@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/created-id.js

@@ -0,0 +1,162 @@
+/**
+ * The id a create's answer gives the record it made.
+ *
+ * Teardown deletes by this id, so where it comes from decides whether a delete removes the API tester's own
+ * row or somebody else's. A declared `x-entity.createdIdFrom`, or the identity at the top of the
+ * answer, names the record by contract. Anything else is a candidate: the record under an
+ * envelope, or a conventional id key found by walking the answer — which can just as well be a
+ * related record's (`Status: { ID: 1 }`). A candidate counts only once a read under it shows what
+ * was sent (`confirmSubmitted`). A create whose body names no id at all may still name the record by
+ * its URL, in `Location` (`createdIdOf`).
+ */
+import { createdIdKeys, findCreatedId } from "./effects/ids.js";
+import { readPath } from "../client/read-path.js";
+import { headerValue } from "./headers.js";
+import { createdId } from "./proven-id.js";
+function isScalarId(value) {
+    return typeof value === "string" || typeof value === "number";
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Keys a create may wrap the record it made in: `{ success, id, data: { ... } }`. */
+const CREATE_ENVELOPE_KEYS = ["data", "item", "result", "record"];
+/**
+ * The record a create answered with. Some creates wrap it — `{ success, id, data: { ID, ... } }` —
+ * and taking the envelope for the record compares the wrong object and loses the id. The record
+ * is the top level or the object under an envelope key, whichever holds more of what was sent, so
+ * a record that merely has an object field named `data` keeps its top level. When the record
+ * lacks its identity, the envelope's identity (or `id`) is the one the create answered.
+ */
+export function createdRecordOf(response, identity, sent) {
+    if (!isPlainRecord(response))
+        return {};
+    const submitted = isPlainRecord(sent)
+        ? Object.entries(sent).filter(([, value]) => isScalarId(value) || typeof value === "boolean")
+        : [];
+    const holds = (candidate) => submitted.filter(([key, value]) => candidate[key] === value).length;
+    let record = response;
+    for (const key of CREATE_ENVELOPE_KEYS) {
+        const inner = response[key];
+        if (isPlainRecord(inner) && holds(inner) > holds(record))
+            record = inner;
+    }
+    if (record === response || isScalarId(record[identity]))
+        return record;
+    const answered = isScalarId(response[identity]) ? response[identity] : response["id"];
+    return isScalarId(answered) ? { ...record, [identity]: answered } : record;
+}
+function asCreatedId(value, trusted) {
+    const id = createdId(value);
+    /* `createdId` proves only a string or a number. */
+    return id === undefined ? undefined : { id, trusted, value: value };
+}
+/** The created record's id: declared, then the answer's own identity, then candidates. */
+export function resolveCreatedId(input) {
+    const { body, identity, source } = input;
+    if (source.createdIdFrom !== null) {
+        const declared = asCreatedId(readPath(body, source.createdIdFrom), true);
+        if (declared !== undefined)
+            return declared;
+    }
+    if (isPlainRecord(body)) {
+        const own = asCreatedId(body[identity], true);
+        if (own !== undefined)
+            return own;
+    }
+    if (source.recordPath !== null) {
+        const record = readPath(body, source.recordPath);
+        const inRecord = isPlainRecord(record) ? asCreatedId(record[identity], false) : undefined;
+        if (inRecord !== undefined)
+            return inRecord;
+    }
+    return (asCreatedId(createdRecordOf(body, identity, input.sent)[identity], false) ??
+        asCreatedId(findCreatedId(body, createdIdKeys(input.entity, identity)), false));
+}
+/* A path segment as it was meant: percent-decoded, or as sent when it is not valid encoding. */
+function decoded(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return segment;
+    }
+}
+/**
+ * The id a `Location` header names: the segment the item route's last parameter takes, with the
+ * route laid over the URL's path from its end, so a mount or a base path in front does not matter
+ * and a URL to anything else (a literal segment that differs) names nothing. Without an item route
+ * it is the last segment. A relative Location resolves against `base`, the create's own URL.
+ */
+export function locatedId(location, template, base) {
+    if (location === undefined)
+        return undefined;
+    let pathname;
+    try {
+        pathname = new URL(location, base ?? "http://testing.invalid/").pathname;
+    }
+    catch {
+        return undefined;
+    }
+    const segments = pathname.split("/").filter(Boolean).map(decoded);
+    if (template === undefined)
+        return segments.at(-1);
+    const route = template.split("/").filter(Boolean);
+    const at = route.findLastIndex((segment) => segment.startsWith("{"));
+    const offset = segments.length - route.length;
+    if (at + offset < 0)
+        return undefined;
+    for (let index = Math.max(0, -offset); index < route.length; index++) {
+        const segment = route[index];
+        if (!segment.startsWith("{") && segment !== segments[index + offset])
+            return undefined;
+    }
+    return segments[at + offset];
+}
+/* The route one record of the entity lives at: its read's, else its delete's or its update's. */
+function itemPathOf(model, entity) {
+    const routes = entity === null ? undefined : model.entities.get(entity);
+    const itemOp = [routes?.read, routes?.delete, routes?.update]
+        .map((operationId) => (operationId === undefined ? undefined : model.byOperationId.get(operationId)))
+        .find((op) => op !== undefined);
+    return itemOp?.path;
+}
+/**
+ * The id a create's answer gives the record it made: its body's (`resolveCreatedId`), else the one
+ * its `Location` header names under the entity's item route. A Location is the record's URL by
+ * contract, so its id is trusted as a declared one is. Every reader of a created id goes through here.
+ */
+export function createdIdOf(input) {
+    const { createOp, exchange, model } = input;
+    const entity = createOp.entity;
+    const identity = (entity === null ? undefined : model.entities.get(entity))?.identity ?? "id";
+    const answered = resolveCreatedId({
+        body: exchange.responseBody ?? {},
+        entity: entity ?? "",
+        identity,
+        sent: input.sent,
+        source: { createdIdFrom: createOp.createdIdFrom, recordPath: createOp.recordPath },
+    });
+    return answered ?? locatedCreatedId(input);
+}
+/**
+ * The id a create's `Location` header names under the entity's item route, trusted: a Location is
+ * the record's URL by contract. A reader that takes the id from the body its own way falls back to
+ * this one; every other reader takes both through `createdIdOf`.
+ */
+export function locatedCreatedId(input) {
+    const { exchange } = input;
+    const location = headerValue(exchange.responseHeaders, "location");
+    return asCreatedId(locatedId(location, itemPathOf(input.model, input.createOp.entity), exchange.url), true);
+}
+/**
+ * The id a create's answer names for the record it made, read the way a check reads an echo: the
+ * answered record's identity (`createdRecordOf`), never a candidate found deeper in the answer,
+ * else the one its `Location` names.
+ */
+export function answeredIdOf(input) {
+    const { exchange, identity } = input;
+    const echoed = createdRecordOf(exchange.responseBody ?? {}, identity, exchange.requestBody)[identity];
+    return isScalarId(echoed) ? echoed : locatedCreatedId(input)?.value;
+}
+//# sourceMappingURL=created-id.js.map

package/dist/api/runtime/credential-records.d.ts

@@ -0,0 +1,21 @@
+import type { OperationModel, SpecModel } from "../spec/graph/types.ts";
+import type { Exchange } from "./exchange.ts";
+/** A record a credential recipe minted: its entity, its id, and the operation that minted it. */
+export interface CredentialRecord {
+    entity: string;
+    id: string;
+    operationId: string;
+}
+/**
+ * Every record a recipe's mint made, from the exchanges the credential store sent: those to a mint
+ * operation that answered 2xx with an id. A mint whose answer names no id is not here; its entity
+ * stays out of the run (`authOwnedReason`), rather than risk the credential.
+ */
+export declare function mintedRecords(input: {
+    exchanges: readonly Exchange[];
+    mintOps: ReadonlySet<string>;
+    model: Pick<SpecModel, "byOperationId" | "entities">;
+}): CredentialRecord[];
+/** The held record a request names by its resolved path, on that record's own entity; `undefined` when none. */
+export declare function heldCredential(op: Pick<OperationModel, "entity">, pathParams: Readonly<Record<string, string>>, held: readonly CredentialRecord[]): CredentialRecord | undefined;
+//# sourceMappingURL=credential-records.d.ts.map

package/dist/api/runtime/credential-records.js

@@ -0,0 +1,34 @@
+/*
+ * The records that hold a live credential the run depends on: each API key a security recipe minted,
+ * say. A check may read one; it may never change or remove one, or the run would lock itself out
+ * halfway through. Each is known by the mint answer that made it, its id read the way every created
+ * id is (`createdIdOf`: the body by the entity's identity, or Location), so the rest of its entity
+ * stays testable on records the run makes for its checks.
+ */
+import { createdIdOf } from "./created-id.js";
+/**
+ * Every record a recipe's mint made, from the exchanges the credential store sent: those to a mint
+ * operation that answered 2xx with an id. A mint whose answer names no id is not here; its entity
+ * stays out of the run (`authOwnedReason`), rather than risk the credential.
+ */
+export function mintedRecords(input) {
+    const { exchanges, mintOps, model } = input;
+    return exchanges.flatMap((exchange) => {
+        const operationId = exchange.operationId;
+        if (exchange.issuedBy !== "credentials" || operationId === undefined || !mintOps.has(operationId))
+            return [];
+        if (exchange.status < 200 || exchange.status >= 300)
+            return [];
+        const createOp = model.byOperationId.get(operationId);
+        if (createOp === undefined || createOp.entity === null)
+            return [];
+        const id = createdIdOf({ createOp, exchange, model, sent: exchange.requestBody });
+        return id === undefined ? [] : [{ entity: createOp.entity, id: String(id.value), operationId }];
+    });
+}
+/** The held record a request names by its resolved path, on that record's own entity; `undefined` when none. */
+export function heldCredential(op, pathParams, held) {
+    const named = new Set(Object.values(pathParams));
+    return held.find((record) => record.entity === op.entity && named.has(record.id));
+}
+//# sourceMappingURL=credential-records.js.map

package/dist/api/runtime/disposable/after.d.ts

@@ -0,0 +1,26 @@
+/**
+ * What must hold after a destructive call the backend accepted: the suite caller still reads
+ * itself, a deleted record is no longer listed, and a session the call ended is refused and no
+ * longer renews.
+ */
+import type { OperationModel } from "../../spec/graph/types.ts";
+import type { Exchange } from "../exchange.ts";
+import type { FindingCollector } from "../finding.ts";
+import type { DisposableInput, Session } from "./types.ts";
+/** Where a failure lands: the operation's collector, under its entity. */
+export interface Blame {
+    collector: FindingCollector;
+    entity: string;
+}
+/** An accepted destructive call and what it ran with. */
+export interface Accepted {
+    op: OperationModel;
+    session: Session;
+    read: OperationModel;
+    ends: boolean;
+    blame: Blame;
+    called: Exchange;
+    values: Record<string, string>;
+}
+export declare function afterCall(input: DisposableInput, call: Accepted): Promise<void>;
+//# sourceMappingURL=after.d.ts.map

package/dist/api/runtime/disposable/after.js

@@ -0,0 +1,96 @@
+/**
+ * What must hold after a destructive call the backend accepted: the suite caller still reads
+ * itself, a deleted record is no longer listed, and a session the call ended is refused and no
+ * longer renews.
+ */
+import { fillPath } from "../fill-path.js";
+import { DISPOSABLE_CHECK_ID } from "./check.js";
+import { identityOf, parentList, recordsOf } from "./lists.js";
+/* A failure was reported: nothing is proved. */
+const BLAMED = "blamed";
+export async function afterCall(input, call) {
+    const { op, read, blame, called } = call;
+    const caller = await input.client.request(read.method, read.path, {
+        as: { principal: input.principal },
+        operationId: read.operationId,
+    });
+    if (caller.status !== 200) {
+        blame.collector.backend(DISPOSABLE_CHECK_ID, read.entity ?? "caller", {
+            summary: "the suite caller was logged out",
+            detail: `${op.operationId} ran as the second user, and the suite ${read.operationId} then returned ${caller.status}.`,
+            evidence: [called, caller],
+        });
+        return;
+    }
+    let observation = await listedGone(input, call);
+    if (observation === BLAMED)
+        return;
+    if (call.ends) {
+        observation = await sessionEnded(input, call);
+        if (observation === BLAMED)
+            return;
+    }
+    input.grades.prove(op.operationId, observation === undefined ? { call: called.seq } : { call: called.seq, observation });
+}
+/** A deleted record read back from the list one level up: absent proves it, present fails it. */
+async function listedGone(input, call) {
+    const { op, session, values, blame, called } = call;
+    const param = op.pathParams.at(-1);
+    const list = parentList(input.model, op);
+    if (op.method.toUpperCase() !== "DELETE" || param === undefined || list === undefined)
+        return undefined;
+    const listed = await input.client.request(list.method, fillPath(list.path, values), {
+        as: { principal: session.principal },
+        operationId: list.operationId,
+    });
+    const field = identityOf(list, input.model, param);
+    /* `runOne` filled every path parameter before the call. */
+    const value = values[param];
+    if (listed.status < 200 || listed.status >= 300)
+        return undefined;
+    if (recordsOf(listed.responseBody, list, input.model).some((row) => row[field] === value)) {
+        blame.collector.backend(DISPOSABLE_CHECK_ID, blame.entity, {
+            summary: "the credential was still listed",
+            detail: `${op.operationId} returned ${called.status}, and the follow-up list still contained ${value}.`,
+            evidence: [called, listed],
+        });
+        return BLAMED;
+    }
+    return { absent: true, path: "$", seq: listed.seq, value };
+}
+/** The ended session read again, and its refresh tried: both must be refused. */
+async function sessionEnded(input, call) {
+    const { op, session, read, blame, called } = call;
+    /* A probe: the refusal is the answer, never renewed and retried, or the session would look alive. */
+    const gone = await input.client.request(read.method, read.path, {
+        as: { principal: session.principal },
+        operationId: read.operationId,
+        probe: true,
+    });
+    const renewed = session.renew === undefined ? undefined : await session.renew();
+    const refused = gone.status === 401 || gone.status === 403 || gone.status === 404;
+    /* A declared refresh that answered anything but a 4xx still renews. */
+    const renews = renewed !== undefined && !(renewed.status >= 400 && renewed.status < 500);
+    /* A read still answered proves the session ended only beside a refresh that was refused. With
+     * no refresh declared, or one that sent nothing, nothing shows the session ended. */
+    if (!refused && (renewed === undefined || renews)) {
+        blame.collector.backend(DISPOSABLE_CHECK_ID, blame.entity, {
+            summary: "the disposable session was still accepted",
+            detail: `${op.operationId} invalidates ${read.operationId}, and that read then returned ${gone.status} with the second user's credential.`,
+            evidence: renewed === undefined ? [called, gone] : [called, gone, renewed],
+        });
+        return BLAMED;
+    }
+    if (refused && renews) {
+        blame.collector.backend(DISPOSABLE_CHECK_ID, blame.entity, {
+            summary: "the refresh token still renews after the session ended",
+            detail: `${op.operationId} ended the session, and the declared refresh then returned ${renewed.status}.`,
+            evidence: [called, gone, renewed],
+        });
+        return BLAMED;
+    }
+    /* Not refused here means the refresh was: the branch above took every other case. */
+    const proof = refused ? gone : renewed;
+    return { seq: proof.seq, status: proof.status };
+}
+//# sourceMappingURL=after.js.map

package/dist/api/runtime/disposable/check.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `x-destructive` runs as a second user, never the suite caller. That user signs up through the
+ * document's `x-fresh-principal` operation and is a principal of its own in the run's store.
+ * Afterwards the suite caller's own read still answers 200. An operation that invalidates the
+ * caller read must leave that second user's credential refused, and a declared refresh must no
+ * longer renew it.
+ *
+ * What a destructive call needs beforehand — a second factor enabled, a credential registered,
+ * ownership handed off — is product knowledge. When the call is refused for want of it, the
+ * operation stays untested and a scenario sets the scene.
+ */
+import type { OperationModel, SpecModel } from "../../spec/graph/types.ts";
+import type { CheckId } from "../check-ids.ts";
+import type { Check } from "../checks/core/check.ts";
+export declare const DISPOSABLE_CHECK_ID: Extract<CheckId, "auth.destructive-spares-the-caller">;
+export declare const disposableCheck: Check;
+export declare function destructiveOps(model: SpecModel): OperationModel[];
+/** The caller reading itself: an `identity: self` read with nothing to fill in. */
+export declare function callerRead(model: SpecModel): OperationModel | undefined;
+export declare function invalidatesCaller(op: OperationModel, read: OperationModel): boolean;
+//# sourceMappingURL=check.d.ts.map

package/dist/api/runtime/disposable/check.js

@@ -0,0 +1,33 @@
+/**
+ * `x-destructive` runs as a second user, never the suite caller. That user signs up through the
+ * document's `x-fresh-principal` operation and is a principal of its own in the run's store.
+ * Afterwards the suite caller's own read still answers 200. An operation that invalidates the
+ * caller read must leave that second user's credential refused, and a declared refresh must no
+ * longer renew it.
+ *
+ * What a destructive call needs beforehand — a second factor enabled, a credential registered,
+ * ownership handed off — is product knowledge. When the call is refused for want of it, the
+ * operation stays untested and a scenario sets the scene.
+ */
+import { ASSERTED } from "../finding.js";
+export const DISPOSABLE_CHECK_ID = "auth.destructive-spares-the-caller";
+export const disposableCheck = {
+    id: DISPOSABLE_CHECK_ID,
+    mutates: true,
+    needs: "x-destructive, a way to sign up a second user, and a caller read",
+    plan: () => ({ ok: false }),
+    run: () => Promise.resolve(ASSERTED),
+    /* Destructive routes have no entity. `runDisposableOps` grades them after the entity loop. */
+    subjects: () => [],
+};
+export function destructiveOps(model) {
+    return model.operations.filter((op) => op.destructive && op.unsendable === null);
+}
+/** The caller reading itself: an `identity: self` read with nothing to fill in. */
+export function callerRead(model) {
+    return model.operations.find((op) => op.identity === "self" && op.action === "read" && op.pathParams.length === 0);
+}
+export function invalidatesCaller(op, read) {
+    return op.invalidates.some((route) => route === `${read.method.toUpperCase()} ${read.path}` || route === read.route);
+}
+//# sourceMappingURL=check.js.map

package/dist/api/runtime/disposable/lists.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The list one level up from a destructive route, read for the id it needs and again to see the
+ * record gone; and the body a destructive call sends.
+ */
+import type { JsonSchema } from "../../spec/types.ts";
+import type { OperationModel, SpecModel } from "../../spec/graph/types.ts";
+export declare function recordsOf(body: unknown, op: OperationModel, model: SpecModel): Record<string, unknown>[];
+export declare function identityOf(list: OperationModel, model: SpecModel, param: string): string;
+/** The collection read one level up — `GET /a/{id}` lists for `DELETE /a/{id}/b/{item}`. */
+export declare function parentList(model: SpecModel, op: OperationModel): OperationModel | undefined;
+/** The generated body with every field the signup already knows by name; none without a schema. */
+export declare function bodyFor(schema: JsonSchema | null, known: Record<string, unknown>, generated: Record<string, unknown>): unknown;
+//# sourceMappingURL=lists.d.ts.map

package/dist/api/runtime/disposable/lists.js

@@ -0,0 +1,47 @@
+/**
+ * The list one level up from a destructive route, read for the id it needs and again to see the
+ * record gone; and the body a destructive call sends.
+ */
+import { effective } from "../../spec/collection/effective.js";
+import { deriveIdentity } from "../../spec/collection/identity.js";
+import { successSchema } from "../../spec/collection/responses.js";
+import { deriveCollectionShape } from "../../spec/collection/shape.js";
+/** The collection shape `list` answers with. Every operation of a built model has its raw operation. */
+function shapeOf(list, model) {
+    return deriveCollectionShape(successSchema(model.rawOperations.get(list.operationId)));
+}
+export function recordsOf(body, op, model) {
+    const shape = shapeOf(op, model);
+    if (body === null || typeof body !== "object")
+        return [];
+    const value = shape?.key === null || shape?.key === undefined ? body : body[shape.key];
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((item) => item !== null && typeof item === "object" && !Array.isArray(item));
+}
+export function identityOf(list, model, param) {
+    const shape = shapeOf(list, model);
+    const props = effective(shape?.itemSchema ?? null)?.properties;
+    if (props !== null && props !== undefined && typeof props === "object" && param in props)
+        return param;
+    return deriveIdentity(shape?.itemSchema ?? null, param) ?? "id";
+}
+/** The collection read one level up — `GET /a/{id}` lists for `DELETE /a/{id}/b/{item}`. */
+export function parentList(model, op) {
+    const parent = op.path.replace(/\/\{[^}]+\}$/, "");
+    return model.operations.find((item) => item.method.toUpperCase() === "GET" && item.path === parent);
+}
+/** The generated body with every field the signup already knows by name; none without a schema. */
+export function bodyFor(schema, known, generated) {
+    if (schema === null)
+        return undefined;
+    const out = { ...generated };
+    const props = schema.properties;
+    if (props !== null && props !== undefined && typeof props === "object") {
+        for (const name of Object.keys(props))
+            if (name in known)
+                out[name] = known[name];
+    }
+    return out;
+}
+//# sourceMappingURL=lists.js.map

package/dist/api/runtime/disposable/one.d.ts

@@ -0,0 +1,15 @@
+/**
+ * One destructive operation, run as the second user: its path filled from that user's lists, its
+ * body from the schema and what the signup knows, and its answer graded.
+ */
+import type { OperationModel } from "../../spec/graph/types.ts";
+import type { DisposableInput, Session } from "./types.ts";
+/** A destructive operation, the session it runs as, the caller read, and whether it ends the session. */
+export interface DisposableCall {
+    op: OperationModel;
+    session: Session;
+    read: OperationModel;
+    ends: boolean;
+}
+export declare function runOne(input: DisposableInput, call: DisposableCall): Promise<void>;
+//# sourceMappingURL=one.d.ts.map

package/dist/api/runtime/disposable/one.js

@@ -0,0 +1,98 @@
+/**
+ * One destructive operation, run as the second user: its path filled from that user's lists, its
+ * body from the schema and what the signup knows, and its answer graded.
+ */
+import { requestSchema } from "../../spec/collection/request.js";
+import { fillPath } from "../fill-path.js";
+import { buildCohort } from "../fixture.js";
+import { applyResolveInput } from "../input.js";
+import { afterCall } from "./after.js";
+import { DISPOSABLE_CHECK_ID } from "./check.js";
+import { bodyFor, identityOf, parentList, recordsOf } from "./lists.js";
+export async function runOne(input, call) {
+    const { op, session } = call;
+    const blame = {
+        collector: input.findings.attributed([op.operationId]).ownedBy(DISPOSABLE_CHECK_ID),
+        entity: op.entity ?? call.read.entity ?? "caller",
+    };
+    const values = await pathValues(input, op, session);
+    if (values === null)
+        return;
+    const body = await destructiveBody(input, op, session);
+    const called = await input.client.request(op.method, fillPath(op.path, values), {
+        as: { principal: session.principal },
+        ...(body === undefined ? {} : { body }),
+        operationId: op.operationId,
+    });
+    if (called.status >= 500) {
+        input.grades.graded([op.operationId], DISPOSABLE_CHECK_ID);
+        blame.collector.backend(DISPOSABLE_CHECK_ID, blame.entity, {
+            summary: "the disposable call failed",
+            detail: `${op.operationId} returned ${called.status}.`,
+            evidence: [called],
+        });
+        return;
+    }
+    if (called.status < 200 || called.status >= 300) {
+        input.grades.skipped([op.operationId], `destructive call returned ${called.status}; a scenario must set the scene`);
+        return;
+    }
+    input.grades.graded([op.operationId], DISPOSABLE_CHECK_ID);
+    await afterCall(input, { ...call, blame, called, values });
+}
+/** The path, each parameter the session's scope lacks read from the list one level up; `null` once one cannot be. */
+async function pathValues(input, op, session) {
+    const values = { ...session.scope };
+    for (const param of op.pathParams) {
+        if (values[param] !== undefined)
+            continue;
+        const list = parentList(input.model, op);
+        if (list === undefined) {
+            input.grades.skipped([op.operationId], `unresolved param ${param}`);
+            return null;
+        }
+        const listed = await input.client.request(list.method, fillPath(list.path, values), {
+            as: { principal: session.principal },
+            operationId: list.operationId,
+        });
+        /* A refusal, a session the server ended and the API tester could not renew say, lists nothing to read. */
+        if (listed.status < 200 || listed.status >= 300) {
+            input.grades.skipped([op.operationId], `${list.operationId} answered ${listed.status}`);
+            return null;
+        }
+        const field = identityOf(list, input.model, param);
+        const row = recordsOf(listed.responseBody, list, input.model).find((item) => typeof item[field] === "string");
+        if (row === undefined) {
+            input.grades.skipped([op.operationId], "the list returned no id");
+            return null;
+        }
+        values[param] = String(row[field]);
+    }
+    return values;
+}
+/** The schema-built body with what the signup knows overlaid; none when the operation takes none. */
+async function destructiveBody(input, op, session) {
+    /* Every operation of a built model has its raw operation. */
+    const schema = requestSchema(input.model.rawOperations.get(op.operationId));
+    let generated = {};
+    if (schema !== null) {
+        try {
+            /* One variant asked for, one member back, and its body is always an object. */
+            const [member] = buildCohort(schema, input.seed ?? 1, {
+                variants: ["baseline"],
+                nonce: `${input.nonce ?? "user"}d`,
+                operationId: op.operationId,
+            });
+            generated = member.body;
+        }
+        catch {
+            /* `buildCohort` throws only an overflow (a `FixtureOverflow`, or a `RangeError` past its
+             * depth): the body stays empty, and what the signup knows still fills it. */
+        }
+        if (input.resolveInput !== undefined) {
+            generated = await applyResolveInput(generated, input.resolveInput, { operationId: op.operationId, schema });
+        }
+    }
+    return bodyFor(schema, session.known, generated);
+}
+//# sourceMappingURL=one.js.map

package/dist/api/runtime/disposable/run.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Every destructive operation in scope, each run as a second user: one shared by the operations
+ * that leave the session standing, and one of its own for each that ends it.
+ */
+import type { DisposableInput } from "./types.ts";
+export declare function runDisposableOps(input: DisposableInput): Promise<void>;
+//# sourceMappingURL=run.d.ts.map

package/dist/api/runtime/disposable/run.js

@@ -0,0 +1,54 @@
+/**
+ * Every destructive operation in scope, each run as a second user: one shared by the operations
+ * that leave the session standing, and one of its own for each that ends it.
+ */
+import { UnsatisfiedSecurity } from "../../client/credential-source.js";
+import { FencedError } from "../fence.js";
+import { callerRead, destructiveOps, DISPOSABLE_CHECK_ID, invalidatesCaller } from "./check.js";
+import { runOne } from "./one.js";
+import { signUp } from "./signup.js";
+export async function runDisposableOps(input) {
+    const ops = destructiveOps(input.model).filter((op) => input.mode === "full" || input.inScope(op.operationId));
+    if (ops.length === 0)
+        return;
+    input.checksRun?.add(DISPOSABLE_CHECK_ID);
+    const read = callerRead(input.model);
+    if (read === undefined) {
+        input.grades.skipped(ops.map((op) => op.operationId), "no caller read (an identity: self read)");
+        return;
+    }
+    /* An operation that ends the session gets a user of its own, so no order between them matters. */
+    let shared;
+    for (const [index, op] of ops.entries()) {
+        const ends = invalidatesCaller(op, read);
+        let session;
+        try {
+            session = ends ? await signUp(input, `${index}`) : (shared ?? (await signUp(input, "shared")));
+        }
+        catch (error) {
+            session = { blocked: error instanceof Error ? error.message : String(error) };
+        }
+        if ("blocked" in session) {
+            input.grades.skipped([op.operationId], `the second user could not sign up: ${session.blocked}`);
+            continue;
+        }
+        if (!ends)
+            shared = session;
+        await runAsSecondUser(input, { ends, op, read, session });
+    }
+}
+/*
+ * One operation as the second user. A credential it cannot hold (a renewal that would sign up
+ * again), or a request the fence refused, skips it, with why: nothing reached the backend to judge.
+ */
+async function runAsSecondUser(input, run) {
+    try {
+        await runOne(input, run);
+    }
+    catch (error) {
+        if (!(error instanceof UnsatisfiedSecurity) && !(error instanceof FencedError))
+            throw error;
+        input.grades.skipped([run.op.operationId], error.message);
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/api/runtime/disposable/signup.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Signing up the second user: a principal of the run's own, enrolled in its store through the
+ * document's `x-fresh-principal` operation, so its requests go `as` it and are placed by each
+ * operation's security, refreshed and retried on a 401 like any configured principal's.
+ */
+import type { DisposableInput, Session } from "./types.ts";
+/** The second user labeled `label`, as a session; BLOCKED with the reason when it cannot be signed up. */
+export declare function signUp(input: DisposableInput, label: string): Promise<Session | {
+    blocked: string;
+}>;
+//# sourceMappingURL=signup.d.ts.map