@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/world/read-back.js

@@ -0,0 +1,120 @@
+/**
+ * The record a create made, when its answer is not that record.
+ *
+ * A create may answer an acknowledgment, `{ id, message }`, or nothing but a `Location`. Taking
+ * that for the record seeds the cohort with the acknowledgment's own fields: every check that
+ * reads a field off a seeded record then works from what the server never said it stored. Such an
+ * answer is read back through the entity's item read, by the id it gave, and the cohort holds what
+ * the read returns. With nothing to read it back by, the record is what the API tester sent under that id,
+ * marked unverified, and checks that would judge stored fields against it stand down.
+ */
+import { UnsatisfiedSecurity } from "../../client/credential-source.js";
+import { messageOf } from "../../errors/message.js";
+import { itemSchemaOf } from "../checks/payloads/item-schema.js";
+import { FencedError } from "../fence.js";
+import { fillPath } from "../fill-path.js";
+import { readRoute } from "./confirm.js";
+import { idOf, isPlainRecord, recordOf } from "./records.js";
+import { requestSchemaOf } from "./schema.js";
+/**
+ * Whether an answer is the record the create made: it names every field the item schema requires
+ * and every field the create sent. Names, not values — a server may normalize what it stores.
+ */
+export function answersRecord(answer, expected) {
+    return [...expected.required, ...expected.submitted].every((name) => Object.hasOwn(answer, name));
+}
+/* A request property the server takes and never returns: a password, a secret. */
+function writeOnly(schema, name) {
+    const property = schema?.properties?.[name];
+    return property?.writeOnly === true;
+}
+/** What the create answered, short of the record: only the fields the record's own schema has. */
+function answeredOf(input) {
+    return isPlainRecord(input.answered) ? input.answered : {};
+}
+/**
+ * The fields of a create's answer the entity's record declares: an acknowledgment's `message` is
+ * no field of the record, and is never seeded as one. Nothing, when the record declares none.
+ */
+export function declaredFields(model, createOp, answer) {
+    const entity = createOp.entity === null ? undefined : model.entities.get(createOp.entity);
+    const opOf = (operationId) => operationId === undefined ? undefined : model.byOperationId.get(operationId);
+    const item = itemSchemaOf({ listOp: opOf(entity?.list), model, readOp: opOf(entity?.read) });
+    const properties = (item?.properties ?? {});
+    return Object.fromEntries(Object.entries(answer).filter(([name]) => Object.hasOwn(properties, name)));
+}
+/** The fields the create's answer must name to be the record (`answersRecord`). */
+export function expectedFields(model, createOp, sent) {
+    const entity = createOp.entity === null ? undefined : model.entities.get(createOp.entity);
+    const opOf = (operationId) => operationId === undefined ? undefined : model.byOperationId.get(operationId);
+    const item = itemSchemaOf({ listOp: opOf(entity?.list), model, readOp: opOf(entity?.read) });
+    const request = requestSchemaOf(createOp, model);
+    const submitted = isPlainRecord(sent)
+        ? Object.entries(sent)
+            .filter(([name, value]) => value !== undefined && !writeOnly(request, name))
+            .map(([name]) => name)
+        : [];
+    return { required: (item?.required ?? []), submitted };
+}
+/**
+ * The created record as the item read shows it under `id`, over what the create answered; or,
+ * unverified, what the create answered over what was sent: the answer is the server's, the body only
+ * what the API tester asked for.
+ */
+export async function readBackCreated(input) {
+    const { createOp, id, model } = input;
+    const identity = (createOp.entity === null ? undefined : model.entities.get(createOp.entity))?.identity ?? "id";
+    const unverified = (cause) => ({
+        acknowledged: false,
+        record: {
+            ...(isPlainRecord(input.sent) ? input.sent : {}),
+            ...answeredOf(input),
+            [identity]: id.value,
+        },
+        unverified: cause,
+    });
+    const route = createOp.entity === null
+        ? null
+        : readRoute({
+            entity: createOp.entity,
+            model,
+            ...(input.readable === undefined ? {} : { readable: input.readable }),
+        });
+    if (route === null)
+        return unverified("no item read");
+    let path;
+    try {
+        path = fillPath(route.readOp.path, { ...input.scope, [route.param]: id.id });
+    }
+    catch (error) {
+        return unverified(`the item read could not be addressed: ${messageOf(error)}`);
+    }
+    const read = await sendable(() => input.client.get(path, { as: { principal: input.principal }, operationId: route.readOp.operationId }));
+    if (typeof read === "string")
+        return unverified(`read back could not be sent: ${read}`);
+    if (read.status < 200 || read.status >= 300)
+        return unverified(`read back answered ${read.status}`);
+    const record = recordOf(route.readOp, read.responseBody);
+    if (record === undefined)
+        return unverified(`read back answered ${read.status} without the record`);
+    const readId = idOf(record, identity);
+    if (readId !== undefined && readId !== id.id)
+        return unverified(`read back answered ${read.status} with another record`);
+    /* The read shows what is stored; a field it leaves out keeps what the create answered. */
+    return { acknowledged: false, record: { ...answeredOf(input), ...record, [identity]: readId ?? id.value } };
+}
+/*
+ * The read, or why the creator could not send it: a credential that cannot meet its security, or
+ * the fence refusing it. Anything else, a network error among them, ends the seed as it would.
+ */
+async function sendable(send) {
+    try {
+        return await send();
+    }
+    catch (error) {
+        if (error instanceof UnsatisfiedSecurity || error instanceof FencedError)
+            return error.message;
+        throw error;
+    }
+}
+//# sourceMappingURL=read-back.js.map

package/dist/api/runtime/world/records.d.ts

@@ -0,0 +1,29 @@
+/** Records as a backend answers them: plain objects, read by identity, out of single and list bodies. */
+import type { CollectionShape } from "../../spec/collection/shape.ts";
+export type Record_ = Record<string, unknown>;
+export declare function isScalarId(value: unknown): value is string | number;
+export declare function isPlainRecord(value: unknown): value is Record_;
+/**
+ * The record a single-record answer holds: the object at the operation's declared
+ * `x-entity.recordPath`, or the body itself when nothing is declared. `undefined` when there is
+ * none — an update that answers `{ success, id, message }` holds no record, and comparing against
+ * an empty one would report every field dropped.
+ */
+export declare function recordOf(op: {
+    recordPath: string | null;
+}, body: unknown): Record_ | undefined;
+/**
+ * A record's identity as text, or `undefined` when it has none to give. Every id the API tester puts in a
+ * request goes through here (lint rule `testing/id-through-reader`): `String(record[identity])` on a
+ * record without one is the text "undefined", and a request made from it means nothing.
+ */
+export declare function idOf(record: Record_ | undefined, identity: string): string | undefined;
+/** Where a list body keeps its records: the rows' key (null for a bare array), and each record within a row. */
+export type RowsAt = Pick<CollectionShape, "key" | "within">;
+/**
+ * The records a list body holds: a bare array, or the array under the collection key, each row
+ * read at `within` when the rows wrap their record (`$.hits[*].document`). A row that holds no
+ * record is skipped; the response-schema checks report it, and no check reads a field off it.
+ */
+export declare function recordsFromList(body: unknown, rows: RowsAt | null): Record_[];
+//# sourceMappingURL=records.d.ts.map

package/dist/api/runtime/world/records.js

@@ -0,0 +1,45 @@
+/** Records as a backend answers them: plain objects, read by identity, out of single and list bodies. */
+import { readPath } from "../../client/read-path.js";
+export function isScalarId(value) {
+    return typeof value === "string" || typeof value === "number";
+}
+export function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * The record a single-record answer holds: the object at the operation's declared
+ * `x-entity.recordPath`, or the body itself when nothing is declared. `undefined` when there is
+ * none — an update that answers `{ success, id, message }` holds no record, and comparing against
+ * an empty one would report every field dropped.
+ */
+export function recordOf(op, body) {
+    const record = op.recordPath === null ? body : readPath(body, op.recordPath);
+    return isPlainRecord(record) ? record : undefined;
+}
+/**
+ * A record's identity as text, or `undefined` when it has none to give. Every id the API tester puts in a
+ * request goes through here (lint rule `testing/id-through-reader`): `String(record[identity])` on a
+ * record without one is the text "undefined", and a request made from it means nothing.
+ */
+export function idOf(record, identity) {
+    const value = record?.[identity];
+    return isScalarId(value) ? String(value) : undefined;
+}
+/**
+ * The records a list body holds: a bare array, or the array under the collection key, each row
+ * read at `within` when the rows wrap their record (`$.hits[*].document`). A row that holds no
+ * record is skipped; the response-schema checks report it, and no check reads a field off it.
+ */
+export function recordsFromList(body, rows) {
+    const key = rows?.key ?? null;
+    const list = Array.isArray(body) ? body : key === null || !isPlainRecord(body) ? undefined : body[key];
+    if (!Array.isArray(list))
+        return [];
+    const within = rows?.within ?? [];
+    return list.map((row) => within.reduce(field, row)).filter(isPlainRecord);
+}
+/* One property down, or nothing below what is not a record. */
+function field(node, name) {
+    return isPlainRecord(node) ? node[name] : undefined;
+}
+//# sourceMappingURL=records.js.map

package/dist/api/runtime/world/schema.d.ts

@@ -0,0 +1,7 @@
+/** The request body a create sends, as its schema. */
+import type { OperationModel, SpecModel } from "../../spec/graph/types.ts";
+import type { JsonSchema } from "../../spec/types.ts";
+export declare function requestSchemaOf(op: OperationModel, model: SpecModel): JsonSchema | null;
+/** Top-level properties of a request schema that hold text. */
+export declare function stringProperties(schema: JsonSchema | null): string[];
+//# sourceMappingURL=schema.d.ts.map

package/dist/api/runtime/world/schema.js

@@ -0,0 +1,21 @@
+/** The request body a create sends, as its schema. */
+import { requestContent } from "../../spec/collection/request.js";
+import { isObject } from "../generate/algebra.js";
+export function requestSchemaOf(op, model) {
+    const raw = model.rawOperations.get(op.operationId);
+    if (raw === undefined)
+        throw new Error(`${op.operationId} is not an operation of this model`);
+    const picked = requestContent(raw);
+    return picked === null ? null : picked.schema;
+}
+/** Top-level properties of a request schema that hold text. */
+export function stringProperties(schema) {
+    const properties = (schema?.properties ?? {});
+    return Object.entries(properties)
+        .filter(([, property]) => {
+        const type = isObject(property) ? property.type : undefined;
+        return type === "string" || (Array.isArray(type) && type.includes("string"));
+    })
+        .map(([name]) => name);
+}
+//# sourceMappingURL=schema.js.map

package/dist/api/runtime/world/seed-cohort.d.ts

@@ -0,0 +1,8 @@
+import type { OperationModel } from "../../spec/graph/types.ts";
+import type { Scope, SeededCohort, Seeding } from "./types.ts";
+/**
+ * Creates the cohort and returns the server's view of each instance. A create the principal must not
+ * send (`withheld`) is never sent: seeding stops with the reason.
+ */
+export declare function seedCohort(createOp: OperationModel, seeding: Seeding, scope: Scope): Promise<SeededCohort>;
+//# sourceMappingURL=seed-cohort.d.ts.map

package/dist/api/runtime/world/seed-cohort.js

@@ -0,0 +1,193 @@
+import { buildCohort, ensureDistinctUniqueValues, isOverflowError, overflowFrom, } from "../fixture.js";
+import { fillPath } from "../fill-path.js";
+import { SeedError } from "../seed-error.js";
+import { uniqueTupleCollides, uniquifyProbeBody } from "../unique.js";
+import { forEachInvocation } from "../upload-each.js";
+import { identitiesRefused, takenFor } from "./client-identity.js";
+import { failOrAdopt, postFresh, recordCreated, withGap } from "./cohort.js";
+import { listExisting } from "./list-existing.js";
+import { isScalarId } from "./records.js";
+import { requestSchemaOf } from "./schema.js";
+import { uploadContext } from "./upload-context.js";
+function cohortPlan(createOp, model) {
+    const schema = requestSchemaOf(createOp, model);
+    if (schema === null) {
+        throw new SeedError(createOp.operationId, `${createOp.operationId} declares no request body`);
+    }
+    const entity = createOp.entity === null ? undefined : model.entities.get(createOp.entity);
+    /* A client-chosen identity names one record by definition: never generate one an existing record
+     * holds. Generation only — the identity does not join the unique sets checks grade. */
+    const ownIdentity = entity?.identity ?? null;
+    const bodyProperties = (schema.properties ?? {});
+    const identityInBody = ownIdentity !== null &&
+        Object.hasOwn(bodyProperties, ownIdentity) &&
+        !(createOp.unique ?? []).some((set) => set.length === 1 && set[0] === ownIdentity);
+    const avoid = identityInBody && ownIdentity !== null ? [...(createOp.unique ?? []), [ownIdentity]] : (createOp.unique ?? []);
+    return { avoid, identity: entity?.identity ?? "id", identityInBody, ownIdentity, schema };
+}
+function plannedMembers(createOp, seeding, plan) {
+    const { model, options } = seeding;
+    const generated = buildCohort(plan.schema, options.seed, {
+        defs: model.defs,
+        distinct: new Set(plan.avoid.flat()),
+        ...(options.nonce === undefined ? {} : { nonce: options.nonce }),
+        operationId: createOp.operationId,
+    }).slice(0, options.cohortSize ?? 7);
+    return ensureDistinctUniqueValues(generated, createOp.unique ?? [], {
+        schema: plan.schema,
+        defs: model.defs,
+        distinct: new Set((createOp.unique ?? []).flat()),
+        ...(options.nonce === undefined ? {} : { nonce: options.nonce }),
+    });
+}
+/** The members redrawn until none shares a unique set with a listed record; none may name a listed identity. */
+function avoidExisting(input, members, existing) {
+    const { createOp, plan } = input;
+    const { avoid, ownIdentity } = plan;
+    let kept = members.map((member, index) => {
+        let body = member.body;
+        for (let token = 0; token < 8 && uniqueTupleCollides(body, avoid, existing); token++) {
+            body = uniquifyProbeBody(body, avoid, { schema: plan.schema, token: `ex${index}${token}-${input.nonce ?? ""}` });
+        }
+        return { ...member, body };
+    });
+    /* A body still naming an existing record's identity would overwrite or adopt it: never send it. */
+    if (plan.identityInBody && ownIdentity !== null) {
+        kept = kept.filter((member) => !uniqueTupleCollides(member.body, [[ownIdentity]], existing));
+        if (kept.length === 0) {
+            throw new SeedError(createOp.operationId, `every generated "${ownIdentity}" names an existing record, so nothing was created`);
+        }
+    }
+    return kept;
+}
+/** One create per fixture slot, from the baseline member. */
+async function seedSlot(run, members, nextUploads) {
+    const [baseline] = members;
+    const { exchange, sent: member } = await postFresh(run, baseline ?? { body: {}, variant: "baseline" }, nextUploads);
+    if (exchange.status >= 300) {
+        run.lastFail = { exchange, member };
+        return null;
+    }
+    const record = await recordCreated(run, exchange, member.body);
+    if (record === null)
+        return null;
+    run.seededMembers.push(member);
+    run.records.push(record);
+    return null;
+}
+/** Every planned member in turn; the first create decides whether there is a cohort at all. */
+async function seedPlanned(run, members, nextUploads) {
+    for (const planned of members) {
+        const { exchange, exhausted, sent: member } = await postFresh(run, planned, nextUploads);
+        if (exchange.status >= 300) {
+            /* The first create decides whether there is a cohort at all; a later one failing
+             * is a variant lost, reported rather than ending the cohort in silence. Identities
+             * refused every time adopt nothing: the seed fails, saying so. */
+            if (run.records.length === 0 && exhausted !== undefined)
+                throw identitiesRefused(run.createOp.operationId, exchange, exhausted);
+            if (run.records.length === 0)
+                return failOrAdopt(run, member, exchange);
+            run.failedVariants.push({ exchange, variant: member.variant });
+            continue;
+        }
+        const record = await recordCreated(run, exchange, member.body);
+        /* Acknowledged but never confirmed: no record to stand for, so no member either. */
+        if (record === null)
+            continue;
+        run.seededMembers.push(member);
+        run.records.push(record);
+    }
+    return null;
+}
+/** The cohort's seeding state before its first create. */
+function cohortRun(start) {
+    const { createOp, plan, scope } = start;
+    return {
+        acknowledged: false,
+        createOp,
+        existingIds: start.existingIds,
+        failedVariants: [],
+        identity: plan.identity,
+        lastFail: undefined,
+        ownIdentity: plan.ownIdentity,
+        path: fillPath(createOp.path, scope.values),
+        records: [],
+        schema: plan.schema,
+        scope,
+        seededMembers: [],
+        seeding: start.seeding,
+        uniqueGap: start.uniqueGap,
+        unverified: undefined,
+    };
+}
+/**
+ * Creates the cohort and returns the server's view of each instance. A create the principal must not
+ * send (`withheld`) is never sent: seeding stops with the reason.
+ */
+export async function seedCohort(createOp, seeding, scope) {
+    const withheld = seeding.options.withheld?.(createOp);
+    if (withheld !== undefined)
+        throw new SeedError(createOp.operationId, withheld);
+    return seedSent(createOp, seeding, scope);
+}
+/*
+ * The records the collection already holds, as this principal lists them: each identity is taken from
+ * now on, so a member drawn again after a collision never lands on one, and members are kept off them.
+ */
+async function besideExisting(createOp, { scope, seeding }, { members, plan }) {
+    const { model, client, options } = seeding;
+    const entity = createOp.entity === null ? undefined : model.entities.get(createOp.entity);
+    const listOp = entity?.list === undefined ? undefined : model.byOperationId.get(entity.list);
+    const existing = listOp === undefined
+        ? []
+        : await listExisting({ listOp, model, values: { ...options.roots, ...scope.values } }, client, options.principal);
+    const { ownIdentity } = plan;
+    const existingIds = ownIdentity === null
+        ? []
+        : existing
+            .map((row) => row[ownIdentity])
+            .filter(isScalarId)
+            .map(String);
+    const taken = takenFor(options, createOp);
+    for (const id of existingIds)
+        taken.add(id);
+    const kept = existing.length > 0 && plan.avoid.length > 0
+        ? avoidExisting({ createOp, nonce: options.nonce, plan }, members, existing)
+        : members;
+    return { existingIds, members: kept };
+}
+/* The cohort, created. */
+async function seedSent(createOp, seeding, scope) {
+    const { model, options } = seeding;
+    const plan = cohortPlan(createOp, model);
+    let members;
+    let uniqueGap;
+    let existingIds;
+    try {
+        const distinct = plannedMembers(createOp, seeding, plan);
+        if (distinct.gap !== null)
+            uniqueGap = distinct.gap;
+        ({ existingIds, members } = await besideExisting(createOp, { scope, seeding }, { members: distinct.members, plan }));
+    }
+    catch (error) {
+        if (isOverflowError(error))
+            throw overflowFrom(error, createOp.operationId);
+        throw error;
+    }
+    const run = cohortRun({ createOp, existingIds, plan, scope, seeding, uniqueGap });
+    const outcomes = await forEachInvocation(createOp.operationId, uploadContext(options), (nextUploads, slot) => slot === undefined ? seedPlanned(run, members, nextUploads) : seedSlot(run, members, nextUploads));
+    const early = outcomes.find((outcome) => outcome !== null);
+    if (early !== undefined)
+        return early;
+    if (run.records.length === 0 && run.lastFail !== undefined) {
+        /* A refusal always answers with a cohort or a seed error. */
+        const failed = await failOrAdopt(run, run.lastFail.member, run.lastFail.exchange);
+        return failed;
+    }
+    return withGap(run, {
+        featureGate: null,
+        members: run.seededMembers.length > 0 ? run.seededMembers : members,
+        records: run.records,
+    });
+}
+//# sourceMappingURL=seed-cohort.js.map

package/dist/api/runtime/world/types.d.ts

@@ -0,0 +1,118 @@
+/** What seeding the world works with: the options a run gives it, the scope it builds, the cohort it makes. */
+import type { Client } from "../../client/client.ts";
+import type { OperationModel, SpecModel } from "../../spec/graph/types.ts";
+import type { Exchange } from "../exchange.ts";
+import type { CohortMember } from "../fixture.ts";
+import type { ProvenId } from "../proven-id.ts";
+import type { UploadContext } from "../upload.ts";
+import type { Record_ } from "./records.ts";
+export interface Scope {
+    values: Record<string, string>;
+    /** Records created while resolving ancestors, newest last — unwound in reverse at teardown. */
+    created: Array<{
+        entity: string;
+        path: string;
+        id: string;
+    }>;
+}
+/** Ancestors made in this run, and those whose create is under way, by principal, operation and parent path. */
+export interface AncestorCache {
+    made: Map<string, string>;
+    /** Entities in parallel lanes can reach the same missing ancestor at once; the second waits here. */
+    creating: Map<string, Promise<string>>;
+}
+export interface WorldOptions {
+    roots: Record<string, string>;
+    seed: number;
+    /**
+     * Per-run token mixed into every value that must not collide with an earlier run's records —
+     * unique columns, above all. A seed alone repeats exactly, which is its job.
+     */
+    nonce?: string;
+    cohortSize?: number;
+    uploads?: UploadContext;
+    /**
+     * Called the moment a record exists, before anything else can fail. A record learned about
+     * only after the step that made it returns is dropped whenever a later step throws.
+     */
+    onCreate?: (entity: string, id: ProvenId, scope: Record<string, string>) => void;
+    /** Called for a create that answered 2xx with no id the API tester could read: the record may remain. */
+    onUnidentified?: (entity: string, operationId: string, exchange: Exchange) => void;
+    /** Whether the API tester may call an operation (a profile can exclude one); omitted means every one. */
+    readable?: (op: OperationModel) => boolean;
+    /**
+     * Who is creating: every request goes `as: { principal }`, and it keys the ancestor cache, since
+     * one principal's parent is not another's.
+     */
+    principal: string;
+    /** Ancestors already made in this run, by principal, operation and parent path. */
+    ancestors?: AncestorCache;
+    /**
+     * Why `principal` must not send a create, when it must not (`privilegedBar`): the create is then
+     * never sent, and seeding stops with the reason. Omitted means every create may be sent.
+     */
+    withheld?: (createOp: OperationModel) => string | undefined;
+    /**
+     * The identities an entity's records hold, by entity: a client-chosen identity is drawn from
+     * outside them, and one refused with 409 joins them. Omitted, each create keeps its own.
+     */
+    taken?: (entity: string) => Set<string>;
+}
+/** Where seeding happens: the model, the client it sends through, and the run's options. */
+export interface Seeding {
+    model: SpecModel;
+    client: Client;
+    options: WorldOptions;
+}
+export interface SeededCohort {
+    members: CohortMember[];
+    records: Record_[];
+    /** Identities the collection held before seeding, as listed: no later create may reuse one. */
+    existingIds?: string[];
+    /**
+     * Set when the first (or only) create was a documented feature-gate 403.
+     *
+     * Not an error: the document said this principal cannot create the row. The run degrades
+     * the same way a profile-excluded create does.
+     */
+    featureGate: {
+        key: string;
+        detail: string;
+        exchange: Exchange;
+    } | null;
+    /**
+     * Create hit a documented plan limit and these records were adopted from the list / an
+     * earlier effect. Write-path checks must stand down — the API tester did not submit these bodies.
+     */
+    adopted?: boolean;
+    /**
+     * First-variant create returned 409 on an `x-unique` operation and a same-tenant row was
+     * adopted. Unique-conflict checks still run; write-path oracles that need the API tester's submitted
+     * seed body stay skipped.
+     */
+    uniqueAdopted?: boolean;
+    /**
+     * The create answered an acknowledgment without the record, and the records are the bodies
+     * The API tester submitted (client-chosen identity). Checks that judge the create's echo stand down.
+     */
+    acknowledged?: boolean;
+    /**
+     * A create answered without the record and there was no item read to read it back by: the
+     * records are the bodies the API tester sent under the ids the answers gave. Checks that judge stored
+     * fields against a record stand down. It holds why the first such record was not read back:
+     * `no item read`, `read back answered 404`.
+     */
+    unverified?: string;
+    /** Set when extra cohort variants were dropped because unique values could not differ. */
+    uniqueGap?: string;
+    /**
+     * Variants after the first whose create failed. The cohort carries on without them, and the
+     * run reports each: a 5xx is the backend's failure, a 4xx a variant the document permits and
+     * the backend refused.
+     */
+    failedVariants?: Array<{
+        variant: string;
+        exchange: Exchange;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/runtime/world/types.js

@@ -0,0 +1,3 @@
+/** What seeding the world works with: the options a run gives it, the scope it builds, the cohort it makes. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/runtime/world/upload-context.d.ts

@@ -0,0 +1,5 @@
+import type { UploadContext } from "../upload.ts";
+import type { WorldOptions } from "./types.ts";
+/** The uploads a create sends: the run's, or a seed-only context when it configured none. */
+export declare function uploadContext(options: WorldOptions): UploadContext;
+//# sourceMappingURL=upload-context.d.ts.map

package/dist/api/runtime/world/upload-context.js

@@ -0,0 +1,7 @@
+/** The uploads a create sends: the run's, or a seed-only context when it configured none. */
+export function uploadContext(options) {
+    return (options.uploads ?? {
+        seed: options.seed,
+    });
+}
+//# sourceMappingURL=upload-context.js.map

package/dist/api/security/credential-names.d.ts

@@ -0,0 +1,7 @@
+/** Request headers that carry a credential by name. */
+export declare const CREDENTIAL_HEADERS: ReadonlySet<string>;
+/** A header whose value is a secret wherever it is recorded: a known name, or `x-<anything>-key|secret|token`. */
+export declare function isSecretHeaderName(name: string): boolean;
+/** A JSON key, form field or query parameter whose value is a secret: `refreshToken`, `api_key`, `password`. */
+export declare function isSecretJsonKey(name: string): boolean;
+//# sourceMappingURL=credential-names.d.ts.map

package/dist/api/security/credential-names.js

@@ -0,0 +1,30 @@
+/*
+ * The header names that carry a credential, whichever principal sent them. One list, read by the
+ * redactor (never write one down in clear) and by redirect stripping (never send one to another
+ * origin), so the two cannot disagree about what a credential is.
+ */
+/** Request headers that carry a credential by name. */
+export const CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "x-api-key",
+    "api-key",
+    "x-auth-token",
+]);
+/* Also secret when written down: a response's cookies. A backend's own secret header is the config's
+ * `redact.headers`, or matches the `x-…-key` family below. */
+const REDACTED_HEADERS = /* @__PURE__ */ new Set([...CREDENTIAL_HEADERS, "set-cookie"]);
+/** A header whose value is a secret wherever it is recorded: a known name, or `x-<anything>-key|secret|token`. */
+export function isSecretHeaderName(name) {
+    const lower = name.toLowerCase();
+    return REDACTED_HEADERS.has(lower) || /^x-.+-(key|secret|token)$/.test(lower);
+}
+/* Key families whose values are secret wherever they appear. */
+const SECRET_KEY = /(^|[_-])(pass(word|wd)?|secret|token|api[_-]?key|apikey|credential|session[_-]?id|private[_-]?key|authorization|cookie)($|[_-])/i;
+/** A JSON key, form field or query parameter whose value is a secret: `refreshToken`, `api_key`, `password`. */
+export function isSecretJsonKey(name) {
+    /* `refreshToken` and `refresh_token` are the same key: case boundaries count as separators. */
+    return SECRET_KEY.test(name.replace(/([a-z0-9])([A-Z])/g, "$1_$2"));
+}
+//# sourceMappingURL=credential-names.js.map

package/dist/api/security/issued-secrets.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Secrets a backend issues mid-run: a value it answers under a secret key (a TOTP setup's `secret`,
+ * a fresh API key's `token`) is a credential wherever else it turns up, such as inside an otpauth URI
+ * beside it, in a later request, or quoted in an error. They are found here in every form a record
+ * may show them, so the redactor can scrub them as it scrubs the credentials a run places.
+ */
+/** Every value `body` holds under a secret key that reads as a credential, raw and base32-normalized. */
+export declare function issuedSecrets(body: unknown): string[];
+//# sourceMappingURL=issued-secrets.d.ts.map