@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/one-shot.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A public read with no id and no entity. Nothing has to be created first.
+ * The document names a success status, and that is what an empty request must get.
+ * A generated body is not sent: a 400 on a body the check invented would not be the server.
+ */
+import type { Check } from "./checks/core/check.ts";
+import type { Client } from "../client/client.ts";
+import { type FindingCollector } from "./finding.ts";
+import type { CheckId } from "./check-ids.ts";
+import type { OperationModel, SpecModel } from "../spec/graph/types.ts";
+import type { GradeLedger } from "./grades.ts";
+export declare const PUBLIC_GET_CHECK_ID: Extract<CheckId, "response.public-get-returns-success">;
+/** A read anyone can make, with nothing to fill in. */
+export declare function isPublicGet(op: OperationModel): boolean;
+/** The document names a 2xx, exactly or as a `2XX` range. */
+export declare function documentsSuccess(op: OperationModel): boolean;
+export declare function runPublicGets(input: {
+    checksRun: Set<string>;
+    client: Client;
+    findings: FindingCollector;
+    grades: GradeLedger;
+    inScope: (operationId: string) => boolean;
+    mode: "full" | "targeted";
+    model: SpecModel;
+}): Promise<void>;
+export declare const publicGetCheck: Check;
+//# sourceMappingURL=one-shot.d.ts.map

package/dist/api/runtime/one-shot.js

@@ -0,0 +1,76 @@
+/**
+ * A public read with no id and no entity. Nothing has to be created first.
+ * The document names a success status, and that is what an empty request must get.
+ * A generated body is not sent: a 400 on a body the check invented would not be the server.
+ */
+import { ASSERTED } from "./finding.js";
+import { describeSuccess } from "../spec/graph/statuses.js";
+import { noSecurityReason } from "./no-security.js";
+export const PUBLIC_GET_CHECK_ID = "response.public-get-returns-success";
+/** A read anyone can make, with nothing to fill in. */
+export function isPublicGet(op) {
+    const method = op.method.toUpperCase();
+    if (op.entity !== null)
+        return false;
+    if (method !== "GET" && method !== "HEAD")
+        return false;
+    if (op.pathParams.length > 0 || op.path.includes("{"))
+        return false;
+    if (op.queryParamNames.length > 0)
+        return false;
+    if (op.hasRequestBody || op.isMutation)
+        return false;
+    if (op.securitySchemes.length > 0)
+        return false;
+    return true;
+}
+/** The document names a 2xx, exactly or as a `2XX` range. */
+export function documentsSuccess(op) {
+    return op.statuses.exact.some((code) => code >= 200 && code < 300) || op.statuses.ranges.includes(2);
+}
+function successMatches(op, status) {
+    if (status < 200 || status >= 300)
+        return false;
+    if (op.statuses.ranges.includes(2))
+        return true;
+    return op.statuses.exact.includes(status);
+}
+export async function runPublicGets(input) {
+    const ops = input.model.operations.filter((op) => isPublicGet(op) && documentsSuccess(op) && (input.mode === "full" || input.inScope(op.operationId)));
+    if (ops.length === 0)
+        return;
+    input.checksRun.add(PUBLIC_GET_CHECK_ID);
+    /* `isPublicGet` keeps only paths with no parameter, so each path is sent as written. */
+    for (const op of ops) {
+        const findings = input.findings.attributed([op.operationId]).ownedBy(PUBLIC_GET_CHECK_ID);
+        const undeclared = noSecurityReason(op);
+        if (undeclared !== undefined) {
+            findings.unresolved(PUBLIC_GET_CHECK_ID, op.operationId, undeclared);
+            continue;
+        }
+        const exchange = await input.client.request(op.method, op.path, {
+            as: { anonymous: true },
+            operationId: op.operationId,
+            probe: true,
+        });
+        input.grades.graded([op.operationId], PUBLIC_GET_CHECK_ID);
+        if (successMatches(op, exchange.status))
+            continue;
+        /* `documentsSuccess` kept only routes that name a 2xx, so this list is never empty. */
+        const expected = describeSuccess(op.statuses).join(", ");
+        findings.backend(PUBLIC_GET_CHECK_ID, op.operationId, {
+            summary: "a public read did not return its success status",
+            detail: `${op.operationId} returned ${exchange.status}. The document says ${expected} for a request with no token and no id.`,
+            evidence: [exchange],
+        });
+    }
+}
+export const publicGetCheck = {
+    id: PUBLIC_GET_CHECK_ID,
+    needs: "a public GET or HEAD with no id, no query, and a documented success status",
+    plan: () => ({ ok: false }),
+    run: () => Promise.resolve(ASSERTED),
+    /* The routes have no entity, so the entity loop cannot grade them. `runPublicGets` does. */
+    subjects: () => [],
+};
+//# sourceMappingURL=one-shot.js.map

package/dist/api/runtime/own-record.d.ts

@@ -0,0 +1,76 @@
+import type { Client } from "../client/client.ts";
+import type { OperationModel, SpecModel } from "../spec/graph/types.ts";
+import { type CredentialRecord } from "./credential-records.ts";
+/** What the run knows to guard its principals' own records with. */
+export interface OwnRecords {
+    /** Every identity key a principal's sign-in reads, and each field it sends one under (`signInFields`). */
+    signIn: ReadonlySet<string>;
+    /**
+     * The identity of the configured principal `principal` sends for, a probe principal's its owner's;
+     * `undefined` for one the run signed up to throw away, whose record it may change.
+     */
+    identityOf: (principal: string) => Readonly<Record<string, unknown>> | undefined;
+    /** A principal the run signs up to throw away, once: what a write that needs a protected field is sent as. */
+    disposable: () => Promise<string | {
+        blocked: string;
+    }>;
+    /** Takes what the principal's self read answered: its own ids, which no config names, join its identity. */
+    learn?: (principal: string, answer: unknown) => void;
+    /** Every record holding a live credential the run depends on, every principal's (`mintedRecords`). */
+    credentials?: () => readonly CredentialRecord[];
+}
+/**
+ * `base`, learning as the run goes: a self read's identifiers join the identity of the configured
+ * principal that read it, so a write to `/users/<its own id>` is guarded though the config named only
+ * how it signs in.
+ */
+export declare function ownRecordsFrom(base: Omit<OwnRecords, "learn">): OwnRecords;
+/** A write refused before it was sent: it would change how a principal signs in. Its message names the fields. */
+export declare class ProtectedWriteError extends Error {
+    name: string;
+}
+/**
+ * A write that names a record the run depends on: a credential it holds, or a configured principal's
+ * own record it would remove or replace. The check that sent it stands down, naming the record.
+ */
+export declare class HeldRecordError extends ProtectedWriteError {
+    name: string;
+}
+/** Why `operationId` is not sent as `principal`'s with `fields`: the reason a stand-down gives. */
+export declare function protectedReason(operationId: string, principal: string, fields: readonly string[]): string;
+/** A write about to be sent: its operation, the path values it fills, and the identity of who sends it. */
+export interface Write {
+    op: Pick<OperationModel, "identity" | "method" | "pathParams">;
+    path: Readonly<Record<string, string>>;
+    identity: Readonly<Record<string, unknown>>;
+}
+/** Whether `write` changes the principal's own record. */
+export declare function ownRecord(write: Write): boolean;
+/**
+ * The fields of `names` a write must not send: on the principal's own record, every
+ * credential-named one and every one `signIn` lists (case aside); on any other record, none.
+ */
+export declare function protectedFields(signIn: ReadonlySet<string>, write: Write, names: Iterable<string>): Set<string>;
+/** A body a write may send, and the protected fields left out of it, by dotted path; or the ones it cannot go without. */
+export type Guarded = {
+    body: unknown;
+    dropped: string[];
+} | {
+    needs: string[];
+};
+/**
+ * The body without the fields `protectedFields` names, deep through plain objects. A field the
+ * schema requires at its level is one the write needs: then nothing is dropped, and the caller
+ * sends it as a disposable principal or stands down, naming it.
+ */
+export declare function guardWrite(signIn: ReadonlySet<string>, write: Write, sent: {
+    body: unknown;
+    schema?: unknown;
+}): Guarded;
+/**
+ * `client`, and every view of it, refusing any write that would still change a protected field of
+ * its sender's own record (`ProtectedWriteError`, nothing sent): what every check sends through, so
+ * a check that picked such a field stands down, naming it, whatever built its body.
+ */
+export declare function guardedClient(client: Client, records: OwnRecords, model: SpecModel): Client;
+//# sourceMappingURL=own-record.d.ts.map

package/dist/api/runtime/own-record.js

@@ -0,0 +1,188 @@
+/*
+ * A write to the principal's own record never changes how it signs in. The record is its own when
+ * the operation is the self-identity resource (`x-entity.identity: self`), when an update or removal
+ * names no record at all (`PUT /users/me`: the caller is the record), or when a path value is one of
+ * its identity values (its own user id). There, a field is protected when its name is a credential's
+ * (`password`, `api_key`) or one its sign-in reads (`email` where the login sends
+ * `{principal.email}`, and the field it sends it under). A run that changed one would lock the
+ * principal out of every later run.
+ */
+import { probeOwner } from "../credentials/probe-principal.js";
+import { isSecretJsonKey } from "../security/credential-names.js";
+import { operationResolver } from "../spec/graph/resolver.js";
+import { SAFE } from "../spec/methods.js";
+import { heldCredential } from "./credential-records.js";
+import { SELF_IDENTITY } from "../spec/sign-up.js";
+/*
+ * The fields of a self read that name the caller's own record: its id, or its login name. A foreign
+ * key (`project_id`, `org_id`) names another record, the tenant the caller belongs to, never its own.
+ */
+const IDENTIFIER = /^(id|uuid|guid|username|login|handle|user_?id|userId|account_?id|accountId)$/;
+/**
+ * `base`, learning as the run goes: a self read's identifiers join the identity of the configured
+ * principal that read it, so a write to `/users/<its own id>` is guarded though the config named only
+ * how it signs in.
+ */
+export function ownRecordsFrom(base) {
+    const learned = new Map();
+    return {
+        ...base,
+        identityOf: (principal) => {
+            const configured = base.identityOf(principal);
+            return configured === undefined ? undefined : { ...configured, ...learned.get(probeOwner(principal)) };
+        },
+        learn: (principal, answer) => {
+            if (base.identityOf(principal) === undefined || !isPlain(answer))
+                return;
+            const ids = Object.entries(answer).filter(([key, value]) => IDENTIFIER.test(key) && scalarText(value).length > 0);
+            const owner = probeOwner(principal);
+            learned.set(owner, { ...learned.get(owner), ...Object.fromEntries(ids) });
+        },
+    };
+}
+/** A write refused before it was sent: it would change how a principal signs in. Its message names the fields. */
+export class ProtectedWriteError extends Error {
+    name = "ProtectedWriteError";
+}
+/**
+ * A write that names a record the run depends on: a credential it holds, or a configured principal's
+ * own record it would remove or replace. The check that sent it stands down, naming the record.
+ */
+export class HeldRecordError extends ProtectedWriteError {
+    name = "HeldRecordError";
+}
+/** Why `operationId` is not sent as `principal`'s with `fields`: the reason a stand-down gives. */
+export function protectedReason(operationId, principal, fields) {
+    const owner = probeOwner(principal);
+    return `${operationId} would change ${fields.join(", ")} on ${owner}'s own record, which ${owner} signs in with: the API tester never sends that`;
+}
+/** Whether `write` changes the principal's own record. */
+export function ownRecord(write) {
+    const { op } = write;
+    const method = op.method.toUpperCase();
+    if (SAFE.has(method))
+        return false;
+    if (op.identity === SELF_IDENTITY)
+        return true;
+    /* A create names no record either: it makes one. */
+    if (op.pathParams.length === 0)
+        return method !== "POST";
+    const own = new Set(Object.values(write.identity).flatMap(scalarText));
+    return Object.values(write.path).some((value) => own.has(value));
+}
+/**
+ * The fields of `names` a write must not send: on the principal's own record, every
+ * credential-named one and every one `signIn` lists (case aside); on any other record, none.
+ */
+export function protectedFields(signIn, write, names) {
+    if (!ownRecord(write))
+        return new Set();
+    const lowered = new Set([...signIn].map((name) => name.toLowerCase()));
+    return new Set([...names].filter((name) => isSecretJsonKey(name) || lowered.has(name.toLowerCase())));
+}
+/**
+ * The body without the fields `protectedFields` names, deep through plain objects. A field the
+ * schema requires at its level is one the write needs: then nothing is dropped, and the caller
+ * sends it as a disposable principal or stands down, naming it.
+ */
+export function guardWrite(signIn, write, sent) {
+    if (!isPlain(sent.body))
+        return { body: sent.body, dropped: [] };
+    const fields = protectedFields(signIn, write, keysOf(sent.body));
+    const dropped = [];
+    const needs = [];
+    const body = without(sent.body, { at: [], dropped, fields, needs, schema: sent.schema });
+    return needs.length > 0 ? { needs } : { body, dropped };
+}
+function without(body, walk) {
+    const schema = isPlain(walk.schema) ? walk.schema : {};
+    const required = Array.isArray(schema["required"]) ? schema["required"] : [];
+    const properties = isPlain(schema["properties"]) ? schema["properties"] : {};
+    const kept = {};
+    for (const [key, value] of Object.entries(body)) {
+        const at = [...walk.at, key];
+        if (walk.fields.has(key))
+            (required.includes(key) ? walk.needs : walk.dropped).push(at.join("."));
+        else
+            kept[key] = isPlain(value) ? without(value, { ...walk, at, schema: properties[key] }) : value;
+    }
+    return kept;
+}
+/* Every key of a body, deep through plain objects. */
+function keysOf(body) {
+    return Object.entries(body).flatMap(([key, value]) => [key, ...(isPlain(value) ? keysOf(value) : [])]);
+}
+function isPlain(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function scalarText(value) {
+    return typeof value === "string" || typeof value === "number" ? [String(value)] : [];
+}
+/** Throws for a request the guard never sends: one naming a held record, or one changing a protected field. */
+function refuse(records, write, sent) {
+    if (!SAFE.has(sent.method.toUpperCase()))
+        refuseHeld(records, write, sent);
+    const { identity, op } = write;
+    if (identity === undefined || !isPlain(sent.body))
+        return;
+    /* Deep, as guardWrite drops: `{ user: { password } }` changes the password as surely as `{ password }`. */
+    const fields = [...protectedFields(records.signIn, { ...write, identity }, keysOf(sent.body))];
+    if (fields.length > 0)
+        throw new ProtectedWriteError(protectedReason(op.operationId, sent.principal, fields));
+}
+/*
+ * A write the run must never send, whoever sends it: one that changes or removes a record holding a
+ * credential the run depends on. And one a configured principal sends to remove or replace its own
+ * record, which would end the account every later check signs in as.
+ */
+function refuseHeld(records, write, sent) {
+    const held = heldCredential(write.op, write.path, records.credentials?.() ?? []);
+    if (held !== undefined) {
+        throw new HeldRecordError(`${write.op.operationId} would change ${held.entity} ${held.id}, a credential the run holds ` +
+            `(minted by ${held.operationId}): the API tester never sends that`);
+    }
+    const replaces = sent.method.toUpperCase() === "DELETE" || sent.method.toUpperCase() === "PUT";
+    if (write.identity === undefined || !replaces)
+        return;
+    if (!ownRecord({ identity: write.identity, op: write.op, path: write.path }))
+        return;
+    const owner = probeOwner(sent.principal);
+    const op = write.op.operationId;
+    throw new HeldRecordError(sent.method.toUpperCase() === "DELETE"
+        ? `${op} would remove ${owner}'s own record: the API tester never sends that`
+        : `${op} is a full replace of ${owner}'s own record, which could clear its sign-in fields: the API tester never sends that`);
+}
+/**
+ * `client`, and every view of it, refusing any write that would still change a protected field of
+ * its sender's own record (`ProtectedWriteError`, nothing sent): what every check sends through, so
+ * a check that picked such a field stands down, naming it, whatever built its body.
+ */
+export function guardedClient(client, records, model) {
+    const resolve = operationResolver(model);
+    const request = async (method, path, options) => {
+        const principal = "principal" in options.as ? options.as.principal : undefined;
+        const identity = principal === undefined ? undefined : records.identityOf(principal);
+        const writes = !SAFE.has(method.toUpperCase());
+        const resolved = identity === undefined && !writes ? null : resolve(method, path);
+        const op = resolved === null ? undefined : model.byOperationId.get(resolved.operationId);
+        if (op !== undefined && resolved !== null) {
+            refuse(records, { identity, op, path: resolved.pathParams }, { body: options.body, method, principal });
+        }
+        const exchange = await client.request(method, path, options);
+        if (op?.identity === SELF_IDENTITY && SAFE.has(method.toUpperCase()) && exchange.status < 300) {
+            records.learn?.(principal, exchange.responseBody);
+        }
+        return exchange;
+    };
+    return new Proxy(client, {
+        get(target, property, receiver) {
+            if (property === "request")
+                return request;
+            if (property === "view") {
+                return (...args) => guardedClient(target.view(...args), records, model);
+            }
+            return Reflect.get(target, property, receiver);
+        },
+    });
+}
+//# sourceMappingURL=own-record.js.map

package/dist/api/runtime/payloads.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Discriminating string payloads.
+ *
+ * The unicode cohort member is a compact mix so filter/sort/search see more than Latin-1. The
+ * catalog is the exhaustive set: each case is written and read back by `payload.string-survives`.
+ * Cases that cannot exist on the JSON wire (NUL, lone surrogates, invalid UTF-8) are omitted.
+ */
+export declare const UNICODE_COHORT_STRING = "\u00E4\u00F6\u00FC\u00DF \u010D\u0107\u017E\u0161\u0111 \u65E5\u672C\u8A9E \u4E2D\u6587 \uD55C\uAE00 \u043F\u0440\u0438\u0432\u0435\u0442 \u0645\u0631\u062D\u0628\u0627 \uD83D\uDE42";
+export interface StringPayload {
+    id: string;
+    value: string;
+    why: string;
+}
+export declare function codePointCount(text: string): number;
+export declare function sliceCodePoints(text: string, max: number): string;
+export declare function payloadFits(value: string, maxLength: number | undefined, minLength: number | undefined): boolean;
+export declare const STRING_PAYLOADS: readonly StringPayload[];
+/** One payload from each family the catalog must cover: the representative subset. */
+export declare const REQUIRED_IDS: readonly ["empty", "space", "german", "croatian", "russian", "arabic", "japanese", "emoji-basic", "zwsp", "nbsp", "nfd-eacute", "html-script"];
+/**
+ * Catalog invariants, over the shipped catalog and cohort string unless given others. Failures are
+ * strings so the conformance parser suite can print them.
+ */
+export declare function catalogProblems(payloads?: readonly StringPayload[], cohort?: string): string[];
+//# sourceMappingURL=payloads.d.ts.map

package/dist/api/runtime/payloads.js

@@ -0,0 +1,252 @@
+/**
+ * Discriminating string payloads.
+ *
+ * The unicode cohort member is a compact mix so filter/sort/search see more than Latin-1. The
+ * catalog is the exhaustive set: each case is written and read back by `payload.string-survives`.
+ * Cases that cannot exist on the JSON wire (NUL, lone surrogates, invalid UTF-8) are omitted.
+ */
+export const UNICODE_COHORT_STRING = "äöüß čćžšđ 日本語 中文 한글 привет مرحبا 🙂";
+export function codePointCount(text) {
+    return [...text].length;
+}
+export function sliceCodePoints(text, max) {
+    if (codePointCount(text) <= max)
+        return text;
+    return [...text].slice(0, max).join("");
+}
+export function payloadFits(value, maxLength, minLength) {
+    const n = codePointCount(value);
+    if (maxLength !== undefined && n > maxLength)
+        return false;
+    if (minLength !== undefined && n < minLength)
+        return false;
+    return true;
+}
+export const STRING_PAYLOADS = [
+    { id: "empty", value: "", why: "empty vs null vs omitted" },
+    { id: "space", value: " ", why: "single ASCII space" },
+    { id: "spaces", value: "   ", why: "whitespace-only" },
+    { id: "tab", value: "\t", why: "horizontal tab" },
+    { id: "lf", value: "\n", why: "line feed" },
+    { id: "cr", value: "\r", why: "carriage return" },
+    { id: "crlf", value: "\r\n", why: "CRLF" },
+    { id: "vt", value: "\v", why: "vertical tab" },
+    { id: "ff", value: "\f", why: "form feed" },
+    { id: "leading-space", value: " leading", why: "trim on write" },
+    { id: "trailing-space", value: "trailing ", why: "trim on write" },
+    { id: "both-space", value: " padded ", why: "trim both ends" },
+    { id: "internal-double", value: "a  b", why: "collapse of internal space" },
+    { id: "nbsp", value: "\u00A0", why: "non-breaking space" },
+    { id: "nnbsp", value: "\u202F", why: "narrow no-break space" },
+    { id: "thin-space", value: "\u2009", why: "thin space" },
+    { id: "hair-space", value: "\u200A", why: "hair space" },
+    { id: "en-space", value: "\u2002", why: "en space" },
+    { id: "em-space", value: "\u2003", why: "em space" },
+    { id: "figure-space", value: "\u2007", why: "figure space" },
+    { id: "punct-space", value: "\u2008", why: "punctuation space" },
+    { id: "mmsp", value: "\u205F", why: "medium mathematical space" },
+    { id: "ideographic-space", value: "\u3000", why: "ideographic space" },
+    { id: "ogham-space", value: "\u1680", why: "Ogham space mark" },
+    { id: "braille-blank", value: "\u2800", why: "Braille blank, looks empty" },
+    { id: "zwsp", value: "\u200B", why: "zero-width space" },
+    { id: "zwnj", value: "\u200C", why: "zero-width non-joiner" },
+    { id: "zwj", value: "\u200D", why: "zero-width joiner" },
+    { id: "bom", value: "\uFEFF", why: "BOM / zero-width no-break space" },
+    { id: "word-joiner", value: "\u2060", why: "word joiner" },
+    { id: "soft-hyphen", value: "\u00AD", why: "soft hyphen" },
+    { id: "cgj", value: "\u034F", why: "combining grapheme joiner" },
+    { id: "invisible-times", value: "\u2062", why: "invisible times" },
+    { id: "invisible-separator", value: "\u2063", why: "invisible separator" },
+    { id: "invisible-plus", value: "\u2064", why: "invisible plus" },
+    { id: "function-application", value: "\u2061", why: "function application" },
+    { id: "hangul-filler", value: "\u3164", why: "Hangul filler" },
+    { id: "hangul-choseong-filler", value: "\u115F", why: "Hangul choseong filler" },
+    { id: "hangul-jungseong-filler", value: "\u1160", why: "Hangul jungseong filler" },
+    { id: "leading-zwsp", value: "\u200Bvisible", why: "leading ZWSP stripped" },
+    { id: "trailing-nbsp", value: "visible\u00A0", why: "trailing NBSP stripped" },
+    { id: "soft-hyphen-embedded", value: "invis\u00ADible", why: "soft hyphen eaten mid-word" },
+    { id: "lrm", value: "\u200E", why: "left-to-right mark" },
+    { id: "rlm", value: "\u200F", why: "right-to-left mark" },
+    { id: "alm", value: "\u061C", why: "Arabic letter mark" },
+    { id: "lre-pdf", value: "\u202Aembedded\u202C", why: "LRE/PDF pair" },
+    { id: "rle-pdf", value: "\u202Bembedded\u202C", why: "RLE/PDF pair" },
+    { id: "lro-pdf", value: "\u202Dembedded\u202C", why: "LRO/PDF pair" },
+    { id: "rlo-pdf", value: "\u202Eembedded\u202C", why: "RLO/PDF pair" },
+    { id: "lri-pdi", value: "\u2066embedded\u2069", why: "LRI/PDI pair" },
+    { id: "rli-pdi", value: "\u2067embedded\u2069", why: "RLI/PDI pair" },
+    { id: "fsi-pdi", value: "\u2068embedded\u2069", why: "FSI/PDI pair" },
+    { id: "mixed-bidi", value: "hello مرحبا world", why: "LTR + Arabic + LTR" },
+    { id: "trojan-bidi", value: "admin\u202E\u2066user", why: "Trojan Source RLO/FSI wrap" },
+    { id: "c0-soh", value: "\u0001", why: "C0 SOH" },
+    { id: "c0-bel", value: "\u0007", why: "C0 BEL" },
+    { id: "c0-bs", value: "\u0008", why: "C0 backspace" },
+    { id: "c0-esc", value: "\u001B", why: "C0 escape" },
+    { id: "del", value: "\u007F", why: "DEL" },
+    { id: "c1-nel", value: "\u0085", why: "C1 next line" },
+    { id: "c1-apc", value: "\u009F", why: "C1 APC" },
+    { id: "line-separator", value: "\u2028", why: "line separator, historical JSON-in-script" },
+    { id: "paragraph-separator", value: "\u2029", why: "paragraph separator" },
+    { id: "german", value: "äöüÄÖÜßẞ", why: "German umlauts and sharp s" },
+    { id: "german-strasse", value: "Straße", why: "ß / ss / ẞ fold" },
+    { id: "croatian", value: "čćžšđ ČĆŽŠĐ", why: "Croatian / South Slavic Latin" },
+    { id: "polish", value: "ąćęłńóśźż", why: "Polish Latin-extended" },
+    { id: "czech", value: "ěřůťďňľ", why: "Czech / Slovak" },
+    { id: "romanian", value: "ăâîșț", why: "Romanian" },
+    { id: "hungarian", value: "őű", why: "Hungarian double-acute" },
+    { id: "turkish-i", value: "ıiIİ", why: "Turkish dotless-i trap" },
+    { id: "nordic", value: "åæøÅÆØ", why: "Nordic" },
+    { id: "icelandic", value: "ðþÐÞ", why: "Icelandic" },
+    { id: "portuguese", value: "ãõç", why: "Portuguese" },
+    { id: "french", value: "œæÉÀÙ", why: "French" },
+    { id: "vietnamese", value: "Việt ơưạ", why: "Vietnamese stacked diacritics" },
+    { id: "baltic", value: "ėįū āēģķļņ", why: "Lithuanian / Latvian" },
+    { id: "catalan", value: "l·l", why: "Catalan middle-dot geminate" },
+    { id: "welsh", value: "ŵŷ", why: "Welsh circumflex vowels" },
+    { id: "esperanto", value: "ĉĝĥĵŝŭ", why: "Esperanto" },
+    { id: "russian", value: "Привет ёЁ ъь", why: "Russian Cyrillic" },
+    { id: "ukrainian", value: "їєґІ", why: "Ukrainian" },
+    { id: "serbian-cyr", value: "ђћјљњџ", why: "Serbian Cyrillic" },
+    { id: "bulgarian", value: "ъ", why: "Bulgarian er-golyam" },
+    { id: "greek", value: "Ελληνικά", why: "Greek" },
+    { id: "arabic", value: "مرحبا", why: "Arabic" },
+    { id: "arabic-harakat", value: "مَرْحَبًا", why: "Arabic with harakat" },
+    { id: "hebrew", value: "שלום", why: "Hebrew" },
+    { id: "hebrew-niqqud", value: "שָׁלוֹם", why: "Hebrew with niqqud" },
+    { id: "persian", value: "سلام", why: "Persian" },
+    { id: "urdu", value: "اردو", why: "Urdu" },
+    { id: "japanese", value: "日本語 ひらがな カタカナ", why: "kanji + hiragana + katakana" },
+    { id: "chinese-simplified", value: "汉字", why: "simplified Chinese" },
+    { id: "chinese-traditional", value: "漢字", why: "traditional Chinese" },
+    { id: "korean", value: "한글", why: "Hangul" },
+    { id: "fullwidth", value: "ＡＢＣ１２３", why: "fullwidth Latin and digits" },
+    { id: "halfwidth-katakana", value: "ｶﾀｶﾅ", why: "halfwidth katakana" },
+    { id: "hindi", value: "नमस्ते", why: "Devanagari" },
+    { id: "bengali", value: "বাংলা", why: "Bengali" },
+    { id: "tamil", value: "தமிழ்", why: "Tamil" },
+    { id: "thai", value: "สวัสดี", why: "Thai" },
+    { id: "lao", value: "ສະບາຍດີ", why: "Lao" },
+    { id: "khmer", value: "សួស្តី", why: "Khmer" },
+    { id: "tibetan", value: "བོད་ཡིག", why: "Tibetan" },
+    { id: "georgian", value: "ქართული", why: "Georgian" },
+    { id: "armenian", value: "Հայերեն", why: "Armenian" },
+    { id: "amharic", value: "አማርኛ", why: "Ethiopic / Amharic" },
+    {
+        id: "rare-scripts",
+        value: "ⵣߒܐހඅကᠠᏣᓀ𞤀ᚠ᚛𐐔𐒀",
+        why: "Tifinagh N'Ko Syriac Thaana Sinhala Myanmar Mongolian Cherokee Canadian-Aboriginal Adlam Runic Ogham Deseret Osage",
+    },
+    { id: "emoji-basic", value: "🙂", why: "basic emoji, supplementary plane" },
+    { id: "emoji-skin", value: "👋🏽", why: "Fitzpatrick skin-tone modifier" },
+    { id: "emoji-zwj-job", value: "👩‍💻", why: "ZWJ profession sequence" },
+    { id: "emoji-zwj-family", value: "👨‍👩‍👧", why: "ZWJ family sequence" },
+    { id: "emoji-flag", value: "🇭🇷", why: "regional-indicator flag" },
+    { id: "emoji-flag-tag", value: "🏴󠁧󠁢󠁥󠁮󠁧󠁿", why: "tag-sequence flag" },
+    { id: "emoji-keycap", value: "1️⃣", why: "keycap combining sequence" },
+    { id: "emoji-vs16", value: "❤️", why: "emoji presentation vs text" },
+    { id: "emoji-heart-text", value: "❤", why: "text-presentation heart" },
+    { id: "emoji-zwj-flag", value: "🏴‍☠️", why: "ZWJ pirate flag" },
+    { id: "emoji-smp", value: "🧠", why: "SMP pictograph" },
+    { id: "nfc-eacute", value: "\u00E9", why: "NFC e-acute" },
+    { id: "nfd-eacute", value: "e\u0301", why: "NFD e + combining acute" },
+    { id: "nfc-and-nfd", value: "\u00E9e\u0301", why: "NFC and NFD of the same letter together" },
+    { id: "hangul-precomposed", value: "한", why: "precomposed Hangul syllable" },
+    { id: "hangul-jamo", value: "\u1112\u1161\u11AB", why: "Hangul L+V+T jamo" },
+    { id: "ligature-fi", value: "fi", why: "Latin small ligature fi" },
+    { id: "isolated-combining", value: "\u0301", why: "lone combining acute" },
+    { id: "combining-stack", value: "a\u0301\u0302\u0308", why: "letter with stacked combining marks" },
+    { id: "latin-a", value: "a", why: "Latin a, pair with Cyrillic a" },
+    { id: "cyrillic-a", value: "а", why: "Cyrillic a, homoglyph of Latin a" },
+    { id: "paypal-latin", value: "paypal", why: "Latin paypal" },
+    { id: "paypal-cyrillic", value: "раураl", why: "Cyrillic lookalike of paypal" },
+    { id: "kelvin", value: "K", why: "Kelvin sign vs K" },
+    { id: "ascii-k", value: "K", why: "ASCII K, pair with Kelvin" },
+    { id: "long-s", value: "ſ", why: "Latin long s" },
+    { id: "quotes", value: "' \" `", why: "ASCII quotes" },
+    { id: "backslash", value: "\\", why: "backslash" },
+    { id: "sql-comment", value: "-- /*", why: "SQL comment tokens" },
+    { id: "html-script", value: "<script>", why: "HTML script tag, sanitizer bait" },
+    { id: "html-entity", value: "&amp;", why: "HTML entity" },
+    { id: "template-dollar", value: "${7}", why: "template interpolation" },
+    { id: "mustache", value: "{{name}}", why: "mustache interpolation" },
+    { id: "null-looking", value: "null", why: "the string null" },
+    { id: "undefined-looking", value: "undefined", why: "the string undefined" },
+    { id: "nan-looking", value: "NaN", why: "the string NaN" },
+    { id: "true-looking", value: "true", why: "the string true" },
+    { id: "zero", value: "0", why: "numeric-looking zero" },
+    { id: "neg-zero", value: "-0", why: "numeric-looking negative zero" },
+    { id: "exp-overflow", value: "1e309", why: "numeric-looking overflow" },
+    { id: "hex-looking", value: "0x1", why: "hex-looking" },
+    { id: "json-object", value: "{}", why: "JSON-looking object" },
+    { id: "json-array", value: "[]", why: "JSON-looking array" },
+    { id: "unicode-quotes", value: "“ ” ‚", why: "typographic quotes" },
+    { id: "embedded-nl", value: "a\nb", why: "newline inside the value" },
+    { id: "bom-prefix", value: "\uFEFFok", why: "BOM prefix on visible text" },
+    { id: "replacement", value: "\uFFFD", why: "replacement character" },
+    { id: "pua", value: "\uE000", why: "private-use area" },
+    { id: "currency", value: "€£¥₩₪₹₿", why: "currency signs" },
+    { id: "math-bold", value: "𝐀", why: "mathematical bold A, supplementary plane" },
+    { id: "superscript", value: "² ³", why: "superscript digits" },
+];
+/** One payload from each family the catalog must cover: the representative subset. */
+export const REQUIRED_IDS = [
+    "empty",
+    "space",
+    "german",
+    "croatian",
+    "russian",
+    "arabic",
+    "japanese",
+    "emoji-basic",
+    "zwsp",
+    "nbsp",
+    "nfd-eacute",
+    "html-script",
+];
+/* A sample of each script the unicode cohort member must carry, and the script's name. */
+const COHORT_SCRIPTS = [
+    ["äöüß", "German"],
+    ["čćžšđ", "Croatian"],
+    ["привет", "Russian"],
+    ["日本語", "Japanese"],
+    ["🙂", "emoji"],
+];
+/*
+ * A surrogate standing alone. Under the `u` flag a well-formed pair reads as one astral code point,
+ * so only an unpaired half matches.
+ */
+const LONE_SURROGATE = /[\uD800-\uDFFF]/u;
+/** What is wrong with one payload: what the JSON wire or a column could not carry. */
+function payloadProblems({ id, value }) {
+    const problems = [];
+    if (value.includes("\u0000"))
+        problems.push(`${id} contains NUL`);
+    if (codePointCount(value) > 128)
+        problems.push(`${id} exceeds 128 code points`);
+    if (LONE_SURROGATE.test(value))
+        problems.push(`${id} contains a lone surrogate`);
+    return problems;
+}
+/**
+ * Catalog invariants, over the shipped catalog and cohort string unless given others. Failures are
+ * strings so the conformance parser suite can print them.
+ */
+export function catalogProblems(payloads = STRING_PAYLOADS, cohort = UNICODE_COHORT_STRING) {
+    const problems = [];
+    const seen = new Set();
+    for (const payload of payloads) {
+        if (seen.has(payload.id))
+            problems.push(`duplicate id ${payload.id}`);
+        seen.add(payload.id);
+        problems.push(...payloadProblems(payload));
+    }
+    for (const id of REQUIRED_IDS) {
+        if (!seen.has(id))
+            problems.push(`missing required family ${id}`);
+    }
+    for (const [sample, script] of COHORT_SCRIPTS) {
+        if (!cohort.includes(sample))
+            problems.push(`cohort missing ${script}`);
+    }
+    return problems;
+}
+//# sourceMappingURL=payloads.js.map