@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/reference/defects/records.d.ts

@@ -0,0 +1,172 @@
+/** Records and responses: writes, reads, validation, statuses, effects, storage, concurrency and access. */
+export declare const RECORD_DEFECTS: {
+    /** Tombstoned records remain in the default listing. */
+    readonly SOFT_DELETE_LEAK: "soft-deleted records still appear in the default list";
+    /** Server-owned fields accept client writes. */
+    readonly IMMUTABLE_WRITABLE: "immutable field accepts a write";
+    /** Sparse fieldsets are accepted and ignored. */
+    readonly SELECT_IGNORED: "select returns every field regardless of what was requested";
+    /** LIKE metacharacters in user input are not escaped. */
+    readonly LIKE_UNESCAPED: "unescaped LIKE metacharacters make a filter match everything";
+    /** Offset arithmetic is wrong by one row per page. */
+    readonly OFF_BY_ONE_PAGE: "page offset is computed one row late";
+    /** Create returns a status the document does not declare. */
+    readonly CREATED_201_AS_200: "create returns 200 where the document declares 201";
+    /** Malformed input crashes instead of being rejected. */
+    readonly ERROR_500_ON_BAD_FILTER: "malformed filter produces 500 instead of 400";
+    /** Deleting an absent record reports success. */
+    readonly DELETE_MISSING_OK: "deleting a nonexistent record returns success instead of 404";
+    /**
+     * A delete answers success and keeps the row. The checks catch it by reading the record back;
+     * teardown, which deleted the same way, lists every record it could not really remove.
+     */
+    readonly DELETE_KEEPS_ROW: "a delete answers success but the record stays";
+    /** Reads of another tenant's record succeed. */
+    readonly CROSS_TENANT_READ: "item route serves records belonging to another tenant";
+    /** The page-size parameter is accepted and ignored. */
+    readonly LIMIT_IGNORED: "limit is accepted but does not bound the page size";
+    /** More rows are returned than the documented maximum allows. */
+    readonly LIMIT_EXCEEDS_MAX: "page size exceeds the documented maxLimit";
+    /** A page size of 0 or past the maximum is served as the nearest allowed one, though the document says it is refused. */
+    readonly LIMIT_OUT_OF_RANGE_SERVED: "an out-of-range page size is served instead of refused";
+    /** The more-pages flag is always false, so callers stop after page one. */
+    readonly HASMORE_ALWAYS_FALSE: "hasMore is false even when further pages exist";
+    /** The sort parameter is accepted and ignored. */
+    readonly ORDER_IGNORED: "order is accepted but does not change the result order";
+    /** The search parameter is accepted and ignored. */
+    readonly SEARCH_IGNORED: "q is accepted but does not filter the result";
+    /** A field is accepted at create and silently discarded. */
+    readonly CREATE_DROPS_FIELD: "create accepts a field and does not persist it";
+    /** An update answers success and leaves one of the fields it was sent unchanged. */
+    readonly UPDATE_DROPS_FIELD: "update accepts a field and does not persist it";
+    /** The item read leaves out a field the record holds: the list and the store still have it. */
+    readonly READ_DROPS_FIELD: "the item read omits a field the record holds";
+    /** A table's item read answers a member its documented schema does not declare; its listing does not. */
+    readonly READ_BODY_DIVERGES: "the item read answers a member its documented schema does not declare";
+    /** The item read answers the write-only fields a row holds, a password say; its listing does not. */
+    readonly WRITE_ONLY_LEAKED: "the item read answers a field the document marks writeOnly";
+    /**
+     * PATCH of the signed-up caller returns 200 and leaves the record unchanged.
+     *
+     * The caller is the record. A success that the next read does not show is a lost update
+     * with nowhere else to look: there is no list and no id.
+     */
+    readonly CALLER_UPDATE_DROPPED: "an update to the signed-up caller returns success and does not stick";
+    /**
+     * A public read with no id returns 500.
+     *
+     * Nothing is created first and no token is sent. The document named a success status.
+     * A 500 is the server failing that read, not a missing fixture.
+     */
+    readonly PUBLIC_GET_NOT_SUCCESS: "a public read with no id returns a server error";
+    /**
+     * The token exchange answers `expires_in` as a string where the document declares an integer.
+     *
+     * The credential still works, so every check that only uses it stays quiet. Only the contract
+     * tier holds that body to its schema: auth runs before any check and nothing else grades it.
+     */
+    readonly TOKEN_EXPIRY_AS_STRING: "the token exchange answers expires_in as a string, not the documented integer";
+    /**
+     * The search answers a card's fields under the bank tag, or a bank account's under the card tag.
+     *
+     * Each field still fits a branch, so only a union pinned by its discriminator rules the body out.
+     * Nothing but the contract tier calls the search, so its call is the one that grades it.
+     */
+    readonly DISCRIMINATOR_BRANCH_WRONG: "the search answers a payment method under the other branch's tag";
+    /** The get of a listed row returns a different body than the list. */
+    readonly LISTED_GET_DIFFERS: "the get of a listed row returns a different body";
+    /**
+     * Non-ASCII and surrounding whitespace are stripped on write.
+     *
+     * The realistic shape: a column that is not Unicode, a `.trim()`, a "sanitizer" that drops
+     * anything outside ASCII printable. Create of ordinary English still looks right.
+     */
+    readonly STRING_PAYLOAD_MANGLED: "non-ASCII and surrounding whitespace are stripped on write";
+    /**
+     * An operation returns a success status the document does not name.
+     *
+     * Not REST (create must be 201). The document said 200 and the handler returned 201, so
+     * generated clients will not treat the response as success.
+     */
+    readonly RESPONSE_STATUS_UNDECLARED: "an operation returns a status its document does not declare";
+    /** An enum field accepts values outside the declared set. */
+    readonly ENUM_NOT_VALIDATED: "enum field accepts a value outside the declared set";
+    /** A string longer than maxLength is stored. */
+    readonly MAXLENGTH_NOT_VALIDATED: "string exceeding maxLength is accepted";
+    /** A create missing a required field succeeds. */
+    readonly REQUIRED_NOT_VALIDATED: "create succeeds with a required field missing";
+    /** A non-JSON content type is accepted on a JSON endpoint. */
+    readonly CONTENT_TYPE_NOT_ENFORCED: "request body is parsed regardless of content type";
+    /**
+     * A table's or a row's update skips validation: it applies what parses and drops the rest, so an
+     * invalid body answers 200. Creates and every other entity's update still validate.
+     */
+    readonly WRITE_BODY_NOT_VALIDATED: "an update applies what parses of an invalid body instead of refusing it";
+    /** Error bodies do not match the documented error schema. */
+    readonly ERROR_SCHEMA_DRIFT: "error response does not match its documented schema";
+    /** The 412 problem detail names another status than the response's: 400 on a 412. */
+    readonly PROBLEM_JSON_MALFORMED: "a problem detail's status disagrees with the response's status";
+    /** Success bodies carry fields the schema does not declare. */
+    readonly RESPONSE_SCHEMA_DRIFT: "success response carries undeclared fields";
+    /** An equality predicate is parsed and then never applied. */
+    readonly FILTER_EQ_NOT_APPLIED: "eq predicate is accepted but matches every record";
+    /** An empty filtered set is replaced by the unfiltered one. */
+    readonly EMPTY_RESULT_RETURNS_ALL: "a filter matching nothing falls back to returning everything";
+    /** SQL three-valued logic leaking through: NULL rows vanish from a negated predicate. */
+    readonly NEQ_DROPS_NULLS: "neq silently excludes records whose value is null";
+    /** The total is computed by a query that disagrees with the one producing the rows. */
+    readonly COUNT_ALWAYS_ZERO: "count reports zero while the same body returns records";
+    /** Descending order drops the rows an ascending order includes. */
+    readonly SORT_DESC_DROPS_NULLS: "descending sort omits records with a null sort key";
+    /** An operation declares an effect in the document and does not perform it. */
+    readonly EFFECT_NOT_APPLIED: "declared x-effects side effect never happens";
+    /** An action crashes: a check that needed it to succeed can only report what it then could not verify. */
+    readonly ACTION_CRASHES: "starting a job answers 500 instead of starting it";
+    /** An async job never leaves its running state. */
+    readonly ASYNC_NEVER_COMPLETES: "async job stays pending forever and never reaches a terminal state";
+    /** The receipt for an async job omits the identifier needed to poll it. */
+    readonly ASYNC_RECEIPT_MISSING_ID: "async receipt omits the job id the document declares";
+    /**
+     * DDL names a physical column differently from every read.
+     *
+     * SQL-store only, and modeled on a real production bug: SQLite resolves an unknown
+     * double-quoted identifier as a *string literal* instead of erroring, so the mismatch
+     * surfaces as every row reporting the column's own name as its value — silent corruption
+     * rather than a loud failure.
+     */
+    readonly COLUMN_NAME_MISMATCH: "physical column name differs from the name every read uses";
+    /**
+     * Numeric columns compared as text, so `amount > 9` misses 10 and ordering reads
+     * 1, 10, 100, 2. Extremely common wherever query values arrive untyped from a URL.
+     */
+    readonly NUMERIC_COMPARED_AS_TEXT: "numeric column is compared and ordered as text";
+    /**
+     * The listing and the cursor lookup disagree about collation, so keyset pagination resolves
+     * a boundary the listing never had — rows are skipped or repeated between pages.
+     */
+    readonly COLLATION_INCONSISTENT: "cursor resolution uses a different collation than the listing";
+    /**
+     * Read-modify-write without locking: the handler reads the row, then writes every column
+     * back. Two concurrent patches to different fields, and the later write reinstates the
+     * earlier field's old value — the classic ORM `save(entity)` lost update.
+     */
+    readonly CONCURRENT_WRITE_LOST: "concurrent writes to different fields lose one of them";
+    /**
+     * The update ignores If-Match: a write naming an ETag the record has moved past is applied
+     * instead of refused with 412, so optimistic concurrency protects nothing.
+     */
+    readonly ETAG_IGNORED: "an update naming a stale ETag in If-Match is applied instead of refused with 412";
+    /**
+     * A lower-ranked role can read a record that a higher-ranked role in the same tenant cannot.
+     *
+     * The lattice is inverted on the item route only: a viewer is served, a member is denied,
+     * the owner still reads. Isolation and the write path stay intact; the failure is purely
+     * that privilege is not monotonic.
+     */
+    readonly ROLE_MONOTONICITY_BROKEN: "a lower-ranked role can read a record a higher-ranked same-tenant role cannot";
+    /** Accept completes but the invitee still cannot read the shared record. */
+    readonly INVITE_NEVER_GRANTS: "accepting an invite does not grant access to the record";
+    /** Revoke returns success and the invitee can still read. */
+    readonly REVOKE_IGNORED: "revoking an invite does not remove access";
+};
+//# sourceMappingURL=records.d.ts.map

package/dist/api/reference/defects/records.js

@@ -0,0 +1,172 @@
+/** Records and responses: writes, reads, validation, statuses, effects, storage, concurrency and access. */
+export const RECORD_DEFECTS = {
+    /** Tombstoned records remain in the default listing. */
+    SOFT_DELETE_LEAK: "soft-deleted records still appear in the default list",
+    /** Server-owned fields accept client writes. */
+    IMMUTABLE_WRITABLE: "immutable field accepts a write",
+    /** Sparse fieldsets are accepted and ignored. */
+    SELECT_IGNORED: "select returns every field regardless of what was requested",
+    /** LIKE metacharacters in user input are not escaped. */
+    LIKE_UNESCAPED: "unescaped LIKE metacharacters make a filter match everything",
+    /** Offset arithmetic is wrong by one row per page. */
+    OFF_BY_ONE_PAGE: "page offset is computed one row late",
+    /** Create returns a status the document does not declare. */
+    CREATED_201_AS_200: "create returns 200 where the document declares 201",
+    /** Malformed input crashes instead of being rejected. */
+    ERROR_500_ON_BAD_FILTER: "malformed filter produces 500 instead of 400",
+    /** Deleting an absent record reports success. */
+    DELETE_MISSING_OK: "deleting a nonexistent record returns success instead of 404",
+    /**
+     * A delete answers success and keeps the row. The checks catch it by reading the record back;
+     * teardown, which deleted the same way, lists every record it could not really remove.
+     */
+    DELETE_KEEPS_ROW: "a delete answers success but the record stays",
+    /** Reads of another tenant's record succeed. */
+    CROSS_TENANT_READ: "item route serves records belonging to another tenant",
+    /** The page-size parameter is accepted and ignored. */
+    LIMIT_IGNORED: "limit is accepted but does not bound the page size",
+    /** More rows are returned than the documented maximum allows. */
+    LIMIT_EXCEEDS_MAX: "page size exceeds the documented maxLimit",
+    /** A page size of 0 or past the maximum is served as the nearest allowed one, though the document says it is refused. */
+    LIMIT_OUT_OF_RANGE_SERVED: "an out-of-range page size is served instead of refused",
+    /** The more-pages flag is always false, so callers stop after page one. */
+    HASMORE_ALWAYS_FALSE: "hasMore is false even when further pages exist",
+    /** The sort parameter is accepted and ignored. */
+    ORDER_IGNORED: "order is accepted but does not change the result order",
+    /** The search parameter is accepted and ignored. */
+    SEARCH_IGNORED: "q is accepted but does not filter the result",
+    /** A field is accepted at create and silently discarded. */
+    CREATE_DROPS_FIELD: "create accepts a field and does not persist it",
+    /** An update answers success and leaves one of the fields it was sent unchanged. */
+    UPDATE_DROPS_FIELD: "update accepts a field and does not persist it",
+    /** The item read leaves out a field the record holds: the list and the store still have it. */
+    READ_DROPS_FIELD: "the item read omits a field the record holds",
+    /** A table's item read answers a member its documented schema does not declare; its listing does not. */
+    READ_BODY_DIVERGES: "the item read answers a member its documented schema does not declare",
+    /** The item read answers the write-only fields a row holds, a password say; its listing does not. */
+    WRITE_ONLY_LEAKED: "the item read answers a field the document marks writeOnly",
+    /**
+     * PATCH of the signed-up caller returns 200 and leaves the record unchanged.
+     *
+     * The caller is the record. A success that the next read does not show is a lost update
+     * with nowhere else to look: there is no list and no id.
+     */
+    CALLER_UPDATE_DROPPED: "an update to the signed-up caller returns success and does not stick",
+    /**
+     * A public read with no id returns 500.
+     *
+     * Nothing is created first and no token is sent. The document named a success status.
+     * A 500 is the server failing that read, not a missing fixture.
+     */
+    PUBLIC_GET_NOT_SUCCESS: "a public read with no id returns a server error",
+    /**
+     * The token exchange answers `expires_in` as a string where the document declares an integer.
+     *
+     * The credential still works, so every check that only uses it stays quiet. Only the contract
+     * tier holds that body to its schema: auth runs before any check and nothing else grades it.
+     */
+    TOKEN_EXPIRY_AS_STRING: "the token exchange answers expires_in as a string, not the documented integer",
+    /**
+     * The search answers a card's fields under the bank tag, or a bank account's under the card tag.
+     *
+     * Each field still fits a branch, so only a union pinned by its discriminator rules the body out.
+     * Nothing but the contract tier calls the search, so its call is the one that grades it.
+     */
+    DISCRIMINATOR_BRANCH_WRONG: "the search answers a payment method under the other branch's tag",
+    /** The get of a listed row returns a different body than the list. */
+    LISTED_GET_DIFFERS: "the get of a listed row returns a different body",
+    /**
+     * Non-ASCII and surrounding whitespace are stripped on write.
+     *
+     * The realistic shape: a column that is not Unicode, a `.trim()`, a "sanitizer" that drops
+     * anything outside ASCII printable. Create of ordinary English still looks right.
+     */
+    STRING_PAYLOAD_MANGLED: "non-ASCII and surrounding whitespace are stripped on write",
+    /**
+     * An operation returns a success status the document does not name.
+     *
+     * Not REST (create must be 201). The document said 200 and the handler returned 201, so
+     * generated clients will not treat the response as success.
+     */
+    RESPONSE_STATUS_UNDECLARED: "an operation returns a status its document does not declare",
+    /** An enum field accepts values outside the declared set. */
+    ENUM_NOT_VALIDATED: "enum field accepts a value outside the declared set",
+    /** A string longer than maxLength is stored. */
+    MAXLENGTH_NOT_VALIDATED: "string exceeding maxLength is accepted",
+    /** A create missing a required field succeeds. */
+    REQUIRED_NOT_VALIDATED: "create succeeds with a required field missing",
+    /** A non-JSON content type is accepted on a JSON endpoint. */
+    CONTENT_TYPE_NOT_ENFORCED: "request body is parsed regardless of content type",
+    /**
+     * A table's or a row's update skips validation: it applies what parses and drops the rest, so an
+     * invalid body answers 200. Creates and every other entity's update still validate.
+     */
+    WRITE_BODY_NOT_VALIDATED: "an update applies what parses of an invalid body instead of refusing it",
+    /** Error bodies do not match the documented error schema. */
+    ERROR_SCHEMA_DRIFT: "error response does not match its documented schema",
+    /** The 412 problem detail names another status than the response's: 400 on a 412. */
+    PROBLEM_JSON_MALFORMED: "a problem detail's status disagrees with the response's status",
+    /** Success bodies carry fields the schema does not declare. */
+    RESPONSE_SCHEMA_DRIFT: "success response carries undeclared fields",
+    /** An equality predicate is parsed and then never applied. */
+    FILTER_EQ_NOT_APPLIED: "eq predicate is accepted but matches every record",
+    /** An empty filtered set is replaced by the unfiltered one. */
+    EMPTY_RESULT_RETURNS_ALL: "a filter matching nothing falls back to returning everything",
+    /** SQL three-valued logic leaking through: NULL rows vanish from a negated predicate. */
+    NEQ_DROPS_NULLS: "neq silently excludes records whose value is null",
+    /** The total is computed by a query that disagrees with the one producing the rows. */
+    COUNT_ALWAYS_ZERO: "count reports zero while the same body returns records",
+    /** Descending order drops the rows an ascending order includes. */
+    SORT_DESC_DROPS_NULLS: "descending sort omits records with a null sort key",
+    /** An operation declares an effect in the document and does not perform it. */
+    EFFECT_NOT_APPLIED: "declared x-effects side effect never happens",
+    /** An action crashes: a check that needed it to succeed can only report what it then could not verify. */
+    ACTION_CRASHES: "starting a job answers 500 instead of starting it",
+    /** An async job never leaves its running state. */
+    ASYNC_NEVER_COMPLETES: "async job stays pending forever and never reaches a terminal state",
+    /** The receipt for an async job omits the identifier needed to poll it. */
+    ASYNC_RECEIPT_MISSING_ID: "async receipt omits the job id the document declares",
+    /**
+     * DDL names a physical column differently from every read.
+     *
+     * SQL-store only, and modeled on a real production bug: SQLite resolves an unknown
+     * double-quoted identifier as a *string literal* instead of erroring, so the mismatch
+     * surfaces as every row reporting the column's own name as its value — silent corruption
+     * rather than a loud failure.
+     */
+    COLUMN_NAME_MISMATCH: "physical column name differs from the name every read uses",
+    /**
+     * Numeric columns compared as text, so `amount > 9` misses 10 and ordering reads
+     * 1, 10, 100, 2. Extremely common wherever query values arrive untyped from a URL.
+     */
+    NUMERIC_COMPARED_AS_TEXT: "numeric column is compared and ordered as text",
+    /**
+     * The listing and the cursor lookup disagree about collation, so keyset pagination resolves
+     * a boundary the listing never had — rows are skipped or repeated between pages.
+     */
+    COLLATION_INCONSISTENT: "cursor resolution uses a different collation than the listing",
+    /**
+     * Read-modify-write without locking: the handler reads the row, then writes every column
+     * back. Two concurrent patches to different fields, and the later write reinstates the
+     * earlier field's old value — the classic ORM `save(entity)` lost update.
+     */
+    CONCURRENT_WRITE_LOST: "concurrent writes to different fields lose one of them",
+    /**
+     * The update ignores If-Match: a write naming an ETag the record has moved past is applied
+     * instead of refused with 412, so optimistic concurrency protects nothing.
+     */
+    ETAG_IGNORED: "an update naming a stale ETag in If-Match is applied instead of refused with 412",
+    /**
+     * A lower-ranked role can read a record that a higher-ranked role in the same tenant cannot.
+     *
+     * The lattice is inverted on the item route only: a viewer is served, a member is denied,
+     * the owner still reads. Isolation and the write path stay intact; the failure is purely
+     * that privilege is not monotonic.
+     */
+    ROLE_MONOTONICITY_BROKEN: "a lower-ranked role can read a record a higher-ranked same-tenant role cannot",
+    /** Accept completes but the invitee still cannot read the shared record. */
+    INVITE_NEVER_GRANTS: "accepting an invite does not grant access to the record",
+    /** Revoke returns success and the invitee can still read. */
+    REVOKE_IGNORED: "revoking an invite does not remove access",
+};
+//# sourceMappingURL=records.js.map

package/dist/api/reference/defects/security.d.ts

@@ -0,0 +1,32 @@
+/** Credentials, schemes, scopes, sessions, roles and logins: what a secured operation promises and breaks. */
+export declare const SECURITY_DEFECTS: {
+    /** The notices listing, secured by the document's root security, answers a request with no credential. */
+    readonly AUTH_IGNORED_ON_ROUTE: "one secured route answers a request that carries no credential";
+    /** The JWT's signature goes unchecked: a token whose signature was altered still authenticates. */
+    readonly TOKEN_NOT_VERIFIED: "a JWT with a bad signature is accepted";
+    /** A route the document secures with jwt alone takes an API key as well. */
+    readonly ANY_SCHEME_ACCEPTED: "a jwt-only route accepts an API key";
+    /** An API key authenticates an operation whose scope it was never granted. */
+    readonly SCOPE_NOT_CHECKED: "an API key without the operation's scope is accepted";
+    /** A record route the document secures with jwt OR a scoped API key refuses every API key. */
+    readonly APIKEY_ALTERNATIVE_BROKEN: "a route documented as jwt or apiKey refuses a valid API key";
+    /** The login the document declares `security: []` demands a credential before it signs anyone in. */
+    readonly PUBLIC_ROUTE_GUARDED: "a route the document declares public demands a credential";
+    /** A logged-out or revoked token, and a revoked API key, keep authenticating. */
+    readonly REVOKED_TOKEN_ACCEPTED: "a revoked token or API key still works";
+    /** A refresh token already rotated still refreshes, and its family is never revoked. */
+    readonly REFRESH_REUSE_ACCEPTED: "a rotated refresh token still refreshes";
+    /** Roles are not enforced on writes: a viewer may create, update and delete. */
+    readonly ROLE_NOT_CHECKED: "a viewer can write";
+    /** An API key is honored under another tenant's project, as if it belonged there. */
+    readonly CROSS_TENANT_KEY_ACCEPTED: "an API key works in another tenant";
+    /** A table's `verified`, marked `x-privileged`, is set by a member's or a viewer's write. */
+    readonly PRIVILEGED_FIELD_WRITABLE: "a non-admin's write sets a field only admin may set";
+    /** The register's `staff`, marked `x-privileged`, is granted to whoever signs up asking for it. */
+    readonly PRIVILEGED_FIELD_ON_SIGNUP: "a sign-up grants the x-privileged staff flag its body sets";
+    /** Behind key-lifecycle, a key's revoke finds it by id across tenants: another tenant's revoke succeeds. */
+    readonly KEY_DELETE_CROSS_TENANT: "another tenant can revoke an API key";
+    /** With `throttleLogins` on, failed logins never answer 429. */
+    readonly LOGIN_NOT_THROTTLED: "login throttling is on but repeated failed logins never answer 429";
+};
+//# sourceMappingURL=security.d.ts.map

package/dist/api/reference/defects/security.js

@@ -0,0 +1,32 @@
+/** Credentials, schemes, scopes, sessions, roles and logins: what a secured operation promises and breaks. */
+export const SECURITY_DEFECTS = {
+    /** The notices listing, secured by the document's root security, answers a request with no credential. */
+    AUTH_IGNORED_ON_ROUTE: "one secured route answers a request that carries no credential",
+    /** The JWT's signature goes unchecked: a token whose signature was altered still authenticates. */
+    TOKEN_NOT_VERIFIED: "a JWT with a bad signature is accepted",
+    /** A route the document secures with jwt alone takes an API key as well. */
+    ANY_SCHEME_ACCEPTED: "a jwt-only route accepts an API key",
+    /** An API key authenticates an operation whose scope it was never granted. */
+    SCOPE_NOT_CHECKED: "an API key without the operation's scope is accepted",
+    /** A record route the document secures with jwt OR a scoped API key refuses every API key. */
+    APIKEY_ALTERNATIVE_BROKEN: "a route documented as jwt or apiKey refuses a valid API key",
+    /** The login the document declares `security: []` demands a credential before it signs anyone in. */
+    PUBLIC_ROUTE_GUARDED: "a route the document declares public demands a credential",
+    /** A logged-out or revoked token, and a revoked API key, keep authenticating. */
+    REVOKED_TOKEN_ACCEPTED: "a revoked token or API key still works",
+    /** A refresh token already rotated still refreshes, and its family is never revoked. */
+    REFRESH_REUSE_ACCEPTED: "a rotated refresh token still refreshes",
+    /** Roles are not enforced on writes: a viewer may create, update and delete. */
+    ROLE_NOT_CHECKED: "a viewer can write",
+    /** An API key is honored under another tenant's project, as if it belonged there. */
+    CROSS_TENANT_KEY_ACCEPTED: "an API key works in another tenant",
+    /** A table's `verified`, marked `x-privileged`, is set by a member's or a viewer's write. */
+    PRIVILEGED_FIELD_WRITABLE: "a non-admin's write sets a field only admin may set",
+    /** The register's `staff`, marked `x-privileged`, is granted to whoever signs up asking for it. */
+    PRIVILEGED_FIELD_ON_SIGNUP: "a sign-up grants the x-privileged staff flag its body sets",
+    /** Behind key-lifecycle, a key's revoke finds it by id across tenants: another tenant's revoke succeeds. */
+    KEY_DELETE_CROSS_TENANT: "another tenant can revoke an API key",
+    /** With `throttleLogins` on, failed logins never answer 429. */
+    LOGIN_NOT_THROTTLED: "login throttling is on but repeated failed logins never answer 429",
+};
+//# sourceMappingURL=security.js.map

package/dist/api/reference/defects/table.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Defects the reference backend can be told to exhibit.
+ *
+ * Each one is a real bug seen in production APIs, reduced to its smallest form. The conformance
+ * suite switches them on individually and asserts the API tester reports exactly that defect and nothing
+ * else — which is what turns "the API tester is smart" into precision and recall numbers.
+ *
+ * Keep the implementations naive and obvious. If the reference backend grows clever it starts
+ * encoding the same assumptions the API tester does, and the two drift together into agreeing on nonsense.
+ */
+import { CATALOG_DEFECTS } from "./catalog.ts";
+import { COMPOSITION_DEFECTS } from "./composition.ts";
+import { CORE_DEFECTS } from "./core.ts";
+import { FRESHNESS_DEFECTS } from "./freshness.ts";
+import { QUERY_DEFECTS } from "./query.ts";
+import { RECORD_DEFECTS } from "./records.ts";
+import { SECURITY_DEFECTS } from "./security.ts";
+export declare const DEFECTS: Readonly<typeof CORE_DEFECTS & typeof COMPOSITION_DEFECTS & typeof QUERY_DEFECTS & typeof RECORD_DEFECTS & typeof CATALOG_DEFECTS & typeof SECURITY_DEFECTS & typeof FRESHNESS_DEFECTS>;
+export type DefectName = keyof typeof DEFECTS;
+export declare function isDefectName(value: string): value is DefectName;
+//# sourceMappingURL=table.d.ts.map

package/dist/api/reference/defects/table.js

@@ -0,0 +1,31 @@
+/**
+ * Defects the reference backend can be told to exhibit.
+ *
+ * Each one is a real bug seen in production APIs, reduced to its smallest form. The conformance
+ * suite switches them on individually and asserts the API tester reports exactly that defect and nothing
+ * else — which is what turns "the API tester is smart" into precision and recall numbers.
+ *
+ * Keep the implementations naive and obvious. If the reference backend grows clever it starts
+ * encoding the same assumptions the API tester does, and the two drift together into agreeing on nonsense.
+ */
+import { CATALOG_DEFECTS } from "./catalog.js";
+import { COMPOSITION_DEFECTS } from "./composition.js";
+import { CORE_DEFECTS } from "./core.js";
+import { FRESHNESS_DEFECTS } from "./freshness.js";
+import { QUERY_DEFECTS } from "./query.js";
+import { RECORD_DEFECTS } from "./records.js";
+import { SECURITY_DEFECTS } from "./security.js";
+/* The families in the table's order: every reader of the names (the matrix, the docs, the goldens) sees this order. */
+export const DEFECTS = {
+    ...CORE_DEFECTS,
+    ...COMPOSITION_DEFECTS,
+    ...QUERY_DEFECTS,
+    ...RECORD_DEFECTS,
+    ...CATALOG_DEFECTS,
+    ...SECURITY_DEFECTS,
+    ...FRESHNESS_DEFECTS,
+};
+export function isDefectName(value) {
+    return Object.hasOwn(DEFECTS, value);
+}
+//# sourceMappingURL=table.js.map

package/dist/api/reference/dialect/canonical.d.ts

@@ -0,0 +1,10 @@
+import type { Dialect } from "./types.ts";
+/**
+ * Rewrites a filter expression from a dialect's grammar into the canonical `field.op.value` the
+ * stores parse, so the storage layer never has to know which dialect it is serving.
+ *
+ * Returns `null` when the expression is malformed, which the caller surfaces as a 400 — the same
+ * treatment the canonical grammar gets.
+ */
+export declare function toCanonicalFilter(expression: string | readonly string[], dialect: Dialect): string | null;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/api/reference/dialect/canonical.js

@@ -0,0 +1,42 @@
+import { fromTemplateTerms } from "./template.js";
+/* `status=eq:active`: a field, an operator and a value. Every group takes part in every match. */
+const COLON_TERM = /^([^=]+)=([a-z]+):(.*)$/s;
+/**
+ * Rewrites a filter expression from a dialect's grammar into the canonical `field.op.value` the
+ * stores parse, so the storage layer never has to know which dialect it is serving.
+ *
+ * Returns `null` when the expression is malformed, which the caller surfaces as a 400 — the same
+ * treatment the canonical grammar gets.
+ */
+export function toCanonicalFilter(expression, dialect) {
+    if (typeof expression !== "string")
+        return dialect.grammar === "template" ? fromTemplateTerms(expression) : null;
+    if (dialect.grammar === "template")
+        return fromTemplateTerms([expression]);
+    /* Already canonical: the postgrest grammar *is* the canonical form, and the equality grammar
+     * has no expression of its own — the per-field parameters were assembled into canonical terms
+     * before reaching here. Re-parsing that would reject a well-formed expression. */
+    if (dialect.grammar === "postgrest" || dialect.grammar === "equality")
+        return expression;
+    return fromColonTerms(expression);
+}
+/* `status=eq:active`, joined by commas. No grouping: the point of a second dialect is different
+ * spelling, not a second expression language to maintain. */
+function fromColonTerms(expression) {
+    const terms = expression
+        .split(",")
+        .map((term) => term.trim())
+        .filter(Boolean);
+    if (terms.length === 0)
+        return null;
+    const canonical = [];
+    for (const term of terms) {
+        const match = COLON_TERM.exec(term);
+        if (match === null)
+            return null;
+        const [, field, op, value] = match;
+        canonical.push(`${field}.${op}.${value}`);
+    }
+    return canonical.length === 1 ? canonical[0] : `and(${canonical.join(",")})`;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/api/reference/dialect/presets.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The conventions a reference backend speaks.
+ *
+ * Everything the API tester had quietly hardcoded — what the page-size parameter is called, where the total
+ * lives in the envelope, how a filter expression is spelled — varies wildly between real APIs
+ * and not at all between two instances of the same fixture. A single-dialect fixture therefore
+ * proves that the checks work on *one* shape, which is a much weaker claim than it appears.
+ *
+ * Two dialects, differing in every name and in the filter grammar, turn that into a real test:
+ * the defects and the checks are identical, so anything that passes on one and fails on the
+ * other was reading a convention rather than the contract.
+ */
+import type { Dialect } from "./types.ts";
+/** `field.op.value` with cursor pagination and entity-named collections. */
+export declare const POSTGREST: Dialect;
+/**
+ * A deliberately unrelated spelling: `per_page`, `sort`, `fields`, `search`, a `data` envelope
+ * with `total_count`/`has_more`, no cursor at all, and `field=op:value` filters.
+ *
+ * Nothing here shares a name with the other dialect, so a check that still works is working from
+ * the document rather than from familiarity.
+ */
+export declare const CLASSIC: Dialect;
+/**
+ * Root array, `Link` header pagination, `offset`/`limit`.
+ *
+ * No envelope at all: the body is the array, there is no total, no `hasMore`, and no page number.
+ * Whether more pages exist is answered by `rel="next"` in a header. Nothing about a check should
+ * have to change for this, and where something does, the check was reading the fixture's habits.
+ */
+export declare const LINKED: Dialect;
+/**
+ * JSON:API-flavored: `sort=-name` for descending, `fields[table]=id,name` for projection.
+ *
+ * The parameter *names* here are unremarkable — `sort`, `fields`, `page`, `filter` — which is the
+ * point. Everything the API tester had generalized was the name; the value grammars stayed hardcoded to one
+ * spelling. A shape that renames nothing but writes its values differently is the sharpest test
+ * of whether that generalization was real.
+ */
+export declare const JSONAPI: Dialect;
+/**
+ * The plainest shape there is: `?status=active&page=2`, no filter expression language at all.
+ *
+ * Half of the API tester's query checks cannot be expressed here — there is no way to write a negation, a
+ * range, or a pattern — and that is precisely the point. Every one of them must report what it
+ * could not test and why, because a run that goes quiet against the most common API shape in the
+ * world is the single most damaging way this tool could fail.
+ */
+export declare const PLAIN: Dialect;
+/**
+ * A grammar the API tester has no name for, declared as a template: one term per filter parameter,
+ * `and_status_eq_active`, repeated for every term. `ne` spells not-equal, null tests are terms of
+ * their own, `in` values are comma-joined, an underscore in a value is written `~`, and `like`
+ * matches a bare substring. Sort keys are `name_ascending` / `name_descending`, comma-joined.
+ *
+ * Nothing in the API tester may know this grammar except through the declaration, so every filter check that
+ * still runs here is reading the template rather than a preset. Its names are the same: no alias
+ * finds `filter_by` or `take`, so every check that sends one read it off `x-query.params`, and none
+ * finds `tally` or `more_ahead`, so every walk that reads one read it off `x-query.envelope`.
+ */
+export declare const TEMPLATE: Dialect;
+export declare const DIALECTS: Record<string, Dialect>;
+//# sourceMappingURL=presets.d.ts.map