@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/conformance/harness/serve.js

@@ -0,0 +1,26 @@
+/**
+ * A suite's own backend, written as a `Handle`: whatever `Via` the suite runs on then decides
+ * whether a socket stands in front of it.
+ */
+import { respond } from "../../reference/http/wire.js";
+/** A JSON answer, or a bare status (with any `headers`) when there is no body. */
+export function answer(status, body, headers = {}) {
+    return body === undefined ? { body: "", headers, status } : respond(status, body, headers);
+}
+/** The request body as JSON; an empty body is `undefined`, and a malformed one rejects. */
+export async function readJson(request) {
+    const text = await request.text();
+    return text === "" ? undefined : JSON.parse(text);
+}
+/** `handle`, answering `failure` when it throws instead of leaving the request unanswered. */
+export function guarded(handle, failure = answer(500)) {
+    return async (request) => {
+        try {
+            return await handle(request);
+        }
+        catch {
+            return failure;
+        }
+    };
+}
+//# sourceMappingURL=serve.js.map

package/dist/api/conformance/leaks.d.ts

@@ -0,0 +1,30 @@
+/**
+ * What a run left behind, read from the backend itself rather than from the API tester's own bookkeeping.
+ *
+ * Counting `created − removed` trusts the ledger it is meant to audit: a record the API tester never ledgered
+ * is neither created nor removed, and the count reads zero while tables sit in the backend. Every
+ * live record present after the run and absent before it was left behind, whoever made it.
+ */
+import type { TeardownReport } from "../runtime/teardown/types.ts";
+export type StoreSnapshot = Record<string, Array<Record<string, unknown>>>;
+export declare function leftBehind(before: StoreSnapshot, after: StoreSnapshot): string[];
+/**
+ * Records that existed before the run and are gone or different after it. The API tester may change only what
+ * it created; on a correct backend, anything listed here is the API tester's doing.
+ */
+export declare function damagedBystanders(before: StoreSnapshot, after: StoreSnapshot): string[];
+/**
+ * Ledgered ids the backend never created during the run. Teardown deletes what is ledgered, so an
+ * id here is one the API tester would delete without having made it — an id it only sent, say.
+ */
+export declare function ledgeredNotCreated(records: ReadonlyArray<{
+    entity: string;
+    id: string;
+}>, created: Readonly<Record<string, readonly string[]>>): string[];
+/**
+ * Rows left behind that the API tester did not report. A row counts as reported when teardown names it as
+ * failed, by entity and id, or when a create of its entity that the API tester could not identify accounts
+ * for it, one row per such create. What remains is litter the API tester never told anyone about.
+ */
+export declare function unreportedLeftovers(leaked: readonly string[], teardown: Pick<TeardownReport, "failed" | "unidentified"> | null | undefined): string[];
+//# sourceMappingURL=leaks.d.ts.map

package/dist/api/conformance/leaks.js

@@ -0,0 +1,75 @@
+/**
+ * What a run left behind, read from the backend itself rather than from the API tester's own bookkeeping.
+ *
+ * Counting `created − removed` trusts the ledger it is meant to audit: a record the API tester never ledgered
+ * is neither created nor removed, and the count reads zero while tables sit in the backend. Every
+ * live record present after the run and absent before it was left behind, whoever made it.
+ */
+export function leftBehind(before, after) {
+    const out = [];
+    for (const [entity, rows] of Object.entries(after)) {
+        const existed = new Set((before[entity] ?? []).map((row) => JSON.stringify(row["id"])));
+        for (const row of rows) {
+            if (existed.has(JSON.stringify(row["id"])))
+                continue;
+            /* A tombstone is a removal: the API no longer serves it. */
+            if (row["deleted_at"] !== null && row["deleted_at"] !== undefined)
+                continue;
+            out.push(`${entity} ${String(row["id"])}`);
+        }
+    }
+    return out;
+}
+/**
+ * Records that existed before the run and are gone or different after it. The API tester may change only what
+ * it created; on a correct backend, anything listed here is the API tester's doing.
+ */
+export function damagedBystanders(before, after) {
+    const out = [];
+    for (const [entity, rows] of Object.entries(before)) {
+        const now = new Map((after[entity] ?? []).map((row) => [String(row["id"]), row]));
+        for (const row of rows) {
+            const later = now.get(String(row["id"]));
+            if (later === undefined) {
+                out.push(`${entity} ${String(row["id"])} deleted`);
+                continue;
+            }
+            const changed = [...new Set([...Object.keys(row), ...Object.keys(later)])].filter((key) => JSON.stringify(row[key]) !== JSON.stringify(later[key]));
+            if (changed.length > 0)
+                out.push(`${entity} ${String(row["id"])} changed ${changed.join(", ")}`);
+        }
+    }
+    return out;
+}
+/**
+ * Ledgered ids the backend never created during the run. Teardown deletes what is ledgered, so an
+ * id here is one the API tester would delete without having made it — an id it only sent, say.
+ */
+export function ledgeredNotCreated(records, created) {
+    return records
+        .filter((record) => !(created[record.entity] ?? []).includes(record.id))
+        .map((record) => `${record.entity} ${record.id}`);
+}
+/**
+ * Rows left behind that the API tester did not report. A row counts as reported when teardown names it as
+ * failed, by entity and id, or when a create of its entity that the API tester could not identify accounts
+ * for it, one row per such create. What remains is litter the API tester never told anyone about.
+ */
+export function unreportedLeftovers(leaked, teardown) {
+    const named = new Set((teardown?.failed ?? []).map((failure) => `${failure.entity} ${failure.id}`));
+    const unidentified = new Map();
+    for (const create of teardown?.unidentified ?? []) {
+        unidentified.set(create.entity, (unidentified.get(create.entity) ?? 0) + 1);
+    }
+    return leaked.filter((row) => {
+        if (named.has(row))
+            return false;
+        const entity = row.slice(0, row.indexOf(" "));
+        const left = unidentified.get(entity) ?? 0;
+        if (left === 0)
+            return true;
+        unidentified.set(entity, left - 1);
+        return false;
+    });
+}
+//# sourceMappingURL=leaks.js.map

package/dist/api/conformance/matrix/cases.d.ts

@@ -0,0 +1,63 @@
+import type { DefectName } from "../../reference/defects/table.ts";
+import type { Finding, Inconclusive } from "../../runtime/finding.ts";
+import { type Target } from "../harness/launch.ts";
+export interface CaseResult {
+    label: string;
+    defect: DefectName | null;
+    expected: string | null;
+    detected: boolean;
+    /** Findings unrelated to the injected defect — false positives. */
+    spurious: Finding[];
+    findings: Finding[];
+    entitiesTested: string[];
+    /** Checks that actually executed. A clean run that ran nothing is not a pass. */
+    checksRun: string[];
+    /** Records created and not cleaned up. */
+    leaked?: number;
+    /** Records that existed before the run and were deleted or changed by it. */
+    bystanders?: string[];
+    /** Ids the API tester ledgered for teardown that the backend never created. */
+    strayLedger?: string[];
+    /** Records left behind that teardown neither named as failed nor counted as unidentified. */
+    unreported?: string[];
+    /** What teardown named as left behind, as `entity id`: each one a leftover the run reported. */
+    reported?: string[];
+    /** Checks that would have sent a value the API tester did not have (the text "undefined"), as `check@entity`. */
+    missingValues?: string[];
+    /** Checks that ran and could not reach a verdict, as `check@entity: reason`. */
+    inconclusive?: string[];
+    /** Checks this defect may legitimately trip, primary first. */
+    acceptable?: string[];
+    error?: string;
+}
+/**
+ * Checks that would have sent a value the API tester did not have, as `check@entity`. A request made from a
+ * value the API tester did not have is refused before it leaves; any such check is a hole in the API tester, whatever
+ * the backend did.
+ */
+export declare function missingValuesOf(inconclusive: readonly Inconclusive[]): string[];
+export declare function runSuite(target: Target, filter?: string[]): Promise<CaseResult[]>;
+/**
+ * A case's result as it can cross to another thread: findings keep everything the verdicts read,
+ * and drop the exchanges they cite, which hold live bodies.
+ */
+export declare function portableResult(result: CaseResult): CaseResult;
+/**
+ * The two clean baselines of a leg: tagged, then with every meta tag stripped. The tagged one comes
+ * first — everything downstream is meaningless if it is not clean. The API tester must stay quiet without the
+ * tags too, running on heuristics alone: a fallback that invents findings would make the tool
+ * unusable on any spec that has not been annotated yet.
+ */
+export declare function runBaselines(target: Target): Promise<CaseResult[]>;
+/** What a defect case is judged by beyond its run, and the name it is shown under; the defaults are the suite's own. */
+export interface Judging {
+    /** The case's name in the report; the defect's own by default. */
+    label?: string;
+    /** Defects that damage bystanders by design. */
+    excused?: ReadonlySet<DefectName>;
+    /** Each generated reproducer's problems; none when every one is runnable. */
+    checkRepros?: (findings: Finding[]) => Promise<string[]>;
+}
+/** One defect, injected alone: detected, and nothing reported that it does not explain. */
+export declare function judgeDefect(defect: DefectName, target: Target, { checkRepros, excused, label }?: Judging): Promise<CaseResult>;
+//# sourceMappingURL=cases.d.ts.map

package/dist/api/conformance/matrix/cases.js

@@ -0,0 +1,157 @@
+import { messageOf } from "../../errors/message.js";
+import { DAMAGES_BYSTANDERS } from "../../reference/defects/bystanders.js";
+import { run } from "../harness/counting.js";
+import { EXPECTED } from "../expected/table.js";
+import { launch, reach } from "../harness/launch.js";
+import { damagedBystanders, ledgeredNotCreated, leftBehind, unreportedLeftovers } from "../leaks.js";
+import { checkReproSyntax } from "../suites/repro-syntax.js";
+import { defectsFor } from "./defects.js";
+import { acceptableOf, primaryOf } from "./expected.js";
+import { optInFor } from "./opt-in.js";
+import { PRINCIPALS, SECURITY } from "./principals.js";
+/**
+ * Checks that would have sent a value the API tester did not have, as `check@entity`. A request made from a
+ * value the API tester did not have is refused before it leaves; any such check is a hole in the API tester, whatever
+ * the backend did.
+ */
+export function missingValuesOf(inconclusive) {
+    return inconclusive
+        .filter((item) => item.reason.startsWith("the API tester had no value"))
+        .map((item) => `${item.check}@${item.entity}`);
+}
+/** testing api run once against the reference with `defects` injected, and what it left in the backend. */
+async function observe(defects, target, untagged) {
+    /* A defect behind an opt-in shows only with it on, in the reference and in the API tester both. */
+    const optIn = optInFor(defects);
+    const server = await launch(target, { defects, untagged, ...optIn.reference });
+    try {
+        const before = await server.snapshot();
+        const result = await run({
+            ...optIn.run,
+            baseUrl: server.url,
+            principals: PRINCIPALS,
+            security: SECURITY,
+            seed: 42,
+            spec: `${server.url}/v1/openapi/spec`,
+            ...reach(server),
+        });
+        /* A tester that litters is one nobody runs twice against anything real, so this is asserted,
+         * not assumed — and read from the backend, not from the API tester's ledger. */
+        const after = await server.snapshot();
+        const leakedRecords = leftBehind(before, after);
+        return {
+            /* The API tester changes only what it made, and ledgers only what the backend made for it. */
+            bystanders: damagedBystanders(before, after),
+            checksRun: result.checksRun,
+            entitiesTested: result.entitiesTested,
+            findings: result.findings,
+            inconclusive: result.inconclusive,
+            leaked: leakedRecords.length,
+            missingValues: missingValuesOf(result.inconclusive),
+            reported: (result.teardown?.failed ?? []).map((failure) => `${failure.entity} ${failure.id}`),
+            strayLedger: ledgeredNotCreated(result.teardown?.records ?? [], server.createdIds()),
+            /* Whatever the defect let through, a record the API tester leaves behind is one it must name. */
+            unreported: unreportedLeftovers(leakedRecords, result.teardown),
+        };
+    }
+    finally {
+        await server.close();
+    }
+}
+export async function runSuite(target, filter) {
+    const results = await runBaselines(target);
+    for (const defect of defectsFor(target.backend, target.dialect, filter)) {
+        results.push(await judgeDefect(defect, target));
+    }
+    return results;
+}
+/** A finding without the exchanges it cites. */
+function strip(finding) {
+    return { ...finding, evidence: [] };
+}
+/**
+ * A case's result as it can cross to another thread: findings keep everything the verdicts read,
+ * and drop the exchanges they cite, which hold live bodies.
+ */
+export function portableResult(result) {
+    return { ...result, findings: result.findings.map(strip), spurious: result.spurious.map(strip) };
+}
+/**
+ * The two clean baselines of a leg: tagged, then with every meta tag stripped. The tagged one comes
+ * first — everything downstream is meaningless if it is not clean. The API tester must stay quiet without the
+ * tags too, running on heuristics alone: a fallback that invents findings would make the tool
+ * unusable on any spec that has not been annotated yet.
+ */
+export async function runBaselines(target) {
+    return [await baseline(target, false), await baseline(target, true)];
+}
+async function baseline(target, untagged) {
+    const label = untagged ? "baseline (untagged spec)" : "baseline (correct backend)";
+    const empty = { defect: null, expected: null, label };
+    try {
+        const { leaked, inconclusive, findings, ...observed } = await observe([], target, untagged);
+        const real = findings.filter((f) => f.verdict !== "COVERAGE_GAP");
+        return {
+            ...empty,
+            ...observed,
+            acceptable: [],
+            detected: real.length === 0,
+            findings,
+            inconclusive: inconclusive.map((item) => `${item.check}@${item.entity}: ${item.reason}`),
+            /* The untagged run strips the very tags teardown leans on; only the tagged one is held to it. */
+            ...(untagged ? {} : { leaked }),
+            spurious: real,
+        };
+    }
+    catch (error) {
+        return {
+            ...empty,
+            checksRun: [],
+            detected: false,
+            entitiesTested: [],
+            error: messageOf(error),
+            findings: [],
+            spurious: [],
+        };
+    }
+}
+/** One defect, injected alone: detected, and nothing reported that it does not explain. */
+export async function judgeDefect(defect, target, { checkRepros = checkReproSyntax, excused = DAMAGES_BYSTANDERS, label = defect } = {}) {
+    const expected = EXPECTED[defect];
+    const acceptable = acceptableOf(expected);
+    const verdict = { acceptable, defect, expected: primaryOf(expected), label };
+    try {
+        const { findings, entitiesTested, checksRun, bystanders, strayLedger, missingValues, unreported } = await observe([defect], target, false);
+        const reproFailures = await checkRepros(findings);
+        if (reproFailures.length > 0) {
+            const error = `generated reproducer is not runnable — ${reproFailures[0]}`;
+            return { ...verdict, checksRun, detected: false, entitiesTested, error, findings, spurious: [] };
+        }
+        const real = findings.filter((f) => f.verdict !== "COVERAGE_GAP");
+        return {
+            ...verdict,
+            /* A defect that by design rewrites other rows is the backend's doing, not the API tester's. */
+            bystanders: excused.has(defect) ? [] : bystanders,
+            checksRun,
+            detected: real.some((f) => f.check === verdict.expected),
+            entitiesTested,
+            findings,
+            missingValues,
+            spurious: real.filter((f) => !acceptable.includes(f.check)),
+            strayLedger,
+            unreported,
+        };
+    }
+    catch (error) {
+        return {
+            ...verdict,
+            checksRun: [],
+            detected: false,
+            entitiesTested: [],
+            error: messageOf(error),
+            findings: [],
+            spurious: [],
+        };
+    }
+}
+//# sourceMappingURL=cases.js.map

package/dist/api/conformance/matrix/defects.d.ts

@@ -0,0 +1,72 @@
+import { type DefectName } from "../../reference/defects/table.ts";
+import type { Backend } from "./engines.ts";
+/**
+ * Defects only the SQL-backed reference can exhibit.
+ *
+ * The in-memory store has no physical column names, so a DDL/read naming mismatch has nowhere
+ * to happen. Every other defect is defined above the stores and runs on every engine.
+ */
+export declare const SQL_ONLY: ReadonlySet<DefectName>;
+export declare const CLIENT_ID_ONLY: ReadonlySet<DefectName>;
+export declare const KEY_LIFECYCLE_ONLY: ReadonlySet<DefectName>;
+export declare const CACHED_READS_ONLY: ReadonlySet<DefectName>;
+export declare const WRITE_ONLY_FIELD_ONLY: ReadonlySet<DefectName>;
+/**
+ * The only defects a remote D1 can say anything an in-process engine cannot.
+ *
+ * Every statement against D1 is a network round trip, so a full pass costs minutes. The defects
+ * worth paying that for are the ones whose behavior comes from the *engine build* — collation,
+ * type affinity, NULL ordering, LIKE escaping, identifier resolution. Everything else is decided
+ * in the request handler, where D1 would re-derive a result `node:sqlite` already gave for free.
+ * The lost update is not among them: the handler holds the write open on purpose, so it is real on
+ * any engine and runs on the in-memory one only (`ONE_ENGINE`).
+ */
+export declare const ENGINE_SENSITIVE: ReadonlySet<DefectName>;
+/**
+ * Defects that need cursor pagination to exist at all. A dialect that pages only by number
+ * cannot exhibit them, so reporting a miss there would be reporting the absence of a feature.
+ */
+/**
+ * Dialects that publish a cursor. Named rather than inferred, because "which defects can this
+ * shape even exhibit" is a property of the fixture, and a new dialect that forgets to declare
+ * itself here shows up as missed detections rather than as silent exclusions.
+ */
+export declare const DIALECTS_WITH_CURSOR: ReadonlySet<string>;
+/**
+ * Dialects that report a total. A shape publishing no count cannot publish a wrong one, so the
+ * count defects have nowhere to happen — the same reasoning that excuses cursor defects on a
+ * cursorless API, and not an excuse for a check that merely failed to fire.
+ */
+export declare const DIALECTS_WITH_TOTAL: ReadonlySet<string>;
+/**
+ * Dialects whose filtering is an expression language rather than one parameter per field.
+ *
+ * Equality-per-field has no expression to malform, no unknown *field* distinct from an unknown
+ * query parameter, and no way to write a pattern — so the defects that live inside a filter
+ * grammar have nowhere to happen.
+ */
+export declare const DIALECTS_WITH_FILTER_EXPRESSION: ReadonlySet<string>;
+/** Defects that need a filter expression language to exist at all. */
+export declare const EXPRESSION_ONLY: ReadonlySet<DefectName>;
+/**
+ * Defects that need a postgrest-shaped filter writer (`in` / `ilike` / `is`). Colon and
+ * equality cannot emit those operators, so injecting the lie there is a miss that names the
+ * grammar rather than the API tester.
+ */
+export declare const POSTGREST_OP_ONLY: ReadonlySet<DefectName>;
+/**
+ * Defects the API tester only probes on a declared sort grammar: a direction token is unknown on purpose only
+ * when the API tester knows the grammar's own. The reference declares its sort grammar where it is a template.
+ */
+export declare const DECLARED_SORT_ONLY: ReadonlySet<DefectName>;
+/** Defects that need a search-mode parameter, which only some dialects publish. */
+export declare const SEARCH_MODE_ONLY: ReadonlySet<DefectName>;
+/** Defects that need a nulls token in the sort grammar — only the dotted grammar writes one. */
+export declare const NULLS_TOKEN_ONLY: ReadonlySet<DefectName>;
+export declare const DIALECTS_WITH_POSTGREST_FILTER: ReadonlySet<string>;
+/** Defects that need a reported total to exist at all. */
+export declare const COUNT_ONLY: ReadonlySet<DefectName>;
+export declare const CURSOR_ONLY: ReadonlySet<DefectName>;
+/** Every defect this backend and dialect can exhibit, narrowed to `filter` when one is given. */
+export declare function defectsFor(backend: Backend, dialect: string, filter?: readonly string[]): DefectName[];
+//# sourceMappingURL=defects.d.ts.map

package/dist/api/conformance/matrix/defects.js

@@ -0,0 +1,233 @@
+import { DEFECTS } from "../../reference/defects/table.js";
+import { DIALECTS } from "../../reference/dialect/presets.js";
+/**
+ * Defects only the SQL-backed reference can exhibit.
+ *
+ * The in-memory store has no physical column names, so a DDL/read naming mismatch has nowhere
+ * to happen. Every other defect is defined above the stores and runs on every engine.
+ */
+export const SQL_ONLY = /* @__PURE__ */ new Set(["COLUMN_NAME_MISMATCH"]);
+/* Only a create that takes the client's id can ignore or overwrite it: the client-ids shape runs these. */
+export const CLIENT_ID_ONLY = /* @__PURE__ */ new Set([
+    "CLIENT_ID_IGNORED",
+    "CLIENT_ID_OVERWRITES",
+]);
+/* Only a listed, tenant-owned key can be revoked across tenants: the key-lifecycle shape runs these. */
+export const KEY_LIFECYCLE_ONLY = /* @__PURE__ */ new Set([
+    "KEY_DELETE_CROSS_TENANT",
+]);
+/* Only a cached read can be stale past its bound or ignore its bypass: the cached-reads shape runs these. */
+export const CACHED_READS_ONLY = /* @__PURE__ */ new Set([
+    "STALE_PAST_BOUND",
+    "BYPASS_IGNORED",
+]);
+/* Only a record with a write-only field can leak one: the write-only-field shape runs these. */
+export const WRITE_ONLY_FIELD_ONLY = /* @__PURE__ */ new Set(["WRITE_ONLY_LEAKED"]);
+/**
+ * The only defects a remote D1 can say anything an in-process engine cannot.
+ *
+ * Every statement against D1 is a network round trip, so a full pass costs minutes. The defects
+ * worth paying that for are the ones whose behavior comes from the *engine build* — collation,
+ * type affinity, NULL ordering, LIKE escaping, identifier resolution. Everything else is decided
+ * in the request handler, where D1 would re-derive a result `node:sqlite` already gave for free.
+ * The lost update is not among them: the handler holds the write open on purpose, so it is real on
+ * any engine and runs on the in-memory one only (`ONE_ENGINE`).
+ */
+export const ENGINE_SENSITIVE = /* @__PURE__ */ new Set([
+    "COLLATION_INCONSISTENT",
+    "COLUMN_NAME_MISMATCH",
+    "LIKE_UNESCAPED",
+    "NEQ_DROPS_NULLS",
+    "NUMERIC_COMPARED_AS_TEXT",
+    "SORT_DESC_DROPS_NULLS",
+    "UNSTABLE_SORT",
+]);
+/**
+ * Defects that need cursor pagination to exist at all. A dialect that pages only by number
+ * cannot exhibit them, so reporting a miss there would be reporting the absence of a feature.
+ */
+/**
+ * Dialects that publish a cursor. Named rather than inferred, because "which defects can this
+ * shape even exhibit" is a property of the fixture, and a new dialect that forgets to declare
+ * itself here shows up as missed detections rather than as silent exclusions.
+ */
+export const DIALECTS_WITH_CURSOR = /* @__PURE__ */ new Set(["postgrest"]);
+/**
+ * Dialects that report a total. A shape publishing no count cannot publish a wrong one, so the
+ * count defects have nowhere to happen — the same reasoning that excuses cursor defects on a
+ * cursorless API, and not an excuse for a check that merely failed to fire.
+ */
+export const DIALECTS_WITH_TOTAL = /* @__PURE__ */ new Set([
+    "postgrest",
+    "classic",
+    "jsonapi",
+    "template",
+]);
+/**
+ * Dialects whose filtering is an expression language rather than one parameter per field.
+ *
+ * Equality-per-field has no expression to malform, no unknown *field* distinct from an unknown
+ * query parameter, and no way to write a pattern — so the defects that live inside a filter
+ * grammar have nowhere to happen.
+ */
+export const DIALECTS_WITH_FILTER_EXPRESSION = /* @__PURE__ */ new Set([
+    "postgrest",
+    "classic",
+    "linked",
+    "jsonapi",
+    "template",
+]);
+/** Defects that need a filter expression language to exist at all. */
+export const EXPRESSION_ONLY = /* @__PURE__ */ new Set([
+    "ERROR_500_ON_BAD_FILTER",
+    /* Per-field equality has no declared filter *expression* to overclaim: an unrecognized
+     * parameter is simply ignored, which is conventional rather than a broken promise. */
+    "SPEC_OVERCLAIMS_FILTERABLE",
+    "FILTER_IGNORED",
+    "LIKE_UNESCAPED",
+    "NEQ_DROPS_NULLS",
+    "NUMERIC_COMPARED_AS_TEXT",
+    "FILTER_ILLEGAL_OP_IGNORED",
+    /* Per-field equality has no operator or conjunction to leave out of a term. */
+    "IGNORES_MALFORMED_FILTER",
+    "FILTER_GTE_IS_GT",
+    "FILTER_LTE_IS_LT",
+    "FILTER_LT_IS_LTE",
+    /* The overclaimed operator is `like`, which per-field equality cannot write. */
+    "SPEC_OVERCLAIMS_FILTER_OP",
+]);
+/**
+ * Defects that need a postgrest-shaped filter writer (`in` / `ilike` / `is`). Colon and
+ * equality cannot emit those operators, so injecting the lie there is a miss that names the
+ * grammar rather than the API tester.
+ */
+export const POSTGREST_OP_ONLY = /* @__PURE__ */ new Set([
+    "FILTER_IN_FIRST_ONLY",
+    "FILTER_ILIKE_IS_LIKE",
+    "FILTER_IS_NULL_MATCHES_ALL",
+    "FILTER_IN_CAP_IGNORED",
+    "FILTER_NIN_FIRST_ONLY",
+    "CONTAINS_MATCHES_SUBSTRING",
+    /* The alias is `ne`, which only the postgrest-shaped writer spells. */
+    "FILTER_ALIAS_MISMAPPED",
+    /* Grouping — nested and()/or(), and enough terms in one expression to pass a cap — exists
+     * only in the postgrest-shaped grammar. */
+    "FILTER_CONDITION_CAP_IGNORED",
+    "FILTER_NESTED_COMBINATOR_LEAKS",
+]);
+/**
+ * Defects the API tester only probes on a declared sort grammar: a direction token is unknown on purpose only
+ * when the API tester knows the grammar's own. The reference declares its sort grammar where it is a template.
+ */
+export const DECLARED_SORT_ONLY = /* @__PURE__ */ new Set([
+    "IGNORES_BAD_SORT_DIRECTION",
+]);
+/** Defects that need a search-mode parameter, which only some dialects publish. */
+export const SEARCH_MODE_ONLY = /* @__PURE__ */ new Set(["SEARCH_MODE_REJECTED"]);
+/** Defects that need a nulls token in the sort grammar — only the dotted grammar writes one. */
+export const NULLS_TOKEN_ONLY = /* @__PURE__ */ new Set([
+    "SORT_NULLS_MODIFIER_IGNORED",
+]);
+export const DIALECTS_WITH_POSTGREST_FILTER = /* @__PURE__ */ new Set([
+    "postgrest",
+    "linked",
+    "jsonapi",
+]);
+/** Defects that need a reported total to exist at all. */
+export const COUNT_ONLY = /* @__PURE__ */ new Set([
+    "COUNT_ALWAYS_ZERO",
+    "COUNT_IGNORES_FILTER",
+]);
+export const CURSOR_ONLY = /* @__PURE__ */ new Set([
+    "CURSOR_DRIFT",
+    "COLLATION_INCONSISTENT",
+]);
+/** Defects whose symptom does not depend on the API's query or envelope conventions. */
+const DIALECT_INSENSITIVE = /* @__PURE__ */ new Set([
+    "PATCH_REPLACES",
+    "CALLER_UPDATE_DROPPED",
+    "PUBLIC_GET_NOT_SUCCESS",
+    "TOKEN_EXPIRY_AS_STRING",
+    "DISCRIMINATOR_BRANCH_WRONG",
+    "ACTION_CRASHES",
+    "LISTED_GET_DIFFERS",
+    "EXISTENCE_LEAK_VIA_STATUS",
+    "UNIQUE_NOT_ENFORCED",
+    "IDEMPOTENCY_IGNORED",
+    "IDEMPOTENT_REPLAY_INSERTS",
+    "IMMUTABLE_WRITABLE",
+    "CREATED_201_AS_200",
+    "DELETE_MISSING_OK",
+    "CROSS_TENANT_READ",
+    "CREATE_DROPS_FIELD",
+    "UPDATE_DROPS_FIELD",
+    "READ_DROPS_FIELD",
+    "READ_BODY_DIVERGES",
+    "WRITE_ONLY_LEAKED",
+    "STRING_PAYLOAD_MANGLED",
+    "ENUM_NOT_VALIDATED",
+    "MAXLENGTH_NOT_VALIDATED",
+    "REQUIRED_NOT_VALIDATED",
+    "CONTENT_TYPE_NOT_ENFORCED",
+    "ERROR_SCHEMA_DRIFT",
+    "PROBLEM_JSON_MALFORMED",
+    "ASYNC_NEVER_COMPLETES",
+    "ASYNC_RECEIPT_MISSING_ID",
+    "CONCURRENT_WRITE_LOST",
+    "ETAG_IGNORED",
+    "ROLE_MONOTONICITY_BROKEN",
+    "INVITE_NEVER_GRANTS",
+    "REVOKE_IGNORED",
+    "CREATE_500_ON_NON_ASCII",
+    "SIDE_EFFECT_NEVER_ARRIVES",
+    "RATE_LIMIT_STRICTER_THAN_DECLARED",
+    "PRIVILEGED_FIELD_ON_SIGNUP",
+]);
+/** Defects that need a page-number parameter to be seen. */
+const PAGE_NUMBER_ONLY = /* @__PURE__ */ new Set(["PAGE_PAST_END_REPEATS"]);
+/** Defects that run on the in-memory engine only: the store plays no part in them. */
+const ONE_ENGINE = /* @__PURE__ */ new Set([
+    "CONCURRENT_WRITE_LOST",
+    "CALLER_UPDATE_DROPPED",
+    "PUBLIC_GET_NOT_SUCCESS",
+    "TOKEN_EXPIRY_AS_STRING",
+    "DISCRIMINATOR_BRANCH_WRONG",
+    "ACTION_CRASHES",
+    "LISTED_GET_DIFFERS",
+    /* The register keeps its accounts in the auth state, never the store. */
+    "PRIVILEGED_FIELD_ON_SIGNUP",
+]);
+/** Every defect this backend and dialect can exhibit, narrowed to `filter` when one is given. */
+export function defectsFor(backend, dialect, filter) {
+    return (Object.keys(DEFECTS)
+        .filter((name) => filter === undefined || filter.length === 0 || filter.includes(name))
+        /* A defect the backend structurally cannot exhibit is not a miss: the in-memory store has
+         * no physical column names, so a DDL/read mismatch has nowhere to happen. */
+        .filter((name) => backend !== "memory" || !SQL_ONLY.has(name))
+        /* Shape-only defects run in the recall pass of the shape that names them. */
+        .filter((name) => !CLIENT_ID_ONLY.has(name) &&
+        !WRITE_ONLY_FIELD_ONLY.has(name) &&
+        !KEY_LIFECYCLE_ONLY.has(name) &&
+        !CACHED_READS_ONLY.has(name))
+        /* Likewise a dialect that has no cursor cannot drift one. */
+        .filter((name) => DIALECTS_WITH_CURSOR.has(dialect) || !CURSOR_ONLY.has(name))
+        /* Likewise a shape with no total cannot report a wrong one. */
+        .filter((name) => DIALECTS_WITH_TOTAL.has(dialect) || !COUNT_ONLY.has(name))
+        /* And a shape with no filter *expression* cannot malform one. */
+        .filter((name) => DIALECTS_WITH_FILTER_EXPRESSION.has(dialect) || !EXPRESSION_ONLY.has(name))
+        .filter((name) => DIALECTS_WITH_POSTGREST_FILTER.has(dialect) || !POSTGREST_OP_ONLY.has(name))
+        .filter((name) => DIALECTS[dialect]?.params.searchMode !== undefined || !SEARCH_MODE_ONLY.has(name))
+        .filter((name) => DIALECTS[dialect]?.sortTemplate !== undefined || !DECLARED_SORT_ONLY.has(name))
+        /* A dialect that pages by offset has no page number to ask past the end. */
+        .filter((name) => DIALECTS[dialect]?.params.page !== undefined || !PAGE_NUMBER_ONLY.has(name))
+        .filter((name) => (DIALECTS[dialect]?.sortGrammar ?? "dotted") === "dotted" || !NULLS_TOKEN_ONLY.has(name))
+        /* A fault in writes, auth or validation reads the same under every dialect; the extra
+         * dialect passes are for how a listing is asked for and answered. */
+        .filter((name) => dialect === "postgrest" || !DIALECT_INSENSITIVE.has(name))
+        /* A store-independent race, timed with a sleep: one engine shows it as well as three. */
+        .filter((name) => backend === "memory" || !ONE_ENGINE.has(name))
+        /* D1 is a network round trip per statement. Restricting it to the engine-sensitive set
+         * keeps a run to minutes rather than an hour, and drops nothing D1 could uniquely show. */
+        .filter((name) => backend !== "d1" || ENGINE_SENSITIVE.has(name)));
+}
+//# sourceMappingURL=defects.js.map