@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/scope/target.js

@@ -0,0 +1,62 @@
+import { staticSubjects, testableEntities, untestableReason } from "./entities.js";
+import { targetEntity, targetPattern } from "./targeting.js";
+/** The targeted scope: the entities whose checks grade a target, and why any other target never can be. */
+function targetedScope(ctx, testable, authCreates, requested) {
+    const { model, targets } = ctx;
+    const graded = new Set();
+    const entities = testable.filter((entity) => {
+        const subjects = staticSubjects(entity, model);
+        const hit = [...subjects].some((id) => targets.has(id));
+        if (hit)
+            for (const id of subjects)
+                if (targets.has(id))
+                    graded.add(id);
+        return hit;
+    });
+    const untestable = new Map();
+    for (const id of targets) {
+        if (graded.has(id))
+            continue;
+        /* A primary target is an operationId of the model. */
+        untestable.set(id, untestableReason(model.byOperationId.get(id), model, authCreates));
+    }
+    const origins = new Map();
+    for (const [originId, ids] of ctx.originTargets)
+        if (ids.size > 0)
+            origins.set(originId, [...ids]);
+    return {
+        entities,
+        excluded: ctx.excluded,
+        inScope: (operationId) => targets.has(operationId),
+        mode: "targeted",
+        origins,
+        requested,
+        targets,
+        untestable,
+    };
+}
+export function resolveTargetScope(model, input) {
+    const ops = [...(input.ops ?? [])].map((s) => s.trim()).filter(Boolean);
+    const only = [...(input.only ?? [])].map((s) => s.trim()).filter(Boolean);
+    const authCreates = input.authCreates ?? new Set();
+    const testable = testableEntities(model, authCreates);
+    if (ops.length === 0 && only.length === 0) {
+        return {
+            entities: testable,
+            excluded: [],
+            inScope: () => true,
+            mode: "full",
+            origins: new Map(),
+            requested: { only, ops },
+            targets: new Set(),
+            untestable: new Map(),
+        };
+    }
+    const t = { excluded: [], input, model, originTargets: new Map(), targets: new Set() };
+    for (const pattern of ops)
+        targetPattern(t, pattern);
+    for (const name of only)
+        targetEntity(t, name);
+    return targetedScope(t, testable, authCreates, { only, ops });
+}
+//# sourceMappingURL=target.js.map

package/dist/api/runtime/scope/targeting.d.ts

@@ -0,0 +1,19 @@
+/** Collecting a targeted run's operations: `--ops` patterns and `--only` entities, per origin, under the profile. */
+import type { SpecModel } from "../../spec/graph/types.ts";
+import type { ScopeInput } from "./types.ts";
+/** What a targeted run has gathered so far. */
+export interface Targeting {
+    model: SpecModel;
+    input: ScopeInput;
+    targets: Set<string>;
+    originTargets: Map<string, Set<string>>;
+    excluded: Array<{
+        operationId: string;
+        reason: string;
+    }>;
+}
+/** One `--ops` pattern: `<origin>:<pattern>` against that origin, anything else against the primary. */
+export declare function targetPattern(t: Targeting, pattern: string): void;
+/** One `--only` entity: every operation it owns, on the primary and on each origin that models it. */
+export declare function targetEntity(t: Targeting, name: string): void;
+//# sourceMappingURL=targeting.d.ts.map

package/dist/api/runtime/scope/targeting.js

@@ -0,0 +1,82 @@
+/** Collecting a targeted run's operations: `--ops` patterns and `--only` entities, per origin, under the profile. */
+import { didYouMean } from "../../errors/suggest.js";
+import { resolveOperationName } from "../../spec/operation-name.js";
+import { matchPattern } from "./match.js";
+import { ScopeError } from "./scope-error.js";
+function admit(t, candidate) {
+    const { exclusion } = t.input;
+    /* A candidate id comes from its model, so its operation is there. */
+    const op = candidate.model.byOperationId.get(candidate.id);
+    const reason = exclusion === undefined ? null : exclusion.reason(op);
+    if (exclusion === undefined || reason === null) {
+        candidate.into.add(candidate.id);
+        return;
+    }
+    if (candidate.exact) {
+        throw new ScopeError(`testing api: target ${candidate.label} is excluded by --profile ${exclusion.profile} (${reason}). ` +
+            `Drop it from --ops or run --profile full.`);
+    }
+    t.excluded.push({ operationId: candidate.label, reason });
+}
+function originSet(t, originId) {
+    const into = t.originTargets.get(originId) ?? new Set();
+    t.originTargets.set(originId, into);
+    return into;
+}
+/** One `--ops` pattern: `<origin>:<pattern>` against that origin, anything else against the primary. */
+export function targetPattern(t, pattern) {
+    const { input } = t;
+    const colon = pattern.indexOf(":");
+    const originId = colon > 0 ? pattern.slice(0, colon) : undefined;
+    const originModel = originId === undefined ? undefined : input.origins?.get(originId);
+    if (originId !== undefined && originModel !== undefined) {
+        const into = originSet(t, originId);
+        const matched = matchPattern(pattern.slice(colon + 1), originModel, pattern);
+        for (const id of matched.ids) {
+            admit(t, { exact: matched.exact, id, into, label: `${originId}:${id}`, model: originModel });
+        }
+        return;
+    }
+    /* A prefix that names no configured origin, on an id the primary does not have. */
+    if (originId !== undefined &&
+        resolveOperationName(pattern, t.model.byOperationId) === undefined &&
+        input.origins !== undefined) {
+        const known = [...input.origins.keys()];
+        throw new ScopeError(`testing api: --ops "${pattern}" names origin "${originId}", which is not configured.` +
+            (known.length === 0 ? "" : ` Known: ${known.join(", ")}.`));
+    }
+    const matched = matchPattern(pattern, t.model, pattern);
+    for (const id of matched.ids)
+        admit(t, { exact: matched.exact, id, into: t.targets, label: id, model: t.model });
+}
+/** One `--only` entity: every operation it owns, on the primary and on each origin that models it. */
+export function targetEntity(t, name) {
+    const { model, input } = t;
+    let found = false;
+    if (model.entities.has(name)) {
+        found = true;
+        for (const op of model.operations) {
+            if (op.entity === name)
+                admit(t, { exact: false, id: op.operationId, into: t.targets, label: op.operationId, model });
+        }
+    }
+    for (const [originId, originModel] of input.origins ?? []) {
+        if (!originModel.entities.has(name))
+            continue;
+        found = true;
+        const into = originSet(t, originId);
+        for (const op of originModel.operations) {
+            if (op.entity !== name)
+                continue;
+            admit(t, { exact: false, id: op.operationId, into, label: `${originId}:${op.operationId}`, model: originModel });
+        }
+    }
+    if (!found) {
+        const known = [
+            ...model.entities.keys(),
+            ...[...(input.origins?.values() ?? [])].flatMap((m) => [...m.entities.keys()]),
+        ];
+        throw new ScopeError(`testing api: --only "${name}" names no entity.${didYouMean(name, known)}`);
+    }
+}
+//# sourceMappingURL=targeting.js.map

package/dist/api/runtime/scope/types.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Operation scope: which operations a run grades.
+ *
+ * A full run grades every operation some check judges. A targeted run (`--ops`, `--only`) grades
+ * only the named operations. Everything else the API tester calls — principal sign-up, parent creates, the
+ * cohort create behind a list, teardown deletes — is support: called to reach or observe a
+ * target, never graded. Resolution is static over the entity graph so `testing api plan --ops` can show
+ * the scope with no network, and so a typo fails before the first request.
+ */
+import type { EntityModel, OperationModel, SpecModel } from "../../spec/graph/types.ts";
+import type { Exchange } from "../exchange.ts";
+import type { Finding, Inconclusive } from "../finding.ts";
+import type { GradeLedger, PassEvidence } from "../grades.ts";
+export interface ScopeInput {
+    /** operationIds; `*` globs within one id; `<originId>:<operationId>` routes to an origin. */
+    ops?: readonly string[];
+    /** Entity names; each expands to every operation the entity owns. */
+    only?: readonly string[];
+    /** Secondary origins by id, so prefixed targets validate before any request. */
+    origins?: ReadonlyMap<string, SpecModel>;
+    /** Creates that already ran as principal auth steps — those entities are not fixtures. */
+    authCreates?: ReadonlySet<string>;
+    /** Active profile gate. An exact target it excludes is a usage error, not a quiet gap. */
+    exclusion?: {
+        profile: string;
+        reason: (op: OperationModel) => string | null;
+    };
+}
+export interface TargetScope {
+    mode: "full" | "targeted";
+    requested: {
+        ops: string[];
+        only: string[];
+    };
+    /** Primary-origin targets. Empty in a full run, where `inScope` is always true. */
+    targets: ReadonlySet<string>;
+    /** Origin id → its targets, prefix removed. Only origins with at least one target appear. */
+    origins: ReadonlyMap<string, string[]>;
+    /** Entities seeded and checked, in run order. */
+    entities: EntityModel[];
+    /** Target → why no check can ever grade it. */
+    untestable: ReadonlyMap<string, string>;
+    /** Glob or `--only` matches the profile excluded, dropped from the targets. */
+    excluded: Array<{
+        operationId: string;
+        reason: string;
+    }>;
+    inScope: (operationId: string) => boolean;
+}
+export type OperationStatus = "passed" | "failed" | "inconclusive" | "blocked" | "untested";
+export type PassTier = "contract" | "verified";
+/**
+ * `verified`: a later exchange shows what the call did. `complete`: a read, or an operation that
+ * declares it has no effects, met its contract, which is all it promises. `unproven`: the call met
+ * its contract, but whatever it changes was never observed.
+ */
+export type Sufficiency = "verified" | "complete" | "unproven";
+export interface OperationCoverage {
+    operationId: string;
+    /** Secondary origin id; absent on the primary. */
+    origin?: string;
+    entity: string | null;
+    status: OperationStatus;
+    /** `gaps`: ran, but reported it could not exercise this operation (a missing peer, tag, or route). */
+    checks: {
+        passed: string[];
+        failed: string[];
+        suppressed: string[];
+        inconclusive: string[];
+        gaps: string[];
+    };
+    /** Defect findings attributed to this operation. */
+    findings: number;
+    /** Why it was not graded, when it was not. */
+    reason: string | null;
+    /**
+     * How a pass was proven. `verified`: a later exchange shows a value from the call.
+     * `contract`: the call got a documented success and its body matched the schema.
+     */
+    tier?: PassTier;
+    /** The exchanges behind a pass. */
+    evidence?: PassEvidence;
+    /** How far a pass goes; see `sufficiencyOf`. */
+    sufficiency?: Sufficiency;
+    /** One line on why the pass goes that far, or why the operation did not pass. */
+    why?: string;
+}
+/** An operation a targeted run called without grading it. */
+export interface SupportUse {
+    operationId: string;
+    origin?: string;
+    calls: number;
+    non2xx: number;
+    firstFailure?: {
+        status: number;
+        requestId: string;
+    };
+}
+export interface ScopeReport {
+    mode: "full" | "targeted";
+    requested: {
+        ops: string[];
+        only: string[];
+    };
+    operations: OperationCoverage[];
+    support: SupportUse[];
+    /** Glob or `--only` matches the profile excluded. */
+    excluded: Array<{
+        operationId: string;
+        reason: string;
+    }>;
+    /** Secondary origins a targeted run did not touch because none of their operations were targets. */
+    originsSkipped: string[];
+}
+export interface CoverageInput {
+    model: SpecModel;
+    scope: TargetScope;
+    ledger: GradeLedger;
+    findings: readonly Finding[];
+    inconclusive: readonly Inconclusive[];
+    transcript: readonly Exchange[];
+    baseUrl: string;
+    authCreates: ReadonlySet<string>;
+}
+export interface ScopePlan {
+    mode: "full" | "targeted";
+    requested: {
+        ops: string[];
+        only: string[];
+    };
+    entities: string[];
+    targets: Array<{
+        operationId: string;
+        entity: string | null;
+        checks: string[];
+    }>;
+    untestable: Array<{
+        operationId: string;
+        reason: string;
+    }>;
+    /** Predicted from the graph: lifecycle routes of queued entities and the parents their creates need. */
+    support: string[];
+    excluded: Array<{
+        operationId: string;
+        reason: string;
+    }>;
+    origins: Record<string, string[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/runtime/scope/types.js

@@ -0,0 +1,11 @@
+/**
+ * Operation scope: which operations a run grades.
+ *
+ * A full run grades every operation some check judges. A targeted run (`--ops`, `--only`) grades
+ * only the named operations. Everything else the API tester calls — principal sign-up, parent creates, the
+ * cohort create behind a list, teardown deletes — is support: called to reach or observe a
+ * target, never graded. Resolution is static over the entity graph so `testing api plan --ops` can show
+ * the scope with no network, and so a typo fails before the first request.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/runtime/seed-error.d.ts

@@ -0,0 +1,23 @@
+import type { Exchange } from "./exchange.ts";
+/** The request a seed failed on, when the failure was an HTTP response. */
+export interface FailedRequest {
+    /** Status the failing request returned. */
+    status: number;
+    /** The create that failed — a parent's, not always the entity's own. */
+    operationId?: string;
+    exchange?: Exchange;
+}
+/** Why a record the API tester needed could not be made or found: the parameter or operation, and the answer. */
+export declare class SeedError extends Error {
+    /** The path parameter or operation the seed failed on. */
+    readonly culprit: string;
+    /** Status the failing request returned, when the failure was an HTTP response. */
+    readonly status: number | undefined;
+    /** The create that failed, when the failure was one — a parent's, not always the entity's own. */
+    readonly operationId: string | undefined;
+    readonly exchange: Exchange | undefined;
+    constructor(
+    /** The path parameter or operation the seed failed on. */
+    culprit: string, message: string, request?: FailedRequest);
+}
+//# sourceMappingURL=seed-error.d.ts.map

package/dist/api/runtime/seed-error.js

@@ -0,0 +1,19 @@
+/** Why a record the API tester needed could not be made or found: the parameter or operation, and the answer. */
+export class SeedError extends Error {
+    culprit;
+    /** Status the failing request returned, when the failure was an HTTP response. */
+    status;
+    /** The create that failed, when the failure was one — a parent's, not always the entity's own. */
+    operationId;
+    exchange;
+    constructor(
+    /** The path parameter or operation the seed failed on. */
+    culprit, message, request) {
+        super(message);
+        this.culprit = culprit;
+        this.status = request?.status;
+        this.operationId = request?.operationId;
+        this.exchange = request?.exchange;
+    }
+}
+//# sourceMappingURL=seed-error.js.map

package/dist/api/runtime/self/actions.d.ts

@@ -0,0 +1,12 @@
+/** GET actions on the caller with no path id: each asked about what the create sent, and must answer about it. */
+import type { Client } from "../../client/client.ts";
+import type { EntityModel, SpecModel } from "../../spec/graph/types.ts";
+import type { FindingCollector, Outcome } from "../finding.ts";
+import type { CreatedCaller } from "./create.ts";
+export declare function runSelfActions(input: {
+    principal: string;
+    client: Client;
+    entity: EntityModel;
+    model: SpecModel;
+}, findings: FindingCollector, created: CreatedCaller | null): Promise<Outcome | null>;
+//# sourceMappingURL=actions.d.ts.map

package/dist/api/runtime/self/actions.js

@@ -0,0 +1,59 @@
+/** GET actions on the caller with no path id: each asked about what the create sent, and must answer about it. */
+import { SELF_CHECK_ID, selfActionIds } from "./operations.js";
+import { operation } from "./requests.js";
+/** The action's query, from the scalars the create sent under its parameter names. */
+function actionQuery(op, created) {
+    const query = {};
+    for (const name of op.queryParamNames) {
+        const value = created?.body[name];
+        if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+            query[name] = String(value);
+        }
+    }
+    return query;
+}
+/** A field the answer names that differs from what the query asked for, or `null`. */
+function answeredOther(response, query) {
+    if (response.responseBody === null || typeof response.responseBody !== "object")
+        return null;
+    const record = response.responseBody;
+    for (const [name, value] of Object.entries(query)) {
+        if (Object.prototype.hasOwnProperty.call(record, name) && String(record[name]) !== value)
+            return name;
+    }
+    return null;
+}
+export async function runSelfActions(input, findings, created) {
+    for (const id of selfActionIds(input.entity, input.model)) {
+        /* An action id comes from the model, so its operation is there. */
+        const op = operation(input.model, id);
+        const query = actionQuery(op, created);
+        const missing = op.queryParamNames.filter((name) => query[name] === undefined);
+        if (missing.length > 0) {
+            return findings.unresolved(SELF_CHECK_ID, input.entity.name, `${op.operationId} needs ${missing.join(", ")} and the create did not send it`);
+        }
+        const response = await input.client.request(op.method, op.path, {
+            as: { principal: input.principal },
+            operationId: op.operationId,
+            query,
+        });
+        if (response.status !== 200) {
+            return findings.backend(SELF_CHECK_ID, input.entity.name, {
+                summary: "the caller query failed",
+                detail: `${op.operationId} returned ${response.status} for ${JSON.stringify(query)}.`,
+                evidence: [response],
+            });
+        }
+        const other = answeredOther(response, query);
+        if (other !== null) {
+            const record = response.responseBody;
+            return findings.backend(SELF_CHECK_ID, input.entity.name, {
+                summary: "the caller query answered about a different value",
+                detail: `${op.operationId} was asked for ${other}=${query[other]} and returned ${JSON.stringify(record[other])}.`,
+                evidence: [response],
+            });
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=actions.js.map

package/dist/api/runtime/self/check.d.ts

@@ -0,0 +1,3 @@
+import type { UnlistedCheck } from "../checks/core/check.ts";
+export declare const selfIdentityCheck: UnlistedCheck<void>;
+//# sourceMappingURL=check.d.ts.map

package/dist/api/runtime/self/check.js

@@ -0,0 +1,26 @@
+import { runSelfIdentity } from "./identity.js";
+import { entityIsSelf, SELF_CHECK_ID, selfOperationIds } from "./operations.js";
+export const selfIdentityCheck = {
+    id: SELF_CHECK_ID,
+    mutates: true,
+    needs: "x-entity.identity: self, and a read or an update",
+    plan(ctx) {
+        const entity = ctx.model.entities.get(ctx.entityName);
+        if (entity === undefined || !entityIsSelf(entity)) {
+            return { ok: false, needs: "x-entity.identity: self, and a read or an update" };
+        }
+        return { ok: true, value: undefined };
+    },
+    async run(ctx) {
+        return runSelfIdentity({
+            principal: ctx.actor.id,
+            client: ctx.client,
+            entity: ctx.model.entities.get(ctx.entityName),
+            findings: ctx.findings,
+            model: ctx.model,
+            ...(ctx.ownRecords === undefined ? {} : { ownRecords: ctx.ownRecords }),
+        });
+    },
+    subjects: (entity, model) => selfOperationIds(entity, model),
+};
+//# sourceMappingURL=check.js.map

package/dist/api/runtime/self/create.d.ts

@@ -0,0 +1,26 @@
+/** The caller's own create, when the spec has one: what it sends, and whether the next read shows it. */
+import type { Client } from "../../client/client.ts";
+import type { Hooks } from "../../config/types/hooks.ts";
+import type { EntityModel, SpecModel } from "../../spec/graph/types.ts";
+import type { Exchange } from "../exchange.ts";
+import type { FindingCollector, Outcome } from "../finding.ts";
+export interface CreatedCaller {
+    body: Record<string, unknown>;
+    exchange: Exchange;
+}
+export interface CallerInput {
+    principal: string;
+    client: Client;
+    entity: EntityModel;
+    model: SpecModel;
+    nonce?: string;
+    resolveInput?: Hooks["resolveInput"];
+    seed?: number;
+}
+/** Whether the read shows a scalar the create sent, under the same field. */
+export declare function callerEchoed(sent: Record<string, unknown>, body: unknown): boolean;
+/** The create ran and the check ends on it: an unresolved body or a refused create. */
+export declare function failedToCreate(created: CreatedCaller | Outcome | null): created is Outcome;
+/** POST the spec's create. `null` when this caller record already exists. */
+export declare function createCaller(input: CallerInput, findings: FindingCollector): Promise<CreatedCaller | Outcome | null>;
+//# sourceMappingURL=create.d.ts.map

package/dist/api/runtime/self/create.js

@@ -0,0 +1,96 @@
+/** The caller's own create, when the spec has one: what it sends, and whether the next read shows it. */
+import { buildCohort } from "../fixture.js";
+import { applyResolveInput } from "../input.js";
+import { requestSchemaOf } from "../world/schema.js";
+import { SELF_CHECK_ID } from "./operations.js";
+import { operation, pathOf } from "./requests.js";
+/** Optional fields stay out. A create that pairs them (a label without its url) is a different check. */
+function requiredSchema(schema) {
+    const required = Array.isArray(schema.required)
+        ? schema.required.filter((name) => typeof name === "string")
+        : [];
+    if (required.length === 0)
+        return schema;
+    const properties = schema.properties;
+    if (properties === null || typeof properties !== "object" || Array.isArray(properties))
+        return schema;
+    const source = properties;
+    const picked = {};
+    for (const name of required)
+        if (name in source)
+            picked[name] = source[name];
+    return { ...schema, properties: picked, required };
+}
+function propertyNames(schema) {
+    const properties = schema.properties;
+    if (properties === null || typeof properties !== "object" || Array.isArray(properties))
+        return new Set();
+    return new Set(Object.keys(properties));
+}
+/** Whether the read shows a scalar the create sent, under the same field. */
+export function callerEchoed(sent, body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return false;
+    const record = body;
+    return Object.entries(sent).some(([key, value]) => {
+        if (value === null || typeof value === "object")
+            return false;
+        return record[key] === value;
+    });
+}
+function callerBody(input, findings, { operationId, schema }) {
+    const required = requiredSchema(schema);
+    try {
+        /* One variant asked for, one member made: buildCohort maps the variants it is given. */
+        const member = buildCohort(required, input.seed ?? 1, {
+            variants: ["baseline"],
+            distinct: propertyNames(required),
+            ...(input.nonce === undefined ? {} : { nonce: input.nonce }),
+            operationId,
+        })[0];
+        return { body: member.body };
+    }
+    catch (error) {
+        /* buildCohort reports every failure as an overflow naming why. */
+        return { outcome: findings.unresolved(SELF_CHECK_ID, input.entity.name, error.message) };
+    }
+}
+/** The create ran and the check ends on it: an unresolved body or a refused create. */
+export function failedToCreate(created) {
+    return created !== null && "kind" in created;
+}
+/** POST the spec's create. `null` when this caller record already exists. */
+export async function createCaller(input, findings) {
+    const createOp = operation(input.model, input.entity.create);
+    if (createOp === undefined)
+        return null;
+    const createPath = pathOf(createOp);
+    if (createPath === null) {
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, `${createOp.operationId} needs a path id`);
+    }
+    const schema = requestSchemaOf(createOp, input.model);
+    if (schema === null) {
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, `${createOp.operationId} declares no request body`);
+    }
+    const generated = callerBody(input, findings, { operationId: createOp.operationId, schema });
+    if ("outcome" in generated)
+        return generated.outcome;
+    let body = generated.body;
+    if (input.resolveInput !== undefined) {
+        body = await applyResolveInput(body, input.resolveInput, { operationId: createOp.operationId, schema });
+    }
+    const exchange = await input.client.request(createOp.method, createPath, {
+        body,
+        as: { principal: input.principal },
+        operationId: createOp.operationId,
+    });
+    if (exchange.status < 200 || exchange.status >= 300) {
+        return findings.backend(SELF_CHECK_ID, input.entity.name, {
+            summary: "creating the caller failed",
+            detail: `${createOp.operationId} returned ${exchange.status} for the signed-up caller.`,
+            evidence: [exchange],
+        });
+    }
+    return { body, exchange };
+}
+//# sourceMappingURL=create.js.map

package/dist/api/runtime/self/guard.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Who the self check acts as. The caller's record is the caller's own: its update never picks a
+ * field the caller signs in with (`protectedFields`). When proving the update or the create needs
+ * one (the only field there is to change, a field the create requires), the run's disposable
+ * principal acts instead, whose record is its to change; with none, the check stands down, naming it.
+ */
+import type { Outcome } from "../finding.ts";
+import type { SelfInput } from "./input.ts";
+import type { SelfRun } from "./verdicts.ts";
+/** The principal the check acts as, and the fields its update must leave alone. */
+export interface Acting {
+    principal: string;
+    avoid: ReadonlySet<string>;
+}
+export declare function actingAs(input: SelfInput, run: SelfRun): Promise<Acting | Outcome>;
+//# sourceMappingURL=guard.d.ts.map