@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/checks/families/validation/invalid-body.js

@@ -0,0 +1,52 @@
+/*
+ * The one invalid body request.invalid-body-refused sends an operation, read from its request schema
+ * alone, so every run sends the same one: a body missing its first required property (never for a
+ * PATCH), else one whose first typed property, in document order, carries a value of another type.
+ * A property the path already names is never the one broken. Only what a writer may
+ * send is considered: readOnly properties, and optional x-privileged ones, are no part of the choice.
+ */
+import { ordinaryRequestSchema } from "../../../fixture.js";
+/* A value of each JSON type, in the order one is tried: the first no declared type admits is sent. */
+const SPECIMENS = [
+    [["integer", "number"], 7],
+    [["string"], "testing-invalid"],
+    [["boolean"], true],
+    [["array"], []],
+    [["object"], {}],
+];
+/**
+ * The invalid body's recipe for `schema`, or null when it names no property to break. Neither choice
+ * touches a property the path already names (`kept`), nor a readOnly one, which no writer sends: a
+ * server may rightly take the one from the path and ignore the other. A merge write is sent the wrong
+ * type rather than missing a required property.
+ */
+export function invalidChoice(schema, { merge = false, kept = new Set() } = {}) {
+    const ordinary = ordinaryRequestSchema(schema);
+    if (typeof ordinary !== "object" || ordinary.properties === undefined)
+        return null;
+    const properties = Object.entries(ordinary.properties).filter(([name]) => !kept.has(name));
+    const breakable = new Set(properties.map(([name]) => name));
+    const required = !merge && Array.isArray(ordinary.required) ? ordinary.required : [];
+    const missing = required.find((name) => breakable.has(name));
+    if (missing !== undefined)
+        return { field: missing, kind: "missing" };
+    for (const [field, property] of properties) {
+        const value = wrongTyped(property.type);
+        if (value !== undefined)
+            return { field, kind: "wrong-type", value };
+    }
+    return null;
+}
+/** A value of a JSON type `type` does not admit; undefined when it admits them all or states none. */
+export function wrongTyped(type) {
+    const admitted = typeof type === "string" ? [type] : Array.isArray(type) ? type : [];
+    if (admitted.length === 0)
+        return undefined;
+    return SPECIMENS.find(([types]) => !types.some((name) => admitted.includes(name)))?.[1];
+}
+/** `base` made invalid by `choice`: a copy, the property removed or set to the wrong type. */
+export function invalidated(base, choice) {
+    const { [choice.field]: _dropped, ...rest } = base;
+    return choice.kind === "missing" ? rest : { ...rest, [choice.field]: choice.value };
+}
+//# sourceMappingURL=invalid-body.js.map

package/dist/api/runtime/checks/families/validation/request-invalid-body-refused.d.ts

@@ -0,0 +1,18 @@
+import type { OperationCheck } from "../../core/check.ts";
+import type { Actor } from "../../../../client/credential-source.ts";
+import { type Address } from "../security/probing.ts";
+import { type InvalidChoice } from "./invalid-body.ts";
+/** Why a write outside a run-created record is not probed. */
+export declare const SIDE_EFFECT = "an action outside a run-created record could apply a side effect the run cannot undo";
+/** Why an open POST the document does not declare a signup is not probed. */
+export declare const SIGN_IN = "an open POST the document marks x-fresh-principal; any other could be a sign-in, where a malformed body can count toward a lockout";
+/** The invalid request: where it goes, who sends it, how its body is wrong, and whether it is an open POST. */
+interface InvalidProbe {
+    address: Address;
+    as: Actor;
+    choice: InvalidChoice;
+    open: boolean;
+}
+export declare const invalidBodyRefused: OperationCheck<InvalidProbe>;
+export {};
+//# sourceMappingURL=request-invalid-body-refused.d.ts.map

package/dist/api/runtime/checks/families/validation/request-invalid-body-refused.js

@@ -0,0 +1,152 @@
+import { messageOf } from "../../../../errors/message.js";
+import { fillPath } from "../../../fill-path.js";
+import { ASSERTED } from "../../../finding.js";
+import { buildCohort } from "../../../fixture.js";
+import { requestContent } from "../../../../spec/collection/request.js";
+import { defineCheck } from "../../core/define.js";
+import { isReadMethod, targetPlan } from "../../core/operation.js";
+import { andThen, cannot, ready } from "../../core/plan.js";
+import { acceptorOf, send } from "../security/probing.js";
+import { currentOf, writableBody } from "../security/writable.js";
+import { invalidChoice, invalidated } from "./invalid-body.js";
+import { undeliverable } from "./undeliverable.js";
+const ID = "request.invalid-body-refused";
+/** Why a write outside a run-created record is not probed. */
+export const SIDE_EFFECT = "an action outside a run-created record could apply a side effect the run cannot undo";
+/** Why an open POST the document does not declare a signup is not probed. */
+export const SIGN_IN = "an open POST the document marks x-fresh-principal; any other could be a sign-in, where a malformed body can count toward a lockout";
+export const invalidBodyRefused = defineCheck({
+    id: ID,
+    mutates: true,
+    needs: "a write other than a create that takes a JSON request body",
+    plan: (ctx) => andThen(subjectPlan(ctx), (subject) => probePlan(ctx, subject)),
+    async run(ctx, probe) {
+        return judged(ctx, probe, await send(ctx, probe.address, probe.as));
+    },
+    subject: "operation",
+});
+/* The operation as a subject: a write with a JSON body, not a create, no credential step, with something to break. */
+function subjectPlan(ctx) {
+    const { model, operation } = ctx;
+    const { operationId } = operation;
+    /* The model holds every operation it lists. */
+    const content = jsonContent(model.rawOperations.get(operationId));
+    if (isReadMethod(operation) || content === null)
+        return cannot("a write that takes a JSON request body");
+    if (ctx.recipeOperations.has(operationId)) {
+        return cannot(`an operation no credential recipe names; ${operationId} is a step of one`);
+    }
+    const entity = operation.entity === null ? undefined : model.entities.get(operation.entity);
+    /* A sign-up is never seeded as a fixture, so no create check reads its body: this one does. */
+    if (entity?.create === operationId && !operation.freshPrincipal) {
+        return cannot(`a write other than its entity's create; ${operationId} is ${entity.name}'s create`);
+    }
+    /* The path names the record and its parents: the server takes those from it, not from the body. */
+    const kept = new Set(operation.pathParams);
+    if (typeof entity?.identity === "string")
+        kept.add(entity.identity);
+    const choice = invalidChoice(content.schema, { kept, merge: operation.method.toUpperCase() === "PATCH" });
+    if (choice === null)
+        return cannot("a request schema with a required or typed property");
+    return ready({ choice, mediaType: content.mediaType, schema: content.schema });
+}
+/* The operation's JSON request content, when it documents one. */
+function jsonContent(raw) {
+    const json = Object.keys(raw.requestBody?.content ?? {}).find((type) => type.split(";")[0].toLowerCase().includes("json"));
+    return json === undefined ? null : requestContent(raw, json);
+}
+/*
+ * Where the invalid body goes: a write whose path names a record (the stage handed it a target, or the
+ * actor's scope leaves a parameter unfilled) to the run-created target alone; an open POST anonymously;
+ * anything else nowhere.
+ */
+function probePlan(ctx, subject) {
+    const { choice, mediaType } = subject;
+    const { actor, operation } = ctx;
+    if (ctx.target !== undefined || operation.pathParams.some((name) => !Object.hasOwn(actor.scope, name))) {
+        return andThen(targetPlan(ctx), (target) => {
+            const record = currentOf(target);
+            if (record === undefined)
+                return cannot("the target record's current state, for a harmless body");
+            const address = {
+                body: itemBody(ctx, subject, invalidated(writableBody(ctx, record), choice)),
+                contentType: mediaType,
+                path: target.path,
+            };
+            return ready({ address, as: { principal: acceptorOf(ctx).id }, choice, open: false });
+        });
+    }
+    if (!openToAll(ctx.security) || operation.method.toUpperCase() !== "POST")
+        return cannot(SIDE_EFFECT);
+    if (!operation.freshPrincipal)
+        return cannot(SIGN_IN);
+    return andThen(drawnBody(ctx, subject), (drawn) => {
+        const path = fillPath(operation.path, actor.scope);
+        const address = { body: invalidated(drawn, choice), contentType: mediaType, path };
+        return ready({ address, as: { anonymous: true }, choice, open: true });
+    });
+}
+/*
+ * An item body as sent: an action (a POST on the record that is not its entity's update, an invite
+ * say) reaches out, so every address it holds is one that reaches nothing.
+ */
+function itemBody(ctx, { schema }, body) {
+    const { model, operation } = ctx;
+    const isUpdate = [...model.entities.values()].some((entity) => entity.update === operation.operationId);
+    const action = operation.method.toUpperCase() === "POST" && !isUpdate;
+    return action ? undeliverable(body, schema, ctx.nonce) : body;
+}
+/* Whether the document declares the operation open to all and to nobody else: `security: []`. */
+function openToAll(security) {
+    return security.source !== "none" && security.alternatives.every((alternative) => alternative.length === 0);
+}
+/* A valid body for the operation, drawn under the run's seed, to break; or why none can be drawn. */
+function drawnBody(ctx, { schema }) {
+    const { operationId } = ctx.operation;
+    try {
+        const [member] = buildCohort(schema, ctx.seed, {
+            defs: ctx.model.defs,
+            nonce: ctx.nonce,
+            operationId,
+            variants: ["baseline"],
+        });
+        return ready(member.body);
+    }
+    catch (error) {
+        /* A schema no body satisfies: buildCohort throws a FixtureOverflow naming why. */
+        return cannot(`a valid body for ${operationId} to break: ${messageOf(error)}`);
+    }
+}
+/* The invalid body in the reader's terms. */
+function described(choice) {
+    return choice.kind === "missing"
+        ? `a body missing the required property "${choice.field}"`
+        : `a body whose "${choice.field}" is ${JSON.stringify(choice.value)}, a type the schema does not allow`;
+}
+/* Any 4xx passes; a 2xx applied invalid input, and a 5xx crashed on it. */
+function judged(ctx, probe, exchange) {
+    const { status } = exchange;
+    const sent = `${ctx.subject} answered ${status} to ${described(probe.choice)}.`;
+    if (status >= 400 && status < 500)
+        return ASSERTED;
+    if (status >= 500) {
+        return ctx.findings.backend(ID, ctx.subject, {
+            detail: `${sent} Invalid input must be refused with a 4xx, not crash the handler.`,
+            evidence: [exchange],
+            summary: "an invalid body drew a server error",
+        });
+    }
+    if (status < 200 || status >= 300) {
+        const reason = `${ctx.subject} answered ${status} to the invalid body: neither a refusal nor a success`;
+        return ctx.findings.unresolved(ID, ctx.subject, reason);
+    }
+    const applied = probe.open
+        ? " The write is taken as applied: teardown removes what it made, or reports it as a record that may remain."
+        : "";
+    return ctx.findings.backend(ID, ctx.subject, {
+        detail: `${sent} A write must refuse invalid input with a 4xx; this one applied what it could parse.${applied}`,
+        evidence: [exchange],
+        summary: "a write accepted a body its schema rules out",
+    });
+}
+//# sourceMappingURL=request-invalid-body-refused.js.map

package/dist/api/runtime/checks/families/validation/undeliverable.d.ts

@@ -0,0 +1,3 @@
+/** `value` with every address its `schema` declares, at any depth, replaced by one that reaches nothing. */
+export declare function undeliverable(value: unknown, schema: unknown, nonce: string): unknown;
+//# sourceMappingURL=undeliverable.d.ts.map

package/dist/api/runtime/checks/families/validation/undeliverable.js

@@ -0,0 +1,40 @@
+/*
+ * A probe body nothing can be delivered to: a broken API that applies it anyway must not mail a real
+ * inbox or call a real webhook. Every email-format value becomes an identity no account holds, at RFC
+ * 2606's `.invalid` domain (`nonexistentIdentity`), and every URL-format value a URL on an `.invalid`
+ * host, which never resolves. Only a string is replaced: a value of another type stays as it is.
+ */
+import { nonexistentIdentity } from "../../../nonexistent-identity.js";
+const EMAIL = /* @__PURE__ */ new Set(["email", "idn-email"]);
+const URL_FORMATS = /* @__PURE__ */ new Set([
+    "uri",
+    "url",
+    "iri",
+    "uri-reference",
+    "iri-reference",
+]);
+/** `value` with every address its `schema` declares, at any depth, replaced by one that reaches nothing. */
+export function undeliverable(value, schema, nonce) {
+    if (schema === null || typeof schema !== "object")
+        return value;
+    const node = schema;
+    if (typeof value === "string")
+        return addressed(value, node, nonce);
+    if (Array.isArray(value))
+        return value.map((item) => undeliverable(item, node.items, nonce));
+    const properties = node.properties;
+    if (value === null || typeof value !== "object" || properties === null || typeof properties !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([name, item]) => [
+        name,
+        undeliverable(item, properties[name], nonce),
+    ]));
+}
+/* A string as its format would have it delivered to nowhere. */
+function addressed(value, schema, nonce) {
+    const format = typeof schema.format === "string" ? schema.format : "";
+    if (EMAIL.has(format))
+        return nonexistentIdentity({ name: "email", schema }, nonce);
+    return URL_FORMATS.has(format) ? `https://testing-nonexistent-${nonce}.invalid/` : value;
+}
+//# sourceMappingURL=undeliverable.js.map

package/dist/api/runtime/checks/families/validation/validation-content-type-enforced.d.ts

@@ -0,0 +1,9 @@
+import type { Check } from "../../core/check.ts";
+import type { OperationObject } from "../../../../spec/types.ts";
+import { type CreateBody } from "./bodies.ts";
+export declare const contentTypeEnforced: Check<CreateBody>;
+/** The media type the operation declares for its request body, as a finding names it. */
+export declare function declaredMediaTypeOf(raw: OperationObject | undefined): string;
+/** An encoded body as the text sent under the undeclared label: a form as its query string. */
+export declare function asText(body: unknown): string;
+//# sourceMappingURL=validation-content-type-enforced.d.ts.map

package/dist/api/runtime/checks/families/validation/validation-content-type-enforced.js

@@ -0,0 +1,50 @@
+import { defineCheck } from "../../core/define.js";
+import { requestContent } from "../../../../spec/collection/request.js";
+import { documentsStatus } from "../../../../spec/graph/statuses.js";
+import { fillPath } from "../../../fill-path.js";
+import { standDown } from "../../../finding.js";
+import { cannot } from "../../core/plan.js";
+import { encodeOpBody, validBody } from "../../payloads/body.js";
+import { asProbe, judgeRefusal } from "../../planning/refusal.js";
+import { standDownForFeatureGate } from "../../planning/stand-down.js";
+import { subjectsOf } from "../../planning/subjects.js";
+import { createBodyPlan } from "./bodies.js";
+export const contentTypeEnforced = defineCheck({
+    plan: (ctx) => ctx.createOp !== undefined && documentsStatus(ctx.createOp.statuses, 415) ? createBodyPlan(ctx) : cannot(),
+    mutates: true,
+    id: "validation.content-type-enforced",
+    needs: "a documented 415 response",
+    subjects: subjectsOf.create,
+    async run(ctx, { createOp, schema }) {
+        /* The body the endpoint would parse, under a label it does not accept: a server that skips
+         * the check must then process it, rather than refuse it for some unrelated reason. */
+        const encoded = await encodeOpBody(ctx, createOp, validBody(ctx, schema));
+        const declaredMediaType = declaredMediaTypeOf(ctx.model.rawOperations.get(createOp.operationId));
+        const exchange = await asProbe(ctx).client.request("POST", fillPath(createOp.path, ctx.scope), {
+            body: asText(encoded.body),
+            contentType: "text/plain",
+            as: { principal: ctx.actor.id },
+        });
+        if (standDownForFeatureGate(ctx, createOp, exchange, this.id))
+            return standDown("a documented feature gate refused the request");
+        const refused = judgeRefusal(ctx, this.id, ["content-type"], exchange);
+        if (refused !== null)
+            return refused;
+        return ctx.findings.backend(this.id, ctx.entityName, {
+            summary: "a request labeled with an undeclared content type was processed",
+            detail: `the operation documents 415 and declares ${declaredMediaType}, but the same body sent as ` +
+                `text/plain was processed (${exchange.status}). Content negotiation is documented ` +
+                "but not implemented.",
+            evidence: [exchange],
+        });
+    },
+});
+/** The media type the operation declares for its request body, as a finding names it. */
+export function declaredMediaTypeOf(raw) {
+    return raw === undefined ? "a declared media type" : (requestContent(raw)?.mediaType ?? "a declared media type");
+}
+/** An encoded body as the text sent under the undeclared label: a form as its query string. */
+export function asText(body) {
+    return body instanceof URLSearchParams ? body.toString() : typeof body === "string" ? body : JSON.stringify(body);
+}
+//# sourceMappingURL=validation-content-type-enforced.js.map

package/dist/api/runtime/checks/families/validation/validation-enum-enforced.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from "../../core/check.ts";
+import { type ConstrainedField, type CreateBody } from "./bodies.ts";
+export declare const enumValidated: Check<CreateBody & {
+    target: ConstrainedField;
+}>;
+//# sourceMappingURL=validation-enum-enforced.d.ts.map

package/dist/api/runtime/checks/families/validation/validation-enum-enforced.js

@@ -0,0 +1,44 @@
+import { defineCheck } from "../../core/define.js";
+import { fillPath } from "../../../fill-path.js";
+import { standDown } from "../../../finding.js";
+import { outsideEnum } from "../../../generate/probes.js";
+import { andThen, cannot, ready } from "../../core/plan.js";
+import { encodeOpBody, validBody } from "../../payloads/body.js";
+import { asProbe, judgeRefusal } from "../../planning/refusal.js";
+import { standDownForFeatureGate } from "../../planning/stand-down.js";
+import { subjectsOf } from "../../planning/subjects.js";
+import { createBodyPlan, findConstrained } from "./bodies.js";
+export const enumValidated = defineCheck({
+    plan: (ctx) => andThen(createBodyPlan(ctx), (create) => {
+        const target = findConstrained(create.schema, (s) => Array.isArray(s.enum) && s.enum.length > 0);
+        return target === null ? cannot("a request field that declares an enum") : ready({ ...create, target });
+    }),
+    mutates: true,
+    id: "validation.enum-enforced",
+    needs: "a request schema with an enum field",
+    subjects: subjectsOf.create,
+    async run(ctx, { createOp, schema, target }) {
+        const outside = outsideEnum(target.schema);
+        if (!outside.ok)
+            return ctx.findings.unresolved(this.id, ctx.entityName, outside.reason);
+        const body = { ...validBody(ctx, schema), [target.name]: outside.value };
+        const exchange = await asProbe(ctx).client.request("POST", fillPath(createOp.path, ctx.scope), {
+            ...(await encodeOpBody(ctx, createOp, body)),
+            as: { principal: ctx.actor.id },
+        });
+        if (standDownForFeatureGate(ctx, createOp, exchange, this.id))
+            return standDown("a documented feature gate refused the request");
+        const refused = judgeRefusal(ctx, this.id, ["validation"], exchange);
+        if (refused !== null)
+            return refused;
+        const declaredValues = target.schema.enum.map((v) => JSON.stringify(v)).join(", ");
+        return ctx.findings.backend(this.id, ctx.entityName, {
+            summary: "a value outside the declared enum was accepted",
+            detail: `"${target.name}" declares [${declaredValues}] but the backend accepted ${JSON.stringify(outside.value)} ` +
+                `with ${exchange.status}. Clients generated from this document will assume the field ` +
+                "only ever holds a declared member.",
+            evidence: [exchange],
+        });
+    },
+});
+//# sourceMappingURL=validation-enum-enforced.js.map

package/dist/api/runtime/checks/families/validation/validation-max-length-enforced.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from "../../core/check.ts";
+import { type ConstrainedField, type CreateBody } from "./bodies.ts";
+export declare const maxLengthValidated: Check<CreateBody & {
+    target: ConstrainedField;
+}>;
+//# sourceMappingURL=validation-max-length-enforced.d.ts.map

package/dist/api/runtime/checks/families/validation/validation-max-length-enforced.js

@@ -0,0 +1,44 @@
+import { defineCheck } from "../../core/define.js";
+import { fillPath } from "../../../fill-path.js";
+import { standDown } from "../../../finding.js";
+import { overMaxLength } from "../../../generate/probes.js";
+import { andThen, cannot, ready } from "../../core/plan.js";
+import { encodeOpBody, validBody } from "../../payloads/body.js";
+import { asProbe, judgeRefusal } from "../../planning/refusal.js";
+import { standDownForFeatureGate } from "../../planning/stand-down.js";
+import { subjectsOf } from "../../planning/subjects.js";
+import { createBodyPlan, findConstrained } from "./bodies.js";
+export const maxLengthValidated = defineCheck({
+    plan: (ctx) => andThen(createBodyPlan(ctx), (create) => {
+        const target = findConstrained(create.schema, (s) => typeof s.maxLength === "number" && s.maxLength < 4096);
+        return target === null ? cannot("a request field that declares a maxLength") : ready({ ...create, target });
+    }),
+    mutates: true,
+    id: "validation.max-length-enforced",
+    needs: "a request schema with a maxLength constraint",
+    subjects: subjectsOf.create,
+    async run(ctx, { createOp, schema, target }) {
+        const max = target.schema.maxLength;
+        const over = overMaxLength(target.schema);
+        if (!over.ok)
+            return standDown(over.reason);
+        const value = over.value;
+        const body = { ...validBody(ctx, schema), [target.name]: value };
+        const exchange = await asProbe(ctx).client.request("POST", fillPath(createOp.path, ctx.scope), {
+            ...(await encodeOpBody(ctx, createOp, body)),
+            as: { principal: ctx.actor.id },
+        });
+        if (standDownForFeatureGate(ctx, createOp, exchange, this.id))
+            return standDown("a documented feature gate refused the request");
+        const refused = judgeRefusal(ctx, this.id, ["validation"], exchange);
+        if (refused !== null)
+            return refused;
+        return ctx.findings.backend(this.id, ctx.entityName, {
+            summary: "a string longer than the declared maxLength was accepted",
+            detail: `"${target.name}" declares maxLength ${max} but a ${value.length}-character value was stored ` +
+                `(${exchange.status}). The constraint exists in the document only.`,
+            evidence: [exchange],
+        });
+    },
+});
+//# sourceMappingURL=validation-max-length-enforced.js.map

package/dist/api/runtime/checks/families/validation/validation-required-enforced.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from "../../core/check.ts";
+import { type CreateBody } from "./bodies.ts";
+export declare const requiredValidated: Check<CreateBody & {
+    field: string;
+}>;
+//# sourceMappingURL=validation-required-enforced.d.ts.map

package/dist/api/runtime/checks/families/validation/validation-required-enforced.js

@@ -0,0 +1,40 @@
+import { defineCheck } from "../../core/define.js";
+import { fillPath } from "../../../fill-path.js";
+import { standDown } from "../../../finding.js";
+import { andThen, cannot, ready } from "../../core/plan.js";
+import { encodeOpBody, validBody } from "../../payloads/body.js";
+import { asProbe, judgeRefusal } from "../../planning/refusal.js";
+import { standDownForFeatureGate } from "../../planning/stand-down.js";
+import { subjectsOf } from "../../planning/subjects.js";
+import { createBodyPlan } from "./bodies.js";
+export const requiredValidated = defineCheck({
+    plan: (ctx) => andThen(createBodyPlan(ctx), (create) => {
+        const required = Array.isArray(create.schema.required) ? create.schema.required : [];
+        const field = required[0];
+        return field === undefined ? cannot("a request body with a required field") : ready({ ...create, field });
+    }),
+    mutates: true,
+    id: "validation.required-enforced",
+    needs: "a request schema with a required field",
+    subjects: subjectsOf.create,
+    async run(ctx, { createOp, field, schema }) {
+        const { [field]: _omitted, ...body } = validBody(ctx, schema);
+        const exchange = await asProbe(ctx).client.request("POST", fillPath(createOp.path, ctx.scope), {
+            ...(await encodeOpBody(ctx, createOp, body, { omit: new Set([field]) })),
+            as: { principal: ctx.actor.id },
+        });
+        if (standDownForFeatureGate(ctx, createOp, exchange, this.id))
+            return standDown("a documented feature gate refused the request");
+        const refused = judgeRefusal(ctx, this.id, ["validation"], exchange);
+        if (refused !== null)
+            return refused;
+        return ctx.findings.backend(this.id, ctx.entityName, {
+            summary: "create succeeded without a required field",
+            detail: `"${field}" is listed in the schema's required array, but omitting it returned ` +
+                `${exchange.status}. Either the handler does not validate it or the document ` +
+                "overstates the requirement.",
+            evidence: [exchange],
+        });
+    },
+});
+//# sourceMappingURL=validation-required-enforced.js.map

package/dist/api/runtime/checks/families/write/concurrency-if-match-enforced.d.ts

@@ -0,0 +1,23 @@
+import type { Check } from "../../core/check.ts";
+import type { OperationModel } from "../../../../spec/graph/types.ts";
+/** What the check runs on: the item read that tags a version, and the update that takes one. */
+interface Plan {
+    readOp: OperationModel;
+    updateOp: OperationModel;
+    /** The If-Match header, under the spelling the update declares. */
+    header: string;
+}
+/**
+ * An update that names, in `If-Match`, a version the record no longer has must be refused with 412.
+ *
+ * Optimistic concurrency rests on it: a client reads, edits, and writes back under the ETag it read,
+ * trusting the server to refuse the write if anyone changed the record in between. A server that
+ * ignores the header applies the write over the other change, and tells the caller it succeeded.
+ *
+ * Both updates send the record's own writable state, so the stale one changes nothing a reader could
+ * see even when it is wrongly applied; whether it was applied is told by the ETag the record reads
+ * back with afterwards.
+ */
+export declare const ifMatchEnforced: Check<Plan>;
+export {};
+//# sourceMappingURL=concurrency-if-match-enforced.d.ts.map