@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/conformance/expected/composition.js

@@ -0,0 +1,81 @@
+/** The defects whose primary check is in the composition family, and the check each must trip. */
+export const COMPOSITION_EXPECTED = {
+    FILTER_AFTER_PAGINATION: [
+        "query.filter-selects-from-whole-set",
+        /* The same misordering makes a filtered page shorter than the page size, which the
+         * count and negation properties observe from their own angles. */
+        "count.matches-filtered-set",
+        "filter.negation-partitions-the-set",
+        "filter.equality-selects-exactly-one",
+        "filter.zero-match-returns-none",
+        "query.axes-compose",
+        /* A range predicate is evaluated over the same truncated window, so it under-matches too. */
+        "filter.numeric-comparison-is-numeric",
+        /* And a record that falls outside the window is absent from a filtered projection while
+         * present in the item route, which is a genuine disagreement between read paths. */
+        "consistency.projections-agree",
+        /* The tenant-scoping probe filters too, so its records fall outside the window and the
+         * leak it looks for cannot be observed. */
+        "tenant.filter-does-not-bypass-scope",
+        /* A membership filter is a filter: its matches outside the window are lost the same way. */
+        "filter.contains-membership",
+    ],
+    FILTER_DROPPED_WHEN_SORTED: [
+        "query.axes-compose",
+        /* A sorted page walk gathers its set with the filter present, so the same drop shows up
+         * there — and the negation check partitions across pages under a sort too. */
+        "filter.negation-partitions-the-set",
+        "pagination.page-walk-covers-set",
+        "count.matches-filtered-set",
+        /* Every larger composition that sorts a filter sees the same drop. */
+        "query.filter-search-sort-compose",
+        "query.filter-sort-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    /* As above: each composition holding the filter and the axis that drops it sees the drop. */
+    FILTER_DROPPED_WHEN_SELECTED: [
+        "query.filter-and-select-compose",
+        "query.filter-search-select-compose",
+        "query.filter-sort-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    FILTER_DROPPED_WHEN_SEARCHED: [
+        "query.search-and-filter-compose",
+        "query.filter-search-sort-compose",
+        "query.filter-search-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    /* The four-axis query holds each of these pairs, so it sees the dropped filter too — and
+     * reports it whenever another defect leaves the triple unable to. */
+    FILTER_DROPPED_WHEN_SORTED_AND_SELECTED: [
+        "query.filter-sort-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    FILTER_DROPPED_WHEN_SORTED_AND_SEARCHED: [
+        "query.filter-search-sort-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    FILTER_DROPPED_WHEN_SEARCHED_AND_SELECTED: [
+        "query.filter-search-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    FILTER_DROPPED_WHEN_SORTED_SEARCHED_AND_SELECTED: "query.filter-search-sort-select-compose",
+    /* The search is dropped wherever a select joins it, the filter+search+select triple included. */
+    SEARCH_DROPPED_WHEN_SELECTED: [
+        "query.search-and-select-compose",
+        "query.filter-search-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    SEARCH_DROPPED_WHEN_SORTED: [
+        "query.search-and-sort-compose",
+        "query.filter-search-sort-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    ORDER_DROPPED_WHEN_SELECTED: [
+        "query.sort-and-select-compose",
+        "query.filter-sort-select-compose",
+        "query.filter-search-sort-select-compose",
+    ],
+    UNKNOWN_PARAM_EMPTIES_LIST: "query.unknown-parameter-consistent",
+};
+//# sourceMappingURL=composition.js.map

package/dist/api/conformance/expected/conformance.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the conformance family; a name that is not a defect falls out and fails its row. */
+type ConformanceDefect = Extract<DefectName, "PUBLIC_GET_NOT_SUCCESS" | "TOKEN_EXPIRY_AS_STRING" | "DISCRIMINATOR_BRANCH_WRONG" | "RESPONSE_STATUS_UNDECLARED" | "ERROR_SCHEMA_DRIFT" | "PROBLEM_JSON_MALFORMED" | "RESPONSE_SCHEMA_DRIFT" | "READ_BODY_DIVERGES" | "WRITE_ONLY_LEAKED" | "ACTION_CRASHES">;
+/** The defects whose primary check is in the conformance family, and the check each must trip. */
+export declare const CONFORMANCE_EXPECTED: Record<ConformanceDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=conformance.d.ts.map

package/dist/api/conformance/expected/conformance.js

@@ -0,0 +1,20 @@
+/** The defects whose primary check is in the conformance family, and the check each must trip. */
+export const CONFORMANCE_EXPECTED = {
+    PUBLIC_GET_NOT_SUCCESS: "response.public-get-returns-success",
+    TOKEN_EXPIRY_AS_STRING: "response.contract-call",
+    DISCRIMINATOR_BRANCH_WRONG: "response.contract-call",
+    RESPONSE_STATUS_UNDECLARED: "response.status-is-documented",
+    ERROR_SCHEMA_DRIFT: "schema.error-response-matches-document",
+    PROBLEM_JSON_MALFORMED: "schema.problem-json-shape",
+    /* Every record answer carries the undeclared fields: the create's, and the reads' too. */
+    RESPONSE_SCHEMA_DRIFT: ["schema.success-response-matches-document", "schema.read-response-matches-document"],
+    READ_BODY_DIVERGES: "schema.read-response-matches-document",
+    /*
+     * A password the item read answers. The reference's record schemas are closed, and a writeOnly
+     * property is no part of a response, so the read's schema check sees an undeclared field too.
+     */
+    WRITE_ONLY_LEAKED: ["response.write-only-not-returned", "schema.read-response-matches-document"],
+    /* The 500 is a crash, and one the reference document never lists, which is a spec finding too. */
+    ACTION_CRASHES: ["response.no-server-error", "response.status-is-documented"],
+};
+//# sourceMappingURL=conformance.js.map

package/dist/api/conformance/expected/consistency.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the consistency family; a name that is not a defect falls out and fails its row. */
+type ConsistencyDefect = Extract<DefectName, "PARENT_PROJECTION_STALE" | "LIST_DETAIL_DISAGREE" | "STALE_LIST" | "LISTED_GET_DIFFERS" | "STALE_PAST_BOUND" | "BYPASS_IGNORED">;
+/** The defects whose primary check is in the consistency family, and the check each must trip. */
+export declare const CONSISTENCY_EXPECTED: Record<ConsistencyDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=consistency.d.ts.map

package/dist/api/conformance/expected/consistency.js

@@ -0,0 +1,21 @@
+/** The defects whose primary check is in the consistency family, and the check each must trip. */
+export const CONSISTENCY_EXPECTED = {
+    PARENT_PROJECTION_STALE: "invalidation.declared-route-changes",
+    LIST_DETAIL_DISAGREE: [
+        "consistency.projections-agree",
+        /* A listing serving a different value for a searchable field also breaks every predicate
+         * evaluated against the stored value: the record comes back under a name the caller can
+         * see but cannot search or filter for. */
+        "search.q-narrows-result",
+        "filter.equality-selects-exactly-one",
+        "select.projection-honored",
+        "sort.order-is-applied",
+        /* The listing's suffix carries a name at its maxLength past it: a value its schema forbids. */
+        "schema.read-response-matches-document",
+    ],
+    STALE_LIST: "list.read-after-write",
+    LISTED_GET_DIFFERS: "list.item-matches-listed-row",
+    STALE_PAST_BOUND: "consistency.staleness-within-bound",
+    BYPASS_IGNORED: "consistency.bypass-is-fresh",
+};
+//# sourceMappingURL=consistency.js.map

package/dist/api/conformance/expected/filter.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the filter family; a name that is not a defect falls out and fails its row. */
+type FilterDefect = Extract<DefectName, "FILTER_GROUP_COMBINATOR_SWAPPED" | "ERROR_500_ON_BAD_FILTER" | "FILTER_IGNORED" | "LIKE_UNESCAPED" | "FILTER_EQ_NOT_APPLIED" | "EMPTY_RESULT_RETURNS_ALL" | "NEQ_DROPS_NULLS" | "NUMERIC_COMPARED_AS_TEXT" | "FILTER_IN_FIRST_ONLY" | "FILTER_GTE_IS_GT" | "FILTER_ILIKE_IS_LIKE" | "FILTER_IS_NULL_MATCHES_ALL" | "FILTER_ILLEGAL_OP_IGNORED" | "IGNORES_MALFORMED_FILTER" | "FILTER_ALIAS_MISMAPPED" | "FILTER_CONDITION_CAP_IGNORED" | "FILTER_IN_CAP_IGNORED" | "FILTER_LTE_IS_LT" | "FILTER_LT_IS_LTE" | "FILTER_NESTED_COMBINATOR_LEAKS" | "FILTER_NIN_FIRST_ONLY" | "CONTAINS_MATCHES_SUBSTRING">;
+/** The defects whose primary check is in the filter family, and the check each must trip. */
+export declare const FILTER_EXPECTED: Record<FilterDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=filter.d.ts.map

package/dist/api/conformance/expected/filter.js

@@ -0,0 +1,76 @@
+/** The defects whose primary check is in the filter family, and the check each must trip. */
+export const FILTER_EXPECTED = {
+    FILTER_GROUP_COMBINATOR_SWAPPED: [
+        "filter.and-composes-as-intersection",
+        /* Only fires where an or() combinator exists to swap at all — the postgrest-shaped
+         * dialects. On the others the swap still corrupts and(), which is the primary. */
+        "filter.or-composes-as-union",
+    ],
+    ERROR_500_ON_BAD_FILTER: [
+        "error.malformed-filter-not-5xx",
+        /* A crash on an unknown field is this check's own failure: it is not rejected. */
+        "filter.unknown-field-rejected",
+        /* 500 is not in the document. The status-vs-document check is a real second symptom,
+         * not a misdiagnosis: the handler crashed and invented a code the spec never named. */
+        "response.status-is-documented",
+        /* Every crash a filter probe draws that no filter check cited is failed on its own. */
+        "response.no-server-error",
+        /* The defect turns every refused filter into a 500, the over-limit in() and the condition cap
+         * among them: when the primary is masked, these two report the same crash on their own. */
+        "filter.in-over-limit-rejected",
+        "filter.condition-cap-rejected",
+    ],
+    FILTER_IGNORED: "filter.unknown-field-rejected",
+    LIKE_UNESCAPED: "filter.like-metacharacters-escaped",
+    FILTER_EQ_NOT_APPLIED: [
+        "filter.equality-selects-exactly-one",
+        "filter.zero-match-returns-none",
+        "filter.negation-partitions-the-set",
+        "count.matches-filtered-set",
+        "filter.like-metacharacters-escaped",
+    ],
+    EMPTY_RESULT_RETURNS_ALL: [
+        "filter.zero-match-returns-none",
+        "filter.unknown-field-rejected",
+        "filter.like-metacharacters-escaped",
+        /* Falling back to the unfiltered set breaks every narrowing predicate, not just the
+         * filter that triggered it — search and the tenant-scoped filter included. */
+        "search.q-narrows-result",
+        "tenant.filter-does-not-bypass-scope",
+        "filter.negation-partitions-the-set",
+        /* A page walk narrows too: the final page's query legitimately matches nothing, and a
+         * backend that answers "nothing" with "everything" makes records reappear mid-walk. */
+        "pagination.page-walk-covers-set",
+        "count.matches-filtered-set",
+        "filter.empty-in",
+    ],
+    NEQ_DROPS_NULLS: "filter.negation-partitions-the-set",
+    NUMERIC_COMPARED_AS_TEXT: [
+        "filter.numeric-comparison-is-numeric",
+        "sort.order-is-applied",
+        "sort.reverse-symmetry",
+        "sort.numeric-order-is-numeric",
+        "pagination.page-walk-covers-set",
+        "pagination.cursor-agrees-with-page",
+    ],
+    FILTER_IN_FIRST_ONLY: "filter.in-is-union-of-eq",
+    FILTER_GTE_IS_GT: "filter.gte-is-gt-or-eq",
+    FILTER_ILIKE_IS_LIKE: "filter.ilike-is-case-insensitive",
+    FILTER_IS_NULL_MATCHES_ALL: "filter.is-null-selects-nulls",
+    FILTER_ILLEGAL_OP_IGNORED: "filter.illegal-op-rejected",
+    IGNORES_MALFORMED_FILTER: "filter.malformed-term-rejected",
+    FILTER_ALIAS_MISMAPPED: [
+        "filter.alias-matches-canonical",
+        /* `ne` read as `eq` is legal on a field that allows eq and not neq — so an operator the
+         * document closes off is accepted. The same mismapping, seen from the allowlist. */
+        "filter.illegal-op-rejected",
+    ],
+    FILTER_CONDITION_CAP_IGNORED: "filter.condition-cap-rejected",
+    FILTER_IN_CAP_IGNORED: "filter.in-over-limit-rejected",
+    FILTER_LTE_IS_LT: "filter.lte-is-lt-or-eq",
+    FILTER_LT_IS_LTE: "filter.ordered-triple-partitions",
+    FILTER_NESTED_COMBINATOR_LEAKS: "filter.nested-and-or-distributes",
+    FILTER_NIN_FIRST_ONLY: "filter.nin-complements-in",
+    CONTAINS_MATCHES_SUBSTRING: "filter.contains-membership",
+};
+//# sourceMappingURL=filter.js.map

package/dist/api/conformance/expected/isolation.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the isolation family; a name that is not a defect falls out and fails its row. */
+type IsolationDefect = Extract<DefectName, "CROSS_TENANT_READ" | "EXISTENCE_LEAK_VIA_STATUS" | "TENANT_LEAK_VIA_FILTER" | "CALLER_UPDATE_DROPPED" | "DISPOSABLE_KILLS_CALLER" | "ROOT_READ_OPEN" | "ROLE_MONOTONICITY_BROKEN" | "INVITE_NEVER_GRANTS" | "REVOKE_IGNORED" | "CROSS_TENANT_WRITE" | "ROLE_WRITE_INVERTED" | "FOREIGN_PARENT_ACCEPTED">;
+/** The defects whose primary check is in the isolation family, and the check each must trip. */
+export declare const ISOLATION_EXPECTED: Record<IsolationDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=isolation.d.ts.map

package/dist/api/conformance/expected/isolation.js

@@ -0,0 +1,37 @@
+/** The defects whose primary check is in the isolation family, and the check each must trip. */
+export const ISOLATION_EXPECTED = {
+    CROSS_TENANT_READ: "tenant.item-not-readable-cross-tenant",
+    EXISTENCE_LEAK_VIA_STATUS: "tenant.denial-does-not-reveal-existence",
+    TENANT_LEAK_VIA_FILTER: [
+        "tenant.filter-does-not-bypass-scope",
+        /* Any filtered query reaches across tenants, so a filter combined with a search returns
+         * foreign records the search alone does not: the same leak, seen from the composition. */
+        "query.search-and-filter-compose",
+    ],
+    CALLER_UPDATE_DROPPED: "auth.self-is-the-caller",
+    DISPOSABLE_KILLS_CALLER: [
+        "auth.destructive-spares-the-caller",
+        /* The caller's sessions are dead and every fresh sign-in is refused too, so the control read
+         * blocks it: the defect's own consequence, named, not a second defect. */
+        "auth.blocked",
+    ],
+    ROOT_READ_OPEN: [
+        "read.matches-caller-root",
+        /* A root read open to every caller is open to a caller with no credential, a bad one, or
+         * another scheme's: the security probes on that route see the same hole. */
+        "auth.missing-credential-refused",
+        "auth.invalid-credential-refused",
+        "auth.wrong-scheme-refused",
+    ],
+    ROLE_MONOTONICITY_BROKEN: "auth.rank-is-monotonic",
+    INVITE_NEVER_GRANTS: "auth.invite-grants-then-revokes",
+    REVOKE_IGNORED: "auth.invite-grants-then-revokes",
+    CROSS_TENANT_WRITE: "tenant.item-not-writable-cross-tenant",
+    ROLE_WRITE_INVERTED: [
+        "auth.rank-is-monotonic-on-writes",
+        /* The lowest rank writing where a higher one cannot is the read-only viewer's write accepted. */
+        "auth.role-enforced",
+    ],
+    FOREIGN_PARENT_ACCEPTED: "tenant.parent-not-reachable-from-another-root",
+};
+//# sourceMappingURL=isolation.js.map

package/dist/api/conformance/expected/other.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the other family; a name that is not a defect falls out and fails its row. */
+type OtherDefect = Extract<DefectName, "SPEC_OVERCLAIMS_FILTERABLE" | "SPEC_OVERCLAIMS_SORTABLE" | "SPEC_OVERCLAIMS_SELECTABLE" | "SELECT_IGNORED" | "SEARCH_IGNORED" | "EFFECT_NOT_APPLIED" | "SELECT_FIELD_MISSING" | "ASYNC_NEVER_COMPLETES" | "ASYNC_RECEIPT_MISSING_ID" | "SEARCH_CASE_SENSITIVE" | "SEARCH_EMPTY_MATCHES_NONE" | "SEARCH_ONLY_FIRST_TOKEN" | "SELECT_UNKNOWN_IGNORED" | "SPEC_OVERCLAIMS_FILTER_OP" | "SEARCH_MODE_REJECTED" | "NESTED_SELECT_IGNORED" | "SIDE_EFFECT_NEVER_ARRIVES" | "RATE_LIMIT_STRICTER_THAN_DECLARED">;
+/** The defects whose primary check is in the other family, and the check each must trip. */
+export declare const OTHER_EXPECTED: Record<OtherDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=other.d.ts.map

package/dist/api/conformance/expected/other.js

@@ -0,0 +1,26 @@
+/** The defects whose primary check is in the other family, and the check each must trip. */
+export const OTHER_EXPECTED = {
+    SPEC_OVERCLAIMS_FILTERABLE: "spec.declared-filterable-is-filterable",
+    SPEC_OVERCLAIMS_SORTABLE: ["spec.declared-sortable-is-sortable", "spec.declared-sortable-nulls-accepted"],
+    SPEC_OVERCLAIMS_SELECTABLE: "spec.declared-selectable-is-selectable",
+    SELECT_IGNORED: "select.projection-honored",
+    SEARCH_IGNORED: "search.q-narrows-result",
+    EFFECT_NOT_APPLIED: ["effects.declared-effect-occurs", "async.reaches-terminal-state"],
+    SELECT_FIELD_MISSING: "select.requested-fields-present",
+    ASYNC_NEVER_COMPLETES: "async.reaches-terminal-state",
+    ASYNC_RECEIPT_MISSING_ID: [
+        "async.receipt-identifies-the-job",
+        "async.reaches-terminal-state",
+        "schema.success-response-matches-document",
+    ],
+    SEARCH_CASE_SENSITIVE: "search.case-insensitive",
+    SEARCH_EMPTY_MATCHES_NONE: "search.empty-q",
+    SEARCH_ONLY_FIRST_TOKEN: "search.tokens-and",
+    SELECT_UNKNOWN_IGNORED: "select.unknown-field-rejected",
+    SPEC_OVERCLAIMS_FILTER_OP: "spec.declared-filterable-ops-accepted",
+    SEARCH_MODE_REJECTED: "search.mode-accepted",
+    NESTED_SELECT_IGNORED: "select.nested-honored",
+    SIDE_EFFECT_NEVER_ARRIVES: "effects.side-effect-arrives",
+    RATE_LIMIT_STRICTER_THAN_DECLARED: "spec.declared-rate-limit-is-honored",
+};
+//# sourceMappingURL=other.js.map

package/dist/api/conformance/expected/pagination.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the pagination family; a name that is not a defect falls out and fails its row. */
+type PaginationDefect = Extract<DefectName, "COUNT_IGNORES_FILTER" | "CURSOR_DRIFT" | "OFF_BY_ONE_PAGE" | "UNSTABLE_SORT" | "LIMIT_IGNORED" | "LIMIT_EXCEEDS_MAX" | "LIMIT_OUT_OF_RANGE_SERVED" | "HASMORE_ALWAYS_FALSE" | "COUNT_ALWAYS_ZERO" | "COLLATION_INCONSISTENT" | "PAGE_PAST_END_REPEATS">;
+/** The defects whose primary check is in the pagination family, and the check each must trip. */
+export declare const PAGINATION_EXPECTED: Record<PaginationDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=pagination.d.ts.map

package/dist/api/conformance/expected/pagination.js

@@ -0,0 +1,23 @@
+/** The defects whose primary check is in the pagination family, and the check each must trip. */
+export const PAGINATION_EXPECTED = {
+    COUNT_IGNORES_FILTER: "count.matches-filtered-set",
+    CURSOR_DRIFT: "pagination.cursor-agrees-with-page",
+    OFF_BY_ONE_PAGE: "pagination.page-walk-covers-set",
+    UNSTABLE_SORT: [
+        "pagination.page-walk-covers-set",
+        /* An unstable default order can hide a just-created record behind a page boundary,
+         * which the write-visibility check observes as a lost write. Same root cause. */
+        "list.read-after-write",
+        "sort.stable-tiebreak",
+    ],
+    LIMIT_IGNORED: "pagination.limit-bounds-page-size",
+    /* Past the maximum is also out of the declared range, which the document says is refused. */
+    LIMIT_EXCEEDS_MAX: ["pagination.limit-respects-documented-max", "pagination.limit-bounds-enforced"],
+    LIMIT_OUT_OF_RANGE_SERVED: "pagination.limit-bounds-enforced",
+    HASMORE_ALWAYS_FALSE: "pagination.has-more-is-accurate",
+    COUNT_ALWAYS_ZERO: ["count.consistent-with-returned-page", "count.matches-filtered-set"],
+    COLLATION_INCONSISTENT: "pagination.cursor-agrees-with-page",
+    /* A walk whose last page is full asks once more, and sees the repeat. */
+    PAGE_PAST_END_REPEATS: ["pagination.bounds-handled", "pagination.page-walk-covers-set"],
+};
+//# sourceMappingURL=pagination.js.map

package/dist/api/conformance/expected/security.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the security family; a name that is not a defect falls out and fails its row. */
+type SecurityDefect = Extract<DefectName, "AUTH_IGNORED_ON_ROUTE" | "TOKEN_NOT_VERIFIED" | "ANY_SCHEME_ACCEPTED" | "SCOPE_NOT_CHECKED" | "APIKEY_ALTERNATIVE_BROKEN" | "PUBLIC_ROUTE_GUARDED" | "REVOKED_TOKEN_ACCEPTED" | "REFRESH_REUSE_ACCEPTED" | "ROLE_NOT_CHECKED" | "CROSS_TENANT_KEY_ACCEPTED" | "PRIVILEGED_FIELD_WRITABLE" | "PRIVILEGED_FIELD_ON_SIGNUP" | "LOGIN_NOT_THROTTLED" | "KEY_DELETE_CROSS_TENANT">;
+/** The defects whose primary check is in the security family, and the check each must trip. */
+export declare const SECURITY_EXPECTED: Record<SecurityDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=security.d.ts.map

package/dist/api/conformance/expected/security.js

@@ -0,0 +1,29 @@
+/** The defects whose primary check is in the security family, and the check each must trip. */
+export const SECURITY_EXPECTED = {
+    AUTH_IGNORED_ON_ROUTE: [
+        "auth.missing-credential-refused",
+        /* A route that checks no credential takes any credential too: garbage, a bad signature and
+         * another scheme's value are each accepted there, the same hole seen from each probe. */
+        "auth.invalid-credential-refused",
+        "auth.wrong-scheme-refused",
+    ],
+    TOKEN_NOT_VERIFIED: "auth.invalid-credential-refused",
+    ANY_SCHEME_ACCEPTED: "auth.wrong-scheme-refused",
+    SCOPE_NOT_CHECKED: "auth.scope-enforced",
+    APIKEY_ALTERNATIVE_BROKEN: "auth.alternative-accepted",
+    PUBLIC_ROUTE_GUARDED: "auth.anonymous-operation-open",
+    REVOKED_TOKEN_ACCEPTED: [
+        "auth.revoked-credential-refused",
+        /* A logout that revokes nothing leaves the disposable user's ended session working too. */
+        "auth.destructive-spares-the-caller",
+    ],
+    REFRESH_REUSE_ACCEPTED: "auth.refresh-reuse-refused",
+    ROLE_NOT_CHECKED: "auth.role-enforced",
+    CROSS_TENANT_KEY_ACCEPTED: "auth.cross-tenant-key-refused",
+    PRIVILEGED_FIELD_WRITABLE: "auth.privileged-field-ignored",
+    PRIVILEGED_FIELD_ON_SIGNUP: "auth.privileged-field-ignored",
+    LOGIN_NOT_THROTTLED: "auth.login-throttled",
+    /* Proved on a key made for the probe: the run's own minted keys are never the target. */
+    KEY_DELETE_CROSS_TENANT: "tenant.item-not-writable-cross-tenant",
+};
+//# sourceMappingURL=security.js.map

package/dist/api/conformance/expected/sort.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the sort family; a name that is not a defect falls out and fails its row. */
+type SortDefect = Extract<DefectName, "ORDER_IGNORED" | "SORT_DESC_DROPS_NULLS" | "IGNORES_BAD_SORT_DIRECTION" | "SORT_NUMERIC_AS_TEXT" | "SORT_MULTI_KEY_IGNORED" | "SORT_NULLS_MODIFIER_IGNORED" | "SORT_UNKNOWN_FIELD_IGNORED" | "DEFAULT_ORDER_IGNORED" | "TIEBREAK_NOT_APPLIED">;
+/** The defects whose primary check is in the sort family, and the check each must trip. */
+export declare const SORT_EXPECTED: Record<SortDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=sort.d.ts.map

package/dist/api/conformance/expected/sort.js

@@ -0,0 +1,13 @@
+/** The defects whose primary check is in the sort family, and the check each must trip. */
+export const SORT_EXPECTED = {
+    ORDER_IGNORED: "sort.order-is-applied",
+    SORT_DESC_DROPS_NULLS: "sort.reverse-symmetry",
+    IGNORES_BAD_SORT_DIRECTION: "sort.invalid-direction-rejected",
+    SORT_NUMERIC_AS_TEXT: "sort.numeric-order-is-numeric",
+    SORT_MULTI_KEY_IGNORED: "sort.multi-key-tiebreak",
+    SORT_NULLS_MODIFIER_IGNORED: "sort.nulls-first-last",
+    SORT_UNKNOWN_FIELD_IGNORED: "sort.unknown-field-rejected",
+    DEFAULT_ORDER_IGNORED: "sort.default-order-applied",
+    TIEBREAK_NOT_APPLIED: "sort.stable-tiebreak",
+};
+//# sourceMappingURL=sort.js.map

package/dist/api/conformance/expected/table.d.ts

@@ -0,0 +1,11 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/**
+ * Which check each defect must trip.
+ *
+ * The first id is the primary — the diagnosis the API tester is required to reach. Any further ids are
+ * *acceptable* consequences: one defect can legitimately violate several properties at once, and
+ * calling those false positives would push the API tester toward under-reporting real problems.
+ */
+export declare const EXPECTED: Record<DefectName, FindingId | FindingId[]>;
+//# sourceMappingURL=table.d.ts.map

package/dist/api/conformance/expected/table.js

@@ -0,0 +1,32 @@
+import { COMPOSITION_EXPECTED } from "./composition.js";
+import { CONFORMANCE_EXPECTED } from "./conformance.js";
+import { CONSISTENCY_EXPECTED } from "./consistency.js";
+import { FILTER_EXPECTED } from "./filter.js";
+import { ISOLATION_EXPECTED } from "./isolation.js";
+import { OTHER_EXPECTED } from "./other.js";
+import { PAGINATION_EXPECTED } from "./pagination.js";
+import { SECURITY_EXPECTED } from "./security.js";
+import { SORT_EXPECTED } from "./sort.js";
+import { VALIDATION_EXPECTED } from "./validation.js";
+import { WRITE_EXPECTED } from "./write.js";
+/**
+ * Which check each defect must trip.
+ *
+ * The first id is the primary — the diagnosis the API tester is required to reach. Any further ids are
+ * *acceptable* consequences: one defect can legitimately violate several properties at once, and
+ * calling those false positives would push the API tester toward under-reporting real problems.
+ */
+export const EXPECTED = {
+    ...COMPOSITION_EXPECTED,
+    ...CONFORMANCE_EXPECTED,
+    ...CONSISTENCY_EXPECTED,
+    ...FILTER_EXPECTED,
+    ...ISOLATION_EXPECTED,
+    ...OTHER_EXPECTED,
+    ...PAGINATION_EXPECTED,
+    ...SECURITY_EXPECTED,
+    ...SORT_EXPECTED,
+    ...VALIDATION_EXPECTED,
+    ...WRITE_EXPECTED,
+};
+//# sourceMappingURL=table.js.map

package/dist/api/conformance/expected/validation.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the validation family; a name that is not a defect falls out and fails its row. */
+type ValidationDefect = Extract<DefectName, "ENUM_NOT_VALIDATED" | "MAXLENGTH_NOT_VALIDATED" | "REQUIRED_NOT_VALIDATED" | "CONTENT_TYPE_NOT_ENFORCED" | "WRITE_BODY_NOT_VALIDATED">;
+/** The defects whose primary check is in the validation family, and the check each must trip. */
+export declare const VALIDATION_EXPECTED: Record<ValidationDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/api/conformance/expected/validation.js

@@ -0,0 +1,12 @@
+/** The defects whose primary check is in the validation family, and the check each must trip. */
+export const VALIDATION_EXPECTED = {
+    /* What the create let through is stored, and the listing then serves a value its schema forbids. */
+    ENUM_NOT_VALIDATED: ["validation.enum-enforced", "schema.read-response-matches-document"],
+    MAXLENGTH_NOT_VALIDATED: ["validation.max-length-enforced", "schema.read-response-matches-document"],
+    /* The create's required check is the replacing update's too (validateBody, mode "replace"): under the
+     * put-update shape, a PUT update missing a required field is applied, which the update check sees. */
+    REQUIRED_NOT_VALIDATED: ["validation.required-enforced", "request.invalid-body-refused"],
+    CONTENT_TYPE_NOT_ENFORCED: "validation.content-type-enforced",
+    WRITE_BODY_NOT_VALIDATED: "request.invalid-body-refused",
+};
+//# sourceMappingURL=validation.js.map

package/dist/api/conformance/expected/write.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { FindingId } from "../../runtime/check-ids.ts";
+/** The defects with a row in the write family; a name that is not a defect falls out and fails its row. */
+type WriteDefect = Extract<DefectName, "CREATED_201_AS_200" | "IDEMPOTENCY_IGNORED" | "UNIQUE_NOT_ENFORCED" | "DELETE_MISSING_OK" | "IMMUTABLE_WRITABLE" | "PATCH_REPLACES" | "SOFT_DELETE_LEAK" | "CREATE_DROPS_FIELD" | "UPDATE_DROPS_FIELD" | "READ_DROPS_FIELD" | "STRING_PAYLOAD_MANGLED" | "COLUMN_NAME_MISMATCH" | "CONCURRENT_WRITE_LOST" | "ETAG_IGNORED" | "DELETE_KEEPS_ROW" | "IDEMPOTENT_REPLAY_INSERTS" | "CLIENT_ID_IGNORED" | "CLIENT_ID_OVERWRITES" | "HIDDEN_FROM_CREATOR" | "CREATE_500_ON_NON_ASCII">;
+/** The defects whose primary check is in the write family, and the check each must trip. */
+export declare const WRITE_EXPECTED: Record<WriteDefect, FindingId | FindingId[]>;
+export {};
+//# sourceMappingURL=write.d.ts.map

package/dist/api/conformance/expected/write.js

@@ -0,0 +1,66 @@
+/** The defects whose primary check is in the write family, and the check each must trip. */
+export const WRITE_EXPECTED = {
+    CREATED_201_AS_200: "create.status-matches-document",
+    IDEMPOTENCY_IGNORED: "idempotency.replay-does-not-duplicate",
+    UNIQUE_NOT_ENFORCED: ["create.unique-conflict-rejected", "update.unique-conflict-rejected"],
+    DELETE_MISSING_OK: "delete.absent-record-returns-404",
+    IMMUTABLE_WRITABLE: "patch.immutable-field-rejected",
+    /*
+     * The replacing patch resets every unsent field to a blank default; behind rich-schema those blanks
+     * break the record's own constraints (a date-time, a minimum, a const), and the reads serve them.
+     */
+    PATCH_REPLACES: ["patch.minimality", "consistency.projections-agree", "schema.read-response-matches-document"],
+    SOFT_DELETE_LEAK: "softdelete.absent-from-default-list",
+    CREATE_DROPS_FIELD: "create.persists-submitted-fields",
+    UPDATE_DROPS_FIELD: "update.persists-submitted-fields",
+    READ_DROPS_FIELD: ["payload.string-survives", "consistency.projections-agree"],
+    STRING_PAYLOAD_MANGLED: "payload.string-survives",
+    COLUMN_NAME_MISMATCH: [
+        "create.persists-submitted-fields",
+        "list.read-after-write",
+        "search.q-narrows-result",
+        "filter.equality-selects-exactly-one",
+        "sort.order-is-applied",
+        "sort.multi-key-tiebreak",
+        "response.status-is-documented",
+        /* Postgres refuses the unknown column outright, so the defect's reads answer 500. */
+        "response.no-server-error",
+        /*
+         * On an engine with double-quoted-string fallback the response *shape* is corrupted, not
+         * just its values: D1 returns the unresolved identifier as the key, quotes included, so a
+         * row comes back as `{ "\"name\"": "name" }`. The declared property is then missing and an
+         * undeclared one is present, which is a genuine schema violation rather than a knock-on
+         * mis-diagnosis. Verified against a live D1; `node:sqlite` compiles the fallback off and
+         * never reaches this shape.
+         */
+        "schema.success-response-matches-document",
+    ],
+    CONCURRENT_WRITE_LOST: [
+        "concurrency.no-lost-update",
+        /* The defect *is* read-modify-write: PATCH reads the row, then writes every column back.
+         * That is PUT semantics wearing a PATCH label, so whenever anything else touches the row
+         * inside that window the rewrite clobbers a field the caller never named — which is
+         * precisely what the minimality check asserts against. It surfaces on a backend with real
+         * latency and hides on one without, so it is a legitimate second symptom, not a false
+         * positive. */
+        "patch.minimality",
+    ],
+    ETAG_IGNORED: "concurrency.if-match-enforced",
+    DELETE_KEEPS_ROW: "delete.absent-record-returns-404",
+    IDEMPOTENT_REPLAY_INSERTS: "idempotency.replay-does-not-duplicate",
+    /* A table stored under an id the client was never told cannot parent the rows seeded under it. */
+    /* A server that ignores the client's id accepts a create repeating an existing id: the unique
+     * check on the identity is that same loss, seen from the other side. */
+    CLIENT_ID_IGNORED: ["create.keeps-submitted-identity", "world.seed", "create.unique-conflict-rejected"],
+    CLIENT_ID_OVERWRITES: "create.unique-conflict-rejected",
+    /* The payload probe's control write is what hides the row: reading it back finds nothing. */
+    HIDDEN_FROM_CREATOR: "payload.string-survives",
+    CREATE_500_ON_NON_ASCII: [
+        "create.does-not-error",
+        /* The probes that write non-ASCII strings hit the same crash on their own creates. */
+        "payload.string-survives",
+        "response.status-is-documented",
+        "response.no-server-error",
+    ],
+};
+//# sourceMappingURL=write.js.map

package/dist/api/conformance/expected-failures.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Conformance cases known to fail today, and why.
+ *
+ * Each entry is a correct backend the API tester still misjudges. The list may only shrink: a listed case
+ * that starts passing fails the suite until its entry is removed, so a fix is recorded the moment
+ * it lands and a regression cannot hide behind an entry that is no longer needed.
+ *
+ * Keys are case names as the suite prints them (`shape:<name>`, `recall:<shape>:<defect>`).
+ */
+export declare const EXPECTED_FAILURES: Readonly<Record<string, string>>;
+/**
+ * Inconclusive verdicts a clean baseline may return, per `backend:dialect`, as `check@entity`.
+ *
+ * A check that cannot decide against a correct backend has not shown that it passes, so any
+ * verdict not listed here fails the baseline. Like the list above, this may only shrink.
+ */
+export declare const EXPECTED_INCONCLUSIVE: Readonly<Record<string, readonly string[]>>;
+//# sourceMappingURL=expected-failures.d.ts.map

package/dist/api/conformance/expected-failures.js

@@ -0,0 +1,18 @@
+/**
+ * Conformance cases known to fail today, and why.
+ *
+ * Each entry is a correct backend the API tester still misjudges. The list may only shrink: a listed case
+ * that starts passing fails the suite until its entry is removed, so a fix is recorded the moment
+ * it lands and a regression cannot hide behind an entry that is no longer needed.
+ *
+ * Keys are case names as the suite prints them (`shape:<name>`, `recall:<shape>:<defect>`).
+ */
+export const EXPECTED_FAILURES = {};
+/**
+ * Inconclusive verdicts a clean baseline may return, per `backend:dialect`, as `check@entity`.
+ *
+ * A check that cannot decide against a correct backend has not shown that it passes, so any
+ * verdict not listed here fails the baseline. Like the list above, this may only shrink.
+ */
+export const EXPECTED_INCONCLUSIVE = {};
+//# sourceMappingURL=expected-failures.js.map

package/dist/api/conformance/feature-gate/harness.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The feature-gate suite's backend, as a `Handle`: webhooks whose create or update may answer a
+ * feature-gate 403, and invites that never do.
+ */
+import type { Handle } from "../../reference/http/node.ts";
+export type CreateMode = "gate-match" | "gate-mismatch" | "plain-403" | "created";
+export type UpdateMode = "ok" | "gate-match";
+export interface HarnessOptions {
+    create: CreateMode;
+    listSeeded?: boolean;
+    specTag: string | null;
+    update?: UpdateMode;
+}
+/** The 403 a plan without `feature` answers. */
+export declare function gateBody(feature: string): Record<string, unknown>;
+/** The bearer token the harness issues, and the only one it accepts. */
+export declare const GATE_TOKEN = "tok_alpha";
+/** A fresh backend: the document is public, every other route wants the token it issued. */
+export declare function featureGateHarness(options: HarnessOptions): Handle;
+//# sourceMappingURL=harness.d.ts.map