@workerstack/testing 0.0.0-stage → 0.31.0

package/dist/api/runtime/rate-limit/match.d.ts

@@ -0,0 +1,26 @@
+/** How a rate-limit `match` string, or a documented operation, decides which requests it covers. */
+import type { OperationModel, SpecModel } from "../../spec/graph/types.ts";
+/** `operationId` is the operation the client stamped on the request, when it resolved one. */
+export type RequestTest = (method: string, pathname: string, operationId?: string) => boolean;
+/**
+ * Turns a path template or a simple glob into an anchored regex.
+ *
+ * `{param}` segments (from an operation's own path template) and bare `*` segments (from a
+ * user-written pattern) both become `[^/]+`; `*` inside a segment becomes `[^/]*` so `item-*`
+ * matches a prefix without crossing a `/`. Deliberately not a full glob or regex language — the
+ * point of a config-level matcher is that it needs no coordination with the document, and a
+ * bigger grammar would need documenting on both ends.
+ */
+export declare function compilePathPattern(pattern: string): RegExp;
+/**
+ * A rule for one operation. A request the client resolved to an operation matches by that
+ * operationId alone; only a request it could not resolve — an absolute URL off the document —
+ * falls back to comparing method and path.
+ */
+export declare function operationTest(op: OperationModel): RequestTest;
+/** Compiles one `match` string against the model — an operationId, a path pattern, or a category. */
+export declare function compileMatch(match: string, model: SpecModel): Array<{
+    test: RequestTest;
+    category: string;
+}>;
+//# sourceMappingURL=match.d.ts.map

package/dist/api/runtime/rate-limit/match.js

@@ -0,0 +1,55 @@
+/** How a rate-limit `match` string, or a documented operation, decides which requests it covers. */
+/**
+ * Turns a path template or a simple glob into an anchored regex.
+ *
+ * `{param}` segments (from an operation's own path template) and bare `*` segments (from a
+ * user-written pattern) both become `[^/]+`; `*` inside a segment becomes `[^/]*` so `item-*`
+ * matches a prefix without crossing a `/`. Deliberately not a full glob or regex language — the
+ * point of a config-level matcher is that it needs no coordination with the document, and a
+ * bigger grammar would need documenting on both ends.
+ */
+export function compilePathPattern(pattern) {
+    const compiled = pattern
+        .split("/")
+        .map((segment) => {
+        if (segment === "*" || (segment.startsWith("{") && segment.endsWith("}")))
+            return "[^/]+";
+        return segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    })
+        .join("/");
+    return new RegExp(`^${compiled}$`);
+}
+/**
+ * A rule for one operation. A request the client resolved to an operation matches by that
+ * operationId alone; only a request it could not resolve — an absolute URL off the document —
+ * falls back to comparing method and path.
+ */
+export function operationTest(op) {
+    const pathRegex = compilePathPattern(op.path);
+    const method = op.method.toUpperCase();
+    return (m, p, operationId) => operationId !== undefined ? operationId === op.operationId : m === method && pathRegex.test(p);
+}
+/** Compiles one `match` string against the model — an operationId, a path pattern, or a category. */
+export function compileMatch(match, model) {
+    if (match.startsWith("category:")) {
+        const category = match.slice("category:".length).trim();
+        return model.operations
+            .filter((op) => op.rateLimit?.category === category)
+            .map((op) => ({ category, test: operationTest(op) }));
+    }
+    const op = model.byOperationId.get(match);
+    if (op !== undefined)
+        return [{ category: match, test: operationTest(op) }];
+    /* "METHOD /pattern" or a bare "/pattern" matching any method. */
+    const spaceAt = match.indexOf(" ");
+    const methodPart = spaceAt === -1 ? null : match.slice(0, spaceAt).toUpperCase();
+    const pathPart = spaceAt === -1 ? match : match.slice(spaceAt + 1);
+    const pathRegex = compilePathPattern(pathPart);
+    return [
+        {
+            category: match,
+            test: (m, p) => (methodPart === null || methodPart === m) && pathRegex.test(p),
+        },
+    ];
+}
+//# sourceMappingURL=match.js.map

package/dist/api/runtime/rate-limit/retry-after.d.ts

@@ -0,0 +1,40 @@
+/** How long the API tester waits before asking again after a 429 or a 503, and how a server error reads. */
+import type { Exchange, RetryAfterExceeded } from "../exchange.ts";
+/** Extra attempts after the first 429. The first 429 is never a seed/check failure by itself. */
+export declare const MAX_429_RETRIES = 5;
+export declare const RETRY_BACKOFF_INITIAL_MS = 1000;
+/** The longest backoff the API tester picks itself, when the server names no wait. */
+export declare const RETRY_BACKOFF_CAP_MS = 30000;
+/** A 503 that names when to come back is asked again this many times. */
+export declare const MAX_UNAVAILABLE_RETRIES = 3;
+/** The pause before a read that met a gateway status (502, 503, 504) is asked once more. */
+export declare const GATEWAY_RETRY_MS = 1000;
+/** The longest `Retry-After` the API tester waits out unless `network.maxRetryAfterMs` says otherwise. */
+export declare const DEFAULT_MAX_RETRY_AFTER_MS = 60000;
+/**
+ * How a server error reads in a finding. A 503 that still stood after the API tester waited out its
+ * `Retry-After` is the backend being unavailable, told apart from a crash; both are failures.
+ */
+export declare function describeServerError(exchange: Pick<Exchange, "status" | "responseHeaders" | "retryAfterExceeded">): string;
+/** An answer's status, and the wait it asked for when the API tester would not wait that long: "429 and asked the API tester to wait 24h, …". */
+export declare function describeStatus(exchange: Pick<Exchange, "status" | "retryAfterExceeded">): string;
+/** "asked the API tester to wait 24h, longer than network.maxRetryAfterMs (60s)": the wait the API tester did not wait out. */
+export declare function describeExceeded(exceeded: RetryAfterExceeded): string;
+/** A wait in whole seconds, rounded up, written in the largest unit that divides it evenly. */
+export declare function formatWait(ms: number): string;
+/**
+ * `Retry-After` as a wait in ms, as long as the server asked. Delta-seconds or HTTP-date; anything
+ * unparseable is `null` so the caller can fall back to exponential backoff.
+ */
+export declare function parseRetryAfter(value: string | undefined, now?: number): number | null;
+/** Wait before retry `attempt` (0-based) of a 429. Header wins; otherwise 1s, 2s, 4s… capped. */
+export declare function retryWaitMs(retryAfterHeader: string | undefined, attempt: number, now?: number): number;
+/** One answer's status and `Retry-After`, against the longest wait the API tester accepts. */
+export interface RetryAfterInput {
+    status: number;
+    header: string | undefined;
+    limitMs: number;
+}
+/** The wait a 429 or a 503 asked for when it is longer than the API tester waits: that answer stands as it is. */
+export declare function retryAfterVerdict(input: RetryAfterInput, now?: number): RetryAfterExceeded | undefined;
+//# sourceMappingURL=retry-after.d.ts.map

package/dist/api/runtime/rate-limit/retry-after.js

@@ -0,0 +1,81 @@
+/** How long the API tester waits before asking again after a 429 or a 503, and how a server error reads. */
+import { headerValue } from "../headers.js";
+/** Extra attempts after the first 429. The first 429 is never a seed/check failure by itself. */
+export const MAX_429_RETRIES = 5;
+export const RETRY_BACKOFF_INITIAL_MS = 1_000;
+/** The longest backoff the API tester picks itself, when the server names no wait. */
+export const RETRY_BACKOFF_CAP_MS = 30_000;
+/** A 503 that names when to come back is asked again this many times. */
+export const MAX_UNAVAILABLE_RETRIES = 3;
+/** The pause before a read that met a gateway status (502, 503, 504) is asked once more. */
+export const GATEWAY_RETRY_MS = 1_000;
+/** The longest `Retry-After` the API tester waits out unless `network.maxRetryAfterMs` says otherwise. */
+export const DEFAULT_MAX_RETRY_AFTER_MS = 60_000;
+/* Statuses whose `Retry-After` the API tester waits out. */
+const WAITED_STATUSES = /* @__PURE__ */ new Set([429, 503]);
+/**
+ * How a server error reads in a finding. A 503 that still stood after the API tester waited out its
+ * `Retry-After` is the backend being unavailable, told apart from a crash; both are failures.
+ */
+export function describeServerError(exchange) {
+    const { status, retryAfterExceeded } = exchange;
+    if (status === 0)
+        return "did not answer before the request timed out";
+    if (status !== 503 || headerValue(exchange.responseHeaders, "retry-after") === undefined) {
+        return `answered with a server error (${status})`;
+    }
+    return retryAfterExceeded === undefined
+        ? "was unavailable (503) even after waiting out its Retry-After"
+        : `was unavailable (503) and ${describeExceeded(retryAfterExceeded)}`;
+}
+/** An answer's status, and the wait it asked for when the API tester would not wait that long: "429 and asked the API tester to wait 24h, …". */
+export function describeStatus(exchange) {
+    const { status, retryAfterExceeded } = exchange;
+    return retryAfterExceeded === undefined ? String(status) : `${status} and ${describeExceeded(retryAfterExceeded)}`;
+}
+/** "asked the API tester to wait 24h, longer than network.maxRetryAfterMs (60s)": the wait the API tester did not wait out. */
+export function describeExceeded(exceeded) {
+    return `asked the API tester to wait ${formatWait(exceeded.waitMs)}, longer than network.maxRetryAfterMs (${formatWait(exceeded.limitMs)})`;
+}
+/** A wait in whole seconds, rounded up, written in the largest unit that divides it evenly. */
+export function formatWait(ms) {
+    const seconds = Math.ceil(ms / 1000);
+    if (seconds > 0 && seconds % 3600 === 0)
+        return `${seconds / 3600}h`;
+    if (seconds > 0 && seconds % 60 === 0)
+        return `${seconds / 60}m`;
+    return `${seconds}s`;
+}
+/**
+ * `Retry-After` as a wait in ms, as long as the server asked. Delta-seconds or HTTP-date; anything
+ * unparseable is `null` so the caller can fall back to exponential backoff.
+ */
+export function parseRetryAfter(value, now = Date.now()) {
+    if (value === undefined)
+        return null;
+    const trimmed = value.trim();
+    if (trimmed === "")
+        return null;
+    if (/^\d+(?:\.\d+)?$/.test(trimmed))
+        return Math.max(0, Number(trimmed) * 1000);
+    const date = Date.parse(trimmed);
+    if (Number.isNaN(date))
+        return null;
+    return Math.max(0, date - now);
+}
+/** Wait before retry `attempt` (0-based) of a 429. Header wins; otherwise 1s, 2s, 4s… capped. */
+export function retryWaitMs(retryAfterHeader, attempt, now = Date.now()) {
+    const parsed = parseRetryAfter(retryAfterHeader, now);
+    if (parsed !== null)
+        return parsed;
+    const exp = RETRY_BACKOFF_INITIAL_MS * 2 ** Math.max(0, attempt);
+    return Math.min(RETRY_BACKOFF_CAP_MS, exp);
+}
+/** The wait a 429 or a 503 asked for when it is longer than the API tester waits: that answer stands as it is. */
+export function retryAfterVerdict(input, now = Date.now()) {
+    if (!WAITED_STATUSES.has(input.status))
+        return undefined;
+    const waitMs = parseRetryAfter(input.header, now);
+    return waitMs === null || waitMs <= input.limitMs ? undefined : { limitMs: input.limitMs, waitMs };
+}
+//# sourceMappingURL=retry-after.js.map

package/dist/api/runtime/rate-limit/rules.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Rate-limit pacing: keeps the API tester's own traffic under a per-category budget so a documented limit is
+ * respected rather than tripped and reported as a backend defect.
+ *
+ * Two sources compile down to the same shape. `config.rateLimits` is checked first — it is the
+ * operator's belief about *this* environment and wins over a general document claim. `x-rate-limit`
+ * tags fill in anything the config left uncovered. Either way the result is one ordered list of
+ * `{ test, category, rps, source }`: `Client` resolves a request's category by testing it against
+ * this list, never by knowing about operationIds or path templates itself.
+ */
+import type { RateLimitSpec } from "../../config/types/config.ts";
+import type { SpecModel } from "../../spec/graph/types.ts";
+import { type RequestTest } from "./match.ts";
+export interface CompiledRateLimitRule {
+    /** `operationId` is the operation the client stamped on the request, when it resolved one. */
+    test: RequestTest;
+    category: string;
+    rps: number;
+    /** A 429 against a tag-sourced rule is a claim the document made; against config, it is the
+     * operator's own guess about the environment — only the former is ever a finding.
+     * `"implicit"` is the reactive untagged-write bucket: it exists only after a 429, never as a
+     * documented claim. */
+    source: "tag" | "config" | "implicit";
+}
+/**
+ * Builds the ordered rulebook `Client` consults on every request.
+ *
+ * Config rules come first, so they win ties against a tag covering the same route. Tag-derived
+ * rules are grouped by category and given the *minimum* rps any operation in that category
+ * declares — the conservative choice, since exceeding the smallest limit a shared budget names is
+ * what actually produces a 429. A category with no known rate anywhere gets no bucket: this only
+ * ever adds pacing where a rate is knowable, never removes coverage that existed before it.
+ */
+export declare function buildRateLimitRules(model: SpecModel, configured: readonly RateLimitSpec[] | undefined): CompiledRateLimitRule[];
+//# sourceMappingURL=rules.d.ts.map

package/dist/api/runtime/rate-limit/rules.js

@@ -0,0 +1,61 @@
+/**
+ * Rate-limit pacing: keeps the API tester's own traffic under a per-category budget so a documented limit is
+ * respected rather than tripped and reported as a backend defect.
+ *
+ * Two sources compile down to the same shape. `config.rateLimits` is checked first — it is the
+ * operator's belief about *this* environment and wins over a general document claim. `x-rate-limit`
+ * tags fill in anything the config left uncovered. Either way the result is one ordered list of
+ * `{ test, category, rps, source }`: `Client` resolves a request's category by testing it against
+ * this list, never by knowing about operationIds or path templates itself.
+ */
+import { compileMatch, operationTest } from "./match.js";
+function configRules(model, configured) {
+    const rules = [];
+    for (const spec of configured) {
+        for (const compiled of compileMatch(spec.match, model)) {
+            /* `compiled.category` is already the right default per match kind — the category name
+             * for `category:x` (so an override merges into the tag's own bucket), the operationId
+             * or raw pattern otherwise. `spec.category` only needs to override that when a plain
+             * path/operationId rule should join an *existing* tag-declared bucket instead of
+             * getting its own. */
+            rules.push({ category: spec.category ?? compiled.category, rps: spec.rps, source: "config", test: compiled.test });
+        }
+    }
+    return rules;
+}
+/** Tagged operations no config rule already covers, grouped by category with its smallest rate. */
+function tagCategories(model, rules) {
+    const byCategory = new Map();
+    for (const op of model.operations) {
+        if (op.rateLimit === null)
+            continue;
+        if (rules.some((rule) => rule.test(op.method.toUpperCase(), op.path, op.operationId)))
+            continue;
+        const entry = byCategory.get(op.rateLimit.category) ?? { ops: [], rps: null };
+        entry.ops.push(op);
+        if (op.rateLimit.rps !== null)
+            entry.rps = entry.rps === null ? op.rateLimit.rps : Math.min(entry.rps, op.rateLimit.rps);
+        byCategory.set(op.rateLimit.category, entry);
+    }
+    return byCategory;
+}
+/**
+ * Builds the ordered rulebook `Client` consults on every request.
+ *
+ * Config rules come first, so they win ties against a tag covering the same route. Tag-derived
+ * rules are grouped by category and given the *minimum* rps any operation in that category
+ * declares — the conservative choice, since exceeding the smallest limit a shared budget names is
+ * what actually produces a 429. A category with no known rate anywhere gets no bucket: this only
+ * ever adds pacing where a rate is knowable, never removes coverage that existed before it.
+ */
+export function buildRateLimitRules(model, configured) {
+    const rules = configRules(model, configured ?? []);
+    for (const [category, entry] of tagCategories(model, rules)) {
+        if (entry.rps === null)
+            continue;
+        for (const op of entry.ops)
+            rules.push({ category, rps: entry.rps, source: "tag", test: operationTest(op) });
+    }
+    return rules;
+}
+//# sourceMappingURL=rules.js.map

package/dist/api/runtime/root-read.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `x-entity.identity: root` — the path id is the signed-up caller's root.
+ * No list and no create. No token is a 401. The authed read uses that root.
+ */
+import type { Check } from "./checks/core/check.ts";
+import type { Client } from "../client/client.ts";
+import { type FindingCollector, type Outcome } from "./finding.ts";
+import type { CheckId } from "./check-ids.ts";
+import type { EntityModel, SpecModel } from "../spec/graph/types.ts";
+export declare const ROOT_READ_CHECK_ID: Extract<CheckId, "read.matches-caller-root">;
+export declare function rootReadIds(entity: EntityModel): string[];
+export declare function runRootRead(input: {
+    /** The principal it sends as: `as: { principal }`, the operation's security choosing the scheme. */
+    principal: string;
+    client: Client;
+    entity: EntityModel;
+    findings: FindingCollector;
+    model: SpecModel;
+    roots: Record<string, string>;
+}): Promise<Outcome>;
+export declare const rootReadCheck: Check;
+//# sourceMappingURL=root-read.d.ts.map

package/dist/api/runtime/root-read.js

@@ -0,0 +1,78 @@
+/**
+ * `x-entity.identity: root` — the path id is the signed-up caller's root.
+ * No list and no create. No token is a 401. The authed read uses that root.
+ */
+import { ASSERTED } from "./finding.js";
+import { fillPath } from "./fill-path.js";
+import { noSecurityReason } from "./no-security.js";
+export const ROOT_READ_CHECK_ID = "read.matches-caller-root";
+export function rootReadIds(entity) {
+    if (entity.identity !== "root")
+        return [];
+    if (entity.reads !== undefined && entity.reads.length > 0)
+        return entity.reads;
+    return entity.read === undefined ? [] : [entity.read];
+}
+export async function runRootRead(input) {
+    const ids = rootReadIds(input.entity);
+    const findings = input.findings.attributed(ids).ownedBy(ROOT_READ_CHECK_ID);
+    for (const id of ids) {
+        const op = input.model.byOperationId.get(id);
+        if (op === undefined)
+            continue;
+        const undeclared = noSecurityReason(op);
+        if (undeclared !== undefined)
+            return findings.unresolved(ROOT_READ_CHECK_ID, input.entity.name, undeclared);
+        let path;
+        try {
+            path = fillPath(op.path, input.roots);
+        }
+        catch {
+            return findings.unresolved(ROOT_READ_CHECK_ID, input.entity.name, `${op.operationId} needs a path id`);
+        }
+        const query = dateWindow(op.queryParamNames);
+        const anonymous = await input.client.request(op.method, path, {
+            as: { anonymous: true },
+            operationId: op.operationId,
+            probe: true,
+            ...(query === undefined ? {} : { query }),
+        });
+        if (anonymous.status !== 401) {
+            return findings.security(ROOT_READ_CHECK_ID, input.entity.name, {
+                summary: "the parent read answered without a token",
+                detail: `${op.operationId} returned ${anonymous.status} with no credential.`,
+                evidence: [anonymous],
+            });
+        }
+        const read = await input.client.request(op.method, path, {
+            as: { principal: input.principal },
+            operationId: op.operationId,
+            ...(query === undefined ? {} : { query }),
+        });
+        if (read.status !== 200) {
+            return findings.backend(ROOT_READ_CHECK_ID, input.entity.name, {
+                summary: "the parent read failed",
+                detail: `${op.operationId} returned ${read.status} for ${path}.`,
+                evidence: [anonymous, read],
+            });
+        }
+    }
+    return ASSERTED;
+}
+/** `from` is a week before `to` when a read asks for both. */
+function dateWindow(names) {
+    if (!names.includes("from") || !names.includes("to"))
+        return undefined;
+    const to = new Date();
+    const from = new Date(to.getTime() - 7 * 24 * 60 * 60 * 1000);
+    return { from: from.toISOString(), to: to.toISOString() };
+}
+export const rootReadCheck = {
+    id: ROOT_READ_CHECK_ID,
+    needs: "x-entity.identity: root and a read",
+    plan: () => ({ ok: false }),
+    run: () => Promise.resolve(ASSERTED),
+    /* The entity loop calls `runRootRead` and returns. This entry keeps the id registered. */
+    subjects: () => [],
+};
+//# sourceMappingURL=root-read.js.map

package/dist/api/runtime/run/account-hook.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The last way teardown removes an account: `hooks.teardownPrincipal`, handed the account's own
+ * credential as a request would send it now, renewed first, or marked `stale` with why when it
+ * cannot be. Never another principal's credential, which would remove that account instead.
+ */
+import type { AccountEntry } from "../accounts/ledger.ts";
+import type { RunContext } from "./context.ts";
+type Verdict = {
+    status: "removed" | "left";
+    note: string;
+    principal?: string;
+};
+export declare function borrowed(ctx: RunContext, principal: string, sent: ReadonlyArray<{
+    scheme: string;
+    value: string;
+}>): Promise<string | undefined>;
+export declare function hookRemoves(ctx: RunContext, entry: AccountEntry, principal: string | undefined, tried: string[]): Promise<Verdict | undefined>;
+export {};
+//# sourceMappingURL=account-hook.d.ts.map

package/dist/api/runtime/run/account-hook.js

@@ -0,0 +1,67 @@
+/**
+ * The last way teardown removes an account: `hooks.teardownPrincipal`, handed the account's own
+ * credential as a request would send it now, renewed first, or marked `stale` with why when it
+ * cannot be. Never another principal's credential, which would remove that account instead.
+ */
+import { effectiveRecipe } from "../../credentials/effective.js";
+import { recipeKind } from "../../credentials/recipes/acquire.js";
+import { messageOf } from "../../errors/message.js";
+import { accountLabel } from "../accounts/identity.js";
+/*
+ * Why these values `principal` sends are not its own account's, if they are not: one from a static
+ * recipe is the configured principals' own, and one another principal holds too is that principal's.
+ */
+export async function borrowed(ctx, principal, sent) {
+    const entry = ctx.store.principals[principal];
+    for (const { scheme } of sent) {
+        const recipe = effectiveRecipe(ctx.options.security?.[scheme], entry?.security?.[scheme]);
+        if (recipe !== undefined && recipeKind(recipe) === "static") {
+            return `its ${scheme} credential comes from a static recipe, the configured principals' own`;
+        }
+    }
+    const values = new Set(sent.map((one) => one.value));
+    const shared = (await ctx.store.snapshot()).find((one) => one.principal !== principal && values.has(one.credential.value));
+    return shared === undefined ? undefined : `its credential is ${shared.principal}'s`;
+}
+/*
+ * The held credential as a request would send it now: teardown comes long after sign-up, when a
+ * short-lived token has lapsed, so it is renewed first. One that cannot be renewed is handed as held,
+ * with why, so a hook that then fails says the credential it was handed was stale.
+ */
+async function liveCredential(ctx, held) {
+    const { principal, scheme, scopes } = held;
+    const renewed = await ctx.store.acquire({ principal, scheme, scopes });
+    return "blocked" in renewed ? { credential: held.credential, renewal: renewed.blocked } : { credential: renewed };
+}
+export async function hookRemoves(ctx, entry, principal, tried) {
+    const teardown = ctx.hooks.teardownPrincipal;
+    if (teardown === undefined)
+        return undefined;
+    const address = accountLabel(entry.identity);
+    const held = (await ctx.store.snapshot()).find((one) => principal !== undefined && one.principal === principal);
+    if (address === undefined || principal === undefined || held === undefined) {
+        tried.push(`hooks.teardownPrincipal needs ${address === undefined ? "an address to name it by" : "a credential the run holds for it"}`);
+        return undefined;
+    }
+    const { credential, renewal } = await liveCredential(ctx, held);
+    /* A hook handed another principal's credential as this account's would remove that account. */
+    const why = await borrowed(ctx, principal, [{ scheme: held.scheme, value: credential.value }]);
+    if (why !== undefined) {
+        tried.push(`hooks.teardownPrincipal was not called: ${why}, and it is handed the account's own credential`);
+        return undefined;
+    }
+    try {
+        await teardown(address, {
+            credential: credential.value,
+            sends: credential.sends,
+            ...(renewal === undefined ? {} : { stale: renewal }),
+        });
+        return { note: "removed by hooks.teardownPrincipal", principal, status: "removed" };
+    }
+    catch (error) {
+        const stale = renewal === undefined ? "" : `, handed the credential it holds because renewing it was blocked: ${renewal}`;
+        tried.push(`hooks.teardownPrincipal threw: ${messageOf(error)}${stale}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=account-hook.js.map

package/dist/api/runtime/run/accounts.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Removes every account the run made, and lists by name each one it could not.
+ *
+ * In this order, each tried only when the one before could not: the document's delete-self, sent
+ * as the account itself; the delete of the entity its sign-up creates, by its id, as the configured
+ * principals strongest first; `hooks.teardownPrincipal`. What is left is a leftover, named by the
+ * email or username it was made with, so a person can remove it. An account whose name a
+ * configured principal holds, that this run did not make, is never removed: it is not the API tester's.
+ */
+import type { OperationModel } from "../../spec/graph/types.ts";
+import { type AccountEntry } from "../accounts/ledger.ts";
+import type { TeardownReport } from "../teardown/types.ts";
+import type { RunContext } from "./context.ts";
+export declare function teardownAccounts(ctx: RunContext): Promise<void>;
+export declare function labelOf(entry: AccountEntry): string;
+/** Each account the run made as its report lists it: removed, or a leftover named so a person can find it. */
+export declare function accountReport(entries: readonly AccountEntry[]): TeardownReport;
+export declare function borrowedFor(ctx: RunContext, principal: string, op: OperationModel): Promise<string | undefined>;
+export declare function holder(ctx: RunContext, entry: AccountEntry): string | undefined;
+export declare function configuredNotMade(ctx: RunContext, id: string): boolean;
+export declare function signIn(ctx: RunContext, entry: AccountEntry): Promise<string | undefined>;
+//# sourceMappingURL=accounts.d.ts.map