@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/checks/sets/list.d.ts

@@ -0,0 +1,44 @@
+import type { OperationModel } from "../../../spec/graph/types.ts";
+import type { ReadClient } from "../../../client/client.ts";
+import type { Exchange } from "../../exchange.ts";
+import { type Record_, type RowsAt } from "../../world/records.ts";
+import { type CheckContext, type Listed } from "../core/context.ts";
+import { type Query } from "../query/capabilities.ts";
+/**
+ * Reads a pagination fact by whatever the document calls it — and from wherever it lives.
+ *
+ * Most APIs put these in the body. Some put them nowhere at all and publish a `Link` header
+ * instead, in which case "are there more pages" is answered by the presence of `rel="next"`
+ * rather than by a boolean field. Both are answers to the same question, so both are resolved
+ * here and every check that asks stays unaware of the difference.
+ */
+export declare function envelopeValue(ctx: Listed, result: ListResult, role: "total" | "hasMore" | "nextCursor"): unknown;
+export interface ListResult {
+    items: Record_[];
+    envelope: Record<string, unknown>;
+    exchange: Exchange;
+}
+/**
+ * One page of a list: the context's own, or `op`, read as `principal` (the actor by default) in
+ * `scope` (the context's by default).
+ */
+export declare function list(ctx: Listed, query?: Query, { principal, scope, op, }?: {
+    principal?: string | undefined;
+    scope?: Record<string, string> | undefined;
+    op?: OperationModel | undefined;
+}): Promise<ListResult>;
+/** The context as another entity's list operation sees it — for reading a set that is not ours. */
+export declare function forList<C extends ReadClient>(ctx: CheckContext<C>, op: OperationModel): Listed<C>;
+/** Where the context's own list keeps its records: under its collection key, each read at `within`. */
+export declare function rowsAt(ctx: Listed): RowsAt;
+export declare function ids(records: Record_[], identity: string): string[];
+export interface Walk {
+    ids: string[];
+    /** The records in the order the walk met them, repeats included. */
+    items: Record_[];
+    /** Every page the walk read. */
+    exchanges: Exchange[];
+    /** True when the walk stopped at the page cap rather than at the end of the collection. */
+    truncated: boolean;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/api/runtime/checks/sets/list.js

@@ -0,0 +1,77 @@
+import { fillPath } from "../../fill-path.js";
+import { idOf, recordsFromList } from "../../world/records.js";
+import { isListed } from "../core/context.js";
+import { conv } from "../query/capabilities.js";
+/**
+ * Reads a pagination fact by whatever the document calls it — and from wherever it lives.
+ *
+ * Most APIs put these in the body. Some put them nowhere at all and publish a `Link` header
+ * instead, in which case "are there more pages" is answered by the presence of `rel="next"`
+ * rather than by a boolean field. Both are answers to the same question, so both are resolved
+ * here and every check that asks stays unaware of the difference.
+ */
+export function envelopeValue(ctx, result, role) {
+    const key = conv(ctx).envelope[role];
+    if (key !== undefined)
+        return result.envelope[key];
+    const c = conv(ctx);
+    if (c.linkHeader === undefined)
+        return undefined;
+    /* The document declares a Link header, so its *absence* on a given response is meaningful:
+     * no `rel="next"` means there is no next page. Treating a missing header as "unknown" would
+     * let a backend that simply stops emitting links look untestable rather than wrong. */
+    const link = linkRelations(result.exchange);
+    if (role === "hasMore")
+        return link?.has("next") ?? false;
+    if (role === "nextCursor")
+        return link?.get("next") ?? null;
+    return undefined;
+}
+/** Parses RFC 8288 `Link` into rel → URL, or null when the response carries no such header. */
+function linkRelations(exchange) {
+    const header = exchange.responseHeaders?.["link"] ?? exchange.responseHeaders?.["Link"];
+    if (typeof header !== "string" || header === "")
+        return null;
+    const relations = new Map();
+    for (const part of header.split(",")) {
+        const match = /<([^>]+)>\s*;\s*rel\s*=\s*"?([^";]+)"?/.exec(part.trim());
+        if (match?.[1] !== undefined && match[2] !== undefined)
+            relations.set(match[2].trim(), match[1]);
+    }
+    return relations.size === 0 ? null : relations;
+}
+/**
+ * One page of a list: the context's own, or `op`, read as `principal` (the actor by default) in
+ * `scope` (the context's by default).
+ */
+export async function list(ctx, query = {}, { principal = ctx.actor.id, scope = ctx.scope, op = ctx.listOp, } = {}) {
+    const exchange = await ctx.client.get(fillPath(op.path, scope), {
+        as: { principal },
+        operationId: op.operationId,
+        query,
+    });
+    const body = exchange.responseBody;
+    const items = recordsFromList(body, op === ctx.listOp ? rowsAt(ctx) : op.collection);
+    return { envelope: (body ?? {}), exchange, items };
+}
+/** The context as another entity's list operation sees it — for reading a set that is not ours. */
+export function forList(ctx, op) {
+    if (isListed(ctx) && op === ctx.listOp)
+        return ctx;
+    const entity = ctx.model.entities.get(op.entity ?? "");
+    return {
+        ...ctx,
+        collectionKey: op.collection?.key ?? null,
+        identity: entity?.identity ?? "id",
+        listOp: op,
+        query: op.query,
+    };
+}
+/** Where the context's own list keeps its records: under its collection key, each read at `within`. */
+export function rowsAt(ctx) {
+    return { key: ctx.collectionKey, within: ctx.listOp.collection?.within ?? [] };
+}
+export function ids(records, identity) {
+    return records.flatMap((r) => idOf(r, identity) ?? []);
+}
+//# sourceMappingURL=list.js.map

package/dist/api/runtime/checks/sets/read.d.ts

@@ -0,0 +1,58 @@
+import type { SortValue } from "../../../spec/render/sort.ts";
+import { type Record_ } from "../../world/records.ts";
+import type { Listed } from "../core/context.ts";
+import { type Query } from "../query/capabilities.ts";
+import { type ListResult } from "./list.ts";
+/**
+ * What a whole-set read produced. `complete` is true only when the API itself showed the set
+ * ended — see `readSet`; a read that is unresolved or incomplete always says why.
+ */
+export type SetRead = {
+    items: Record_[];
+    /** The last page read. */
+    last: ListResult;
+    pages: ListResult[];
+} & ({
+    status: "ok";
+    complete: true;
+} | {
+    status: "ok" | "unresolved";
+    complete: false;
+    reason: string;
+});
+interface ReadOptions {
+    /** Page size to ask for; never above the documented maximum. */
+    size?: number;
+    order?: SortValue | undefined;
+    /** Bypass the memo: for checks that compare two reads of the same set. */
+    fresh?: boolean;
+    /** Stop after this many pages even if the set continues. */
+    maxPages?: number;
+    /** Keep walking when a page repeats records already seen — the page-walk check wants to see it. */
+    keepRepeats?: boolean;
+    /** Page by cursor even where page numbers or offsets exist. */
+    byCursor?: boolean;
+    /** Who reads: the actor by default. */
+    principal?: string;
+    scope?: Record<string, string>;
+}
+/** One named table in a memo map, made on first use. */
+export declare function memoTable<V>(store: Map<string, unknown>, name: string): Map<string, V>;
+/**
+ * Reads a whole result set — the one primitive every check that reasons about "all the records
+ * matching X" goes through.
+ *
+ * It follows whatever the endpoint pages by: page numbers, row offsets, or a cursor. Offsets count
+ * the records actually returned, so a server that quietly serves fewer than asked for is still
+ * walked correctly. Completeness comes only from evidence the API gave: an empty page, a page
+ * shorter than a full one already seen, a total reached, a missing next cursor. A "no more pages"
+ * signal on a page that was full is checked by reading one more page — a wrong flag must not end
+ * a walk, since a wrong flag is one of the things checks look for. The requested size proves
+ * nothing on its own: a server may cap it without saying so.
+ *
+ * A page answered with an error leaves the set unresolved, never "ended". Identical reads are
+ * shared until the next write, unless `fresh` asks for a new one.
+ */
+export declare function readSet(ctx: Listed, extra?: Query, options?: ReadOptions): Promise<SetRead>;
+export {};
+//# sourceMappingURL=read.d.ts.map

package/dist/api/runtime/checks/sets/read.js

@@ -0,0 +1,196 @@
+import { nextCursorOf } from "../../../spec/collection/cursor.js";
+import { fillPath } from "../../fill-path.js";
+import { idOf } from "../../world/records.js";
+import { conv, pageSize, q } from "../query/capabilities.js";
+import { envelopeValue, list } from "./list.js";
+/** One named table in a memo map, made on first use. */
+export function memoTable(store, name) {
+    const known = store.get(name);
+    if (known !== undefined)
+        return known;
+    const table = new Map();
+    store.set(name, table);
+    return table;
+}
+/** Page-number pages requested together once a walk is known to go past its first page. */
+const PAGES_AHEAD = 4;
+/** Most records one set read will gather before reporting the set as larger than it covers. */
+const SET_RECORD_CAP = 500;
+/**
+ * Reads a whole result set — the one primitive every check that reasons about "all the records
+ * matching X" goes through.
+ *
+ * It follows whatever the endpoint pages by: page numbers, row offsets, or a cursor. Offsets count
+ * the records actually returned, so a server that quietly serves fewer than asked for is still
+ * walked correctly. Completeness comes only from evidence the API gave: an empty page, a page
+ * shorter than a full one already seen, a total reached, a missing next cursor. A "no more pages"
+ * signal on a page that was full is checked by reading one more page — a wrong flag must not end
+ * a walk, since a wrong flag is one of the things checks look for. The requested size proves
+ * nothing on its own: a server may cap it without saying so.
+ *
+ * A page answered with an error leaves the set unresolved, never "ended". Identical reads are
+ * shared until the next write, unless `fresh` asks for a new one.
+ */
+export async function readSet(ctx, extra = {}, options = {}) {
+    const size = Math.min(options.size ?? pageSize(ctx), pageSize(ctx));
+    /* Identical set reads within one run, keyed by request and by how many writes came before. */
+    const memo = memoTable(ctx.memo.run, "setReads");
+    const key = JSON.stringify([
+        ctx.listOp.operationId,
+        fillPath(ctx.listOp.path, options.scope ?? ctx.scope),
+        options.principal ?? ctx.actor.id,
+        extra,
+        size,
+        options.order ?? null,
+        options.maxPages ?? null,
+        options.keepRepeats === true,
+        options.byCursor === true,
+        ctx.client.writes,
+    ]);
+    if (options.fresh !== true) {
+        const cached = memo.get(key);
+        if (cached !== undefined)
+            return cached;
+    }
+    const pending = walkSet(ctx, extra, options, size);
+    if (options.fresh !== true)
+        memo.set(key, pending);
+    return pending;
+}
+function pagingMode(c, byCursor) {
+    if (byCursor && c.cursor !== undefined)
+        return "cursor";
+    if (c.page !== undefined)
+        return "page";
+    if (c.offset !== undefined)
+        return "offset";
+    return c.cursor === undefined ? "single" : "cursor";
+}
+async function walkSet(ctx, extra, options, size) {
+    const mode = pagingMode(conv(ctx), options.byCursor === true);
+    const walk = {
+        ahead: new Map(),
+        ctx,
+        cursor: undefined,
+        extra,
+        fullPage: 0,
+        items: [],
+        mode,
+        options,
+        pages: [],
+        seen: new Set(),
+        size,
+    };
+    const maxPages = options.maxPages ?? Number.POSITIVE_INFINITY;
+    for (let index = 0;; index++) {
+        if (index >= maxPages)
+            return finish(walk, `stopped after ${maxPages} page(s)`);
+        fetchAhead(walk, index, maxPages);
+        const result = await (walk.ahead.get(index) ?? fetchPage(walk, index));
+        const ended = judgePage(walk, index, result);
+        if (ended !== undefined)
+            return ended;
+    }
+}
+/** The walk's end: the whole set, or, given why, a set that goes on past what was read. */
+function finish(walk, cutShort) {
+    const read = { items: walk.items, last: walk.pages.at(-1), pages: walk.pages };
+    return cutShort === undefined
+        ? { ...read, complete: true, status: "ok" }
+        : { ...read, complete: false, reason: cutShort, status: "ok" };
+}
+function fetchPage(walk, index) {
+    const { ctx, mode, options } = walk;
+    const c = conv(ctx);
+    const query = {
+        ...q(ctx, { limit: walk.size, order: options.order }),
+        ...walk.extra,
+    };
+    if (mode === "page" && c.page !== undefined)
+        query[c.page] = index + 1;
+    if (mode === "offset" && c.offset !== undefined)
+        query[c.offset] = walk.items.length;
+    if (mode === "cursor" && c.cursor !== undefined && walk.cursor !== undefined)
+        query[c.cursor] = walk.cursor;
+    return list(ctx, query, { principal: options.principal, scope: options.scope });
+}
+/*
+ * Page numbers are known in advance, so once the first page shows there is more to read, the
+ * next few are requested together. They are still judged one by one, in order, and whatever
+ * was fetched past the end is simply not read. Offsets and cursors depend on the page before.
+ */
+function fetchAhead(walk, index, maxPages) {
+    if (walk.mode !== "page" || index === 0)
+        return;
+    for (let next = index; next < Math.min(index + PAGES_AHEAD, maxPages); next++) {
+        if (walk.ahead.has(next))
+            continue;
+        const pending = fetchPage(walk, next);
+        /* A page fetched past the end is never awaited; its failure must not surface. */
+        pending.catch(() => undefined);
+        walk.ahead.set(next, pending);
+    }
+}
+/** Takes one page into the walk: the finished read when it ends the walk, else `undefined`. */
+function judgePage(walk, index, result) {
+    const { ctx, items, options, pages, seen } = walk;
+    pages.push(result);
+    if (result.exchange.status >= 400) {
+        return {
+            complete: false,
+            items,
+            last: result,
+            pages,
+            reason: `page ${index + 1} was answered with ${result.exchange.status}`,
+            status: "unresolved",
+        };
+    }
+    const page = result.items;
+    if (page.length === 0)
+        return finish(walk);
+    const fresh = page.filter((item) => {
+        const key = idOf(item, ctx.identity);
+        return key === undefined || !seen.has(key);
+    });
+    /* A page holding nothing new means the server is not paging — the same window again. */
+    if (fresh.length === 0 && options.keepRepeats !== true)
+        return finish(walk, "pages repeat the same records");
+    for (const key of page.map((item) => idOf(item, ctx.identity)))
+        if (key !== undefined)
+            seen.add(key);
+    items.push(...page);
+    if (items.length >= SET_RECORD_CAP)
+        return finish(walk, `more than ${SET_RECORD_CAP} records`);
+    if (walk.mode === "single")
+        return finish(walk);
+    return walk.mode === "cursor" ? followCursor(walk, result) : judgeEnd(walk, result);
+}
+/** The next cursor, or the end of the walk when the page names none. */
+function followCursor(walk, result) {
+    const next = nextCursorOf(envelopeValue(walk.ctx, result, "nextCursor"));
+    if (next === undefined)
+        return finish(walk);
+    walk.cursor = next;
+    return undefined;
+}
+/** Whether a numbered or offset page is the last, on the evidence the page and its envelope give. */
+function judgeEnd(walk, result) {
+    const page = result.items;
+    /* A page shorter than a full one already seen is the last page. */
+    if (walk.fullPage > 0 && page.length < walk.fullPage)
+        return finish(walk);
+    walk.fullPage = Math.max(walk.fullPage, page.length);
+    const total = envelopeValue(walk.ctx, result, "total");
+    const hasMore = envelopeValue(walk.ctx, result, "hasMore");
+    /* Where the envelope carries both, they must agree before either is believed: a total of
+     * zero beside a page of rows, or "no more" short of the total, is a signal lying — and a
+     * server that serves fewer rows than asked makes every page look like the last. */
+    const totalSaysDone = typeof total === "number" && walk.items.length >= total;
+    const saysDone = typeof total === "number" && typeof hasMore === "boolean"
+        ? totalSaysDone && !hasMore
+        : totalSaysDone || hasMore === false;
+    /* Done, and the page was not full: the evidence agrees. Done on a full page, or nothing
+     * said at all: read one more page and let it decide. */
+    return saysDone && page.length < walk.size ? finish(walk) : undefined;
+}
+//# sourceMappingURL=read.js.map

package/dist/api/runtime/contract/calls.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The contract floor's pass: every operation no check and no scenario graded is called once, or
+ * judged on the call that already reached it.
+ */
+import type { ContractInput } from "./types.ts";
+export declare function runContractCalls(input: ContractInput): Promise<void>;
+//# sourceMappingURL=calls.d.ts.map

package/dist/api/runtime/contract/calls.js

@@ -0,0 +1,88 @@
+/**
+ * The contract floor's pass: every operation no check and no scenario graded is called once, or
+ * judged on the call that already reached it.
+ */
+import { judges } from "../probe-judging.js";
+import { readActionBind } from "../effects/bind.js";
+import { fillPath } from "../fill-path.js";
+import { CONTRACT_CHECK_ID } from "./check.js";
+import { judge } from "./judge.js";
+import { parametersOf } from "./params.js";
+import { bodyOf, guardedSend, pathValues, queryValues } from "./request.js";
+export async function runContractCalls(input) {
+    const { model, grades } = input;
+    const pending = model.operations.filter((op) => !op.destructive &&
+        !input.owned.has(op.operationId) &&
+        (input.mode === "full" || input.inScope(op.operationId)) &&
+        !grades.judged(op.operationId) &&
+        !grades.evidence.has(op.operationId));
+    if (pending.length === 0)
+        return;
+    input.checksRun.add(CONTRACT_CHECK_ID);
+    for (const op of pending) {
+        if (input.stopped())
+            return;
+        /* Listed, never sent: fetch cannot send it. */
+        if (op.unsendable !== null) {
+            grades.skipped([op.operationId], op.unsendable);
+            continue;
+        }
+        try {
+            await callOnce(input, op);
+        }
+        catch (error) {
+            /* A refused credential or a dropped connection is not this operation's verdict. */
+            grades.skipped([op.operationId], `contract call could not be sent: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+async function callOnce(input, op) {
+    /* Every operation of a built model has its raw operation. */
+    const raw = input.model.rawOperations.get(op.operationId);
+    /* Already called on the way to something else — signup, a scenario's support step. Grade
+     * that exchange; calling again would only repeat a side effect. */
+    const earlier = input.client.transcript.findLast((exchange) => exchange.operationId === op.operationId &&
+        exchange.status >= 200 &&
+        exchange.status < 300 &&
+        judges("response.contract-call", exchange));
+    if (earlier !== undefined) {
+        /* The transcript may have moved the body to disk; judge the body the server sent. */
+        judge(input, { op, raw }, await input.client.hydrate(earlier));
+        return;
+    }
+    const call = {
+        bind: readActionBind(raw["x-bind"]),
+        op,
+        params: parametersOf(raw),
+        raw,
+    };
+    const values = await pathValues(input, call);
+    if (values === null)
+        return;
+    const query = queryValues(input.grades, call);
+    if (query === null)
+        return;
+    const built = bodyOf(input, call);
+    if (built === null)
+        return;
+    /* A credential operation could end, rotate or spend the principal's own session: never sent with it. */
+    const actor = input.credentials.operations.has(op.operationId)
+        ? await input.credentials.actorFor(op)
+        : { as: { principal: input.principal } };
+    if ("untested" in actor) {
+        input.grades.skipped([op.operationId], actor.untested);
+        return;
+    }
+    const sending = await guardedSend(input, call, { as: actor.as, body: built.body, values });
+    if (sending === null)
+        return;
+    const { as, body } = sending;
+    const exchange = await input.client.request(op.method, fillPath(op.path, values, op.paramStyles.path), {
+        ...(body === undefined ? {} : { body }),
+        as,
+        operationId: op.operationId,
+        ...(Object.keys(query).length === 0 ? {} : { query }),
+    });
+    judge(input, call, exchange);
+}
+//# sourceMappingURL=calls.js.map

package/dist/api/runtime/contract/check.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The floor under every operation: nothing in the document goes uncalled. An operation no check
+ * and no scenario graded is called once with a request built from its own schema. A documented
+ * success whose body matches the schema passes at the `contract` tier — the weakest honest
+ * claim, and the report says so. A server error or a body that breaks the schema fails. A
+ * refused request leaves it untested with the refusal as the reason, because a request the API tester
+ * guessed is not proof the backend is wrong; that operation needs a scenario.
+ */
+import type { CheckId } from "../check-ids.ts";
+import type { Check } from "../checks/core/check.ts";
+export declare const CONTRACT_CHECK_ID: Extract<CheckId, "response.contract-call">;
+export declare const contractCallCheck: Check;
+//# sourceMappingURL=check.d.ts.map

package/dist/api/runtime/contract/check.js

@@ -0,0 +1,19 @@
+/**
+ * The floor under every operation: nothing in the document goes uncalled. An operation no check
+ * and no scenario graded is called once with a request built from its own schema. A documented
+ * success whose body matches the schema passes at the `contract` tier — the weakest honest
+ * claim, and the report says so. A server error or a body that breaks the schema fails. A
+ * refused request leaves it untested with the refusal as the reason, because a request the API tester
+ * guessed is not proof the backend is wrong; that operation needs a scenario.
+ */
+import { ASSERTED } from "../finding.js";
+export const CONTRACT_CHECK_ID = "response.contract-call";
+export const contractCallCheck = {
+    id: CONTRACT_CHECK_ID,
+    needs: "an operation nothing else graded, with every path parameter resolvable",
+    plan: () => ({ ok: false }),
+    run: () => Promise.resolve(ASSERTED),
+    /* Runs after every check and scenario, over what they left ungraded. `runContractCalls` does. */
+    subjects: () => [],
+};
+//# sourceMappingURL=check.js.map

package/dist/api/runtime/contract/deletes.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A delete that only answered 2xx has not been shown to delete anything. Read the same resource
+ * once: 404 or 410 proves it, as does a soft-delete marker set on what comes back. A record that
+ * is still readable, unmarked, was not deleted.
+ */
+import type { ConfirmInput } from "./types.ts";
+export declare function confirmDeletes(input: ConfirmInput): Promise<void>;
+//# sourceMappingURL=deletes.d.ts.map

package/dist/api/runtime/contract/deletes.js

@@ -0,0 +1,131 @@
+/**
+ * A delete that only answered 2xx has not been shown to delete anything. Read the same resource
+ * once: 404 or 410 proves it, as does a soft-delete marker set on what comes back. A record that
+ * is still readable, unmarked, was not deleted.
+ */
+import { UnsatisfiedSecurity } from "../../client/credential-source.js";
+import { blockedCheckSummary } from "../blocked-check.js";
+const DELETE_CHECK_ID = "delete.absent-record-returns-404";
+export async function confirmDeletes(input) {
+    for (const op of input.model.operations) {
+        if (input.stopped())
+            return;
+        const target = readBackOf(input, op);
+        if (target === null)
+            continue;
+        const after = await readBack(input, target);
+        if (after !== null)
+            judgeReadBack(input, target, after);
+    }
+}
+/*
+ * The read on the deleted path, as the floor's principal. A credential it cannot hold (BLOCKED by a
+ * failed login or renewal, or none that meets the read's security) leaves this delete unseen, with
+ * why, and the floor goes on: `null`.
+ */
+async function readBack(input, target) {
+    const { op, path, read } = target;
+    try {
+        return await input.client.request("GET", path, {
+            as: { principal: input.principal },
+            operationId: read.operationId,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof UnsatisfiedSecurity))
+            throw error;
+        const attributed = input.findings.attributed([op.operationId]);
+        const entity = op.entity ?? op.operationId;
+        if (error.kind === "blocked") {
+            attributed.blocked("auth.blocked", entity, {
+                summary: blockedCheckSummary(DELETE_CHECK_ID),
+                cause: `${error.reason}. ${read.operationId} was not sent to read ${path} back after ${op.operationId}.`,
+            });
+            return null;
+        }
+        attributed
+            .ownedBy(DELETE_CHECK_ID)
+            .unresolved(DELETE_CHECK_ID, entity, `${read.operationId} could not be sent to read ${path} back after ${op.operationId} (${error.reason}), so whether the record is gone was not seen`);
+        return null;
+    }
+}
+/** The delete to read back, or `null` when it is no delete, out of scope, proven already, or never answered 2xx. */
+function readBackOf(input, op) {
+    const { grades, model } = input;
+    if (op.method.toUpperCase() !== "DELETE")
+        return null;
+    if (input.mode === "targeted" && !input.inScope(op.operationId))
+        return null;
+    if (grades.evidence.get(op.operationId)?.observation !== undefined)
+        return null;
+    const read = model.operations.find((other) => other.method.toUpperCase() === "GET" && other.path === op.path);
+    if (read === undefined)
+        return null;
+    const call = input.client.transcript.findLast((exchange) => exchange.operationId === op.operationId && exchange.status >= 200 && exchange.status < 300);
+    if (call === undefined)
+        return null;
+    try {
+        /* Below the base URL, as the client takes it: under a mount like `/api` the full path
+         * would be prefixed a second time and answer 404 for a record that is still there. */
+        return { call, op, path: input.client.relativePath(call.url), read };
+    }
+    catch {
+        return null;
+    }
+}
+function judgeReadBack(input, target, after) {
+    const { grades } = input;
+    const { call, op, path, read } = target;
+    if (after.status === 404 || after.status === 410) {
+        grades.graded([op.operationId], DELETE_CHECK_ID);
+        grades.prove(op.operationId, { call: call.seq, observation: { seq: after.seq, status: after.status } });
+        return;
+    }
+    if (after.status < 200 || after.status >= 300) {
+        /* A refused read (the caller's session ended, a role it lost) shows nothing about the
+         * record. Say so: going quiet would pass a delete nobody saw through. */
+        input.findings
+            .attributed([op.operationId])
+            .ownedBy(DELETE_CHECK_ID)
+            .unresolved(DELETE_CHECK_ID, op.entity ?? op.operationId, `${read.operationId} answered ${after.status} when reading ${path} back after ${op.operationId}, so whether the record is gone was not seen`);
+        return;
+    }
+    grades.graded([op.operationId], DELETE_CHECK_ID);
+    const observation = emptied(read, after) ?? marked(op, read, after);
+    if (observation !== undefined) {
+        grades.prove(op.operationId, { call: call.seq, observation });
+        return;
+    }
+    input.findings
+        .attributed([op.operationId])
+        .ownedBy(DELETE_CHECK_ID)
+        .backend(DELETE_CHECK_ID, op.entity ?? op.operationId, {
+        summary: "a deleted record is still readable",
+        detail: `${op.operationId} returned ${call.status}, and ${read.operationId} on the same path then returned ${after.status} with no deletion marker.`,
+        evidence: [call, after],
+    });
+}
+/**
+ * A delete of the whole collection has no item to read back: the read on its path is the list,
+ * and the empty list it leaves is the proof.
+ */
+function emptied(read, after) {
+    if (read.collection === null)
+        return undefined;
+    const key = read.collection.key;
+    const listed = key === null ? after.responseBody : after.responseBody?.[key];
+    if (!Array.isArray(listed) || listed.length > 0)
+        return undefined;
+    return { path: key === null ? "$" : `$.${key}`, seq: after.seq, value: "[]" };
+}
+/** A soft-delete marker set on what the read returned. */
+function marked(op, read, after) {
+    const marker = op.softDelete ?? read.softDelete;
+    if (marker === null)
+        return undefined;
+    const value = after.responseBody?.[marker];
+    if (value === undefined || value === null)
+        return undefined;
+    return { path: `$.${marker}`, seq: after.seq, value: String(value) };
+}
+//# sourceMappingURL=deletes.js.map

package/dist/api/runtime/contract/judge.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The verdict on one contract call: a server error fails it, a refusal leaves it untested, an
+ * undocumented success proves nothing, and a documented success passes when its body holds to
+ * the schema.
+ */
+import type { Exchange } from "../exchange.ts";
+import type { ContractCall, ContractInput } from "./types.ts";
+export declare function judge(input: Pick<ContractInput, "findings" | "grades" | "validator">, { op, raw }: Pick<ContractCall, "op" | "raw">, exchange: Exchange): void;
+//# sourceMappingURL=judge.d.ts.map