@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/conformance/specs/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/conformance/specs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Hostile spec fixtures.
+ *
+ * Every one of these is a shape found in a real published OpenAPI document. The bar is not that
+ * The API tester models them well — several are genuinely untestable — but that it never throws, never
+ * hangs, and says plainly what it could not do. Prior art in this space died on exactly this
+ * class: one `nullable` without a `type` made the validator refuse to compile and took the whole
+ * run with it.
+ *
+ * Vendored rather than downloaded so the check stays offline and deterministic.
+ */
+import type { SpecFixture } from "./specs/types.ts";
+export type { SpecFixture } from "./specs/types.ts";
+/** Every fixture, in the order the parser suite reports them. */
+export declare function specFixtures(): SpecFixture[];
+//# sourceMappingURL=specs.d.ts.map

package/dist/api/conformance/specs.js

@@ -0,0 +1,18 @@
+/**
+ * Hostile spec fixtures.
+ *
+ * Every one of these is a shape found in a real published OpenAPI document. The bar is not that
+ * The API tester models them well — several are genuinely untestable — but that it never throws, never
+ * hangs, and says plainly what it could not do. Prior art in this space died on exactly this
+ * class: one `nullable` without a `type` made the validator refuse to compile and took the whole
+ * run with it.
+ *
+ * Vendored rather than downloaded so the check stays offline and deterministic.
+ */
+import { documentFixtures } from "./specs/documents.js";
+import { modelFixtures } from "./specs/models.js";
+/** Every fixture, in the order the parser suite reports them. */
+export function specFixtures() {
+    return [...documentFixtures(), ...modelFixtures()];
+}
+//# sourceMappingURL=specs.js.map

package/dist/api/conformance/suites/coverage-report.d.ts

@@ -0,0 +1,9 @@
+import type { ParserResult } from "../harness/result.ts";
+/**
+ * A skip on one entity must not look like the check never ran.
+ *
+ * Multi-entity labs made this lie: invalidate ran on every child and the console still said
+ * "did not apply" because the parents skipped it.
+ */
+export declare function runCoverageReportSuite(): ParserResult[];
+//# sourceMappingURL=coverage-report.d.ts.map

package/dist/api/conformance/suites/coverage-report.js

@@ -0,0 +1,50 @@
+import { coverageByCheck } from "../../report/render/coverage.js";
+import { renderConsole } from "../../report/render/summary.js";
+/**
+ * A skip on one entity must not look like the check never ran.
+ *
+ * Multi-entity labs made this lie: invalidate ran on every child and the console still said
+ * "did not apply" because the parents skipped it.
+ */
+export function runCoverageReportSuite() {
+    const input = {
+        checksRun: ["invalidation.declared-route-changes", "list.read-after-write"],
+        checksSkipped: [
+            { check: "invalidation.declared-route-changes", entity: "parent", needs: "a foreign read route" },
+            { check: "async.reaches-terminal-state", entity: "parent", needs: "x-async" },
+            { check: "async.reaches-terminal-state", entity: "child", needs: "x-async" },
+        ],
+        checksSuppressed: [],
+        client: { transcript: [] },
+        durationMs: 1,
+        entitiesTested: ["parent", "child"],
+        findings: [],
+    };
+    const coverage = coverageByCheck(input);
+    const text = renderConsole(input);
+    const cases = [
+        [
+            "invalidate is partial, not never",
+            "it ran on the child",
+            coverage.partialSkip.some((r) => r.check === "invalidation.declared-route-changes"),
+        ],
+        [
+            "async never applied",
+            "neither entity had x-async",
+            coverage.never.some((r) => r.check === "async.reaches-terminal-state"),
+        ],
+        [
+            "console does not put a ran check under DID NOT APPLY",
+            "the invalidate line lives in APPLIED ONLY ON SOME ENTITIES",
+            text.includes("APPLIED ONLY ON SOME ENTITIES") &&
+                text.slice(0, text.indexOf("APPLIED ONLY ON SOME ENTITIES")).includes("invalidation") === false,
+        ],
+    ];
+    return cases.map(([name, why, ok]) => ({
+        detail: String(ok),
+        name,
+        ok,
+        why,
+    }));
+}
+//# sourceMappingURL=coverage-report.js.map

package/dist/api/conformance/suites/example.d.ts

@@ -0,0 +1,4 @@
+import type { ParserResult } from "../harness/result.ts";
+/** Checks the document at `path`: the annotated example, unless a test brings another. */
+export declare function runExampleSpecSuite(path?: string): Promise<ParserResult[]>;
+//# sourceMappingURL=example.d.ts.map

package/dist/api/conformance/suites/example.js

@@ -0,0 +1,65 @@
+import { buildModel } from "../../spec/graph/build.js";
+import { dereference } from "../../spec/load/dereference.js";
+import { loadSpec } from "../../spec/load/source.js";
+import { messageOf } from "../../errors/message.js";
+/** What the comments claim about the widget listing. */
+function listExpectations(model) {
+    const list = model.byOperationId.get("widget.list");
+    const query = list?.query;
+    const conventions = list?.conventions;
+    return [
+        ["x-query resolves the filter grammar", "the comment claims postgrest", conventions?.grammar, "postgrest"],
+        ["x-query declares filterable fields", "not guessed from the schema", query?.source, "tag"],
+        ["x-query accepts structured filterable rows", "declared-or-skip catalog", query?.filterFields?.[0]?.field, "id"],
+        ["x-query sets maxLimit", "used to bound page-size probes", query?.maxLimit, 100],
+        ["limit resolves as page size", "distinguished by maximum + default", conventions?.limit, "limit"],
+        ["cursor role resolves", "declared alongside page", conventions?.cursor, "cursor"],
+        ["x-tenant is declared, not inferred", "decides SECURITY vs AMBIGUITY", list?.tenantSource, "tag"],
+    ];
+}
+/** What the comments claim about every other operation. */
+function otherExpectations(model) {
+    const create = model.byOperationId.get("widget.create");
+    const update = model.byOperationId.get("widget.update");
+    const start = model.byOperationId.get("export.start");
+    const widgetRead = model.byOperationId.get("widget.read");
+    const templateRead = model.byOperationId.get("template.read");
+    return [
+        ["workspace widget read is tagged", "SECURITY vs AMBIGUITY is unchanged", widgetRead?.tenantSource, "tag"],
+        [
+            "public catalog is unscoped",
+            "no x-tenant and template_id is not a tenant name",
+            templateRead?.tenantSource,
+            null,
+        ],
+        ["public catalog has no tenant param", 'omit is not the string "null"', templateRead?.tenantParam, null],
+        ["x-invalidate names two routes", "one of them cross-entity", create?.invalidates.length, 2],
+        ["idempotency header is modeled", "a promise the API tester replays", create?.idempotencyHeader, "Idempotency-Key"],
+        ["x-immutable is read", "probed for rejection", update?.immutable.includes("workspace_id"), true],
+        ["x-async is read", "the API tester follows the job", start?.async?.poll, "export.read"],
+        ["x-feature-gate is read", "a matching 403 is coverage, not a seed defect", create?.featureGate, "widgets"],
+        ["x-unique is read", "a 409 duplicate is a pass, 2xx is BACKEND_BUG", create?.unique, [["name"]]],
+    ];
+}
+function judged([name, why, actual, expected]) {
+    const ok = JSON.stringify(actual) === JSON.stringify(expected);
+    return {
+        detail: ok ? `${JSON.stringify(actual)}` : `expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`,
+        name,
+        ok,
+        why,
+    };
+}
+/** Checks the document at `path`: the annotated example, unless a test brings another. */
+export async function runExampleSpecSuite(path = new URL("../../../../labs/api/annotated-openapi.yaml", import.meta.url).pathname) {
+    let model;
+    try {
+        model = buildModel(dereference(await loadSpec(path)).doc);
+    }
+    catch (error) {
+        const why = "the documented example must be a parseable OpenAPI document";
+        return [{ detail: messageOf(error), name: "annotated-openapi.yaml", ok: false, why }];
+    }
+    return [...listExpectations(model), ...otherExpectations(model)].map(judged);
+}
+//# sourceMappingURL=example.js.map

package/dist/api/conformance/suites/parser.d.ts

@@ -0,0 +1,4 @@
+import type { ParserResult } from "../harness/result.ts";
+import { type SpecFixture } from "../specs.ts";
+export declare function runParserSuite(fixtures?: readonly SpecFixture[]): ParserResult[];
+//# sourceMappingURL=parser.d.ts.map

package/dist/api/conformance/suites/parser.js

@@ -0,0 +1,92 @@
+import { buildModel } from "../../spec/graph/build.js";
+import { dereference } from "../../spec/load/dereference.js";
+import { specFixtures } from "../specs.js";
+import { messageOf } from "../../errors/message.js";
+const MANGLED_PLURALS = ["statu", "analyze", "peopl", "campuse", "inbo"];
+function querySource(op) {
+    const source = op?.query?.source;
+    return source === "heuristic" ? [] : [`query source is ${source ?? "null"}, expected heuristic`];
+}
+function maxLimit(op) {
+    const limit = op?.query?.maxLimit;
+    return limit === 50 ? [] : [`maxLimit is ${String(limit)}, expected 50 from per_page.maximum`];
+}
+function roles(op) {
+    const conventions = op?.conventions;
+    if (conventions?.order === "sort" && conventions.select === "fields" && conventions.search === "q")
+        return [];
+    return [`roles resolved to order=${conventions?.order} select=${conventions?.select} search=${conventions?.search}`];
+}
+function rolesByAlias(model) {
+    const op = model.operations[0];
+    return [...querySource(op), ...maxLimit(op), ...roles(op)];
+}
+/* A schema ref to nothing reads as unconstrained with a gap; a parameter ref to nothing leaves its operation untested. */
+function danglingRef(model) {
+    const problems = [];
+    if (!model.gaps.gaps.some((gap) => gap.tag === "$ref" && gap.operationId === "payment.list")) {
+        problems.push("payment.list has no gap for the schema its $ref names but the document lacks");
+    }
+    if (model.byOperationId.get("refund.list")?.unsendable == null) {
+        problems.push("refund.list was modeled with a parameter its $ref names but the document lacks");
+    }
+    return problems;
+}
+/* A requirement whose scopes are not a list reads as needing none, with a gap naming the scheme. */
+function scopesNotAList(model) {
+    const problems = [];
+    const scopes = model.byOperationId.get("RevokeToken")?.security.alternatives;
+    if (JSON.stringify(scopes) !== JSON.stringify([[{ scheme: "oauth2", scopes: [] }]])) {
+        problems.push(`RevokeToken's requirement read as ${JSON.stringify(scopes)}, expected oauth2 with no scopes`);
+    }
+    if (!model.gaps.gaps.some((gap) => gap.tag === "security" && gap.operationId === "RevokeToken")) {
+        problems.push("RevokeToken has no gap for the oauth2 scopes that are not a list");
+    }
+    return problems;
+}
+const PROBES = {
+    "dangling-ref": danglingRef,
+    "external-ref": (_, externalRefs) => externalRefs.length === 0 ? ["external $ref was silently resolved instead of reported"] : [],
+    "irregular-plurals": (model) => MANGLED_PLURALS.filter((bad) => model.entities.has(bad)).map((bad) => `mangled plural produced entity "${bad}"`),
+    "multiple-arrays-in-envelope": (model) => {
+        const key = model.operations[0]?.collection?.key;
+        return key === "reports" ? [] : [`collection key resolved to "${key ?? "none"}", expected "reports"`];
+    },
+    "pagination-only-is-not-query": (model) => {
+        const query = model.operations[0]?.query;
+        return query === null ? [] : [`query capability inferred from page/limit/status: ${query?.source ?? "unknown"}`];
+    },
+    "query-roles-by-alias": rolesByAlias,
+    "scopes-not-a-list": scopesNotAList,
+};
+/** The operation and entity counts a fixture expects, where it states them. */
+function countProblems(fixture, model) {
+    const problems = [];
+    if (fixture.expectOperations !== undefined && model.operations.length !== fixture.expectOperations) {
+        problems.push(`expected ${fixture.expectOperations} operation(s), modeled ${model.operations.length}`);
+    }
+    if (fixture.expectEntities !== undefined && model.entities.size !== fixture.expectEntities) {
+        problems.push(`expected ${fixture.expectEntities} entity/entities, modeled ${model.entities.size}`);
+    }
+    return problems;
+}
+function parseFixture(fixture) {
+    try {
+        const { doc, externalRefs } = dereference(fixture.doc);
+        const model = buildModel(doc);
+        const problems = [...countProblems(fixture, model), ...(PROBES[fixture.name]?.(model, externalRefs) ?? [])];
+        return {
+            detail: problems.join("; ") || `${model.operations.length} ops, ${model.entities.size} entities`,
+            name: fixture.name,
+            ok: problems.length === 0,
+            why: fixture.why,
+        };
+    }
+    catch (error) {
+        return { detail: `threw: ${messageOf(error)}`, name: fixture.name, ok: false, why: fixture.why };
+    }
+}
+export function runParserSuite(fixtures = specFixtures()) {
+    return fixtures.map(parseFixture);
+}
+//# sourceMappingURL=parser.js.map

package/dist/api/conformance/suites/payload-catalog.d.ts

@@ -0,0 +1,3 @@
+import type { ParserResult } from "../harness/result.ts";
+export declare function runPayloadCatalogSuite(): ParserResult[];
+//# sourceMappingURL=payload-catalog.d.ts.map

package/dist/api/conformance/suites/payload-catalog.js

@@ -0,0 +1,13 @@
+import { catalogProblems, STRING_PAYLOADS } from "../../runtime/payloads.js";
+export function runPayloadCatalogSuite() {
+    const problems = catalogProblems();
+    return [
+        {
+            detail: problems.join("; ") || `${STRING_PAYLOADS.length} cases, JSON-stable, no NUL`,
+            name: "string-payload-catalog",
+            ok: problems.length === 0,
+            why: "the payload catalog must be unique, JSON-round-trippable, and cover every promised family",
+        },
+    ];
+}
+//# sourceMappingURL=payload-catalog.js.map

package/dist/api/conformance/suites/public-catalog.d.ts

@@ -0,0 +1,7 @@
+import type { Handle } from "../../reference/http/node.ts";
+/**
+ * A catalog every principal reads in full: no tenant names its records, so a template one
+ * principal made is the other's to read too. Answers each request, failures included.
+ */
+export declare function publicCatalog(): Handle;
+//# sourceMappingURL=public-catalog.d.ts.map

package/dist/api/conformance/suites/public-catalog.js

@@ -0,0 +1,168 @@
+import { bearer } from "../../reference/http/access.js";
+import { bearerSecurity } from "../harness/security.js";
+const PUBLIC_CATALOG_SPEC = {
+    info: { title: "Public catalog", version: "1.0" },
+    openapi: "3.1.0",
+    paths: {
+        "/v1/templates": {
+            get: {
+                operationId: "template.list",
+                parameters: [
+                    {
+                        description: "PostgREST filter expression, e.g. id.eq.value",
+                        in: "query",
+                        name: "filter",
+                        required: false,
+                        schema: { type: "string" },
+                    },
+                ],
+                responses: {
+                    "200": {
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    properties: {
+                                        templates: {
+                                            items: { properties: { id: { type: "string" }, name: { type: "string" } }, type: "object" },
+                                            type: "array",
+                                        },
+                                    },
+                                    required: ["templates"],
+                                    type: "object",
+                                },
+                            },
+                        },
+                        description: "ok",
+                    },
+                },
+                "x-entity": { action: "list", identity: "id", name: "template" },
+            },
+            post: {
+                operationId: "template.create",
+                requestBody: {
+                    content: {
+                        "application/json": {
+                            schema: {
+                                additionalProperties: false,
+                                properties: { name: { maxLength: 128, type: "string" } },
+                                required: ["name"],
+                                type: "object",
+                            },
+                        },
+                    },
+                    required: true,
+                },
+                responses: {
+                    "201": {
+                        content: {
+                            "application/json": {
+                                schema: { properties: { id: { type: "string" }, name: { type: "string" } }, type: "object" },
+                            },
+                        },
+                        description: "created",
+                    },
+                },
+                "x-entity": { action: "create", identity: "id", name: "template" },
+            },
+        },
+        "/v1/templates/{template_id}": {
+            delete: {
+                operationId: "template.delete",
+                parameters: [{ in: "path", name: "template_id", required: true, schema: { type: "string" } }],
+                responses: { "204": { description: "deleted" } },
+                "x-entity": { action: "delete", identity: "id", name: "template" },
+            },
+            get: {
+                operationId: "template.read",
+                parameters: [{ in: "path", name: "template_id", required: true, schema: { type: "string" } }],
+                responses: {
+                    "200": {
+                        content: {
+                            "application/json": {
+                                schema: { properties: { id: { type: "string" }, name: { type: "string" } }, type: "object" },
+                            },
+                        },
+                        description: "ok",
+                    },
+                },
+                "x-entity": { action: "read", identity: "id", name: "template" },
+            },
+        },
+    },
+    ... /* @__PURE__ */bearerSecurity(),
+};
+function send(status, body) {
+    if (body === undefined)
+        return { body: "", headers: {}, status };
+    const text = JSON.stringify(body);
+    return {
+        body: text,
+        headers: { "content-length": String(Buffer.byteLength(text)), "content-type": "application/json" },
+        status,
+    };
+}
+/** A body read as JSON: nothing when empty, and a throw — answered 500 — when it is not JSON. */
+async function readJson(request) {
+    const text = await request.text();
+    return text === "" ? undefined : JSON.parse(text);
+}
+/**
+ * A catalog every principal reads in full: no tenant names its records, so a template one
+ * principal made is the other's to read too. Answers each request, failures included.
+ */
+export function publicCatalog() {
+    const rows = new Map();
+    const tokens = new Set(["tok_alpha", "tok_beta"]);
+    let seq = 0;
+    const answer = async (request) => {
+        const { method, url } = request;
+        if (url.pathname === "/v1/openapi/spec" && method === "GET")
+            return send(200, PUBLIC_CATALOG_SPEC);
+        const token = bearer(request);
+        if (token === undefined || !tokens.has(token))
+            return send(401, { error: "unauthorized" });
+        if (url.pathname === "/v1/templates") {
+            if (method === "GET")
+                return send(200, { templates: listed(rows, url.searchParams.get("filter")) });
+            if (method === "POST") {
+                const body = (await readJson(request));
+                seq += 1;
+                const row = { id: `tmpl_${String(seq)}`, name: typeof body?.name === "string" ? body.name : "" };
+                rows.set(row.id, row);
+                return send(201, row);
+            }
+        }
+        return item(rows, request);
+    };
+    return async (request) => {
+        try {
+            return await answer(request);
+        }
+        catch {
+            return send(500, { error: "internal" });
+        }
+    };
+}
+/* Every template, or the one `filter=id.eq.<id>` names. */
+function listed(rows, filter) {
+    const match = filter === null ? null : /^id\.eq\.(.+)$/.exec(filter);
+    if (match === null)
+        return [...rows.values()];
+    /* `(.+)` always captures: the group is there whenever the match is. */
+    const row = rows.get(String(match[1]));
+    return row === undefined ? [] : [row];
+}
+function item(rows, request) {
+    const match = /^\/v1\/templates\/([^/]+)$/.exec(request.url.pathname);
+    if (match === null || (request.method !== "GET" && request.method !== "DELETE"))
+        return send(404, { error: "not_found" });
+    const id = decodeURIComponent(String(match[1]));
+    const row = rows.get(id);
+    if (row === undefined)
+        return send(404, { error: "not_found" });
+    if (request.method === "GET")
+        return send(200, row);
+    rows.delete(id);
+    return send(204);
+}
+//# sourceMappingURL=public-catalog.js.map

package/dist/api/conformance/suites/render.d.ts

@@ -0,0 +1,6 @@
+import type { ParserResult } from "../harness/result.ts";
+export declare function renderParserSuite(results: ParserResult[]): {
+    text: string;
+    failures: number;
+};
+//# sourceMappingURL=render.d.ts.map

package/dist/api/conformance/suites/render.js

@@ -0,0 +1,19 @@
+export function renderParserSuite(results) {
+    const lines = [];
+    let failures = 0;
+    lines.push("");
+    lines.push("  spec fixture                  result");
+    lines.push("  ─────────────────────────────────────────────────────────────────────────");
+    for (const result of results) {
+        if (!result.ok)
+            failures++;
+        lines.push(`  ${result.ok ? "✓" : "✗"} ${result.name.padEnd(28)} ${result.detail}`);
+        if (!result.ok)
+            lines.push(`      ${result.why}`);
+    }
+    lines.push("");
+    lines.push(`  ${results.length - failures}/${results.length} hostile specs handled`);
+    lines.push("");
+    return { failures, text: lines.join("\n") };
+}
+//# sourceMappingURL=render.js.map

package/dist/api/conformance/suites/repro-syntax.d.ts

@@ -0,0 +1,11 @@
+import { renderRepros } from "../../report/render/repro.ts";
+import type { Finding } from "../../runtime/finding.ts";
+/**
+ * Generated reproducers are shell scripts, so a quoting mistake turns them into scripts that run
+ * against a literal `$BASE` with a literal `$TOKEN` — they look right and do the wrong thing.
+ * `bash -n` parses without executing, which catches that class before anyone copies one.
+ */
+export declare function checkReproSyntax(findings: Finding[]): Promise<string[]>;
+/** Each script's parse failures and unexpandable variables, as `filename: problem`. */
+export declare function checkScripts(scripts: ReturnType<typeof renderRepros>): Promise<string[]>;
+//# sourceMappingURL=repro-syntax.d.ts.map

package/dist/api/conformance/suites/repro-syntax.js

@@ -0,0 +1,55 @@
+import { renderRepros } from "../../report/render/repro.js";
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { messageOf } from "../../errors/message.js";
+import { Redactor } from "../../security/redact.js";
+const exec = /* @__PURE__ */ promisify(execFile);
+/**
+ * Generated reproducers are shell scripts, so a quoting mistake turns them into scripts that run
+ * against a literal `$BASE` with a literal `$TOKEN` — they look right and do the wrong thing.
+ * `bash -n` parses without executing, which catches that class before anyone copies one.
+ */
+export async function checkReproSyntax(findings) {
+    return await checkScripts(renderRepros(findings, "https://example.test", new Redactor()));
+}
+/** Each script's parse failures and unexpandable variables, as `filename: problem`. */
+export async function checkScripts(scripts) {
+    if (scripts.length === 0)
+        return [];
+    const dir = await mkdtemp(join(tmpdir(), "testing-repro-"));
+    try {
+        return await checkEach(dir, scripts);
+    }
+    finally {
+        /* A self-test that litters the temp directory is the same failure it reports elsewhere. */
+        await rm(dir, { force: true, recursive: true });
+    }
+}
+async function checkEach(dir, scripts) {
+    const failures = [];
+    for (const script of scripts) {
+        const path = join(dir, script.filename);
+        await writeFile(path, script.content);
+        try {
+            await exec("bash", ["-n", path]);
+        }
+        catch (error) {
+            failures.push(`${script.filename}: ${messageOf(error)}`);
+        }
+        /* An unexpanded variable inside single quotes is syntactically valid and semantically
+         * wrong, so parse success is not enough. Checked per line and skipping comments: prose
+         * apostrophes ("schema's") would otherwise let the match span into unrelated code. */
+        for (const line of script.content.split("\n")) {
+            if (line.trimStart().startsWith("#"))
+                continue;
+            if (/'[^']*\$(BASE|TOKEN)[^']*'/.test(line)) {
+                failures.push(`${script.filename}: $BASE/$TOKEN appears inside single quotes and will not expand — ${line.trim()}`);
+            }
+        }
+    }
+    return failures;
+}
+//# sourceMappingURL=repro-syntax.js.map

package/dist/api/conformance/suites/tag-unlock.d.ts

@@ -0,0 +1,19 @@
+import { type Via } from "../harness/launch.ts";
+import type { ParserResult } from "../harness/result.ts";
+/**
+ * `doctor` claims each tag unlocks specific checks. This proves it.
+ *
+ * The reference backend is run twice — with its tags and with them stripped — and the checks that
+ * disappear must be exactly the set `TAG_UNLOCKS` promises. Without this the claim is a hand-
+ * maintained list that drifts the moment a check's applicability changes, and a coverage promise
+ * nobody verified is worse than no promise.
+ */
+/**
+ * `baselines`, when given, are the checks the defect matrix's two clean baselines ran — the same
+ * two runs this would otherwise make again.
+ */
+export declare function runTagUnlockSuite(via: Via, baselines?: {
+    tagged: readonly string[];
+    untagged: readonly string[];
+}): Promise<ParserResult[]>;
+//# sourceMappingURL=tag-unlock.d.ts.map

package/dist/api/conformance/suites/tag-unlock.js

@@ -0,0 +1,54 @@
+import { run } from "../harness/counting.js";
+import { launch, reach } from "../harness/launch.js";
+import { PRINCIPALS, SECURITY } from "../matrix/principals.js";
+/** The checks a clean run against the reference runs, with its tags or without them. */
+async function checksRun(untagged, via) {
+    const server = await launch({ backend: "memory", dialect: "postgrest", via }, { untagged });
+    try {
+        const result = await run({
+            baseUrl: server.url,
+            principals: PRINCIPALS,
+            security: SECURITY,
+            seed: 42,
+            spec: `${server.url}/v1/openapi/spec`,
+            ...reach(server),
+        });
+        return new Set(result.checksRun);
+    }
+    finally {
+        await server.close();
+    }
+}
+/**
+ * `doctor` claims each tag unlocks specific checks. This proves it.
+ *
+ * The reference backend is run twice — with its tags and with them stripped — and the checks that
+ * disappear must be exactly the set `TAG_UNLOCKS` promises. Without this the claim is a hand-
+ * maintained list that drifts the moment a check's applicability changes, and a coverage promise
+ * nobody verified is worse than no promise.
+ */
+/**
+ * `baselines`, when given, are the checks the defect matrix's two clean baselines ran — the same
+ * two runs this would otherwise make again.
+ */
+export async function runTagUnlockSuite(via, baselines) {
+    const { TAG_UNLOCKS } = await import("../../report/console/tags.js");
+    const tagged = baselines === undefined ? await checksRun(false, via) : new Set(baselines.tagged);
+    const untagged = baselines === undefined ? await checksRun(true, via) : new Set(baselines.untagged);
+    const lost = [...tagged].filter((id) => !untagged.has(id)).sort();
+    const promised = Object.values(TAG_UNLOCKS).flat().sort();
+    const missing = promised.filter((id) => !lost.includes(id));
+    const unclaimed = lost.filter((id) => !promised.includes(id));
+    const ok = missing.length === 0 && unclaimed.length === 0;
+    return [
+        {
+            detail: ok
+                ? `${lost.length} check(s) unlocked by tags, exactly as documented`
+                : `promised-but-not-lost: [${missing.join(", ")}]; lost-but-unclaimed: [${unclaimed.join(", ")}]`,
+            name: "doctor's tag-unlock claims are true",
+            ok,
+            why: "a coverage promise nobody verified is worse than no promise",
+        },
+    ];
+}
+//# sourceMappingURL=tag-unlock.js.map

package/dist/api/conformance/suites/tenant-scope.d.ts

@@ -0,0 +1,4 @@
+import { type Via } from "../harness/launch.ts";
+import type { ParserResult } from "../harness/result.ts";
+export declare function runTenantScopeSuite(via: Via): Promise<ParserResult[]>;
+//# sourceMappingURL=tenant-scope.d.ts.map