@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/credentials/validate/security.js

@@ -0,0 +1,179 @@
+import { isRaw, isRawUnion, isRecord } from "../../config/types/raw.js";
+import { nearest } from "../../errors/suggest.js";
+import { UsageError } from "../../errors/usage-error.js";
+import { placementOf } from "../../spec/security/placement.js";
+import { effectiveRecipe } from "../effective.js";
+import { recipeSchemes } from "../origin-recipes.js";
+import { freshView, principalProblems, removedProblems } from "./principals.js";
+import { documentProblems } from "./document.js";
+import { declaredEverywhere, originProblems, originViews, scopedRecipes } from "./origins.js";
+import { kindProblems, kindShapeProblems, optionProblems, validPlacement, } from "./recipe-shape.js";
+/** What validation reads from a document: its model, whether it still has `x-auth-flows`, and its signup. */
+export function specView(model, doc) {
+    const fresh = freshView(model);
+    const view = { authFlows: "x-auth-flows" in doc, operations: model.operations, schemes: model.schemes };
+    return fresh === undefined ? view : { ...view, fresh };
+}
+function oauth2Problems(path, oauth2, scheme) {
+    if (scheme.kind !== "oauth2")
+        return [`${path}.oauth2 needs an oauth2 scheme; ${scheme.name} is ${scheme.kind}`];
+    const flow = scheme.flows[oauth2.flow];
+    return flow?.tokenUrl === undefined
+        ? [`${path}.oauth2.flow "${String(oauth2.flow)}" is not a flow scheme ${scheme.name} declares with a tokenUrl`]
+        : [];
+}
+/** The chain of `mint.with` from `start`, ending where it leaves the mints or returns to `start`. */
+function mintChain(start, security) {
+    const chain = [start];
+    let at = start;
+    for (;;) {
+        const next = security[at]?.mint?.with;
+        if (typeof next !== "string" || !isRecord(security[next]))
+            return chain;
+        chain.push(next);
+        if (next === start || chain.length > Object.keys(security).length)
+            return chain;
+        at = next;
+    }
+}
+const names = (spec, operationId) => spec.operations.some((op) => op.operationId === operationId);
+/* A declared revoke, a mint's or a login's (alone, or `{ operationId, body }`), names an operation of the document. */
+function revokeProblems(spec, path, revoke) {
+    const id = isRaw(revoke) ? revoke.operationId : revoke;
+    return typeof id === "string" && !names(spec, id) ? [`${path}.revoke "${id}" names no operation`] : [];
+}
+/* References a mint makes, once its fields are strings: the shape check reports them otherwise. */
+function mintProblems(ctx, path, name, mint) {
+    const { security, spec, scoped } = ctx;
+    const problems = [];
+    if (typeof mint.with === "string" && !isRecord(security[mint.with])) {
+        problems.push(`${path}.mint.with names "${mint.with}", which has no recipe`);
+    }
+    else if (typeof mint.with === "string") {
+        const chain = mintChain(name, security);
+        if (chain.at(-1) === name)
+            problems.push(`${path}.mint.with forms a loop: ${chain.join(" → ")}`);
+    }
+    problems.push(...revokeProblems(spec, `${path}.mint`, mint.revoke));
+    if (typeof mint.operationId !== "string")
+        return problems;
+    if (!names(spec, mint.operationId)) {
+        problems.push(`${path}.mint.operationId "${mint.operationId}" names no operation`);
+    }
+    else if (JSON.stringify(mint.body ?? null).includes("{scopes}")) {
+        if (!scoped.has(name))
+            problems.push(`${path}.mint.body asks for {scopes}, but no operation needs ${name} with scopes`);
+    }
+    return problems;
+}
+const NOT_A_MAP = "security must be a map of scheme → recipe";
+/** What is wrong with `config.security` that needs no document: its shape, and each recipe's kind and options. */
+export function securityMapProblems(config) {
+    if (config.security === undefined)
+        return [];
+    if (!isRecord(config.security))
+        return [NOT_A_MAP];
+    return Object.entries(config.security).flatMap(([name, recipe]) => {
+        const path = `security.${name}`;
+        if (!isRawUnion(recipe))
+            return [`${path} must be a recipe object`];
+        const kind = kindProblems(path, recipe);
+        return kind.length > 0 ? kind : optionProblems(path, recipe);
+    });
+}
+function recipeProblems(ctx, path, name, recipe) {
+    const { spec } = ctx;
+    const scheme = ctx.schemes.get(name);
+    if (scheme === undefined) {
+        const close = nearest(name, spec.schemes.keys())[0];
+        const hint = close === undefined ? "" : ` Did you mean "${close}"?`;
+        return [`${path} names no scheme in the document.${hint} ${ctx.declared}`];
+    }
+    if (scheme.kind === "unsupported")
+        return [`${path}: ${scheme.unsupported}`];
+    if (!isRawUnion(recipe))
+        return [`${path} must be a recipe object`];
+    const kind = kindProblems(path, recipe);
+    if (kind.length > 0)
+        return kind;
+    return [
+        ...optionProblems(path, recipe),
+        ...kindShapeProblems(path, recipe, { hasHook: ctx.hasHook, scheme, signsUp: spec.fresh !== undefined }),
+        ...(isRaw(recipe.oauth2) ? oauth2Problems(path, recipe.oauth2, scheme) : []),
+        ...(isRaw(recipe.mint) ? mintProblems(ctx, path, name, recipe.mint) : []),
+        ...(isRaw(recipe.login) ? revokeProblems(ctx.spec, `${path}.login`, recipe.login.revoke) : []),
+    ];
+}
+/* Each principal's override, checked as the recipe that principal will actually use. */
+function overrideProblems(config, against) {
+    const principals = isRecord(config.principals) ? config.principals : {};
+    return Object.entries(principals).flatMap(([id, entry]) => {
+        const overrides = isRaw(entry) && isRecord(entry.security) ? entry.security : {};
+        return Object.entries(overrides)
+            .filter(([scheme]) => against.schemes.has(scheme))
+            .flatMap(([scheme, override]) => {
+            const base = against.security[scheme];
+            const effective = effectiveRecipe(base, override);
+            return recipeProblems(against, `principals.${id}.security.${scheme}`, scheme, effective);
+        });
+    });
+}
+/* Every header a declared scheme, an origin's scheme or a recipe's extra placement puts a credential in. */
+function headerPlaces(security, spec, origins) {
+    const ofSchemes = (view, owner, fix) => [...view.schemes].flatMap(([scheme, declared]) => {
+        const place = placementOf(declared);
+        return place?.in === "header" ? [{ fix: fix(scheme), name: place.name, owner: owner(scheme) }] : [];
+    });
+    const extra = Object.entries(security).flatMap(([scheme, recipe]) => {
+        const placements = isRawUnion(recipe) && Array.isArray(recipe.placements) ? recipe.placements : [];
+        return placements.flatMap((placement, index) => validPlacement(placement) && placement.in === "header"
+            ? [{ fix: "remove it", name: placement.name, owner: `security.${scheme}.placements[${index}]` }]
+            : []);
+    });
+    return [
+        ...ofSchemes(spec, (scheme) => `scheme "${scheme}"`, (scheme) => `remove it and declare security.${scheme}`),
+        ...Object.entries(origins).flatMap(([id, view]) => ofSchemes(view, (scheme) => `origins.${id} scheme "${scheme}"`, () => "remove it and map the scheme with origins[].security")),
+        ...extra,
+    ];
+}
+/* globalHeaders never carry a credential: an entry in a place a credential goes would collide with it. */
+function globalHeaderProblems(config, places) {
+    const headers = isRecord(config.globalHeaders) ? Object.keys(config.globalHeaders) : [];
+    return headers.flatMap((header) => places
+        .filter((place) => place.name.toLowerCase() === header.toLowerCase())
+        .map((place) => `globalHeaders.${header} is where ${place.owner} places its credential; ${place.fix}`));
+}
+/** Every problem with a config's `security` and `principals`, against the primary document and each origin's. */
+export function securityProblems(config, spec, origins = {}) {
+    const security = isRecord(config.security) ? config.security : {};
+    const hooks = isRaw(config.hooks) ? config.hooks : {};
+    const views = originViews(config, origins);
+    const against = {
+        declared: declaredEverywhere(spec, views),
+        hasHook: typeof hooks.resolveCredential === "function",
+        schemes: recipeSchemes(spec.schemes, views),
+        scoped: scopedRecipes(spec, views),
+        security,
+        spec,
+    };
+    const shape = config.security === undefined || isRecord(config.security) ? [] : [NOT_A_MAP];
+    return [
+        ...shape,
+        ...Object.entries(security).flatMap(([name, recipe]) => recipeProblems(against, `security.${name}`, name, recipe)),
+        ...overrideProblems(config, against),
+        ...principalProblems(config, new Set(against.schemes.keys()), spec.fresh),
+        ...removedProblems(config),
+        ...documentProblems(config, spec, origins),
+        ...originProblems(config, origins, new Set(Object.keys(security))),
+        ...globalHeaderProblems(config, headerPlaces(security, spec, origins)),
+    ].toSorted();
+}
+/** Throws a UsageError naming every `securityProblems` problem against the primary document and each origin's. */
+export function assertSecurity(config, primary, origins = new Map()) {
+    const views = Object.fromEntries([...origins].map(([id, origin]) => [id, specView(origin.model, origin.doc)]));
+    const problems = securityProblems(config, specView(primary.model, primary.doc), views);
+    if (problems.length > 0) {
+        throw new UsageError(`the config's credentials do not fit the document:\n  ${problems.join("\n  ")}`);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/api/credentials/writer.d.ts

@@ -0,0 +1,5 @@
+/** Which principal a run writes as: the one `writer` names, or the first in config order. */
+import type { PrincipalsConfig } from "../config/types/security.ts";
+/** `principals` with `writer` first and the others in config order: every reader takes the first as the writer. */
+export declare function writerFirst(principals: PrincipalsConfig, writer: string | undefined): PrincipalsConfig;
+//# sourceMappingURL=writer.d.ts.map

package/dist/api/credentials/writer.js

@@ -0,0 +1,9 @@
+/** Which principal a run writes as: the one `writer` names, or the first in config order. */
+/** `principals` with `writer` first and the others in config order: every reader takes the first as the writer. */
+export function writerFirst(principals, writer) {
+    const named = writer === undefined ? undefined : principals[writer];
+    if (writer === undefined || named === undefined)
+        return principals;
+    return { [writer]: named, ...principals };
+}
+//# sourceMappingURL=writer.js.map

package/dist/api/errors/message.d.ts

@@ -0,0 +1,3 @@
+/** An error's message as a report states it: the message, or anything else as text. */
+export declare function messageOf(error: unknown): string;
+//# sourceMappingURL=message.d.ts.map

package/dist/api/errors/message.js

@@ -0,0 +1,5 @@
+/** An error's message as a report states it: the message, or anything else as text. */
+export function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=message.js.map

package/dist/api/errors/missing-value.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A request the API tester was about to make from a value it does not have.
+ *
+ * A record without its identity once became the text "undefined" in a path, a filter or a probe,
+ * and the backend's answer to that was read as if it meant something. Nothing is sent: the check
+ * that wanted the value is unresolved, with this as the reason.
+ */
+export declare class MissingValueError extends Error {
+    readonly where: string;
+    name: string;
+    constructor(where: string);
+}
+//# sourceMappingURL=missing-value.d.ts.map

package/dist/api/errors/missing-value.js

@@ -0,0 +1,16 @@
+/**
+ * A request the API tester was about to make from a value it does not have.
+ *
+ * A record without its identity once became the text "undefined" in a path, a filter or a probe,
+ * and the backend's answer to that was read as if it meant something. Nothing is sent: the check
+ * that wanted the value is unresolved, with this as the reason.
+ */
+export class MissingValueError extends Error {
+    where;
+    name = "MissingValueError";
+    constructor(where) {
+        super(`the API tester had no value for ${where}`);
+        this.where = where;
+    }
+}
+//# sourceMappingURL=missing-value.js.map

package/dist/api/errors/network.d.ts

@@ -0,0 +1,21 @@
+export type NetworkKind = "offline" | "dns" | "refused" | "reset" | "timeout" | "unreachable" | "unknown";
+export declare class NetworkError extends Error {
+    readonly code: "NETWORK";
+    readonly kind: NetworkKind;
+    readonly attempts: number;
+    readonly method: string;
+    readonly url: string;
+    constructor(options: {
+        kind: NetworkKind;
+        message: string;
+        attempts: number;
+        method: string;
+        url: string;
+        cause?: unknown;
+    });
+}
+export declare function isNetworkError(error: unknown): error is NetworkError;
+export declare function classifyNetworkError(error: unknown): NetworkKind | null;
+export declare function describeNetworkKind(kind: NetworkKind): string;
+export declare function describeNetworkFailure(error: NetworkError, waitedMs?: number): string;
+//# sourceMappingURL=network.d.ts.map

package/dist/api/errors/network.js

@@ -0,0 +1,122 @@
+/*
+ * What kind of failure a request met before any server answered: no interface, no DNS, refused,
+ * reset, timed out, unreachable. A network failure is not a backend status, and every report says
+ * which it was.
+ */
+export class NetworkError extends Error {
+    code = "NETWORK";
+    kind;
+    attempts;
+    method;
+    url;
+    constructor(options) {
+        super(options.message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "NetworkError";
+        this.attempts = options.attempts;
+        this.kind = options.kind;
+        this.method = options.method;
+        this.url = options.url;
+    }
+}
+export function isNetworkError(error) {
+    return error instanceof NetworkError;
+}
+const DNS = /* @__PURE__ */ new Set([
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EAI_FAIL",
+    "EAI_NODATA",
+    "EAI_NONAME",
+]);
+const REFUSED = /* @__PURE__ */ new Set(["ECONNREFUSED"]);
+const RESET = /* @__PURE__ */ new Set([
+    "ECONNRESET",
+    "EPIPE",
+    "UND_ERR_SOCKET",
+    "UND_ERR_DESTROYED",
+]);
+const TIMEOUT = /* @__PURE__ */ new Set([
+    "ETIMEDOUT",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_BODY_TIMEOUT",
+    "TimeoutError",
+    "AbortError",
+]);
+const UNREACHABLE = /* @__PURE__ */ new Set([
+    "ENETUNREACH",
+    "ENETDOWN",
+    "EHOSTUNREACH",
+    "EHOSTDOWN",
+]);
+const OFFLINE = /* @__PURE__ */ new Set([
+    "ENONET",
+    "ERR_NETWORK_CHANGED",
+    "ERR_INTERNET_DISCONNECTED",
+]);
+const NOT_NETWORK = /CERT|UNABLE_TO_VERIFY|ERR_TLS|ERR_SSL|ERR_INVALID_URL|ERR_INVALID_ARG/;
+export function classifyNetworkError(error) {
+    const tokens = errorTokens(error);
+    if (tokens.some((token) => NOT_NETWORK.test(token)))
+        return null;
+    const hit = (set) => tokens.some((token) => set.has(token));
+    if (hit(OFFLINE))
+        return "offline";
+    if (hit(UNREACHABLE))
+        return "unreachable";
+    if (hit(DNS))
+        return "dns";
+    if (hit(REFUSED))
+        return "refused";
+    if (hit(RESET))
+        return "reset";
+    if (hit(TIMEOUT))
+        return "timeout";
+    const text = tokens.join(" ");
+    if (/fetch failed|networkerror|failed to fetch|socket hang up|getaddrinfo/i.test(text))
+        return "unknown";
+    return null;
+}
+export function describeNetworkKind(kind) {
+    switch (kind) {
+        case "offline":
+            return "this machine has no usable network interface";
+        case "dns":
+            return "DNS could not resolve the host";
+        case "refused":
+            return "the host refused the connection";
+        case "reset":
+            return "the connection was reset";
+        case "timeout":
+            return "the connection timed out";
+        case "unreachable":
+            return "no route to the host";
+        case "unknown":
+            return "the request never reached the server";
+    }
+}
+export function describeNetworkFailure(error, waitedMs = 0) {
+    const wait = waitedMs > 0 ? ` and ${Math.round(waitedMs / 1000)}s waiting for the link` : "";
+    return (`${error.method} ${error.url} failed (${error.kind}: ${describeNetworkKind(error.kind)}) ` +
+        `after ${error.attempts} attempt(s)${wait}. This is not a backend status.`);
+}
+function errorTokens(error) {
+    const tokens = [];
+    const seen = new Set();
+    let current = error;
+    while (current !== null && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        const rec = current;
+        if (typeof rec.code === "string" && rec.code !== "")
+            tokens.push(rec.code);
+        if (typeof rec.name === "string" && rec.name !== "")
+            tokens.push(rec.name);
+        if (typeof rec.message === "string" && rec.message !== "")
+            tokens.push(rec.message);
+        current = rec.cause;
+    }
+    if (typeof error === "string")
+        tokens.push(error);
+    return tokens;
+}
+//# sourceMappingURL=network.js.map

package/dist/api/errors/node-floor.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The oldest Node the API tester supports, as `major.minor`: the first release where `node:sqlite`, a `.ts`
+ * config and the QUERY method all work under plain `node`, the way the published binary runs.
+ * `package.json` `engines.node` is `>=` this `.0`, and every message that names the floor reads it
+ * from here (tests/structure/engines.test.ts holds them together).
+ */
+export declare const NODE_FLOOR = "22.18";
+//# sourceMappingURL=node-floor.d.ts.map

package/dist/api/errors/node-floor.js

@@ -0,0 +1,8 @@
+/**
+ * The oldest Node the API tester supports, as `major.minor`: the first release where `node:sqlite`, a `.ts`
+ * config and the QUERY method all work under plain `node`, the way the published binary runs.
+ * `package.json` `engines.node` is `>=` this `.0`, and every message that names the floor reads it
+ * from here (tests/structure/engines.test.ts holds them together).
+ */
+export const NODE_FLOOR = "22.18";
+//# sourceMappingURL=node-floor.js.map

package/dist/api/errors/suggest.d.ts

@@ -0,0 +1,5 @@
+/** Up to three candidates closest to `name` by edit distance, nearest first; none when nothing is close. */
+export declare function nearest(name: string, candidates: Iterable<string>): string[];
+/** The sentence an error appends to suggest the nearest of `candidates`, or nothing when none is close. */
+export declare function didYouMean(name: string, candidates: Iterable<string>): string;
+//# sourceMappingURL=suggest.d.ts.map

package/dist/api/errors/suggest.js

@@ -0,0 +1,29 @@
+/* Suggestions for a misspelled name, for the error that refuses it. */
+function distance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        let diagonal = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const above = row[j];
+            row[j] = Math.min(above + 1, row[j - 1] + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diagonal = above;
+        }
+    }
+    return row[b.length];
+}
+/** Up to three candidates closest to `name` by edit distance, nearest first; none when nothing is close. */
+export function nearest(name, candidates) {
+    return [...candidates]
+        .map((candidate) => ({ candidate, d: distance(name, candidate) }))
+        .filter((item) => item.d <= Math.max(3, Math.floor(name.length / 3)))
+        .sort((a, b) => a.d - b.d || a.candidate.localeCompare(b.candidate))
+        .slice(0, 3)
+        .map((item) => item.candidate);
+}
+/** The sentence an error appends to suggest the nearest of `candidates`, or nothing when none is close. */
+export function didYouMean(name, candidates) {
+    const close = nearest(name, candidates);
+    return close.length === 0 ? "" : ` Did you mean: ${close.join(", ")}?`;
+}
+//# sourceMappingURL=suggest.js.map

package/dist/api/errors/usage-error.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The command line or config asked for something that cannot be: an overlay patching an operation
+ * the document lacks, a grammar the API tester cannot read, a target that names nothing. Nothing has run, and
+ * the CLI exits with `EXIT.usage` naming the mistake.
+ */
+export declare class UsageError extends Error {
+    name: string;
+}
+//# sourceMappingURL=usage-error.d.ts.map

package/dist/api/errors/usage-error.js

@@ -0,0 +1,9 @@
+/**
+ * The command line or config asked for something that cannot be: an overlay patching an operation
+ * the document lacks, a grammar the API tester cannot read, a target that names nothing. Nothing has run, and
+ * the CLI exits with `EXIT.usage` naming the mistake.
+ */
+export class UsageError extends Error {
+    name = "UsageError";
+}
+//# sourceMappingURL=usage-error.js.map

package/dist/api/index.d.ts

@@ -0,0 +1,26 @@
+export { defineConfig } from "./config/define/define-config.ts";
+export { env } from "./config/env.ts";
+export { loadConfig } from "./config/load.ts";
+export type { AuthStep, EntityConfig, ExternalsConfig, ExternalStep, FieldType, FilterOp, FilterableField, FilterableFrom, HeaderRequest, Hooks, InputRequest, ApiConfig, OperationStep, OriginSpec, OutOfBandConfig, OutOfBandRequest, OutOfBandStep, PathValueRequest, PrincipalEntry, PrincipalsConfig, ProfileSpec, QueryCapabilities, QueryCapabilitiesRequest, QueryEnvelopeNames, QueryEnvelopeRole, QueryParamNames, QueryParamRole, RateLimitSpec, Recipe, RequestStep, Scenario, ScenarioAssert, ScenarioRequestStep, ScenarioStep, SecurityConfig, SideEffectRequest, TeardownPrincipalContext, UploadFile, UploadRequest, UploadResolution, Uploads, } from "./config/define/types.ts";
+export type { PayloadPolicy } from "./config/define/types.ts";
+export { EXIT, exitCode, runVerdict } from "./runtime/exit.ts";
+export type { ReportInput } from "./report/render/input.ts";
+export { loadPersistedPrincipals } from "./runtime/principals.ts";
+export { allocateRunDir, DEFAULT_RUNS_ROOT } from "./runtime/runs.ts";
+export { worstCaseWaitMs } from "./runtime/poll.ts";
+export { buildModel } from "./spec/graph/build.ts";
+export type { EntityModel, OperationModel, SpecModel } from "./spec/graph/types.ts";
+export { dereference } from "./spec/load/dereference.ts";
+export { loadSpec } from "./spec/load/source.ts";
+export { ScopeError } from "./runtime/scope/scope-error.ts";
+export type { OpenApiDocument } from "./spec/types.ts";
+export { run } from "./runtime/run/index.ts";
+export type { RunOptions, RunResult } from "./runtime/run/index.ts";
+export type { Actor } from "./runtime/checks/core/context.ts";
+export type { Finding, Verdict } from "./runtime/finding.ts";
+export { renderMatrixGraph } from "./report/matrix/graph.ts";
+export { renderMatrixHtml } from "./report/matrix/poster.ts";
+export { renderJson } from "./report/render/json.ts";
+export { renderMarkdown } from "./report/render/markdown.ts";
+export { renderRepros } from "./report/render/repro.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.js

@@ -0,0 +1,18 @@
+export { defineConfig } from "./config/define/define-config.js";
+export { env } from "./config/env.js";
+export { loadConfig } from "./config/load.js";
+export { EXIT, exitCode, runVerdict } from "./runtime/exit.js";
+export { loadPersistedPrincipals } from "./runtime/principals.js";
+export { allocateRunDir, DEFAULT_RUNS_ROOT } from "./runtime/runs.js";
+export { worstCaseWaitMs } from "./runtime/poll.js";
+export { buildModel } from "./spec/graph/build.js";
+export { dereference } from "./spec/load/dereference.js";
+export { loadSpec } from "./spec/load/source.js";
+export { ScopeError } from "./runtime/scope/scope-error.js";
+export { run } from "./runtime/run/index.js";
+export { renderMatrixGraph } from "./report/matrix/graph.js";
+export { renderMatrixHtml } from "./report/matrix/poster.js";
+export { renderJson } from "./report/render/json.js";
+export { renderMarkdown } from "./report/render/markdown.js";
+export { renderRepros } from "./report/render/repro.js";
+//# sourceMappingURL=index.js.map

package/dist/api/reference/defects/bystanders.d.ts

@@ -0,0 +1,8 @@
+import type { DefectName } from "./table.ts";
+/**
+ * Defects that by design rewrite or remove records nobody asked them to touch. In those cases a
+ * damaged pre-existing record is the backend's doing, so conformance does not hold the API tester to the
+ * bystander rule. Empty: no defect does that today, and adding one needs the reason beside it.
+ */
+export declare const DAMAGES_BYSTANDERS: ReadonlySet<DefectName>;
+//# sourceMappingURL=bystanders.d.ts.map

package/dist/api/reference/defects/bystanders.js

@@ -0,0 +1,7 @@
+/**
+ * Defects that by design rewrite or remove records nobody asked them to touch. In those cases a
+ * damaged pre-existing record is the backend's doing, so conformance does not hold the API tester to the
+ * bystander rule. Empty: no defect does that today, and adding one needs the reason beside it.
+ */
+export const DAMAGES_BYSTANDERS = /* @__PURE__ */ new Set();
+//# sourceMappingURL=bystanders.js.map

package/dist/api/reference/defects/catalog.d.ts

@@ -0,0 +1,88 @@
+/** What the declared query catalog, ids, tenancy and side effects promise and the backend breaks. */
+export declare const CATALOG_DEFECTS: {
+    /** The alias table maps `ne` to the wrong operator: it behaves as `eq`. */
+    readonly FILTER_ALIAS_MISMAPPED: "the ne alias is mapped to eq instead of neq";
+    /** A filter with more terms than `maxFilterConditions` is evaluated instead of rejected. */
+    readonly FILTER_CONDITION_CAP_IGNORED: "a filter over the documented condition cap is accepted";
+    /** An `in()` list longer than `maxInValues` is evaluated instead of rejected. */
+    readonly FILTER_IN_CAP_IGNORED: "an in() list over the documented maximum is accepted";
+    /** `lte` is compiled as `lt`. */
+    readonly FILTER_LTE_IS_LT: "lte is implemented as lt";
+    /** `lt` is compiled as `lte`, so a boundary value is both below and equal to itself. */
+    readonly FILTER_LT_IS_LTE: "lt is implemented as lte";
+    /**
+     * A builder that keeps one "current joiner": once a nested group sets it, the enclosing group
+     * joins its remaining terms with the nested group's combinator. Flat and()/or() are unaffected.
+     */
+    readonly FILTER_NESTED_COMBINATOR_LEAKS: "a nested group's combinator replaces the enclosing group's";
+    /** `nin.(a,b)` only excludes the first listed value. */
+    readonly FILTER_NIN_FIRST_ONLY: "nin() excludes only the first listed value";
+    /** Every pair and triple of axes composes; all four together drop the filter. */
+    readonly FILTER_DROPPED_WHEN_SORTED_SEARCHED_AND_SELECTED: "a filter stops being applied once a sort, a search and a select are requested together";
+    /** A free-text search is dropped once a sparse fieldset joins it. */
+    readonly SEARCH_DROPPED_WHEN_SELECTED: "a search stops being applied once a select is also requested";
+    /** A free-text search is dropped once a sort joins it. */
+    readonly SEARCH_DROPPED_WHEN_SORTED: "a search stops being applied once a sort is also requested";
+    /** The sort is dropped once a sparse fieldset joins it. */
+    readonly ORDER_DROPPED_WHEN_SELECTED: "a sort stops being applied once a select is also requested";
+    /** Search compares case-sensitively although the document declares it insensitive. */
+    readonly SEARCH_CASE_SENSITIVE: "search is case-sensitive despite searchCase: insensitive";
+    /** An empty `q` matches nothing although the document declares it matches everything. */
+    readonly SEARCH_EMPTY_MATCHES_NONE: "an empty search matches nothing despite searchEmpty: match-all";
+    /** Only the first whitespace-separated search token is applied. */
+    readonly SEARCH_ONLY_FIRST_TOKEN: "only the first search token is applied";
+    /** An unknown select field is dropped although the document says it is rejected. */
+    readonly SELECT_UNKNOWN_IGNORED: "an unknown select field is ignored despite select.unknown: reject";
+    /** `nullsfirst` / `nullslast` are parsed and ignored. */
+    readonly SORT_NULLS_MODIFIER_IGNORED: "nullsfirst and nullslast modifiers are ignored";
+    /** An order on a field that does not exist is dropped instead of rejected. */
+    readonly SORT_UNKNOWN_FIELD_IGNORED: "an unknown sort field is silently ignored rather than rejected";
+    /** The document lists an operator for a field that the backend rejects. */
+    readonly SPEC_OVERCLAIMS_FILTER_OP: "x-query declares a filter operator on a field that the backend rejects";
+    /** `contains` matches the serialized array as text, so an element also matches its superstrings. */
+    readonly CONTAINS_MATCHES_SUBSTRING: "contains matches any element containing the value, not the element itself";
+    /** A search mode the document declares is rejected. */
+    readonly SEARCH_MODE_REJECTED: "a declared search mode is rejected";
+    /** A nested select returns the whole related record rather than the requested fields. */
+    readonly NESTED_SELECT_IGNORED: "a nested select returns every field of the relation";
+    /** Without an explicit order the listing does not use the documented default order. */
+    readonly DEFAULT_ORDER_IGNORED: "the listing ignores the documented default order";
+    /**
+     * Create crashes on input outside ASCII. Only some records carry such input, so most of a
+     * cohort is created fine and one variant fails with a 500.
+     */
+    readonly CREATE_500_ON_NON_ASCII: "create fails with a server error when a string holds non-ASCII text";
+    /** A write whose side effect is declared with x-wait never produces it. */
+    readonly SIDE_EFFECT_NEVER_ARRIVES: "a side effect declared with x-wait never arrives";
+    /** The first listing of each entity is refused with 429, far inside the rate x-rate-limit declares. */
+    readonly RATE_LIMIT_STRICTER_THAN_DECLARED: "a listing answers 429 well inside the rate x-rate-limit declares";
+    /**
+     * Under the client-ids shape: the create stores the table under an id of the server's own,
+     * ignoring the one the client chose, and still answers only an acknowledgment.
+     */
+    readonly CLIENT_ID_IGNORED: "a create ignores the client-chosen id and stores the record under another";
+    /** Under the client-ids shape: a create with an id the tenant already holds overwrites that record. */
+    readonly CLIENT_ID_OVERWRITES: "a create with an existing id silently overwrites that record";
+    /** Update and delete find the record by id alone, so another tenant can change or remove it. */
+    readonly CROSS_TENANT_WRITE: "update and delete reach records belonging to another tenant";
+    /** A child route accepts another tenant's parent id under the caller's own root. */
+    readonly FOREIGN_PARENT_ACCEPTED: "a child collection is reachable through another tenant's parent placed under one's own root";
+    /** A page number past the end returns the last page again instead of an empty page. */
+    readonly PAGE_PAST_END_REPEATS: "a page past the end of the collection repeats the last page";
+    /** A query parameter the listing does not know empties the result instead of being ignored. */
+    readonly UNKNOWN_PARAM_EMPTIES_LIST: "an unknown query parameter makes the listing return nothing";
+    /** The viewer may update records the member may not. */
+    readonly ROLE_WRITE_INVERTED: "a lower-ranked role can update a record a higher-ranked same-tenant role cannot";
+    /** Ties are broken by another field than the declared `stableTiebreak`. */
+    readonly TIEBREAK_NOT_APPLIED: "ties are ordered by another field than the documented tiebreak";
+    /** A replayed idempotency key is answered with the original record, but a second row is written too. */
+    readonly IDEMPOTENT_REPLAY_INSERTS: "a replayed create returns the original record and still inserts another";
+    /**
+     * A row holding `testing-payload-probe` — the ASCII control `payload.string-survives` writes to a fresh
+     * record before any case of its catalog — is hidden from everyone, its creator included: no
+     * read or list serves it, and its delete answers 200 and keeps it. Only teardown's account of
+     * what its creator never saw can name it.
+     */
+    readonly HIDDEN_FROM_CREATOR: "a row holding a given value is never served, not even to its creator, and outlives its delete";
+};
+//# sourceMappingURL=catalog.d.ts.map