went on without. */
+    const blocked = principals.blocked.map(({ id, reason }) => ({ ...runPrincipal(store, id), blocked: reason }));
+    return {
+        principals: [...principals.all, ...blocked].map((principal) => snapshotPrincipal(principal, { held, redactor: client.redactor })),
+        ...(ctx.options.keepCredentials === true ? { credentials: keptCredentials(held) } : {}),
+    };
+}
+/** The result of a run the network cut short before any principal could act. */
+export async function earlyResult(planned) {
+    await planned.journal?.flush().catch(() => undefined);
+    /* Accounts its principals' sign-ups made before it stopped: nothing removes them now. */
+    const accounts = planned.accounts.owed();
+    for (const entry of accounts) {
+        planned.accounts.settle(entry, { note: "the run stopped before teardown", status: "left" });
+    }
+    return {
+        ...resultOf(planned),
+        created: accounts.length,
+        principals: [],
+        scope: scopeReport(planned),
+        teardown: accounts.length === 0 ? null : accountReport(accounts),
+    };
+}
+/** The result of a run that went the whole way. */
+export function finalResult(ctx, settled, coverage) {
+    const { options, findings, state, ledger, targetVersion } = ctx;
+    const baselined = options.baseline === undefined ? undefined : applyBaseline(findings.findings, options.baseline);
+    return {
+        ...resultOf(ctx),
+        ...(baselined === undefined ? {} : { baseline: baselined }),
+        ...(targetVersion === undefined ? {} : { targetVersion }),
+        created: ledger.recorded + ctx.accounts.entries().filter((entry) => entry.status !== "refused").length,
+        principals: settled.principals,
+        ...(settled.credentials === undefined ? {} : { credentials: settled.credentials }),
+        scope: coverage,
+        teardown: withUnidentified(state.teardown, ledger.unidentifiedCreates),
+        ...(state.interrupted ? { interrupted: true } : {}),
+    };
+}
+/** What every result carries, however far the run got. */
+function resultOf({ state, findings, client, model, profile, fence, options, journal, network }) {
+    return {
+        checkNotes: state.checkNotes,
+        checkTimings: state.checkTimings,
+        checksOutOfScope: state.checksOutOfScope,
+        checksRun: [...state.checksRun].sort(),
+        checksSkipped: state.checksSkipped,
+        checksSuppressed: state.checksSuppressed,
+        client,
+        created: 0,
+        entitiesTested: state.entitiesTested,
+        findings: findings.findings,
+        inconclusive: findings.inconclusive,
+        model,
+        profile: profile.name,
+        profileExclusions: state.profileExclusions,
+        ...(fence === undefined
+            ? {}
+            : { fenced: { failRun: options.fence?.failRun !== false, requests: [...fence.fenced] } }),
+        ...(journal === null ? {} : { exchanges: { count: journal.count } }),
+        ...(network.outcome === undefined ? {} : { network: network.outcome }),
+    };
+}
+/* Creates the API tester could not identify belong in the teardown report even when nothing else was ledgered. */
+function withUnidentified(teardown, unidentified) {
+    if (unidentified.length === 0)
+        return teardown;
+    return { ...(teardown ?? { failed: [], records: [], removed: 0, unidentified: [], unsupported: [] }), unidentified };
+}
+//# sourceMappingURL=result.js.map

package/dist/api/runtime/run/scenarios.d.ts

@@ -0,0 +1,4 @@
+import type { RunContext } from "./context.ts";
+/** The declared flows for operations the matrix cannot reach, after the matrix's fixtures are gone. */
+export declare function scenarios(ctx: RunContext): Promise<void>;
+//# sourceMappingURL=scenarios.d.ts.map

package/dist/api/runtime/run/scenarios.js

@@ -0,0 +1,50 @@
+import { accountOps } from "../accounts/ops.js";
+import { deletedDuringRun } from "../accounts/watch.js";
+import { externalExcluded } from "../profile.js";
+import { runScenarios } from "../scenario/run.js";
+import { stopped } from "./interrupt.js";
+/** The declared flows for operations the matrix cannot reach, after the matrix's fixtures are gone. */
+export async function scenarios(ctx) {
+    const { progress, ownScenarios, state, client, principals, findings, grades, hooks, scope, model } = ctx;
+    progress.enter("scenario", `${ownScenarios.length} scenario(s)`);
+    const accounts = scenarioAccounts(ctx);
+    await runScenarios({
+        ...(accounts === undefined ? {} : { accounts }),
+        checksRun: state.checksRun,
+        client,
+        defaultPrincipal: principals.alpha.id,
+        findings,
+        grades,
+        hooks,
+        inScope: (operationId) => scope.inScope(operationId),
+        mode: scope.mode,
+        model,
+        originClients: ctx.originClients,
+        outOfBand: ctx.options.outOfBand ?? {},
+        principals: new Map(principals.all.map((principal) => [principal.id, { scope: principal.scope }])),
+        blocked: new Map(principals.blocked.map((principal) => [principal.id, principal.reason])),
+        scenarios: ownScenarios,
+        skipped: (scenario) => externalExcluded(scenario, ctx.options.externals?.kinds, ctx.profile),
+        stopped: () => stopped(ctx),
+    });
+}
+/**
+ * The run's ledger as a scenario reaches it, when the document can delete an account as itself: a
+ * self delete settles an entry only while it is owed.
+ */
+function scenarioAccounts(ctx) {
+    const { accounts } = ctx;
+    const deleteSelf = accountOps(ctx.model).deleteSelf?.operationId;
+    if (deleteSelf === undefined)
+        return undefined;
+    return {
+        deleteSelf,
+        deletedItself: (entry, exchange) => {
+            if (!accounts.owed().includes(entry))
+                return;
+            accounts.settle(entry, { note: deletedDuringRun(deleteSelf, exchange.seq), status: "removed" });
+        },
+        madeBy: (exchange) => accounts.madeBy(exchange),
+    };
+}
+//# sourceMappingURL=scenarios.js.map

package/dist/api/runtime/run/scope-plan.d.ts

@@ -0,0 +1,7 @@
+import type { Connected, Planned } from "./context.ts";
+/**
+ * What this run grades and what it may call, decided before any principal signs up: a typo in
+ * --ops, or a scenario naming an operation it never calls, must cost nothing.
+ */
+export declare function planScope(connected: Connected): Planned;
+//# sourceMappingURL=scope-plan.d.ts.map

package/dist/api/runtime/run/scope-plan.js

@@ -0,0 +1,64 @@
+import { excludedByProfile } from "../profile.js";
+import { assertScenarios } from "../scenario/validate.js";
+import { authStepOperationIds } from "../scope/entities.js";
+import { GradeLedger } from "../grades.js";
+import { resolveTargetScope } from "../scope/target.js";
+import {} from "../scope/types.js";
+import { uploadMemory } from "../upload.js";
+/**
+ * What this run grades and what it may call, decided before any principal signs up: a typo in
+ * --ops, or a scenario naming an operation it never calls, must cost nothing.
+ */
+export function planScope(connected) {
+    const { options, model, originClients, profile, progress } = connected;
+    const authCreates = authStepOperationIds(options);
+    const scope = resolveTargetScope(model, {
+        ...(options.ops === undefined ? {} : { ops: options.ops }),
+        ...(options.only === undefined ? {} : { only: options.only }),
+        authCreates,
+        exclusion: { profile: profile.name, reason: (op) => excludedByProfile(op, profile.spec) },
+        origins: new Map([...originClients].map(([id, origin]) => [id, origin.model])),
+    });
+    const ownScenarios = scenariosOf(connected);
+    progress.tick({ message: scopeMessage(scope), phase: "load", requests: progress.requests });
+    return {
+        ...connected,
+        authCreates,
+        grades: new GradeLedger(),
+        ownScenarios,
+        scenarioOwned: new Set(ownScenarios.flatMap((scenario) => scenario.covers)),
+        scope,
+        uploads: uploadsOf(connected),
+    };
+}
+/* A scenario that belongs to a secondary origin runs in that origin's run, not here. */
+function scenariosOf({ options, model, originClients }) {
+    const own = (options.scenarios ?? []).filter((scenario) => scenario.origin === undefined);
+    for (const scenario of options.scenarios ?? []) {
+        if (scenario.origin !== undefined && !originClients.has(scenario.origin)) {
+            throw new Error(`testing api: scenario "${scenario.id}" belongs to origin "${scenario.origin}", which is not in config.origins`);
+        }
+    }
+    assertScenarios(own, (id, origin) => origin === undefined
+        ? model.byOperationId.has(id)
+        : originClients.get(origin)?.model.byOperationId.has(id) === true);
+    return own;
+}
+function scopeMessage(scope) {
+    if (scope.mode === "full")
+        return "scope: full";
+    const entities = scope.entities.length;
+    return `scope: targeted · ${scope.targets.size} operation(s) · ${entities} entit${entities === 1 ? "y" : "ies"}`;
+}
+function uploadsOf({ options, hooks, seed }) {
+    return {
+        memory: uploadMemory(),
+        seed,
+        ...(options.uploads === undefined ? {} : { uploads: options.uploads }),
+        ...(options.configDir === undefined ? {} : { configDir: options.configDir }),
+        ...(hooks.resolveUpload === undefined ? {} : { resolveUpload: hooks.resolveUpload }),
+        ...(hooks.resolveInput === undefined ? {} : { resolveInput: hooks.resolveInput }),
+        ...(options.warn === undefined ? {} : { warn: options.warn }),
+    };
+}
+//# sourceMappingURL=scope-plan.js.map

package/dist/api/runtime/run/security-target.d.ts

@@ -0,0 +1,39 @@
+import { UnsatisfiedSecurity } from "../../client/credential-source.ts";
+import type { Probed, WriteTarget } from "../checks/core/operation-context.ts";
+import type { OperationModel } from "../../spec/graph/types.ts";
+import type { Disposable } from "../teardown/types.ts";
+import type { RunContext } from "./context.ts";
+/** What one read back gave: the record's current state, or why the probe is untested. */
+type ReadBack = {
+    current: unknown;
+} | {
+    untested: string;
+    blocked: UnsatisfiedSecurity;
+};
+/** One record's read back: the answer, the transcript length it is known current to, and the ids its path names. */
+interface SharedRead {
+    read: Promise<ReadBack>;
+    since: number;
+    ids: ReadonlySet<string>;
+}
+/** The reads one security stage shares, keyed by record: its creator, the read, and the read's path. */
+export interface TargetReads {
+    held: Map<string, SharedRead>;
+}
+/** A stage's shared reads: none yet. */
+export declare function targetReads(): TargetReads;
+/**
+ * The run-created record `op` can be probed against, read back (through the stage's `reads` when
+ * given); undefined when there is none, and untested, citing the block, when its creator's credential
+ * is BLOCKED.
+ */
+export declare function recordTarget(ctx: RunContext, op: OperationModel, reads?: TargetReads): Promise<Probed<WriteTarget> | undefined>;
+/** The first record the run created (default: every one ledgered) that `op` names as its single record. */
+export declare function targetRecord(ctx: Pick<RunContext, "ledger" | "model">, op: OperationModel, records?: readonly Disposable[]): Disposable | undefined;
+/**
+ * `op`'s target on `record`, one `targetRecord` picked for it, read back as its creator: through the
+ * stage's `reads` when given, so a read another probe made of it serves while nothing changed it.
+ */
+export declare function targetOf(ctx: RunContext, op: OperationModel, record: Disposable, reads?: TargetReads): Promise<Probed<WriteTarget>>;
+export {};
+//# sourceMappingURL=security-target.d.ts.map

package/dist/api/runtime/run/security-target.js

@@ -0,0 +1,139 @@
+/*
+ * The record a write or item-read probe may target: one this run created, taken from the ledger, read
+ * back as its creator so a write's body can be the record's current state. Never an id the run did
+ * not create, and never a collection — a probe only ever sends to a record that already exists. The
+ * parameter the record's id fills must name a record of its entity: `{token}` in
+ * `/invites/{token}/accept` names an invite, so only an invite the run created fills it, never the
+ * table the operation is filed under.
+ *
+ * A stage reads each record back once and shares the read with every probe kind and operation that
+ * names it (`TargetReads`), until a write that may have changed it: the next probe reads it again.
+ */
+import { UnsatisfiedSecurity } from "../../client/credential-source.js";
+import { fillPath } from "../fill-path.js";
+import { owningEntityOf } from "../../spec/graph/roots.js";
+import { SAFE } from "../../spec/methods.js";
+import { recordOf } from "../world/records.js";
+/** A stage's shared reads: none yet. */
+export function targetReads() {
+    return { held: new Map() };
+}
+/**
+ * The run-created record `op` can be probed against, read back (through the stage's `reads` when
+ * given); undefined when there is none, and untested, citing the block, when its creator's credential
+ * is BLOCKED.
+ */
+export async function recordTarget(ctx, op, reads) {
+    const record = targetRecord(ctx, op);
+    return record === undefined ? undefined : targetOf(ctx, op, record, reads);
+}
+/** The first record the run created (default: every one ledgered) that `op` names as its single record. */
+export function targetRecord(ctx, op, records = ctx.ledger.entries()) {
+    return records.find((record) => itemParams(op, record) !== undefined && ownParam(ctx.model, op, record) && actsOn(ctx.model, op, record));
+}
+/*
+ * Whether `op` acts on the record rather than on a collection under it: another entity's create or
+ * list (the rows under a table) is a collection route, never a probe's target.
+ */
+function actsOn(model, op, record) {
+    if (record.entity === op.entity)
+        return true;
+    return ![...model.entities.values()].some((entity) => entity.create === op.operationId || entity.list === op.operationId);
+}
+/* Whether the parameter the record's id fills names a record of the record's own entity. */
+function ownParam(model, op, record) {
+    const param = op.pathParams.find((name) => !(name in record.scope));
+    return owningEntityOf(model.operations, op.path, param) === record.entity;
+}
+/**
+ * `op`'s target on `record`, one `targetRecord` picked for it, read back as its creator: through the
+ * stage's `reads` when given, so a read another probe made of it serves while nothing changed it.
+ */
+export async function targetOf(ctx, op, record, reads) {
+    /* `targetRecord` picks only a record the operation names. */
+    const params = itemParams(op, record);
+    const read = await readBack(ctx, { entity: record.entity, op, owner: record.owner.id, params }, reads);
+    if ("untested" in read)
+        return read;
+    return {
+        current: read.current,
+        entity: record.entity,
+        id: record.id,
+        owner: record.owner.id,
+        params,
+        path: fillPath(op.path, params),
+    };
+}
+/*
+ * The write's path parameters for this record: its creation scope, and the one remaining parameter
+ * filled with its id. A write whose every parameter the scope already names is a collection write,
+ * which has no single record to target.
+ */
+function itemParams(op, record) {
+    const missing = op.pathParams.filter((name) => !(name in record.scope));
+    if (missing.length !== 1)
+        return undefined;
+    return { ...record.scope, [missing[0]]: record.id };
+}
+/*
+ * The record as its creator reads it now, out of any envelope, for a harmless body: by the read at
+ * the probe's own path, else its entity's documented read. Undefined when neither exists or the read
+ * does not show the record; nothing undocumented is ever sent. Shared through `reads` while no write
+ * since may have changed the record; each probe gets its own copy to build a body from.
+ */
+async function readBack(ctx, at, reads) {
+    const { model } = ctx;
+    const read = model.byRoute.get(`GET ${at.op.path}`) ?? model.byOperationId.get(model.entities.get(at.entity)?.read ?? "");
+    if (read === undefined)
+        return { current: undefined };
+    const path = fillPath(read.path, at.params);
+    if (reads === undefined)
+        return readAs(ctx, { at, path, read });
+    const key = `${at.owner} ${read.operationId} ${path}`;
+    let shared = reads.held.get(key);
+    if (shared === undefined || changedSince(ctx, shared)) {
+        const since = ctx.client.transcript.length;
+        shared = { ids: new Set(Object.values(at.params)), read: readAs(ctx, { at, path, read }), since };
+        reads.held.set(key, shared);
+    }
+    else
+        shared.since = ctx.client.transcript.length;
+    const answer = await shared.read;
+    return "current" in answer ? { current: structuredClone(answer.current) } : answer;
+}
+/*
+ * Whether a request since the read may have changed the record: a write, by anyone, whose path names
+ * the record's id or an ancestor's, and that was not refused with a 4xx. One that went through changed
+ * it; a server error or a lost answer may have.
+ */
+function changedSince(ctx, shared) {
+    const { client } = ctx;
+    return client.transcript.slice(shared.since).some((exchange) => {
+        if (SAFE.has(exchange.method) || (exchange.status >= 400 && exchange.status < 500))
+            return false;
+        return namesOf(client.relativePath(exchange.url), exchange).some((name) => shared.ids.has(name));
+    });
+}
+/* The values a request's path holds: each segment as sent, and each parameter as its template decoded it. */
+function namesOf(path, exchange) {
+    return [...path.split("/"), ...Object.values(exchange.pathParams ?? {})];
+}
+/*
+ * One read back as the record's creator. A creator whose credential is BLOCKED reads nothing, and the
+ * probe is untested with the block as its reason.
+ */
+async function readAs(ctx, { at, path, read }) {
+    try {
+        const answer = await ctx.client
+            .readOnlyView({ purpose: "probe", subject: at.op.operationId })
+            .get(path, { as: { principal: at.owner } });
+        return { current: answer.status >= 200 && answer.status < 300 ? recordOf(read, answer.responseBody) : undefined };
+    }
+    catch (error) {
+        if (!(error instanceof UnsatisfiedSecurity) || error.kind !== "blocked")
+            return { current: undefined };
+        const why = `${at.owner}'s credential is BLOCKED (${error.reason})`;
+        return { blocked: error, untested: `${at.op.operationId}'s target could not be read back: ${why}` };
+    }
+}
+//# sourceMappingURL=security-target.js.map

package/dist/api/runtime/run/security-throwaway.d.ts

@@ -0,0 +1,27 @@
+import type { Probed, WriteTarget } from "../checks/core/operation-context.ts";
+import type { OperationModel } from "../../spec/graph/types.ts";
+import type { RunContext } from "./context.ts";
+/** The write stage's throwaways: each DELETE operation's current one, and how many were made. */
+export interface Throwaways {
+    held: Map<string, WriteTarget>;
+    made: number;
+}
+/** Throwaways for one write stage: none yet. */
+export declare function throwaways(): Throwaways;
+/** Whether `op` removes a record: its probes take a throwaway target. */
+export declare function isDelete(op: OperationModel): boolean;
+/**
+ * The throwaway `op`'s next probe sends to: the one it holds, else a new one. Untested, with the
+ * reason, when the run created no record `op` names to model it on, its entity has no create, or the
+ * create made nothing the API tester could ledger.
+ */
+export declare function throwawayTarget(ctx: RunContext, op: OperationModel, throwaway: Throwaways): Promise<Probed<WriteTarget>>;
+/**
+ * Drops `op`'s throwaway when a DELETE sent to it since the `since`th exchange went through: the
+ * probe consumed it, and the next probe on `op` makes another.
+ */
+export declare function settle(ctx: RunContext, throwaway: Throwaways, at: {
+    op: OperationModel;
+    since: number;
+}): void;
+//# sourceMappingURL=security-throwaway.d.ts.map

package/dist/api/runtime/run/security-throwaway.js

@@ -0,0 +1,126 @@
+/*
+ * A DELETE probe's target: a throwaway record of its own, never one another step uses. A refusal
+ * probe's DELETE that a broken API applies takes its record with it, and a shared record's children
+ * after it, so each DELETE operation gets a record made for it alone: by its entity's create, as the
+ * creator of the record a write probe would target, in that record's scope, with no children. It is
+ * ledgered like any create and removed by teardown; one a probe's DELETE consumed is already gone.
+ */
+import { UnsatisfiedSecurity } from "../../client/credential-source.js";
+import { messageOf } from "../../errors/message.js";
+import { encodeForOperation } from "../body/encode.js";
+import { buildCohort } from "../fixture.js";
+import { fillPath } from "../fill-path.js";
+import { uniquifyProbeBody } from "../unique.js";
+import { bodyIdentity, createWithClientId, reserveIdentity } from "../world/client-identity.js";
+import { requestSchemaOf, stringProperties } from "../world/schema.js";
+import { targetOf, targetRecord } from "./security-target.js";
+import { takenOf } from "./state.js";
+/** Throwaways for one write stage: none yet. */
+export function throwaways() {
+    return { held: new Map(), made: 0 };
+}
+/** Whether `op` removes a record: its probes take a throwaway target. */
+export function isDelete(op) {
+    return op.method.toUpperCase() === "DELETE";
+}
+/**
+ * The throwaway `op`'s next probe sends to: the one it holds, else a new one. Untested, with the
+ * reason, when the run created no record `op` names to model it on, its entity has no create, or the
+ * create made nothing the API tester could ledger.
+ */
+export async function throwawayTarget(ctx, op, throwaway) {
+    const kept = throwaway.held.get(op.operationId);
+    if (kept !== undefined)
+        return kept;
+    const shared = targetRecord(ctx, op);
+    if (shared === undefined)
+        return { untested: `a record this run created that ${op.operationId} can be sent to` };
+    const { entity } = shared;
+    const createOp = ctx.model.byOperationId.get(ctx.model.entities.get(entity)?.create ?? "");
+    if (createOp === undefined) {
+        return { untested: `a create for ${entity}, to make a throwaway record that ${op.operationId} can remove` };
+    }
+    throwaway.made += 1;
+    const made = await create(ctx, { createOp, label: `t${throwaway.made}`, op, shared });
+    if ("untested" in made)
+        return { ...made, untested: `a throwaway ${entity} for ${op.operationId}: ${made.untested}` };
+    const target = await targetOf(ctx, op, made);
+    if (!("untested" in target))
+        throwaway.held.set(op.operationId, target);
+    return target;
+}
+/**
+ * Drops `op`'s throwaway when a DELETE sent to it since the `since`th exchange went through: the
+ * probe consumed it, and the next probe on `op` makes another.
+ */
+export function settle(ctx, throwaway, at) {
+    const target = throwaway.held.get(at.op.operationId);
+    if (target === undefined)
+        return;
+    const { client } = ctx;
+    const consumed = client.transcript
+        .slice(at.since)
+        .some((exchange) => `${exchange.method} ${client.relativePath(exchange.url)}` === `DELETE ${target.path}` &&
+        exchange.status >= 200 &&
+        exchange.status < 300);
+    if (consumed)
+        throwaway.held.delete(at.op.operationId);
+}
+/*
+ * One record of the shared record's entity, made by `createOp` as its creator in its scope, and the
+ * ledger's entry for it, one `op` names: the tracker ledgers it as the answer arrives. A client-chosen
+ * identity is reserved as a check's create reserves one, and drawn again when another tenant's record
+ * holds it (`createWithClientId`). Untested with the answer, the refused identities, or the error,
+ * when there is none.
+ */
+async function create(ctx, { createOp, label, op, shared }) {
+    const before = ctx.ledger.entries().length;
+    try {
+        const schema = requestSchemaOf(createOp, ctx.model) ?? {};
+        const at = {
+            identity: bodyIdentity(ctx.model, createOp, schema),
+            schema,
+            taken: takenOf(ctx.state, shared.entity),
+            token: `i${label}`,
+        };
+        const send = async (fields) => {
+            const encoded = await encodeForOperation(createOp, ctx.model, { fields, uploads: ctx.uploads });
+            return ctx.client
+                .view({ purpose: "probe", subject: createOp.operationId })
+                .request(createOp.method.toUpperCase(), fillPath(createOp.path, shared.scope), {
+                as: { principal: shared.owner.id },
+                body: encoded.body,
+                operationId: createOp.operationId,
+                ...(encoded.contentType === undefined ? {} : { contentType: encoded.contentType }),
+            });
+        };
+        const { exchange, exhausted } = await createWithClientId(reserveIdentity(bodyOf(ctx, { createOp, label }), at), send, at);
+        if (exhausted !== undefined)
+            return { untested: exhausted };
+        const made = targetRecord(ctx, op, ctx.ledger.entries().slice(before));
+        return made ?? { untested: `${createOp.operationId} answered ${exchange.status}` };
+    }
+    catch (error) {
+        /* A creator whose credential is BLOCKED stops the probe as the read back would: say so, never just stand down. */
+        const blocked = error instanceof UnsatisfiedSecurity && error.kind === "blocked" ? { blocked: error } : {};
+        return { untested: messageOf(error), ...blocked };
+    }
+}
+/*
+ * A valid body for the create, as an ancestor's is drawn: every string and unique value carries the
+ * run's nonce and the throwaway's label, so it never takes a value the cohort or another throwaway holds.
+ */
+function bodyOf(ctx, { createOp, label }) {
+    const schema = requestSchemaOf(createOp, ctx.model);
+    const unique = createOp.unique ?? [];
+    /* One variant asked for, one member made. */
+    const [member] = buildCohort(schema ?? {}, ctx.seed, {
+        defs: ctx.model.defs,
+        distinct: new Set([...unique.flat(), ...stringProperties(schema)]),
+        nonce: `${ctx.nonce}${label}`,
+        operationId: createOp.operationId,
+        variants: ["baseline"],
+    });
+    return uniquifyProbeBody(member.body, unique, { schema, token: `${label}-${ctx.nonce}` });
+}
+//# sourceMappingURL=security-throwaway.js.map

package/dist/api/runtime/run/security.d.ts

@@ -0,0 +1,11 @@
+import type { RegisteredCheck } from "../checks/core/check.ts";
+import type { RunContext } from "./context.ts";
+/** The collection reads, before the lanes: run concurrently. */
+export declare function runReadSecurity(ctx: RunContext, registry?: readonly RegisteredCheck[]): Promise<void>;
+/**
+ * After the lanes: the reads of one record, concurrently; then the writes and credential-changing
+ * probes, alone and in order. The reads go first, so a write that removes a record cannot pull it
+ * from under them. Every probe of the stage shares one read back of each record it targets.
+ */
+export declare function runWriteSecurity(ctx: RunContext, registry?: readonly RegisteredCheck[]): Promise<void>;
+//# sourceMappingURL=security.d.ts.map