cursedbelt 2.7.0 → 3.0.0

package/dist/verify/fixtures/index.js

@@ -1,789 +0,0 @@
-/**
- * The golden fixture corpus (04 §4).
- *
- * Each fixture is a real `app-config.json` on disk plus an expected-diagnostics
- * JSON. Strictness cuts both ways: a PASS fixture asserts zero errors AND its
- * exact set of warnings/infos — an extra diagnostic fails CI just as loudly as a
- * missing one, because "we got used to that warning" is how gates die.
- *
- * Inputs that are code rather than config — capability profiles, source
- * manifests, storage contracts, code-shape declarations, and the engine-catalog
- * patches that model a mis-declared engine — live here in TypeScript so they are
- * typechecked with everything else.
- */
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { z } from 'zod';
-import { CC_PRAGMAS } from 'cwip/sqlite';
-import { baseRegistry, ENGINE_CATALOG } from '../engines';
-export const FIXTURES_DIR = new URL('.', import.meta.url).pathname;
-export const fixtureConfig = (name) => JSON.parse(readFileSync(join(FIXTURES_DIR, name, 'app-config.json'), 'utf8'));
-export const fixtureExpectations = (name) => JSON.parse(readFileSync(join(FIXTURES_DIR, name, 'expected.json'), 'utf8'));
-/* ------------------------------------------------------------ capabilities */
-const FULL_CAPABILITIES = {
-    ffmpeg: true,
-    wasm: true,
-    shell: true,
-    git: true,
-    aiProvider: true,
-    diskIndex: true,
-    network: true,
-    ocrRuntime: true,
-};
-const NO_FFMPEG = { ...FULL_CAPABILITIES, ffmpeg: false };
-/* ----------------------------------------------------------------- sources */
-const VAULT_SOURCE = {
-    id: 'vault-media',
-    token: 'media:videos',
-    exportable: true,
-    itemCount: 3,
-    description: 'Encrypted media vault bridged into a MediaSource (01 §2.2).',
-};
-const VAULT_SOURCE_12 = { ...VAULT_SOURCE, itemCount: 12 };
-const DEMO_SOURCE = {
-    id: 'demo-videos',
-    token: 'media:videos',
-    exportable: false,
-    itemCount: 2,
-    description: 'Studio demo data — never present in a generated app.',
-};
-const SHEET_SOURCE = {
-    id: 'sheet-import',
-    token: 'knowledge:records',
-    exportable: true,
-    format: 'external',
-    description: 'Spreadsheet import — external format, marshaller-gated.',
-};
-/* ------------------------------------------------- engine catalog patches */
-/** Rebuild the catalog with one engine's ports transformed — models a mis-declared engine. */
-function patchEnginePorts(engineId, transform) {
-    return ENGINE_CATALOG.map((engine) => engine.id === engineId ? { ...engine, ports: engine.ports.map(transform) } : engine);
-}
-function patchPort(engineId, portId, patch) {
-    return patchEnginePorts(engineId, (port) => (port.id === portId ? patch(port) : port));
-}
-/** An asset engine whose edited-out port forgot `emission: 'versioned'` (R-5). */
-const CATALOG_UNVERSIONED_EDITOR = patchPort('asset', 'edited-out', ({ emission: _dropped, ...rest }) => rest);
-/** A fan-in producer with no scopes and a consumer with no scope filter. */
-const CATALOG_UNSCOPED_FANIN = patchPort('knowledge', 'refresh-in', ({ scopeFilter: _dropped, ...rest }) => rest).map((engine) => engine.id === 'asset'
-    ? { ...engine, ports: engine.ports.map((p) => (p.id === 'refresh-out' ? { ...p, scopes: [] } : p)) }
-    : engine);
-/** Cross-repo version skew: the producer holds its own copy of `media:videos`. */
-const skewedVideosToken = (schema, sample) => ({
-    id: 'media:videos',
-    mode: 'value',
-    subtypeOf: 'media:items',
-    description: 'Producer-side copy of media:videos from an older/newer repo.',
-    schema,
-    sample,
-});
-const EXTENDED_VIDEOS = skewedVideosToken(z.object({
-    items: z.array(z.object({
-        id: z.string(),
-        kind: z.enum(['video', 'photo', 'file', 'audio']),
-        streamUrl: z.string().optional(),
-        hlsUrl: z.string().optional(),
-        hasHls: z.boolean().optional(),
-        caption: z.string().optional(), // the backward-compatible addition
-    })),
-}), { items: [{ id: 'vid_1', kind: 'video' }] });
-const DRIFTED_VIDEOS = skewedVideosToken(z.object({ items: z.array(z.object({ id: z.string() })) }), // dropped every playback field
-{ items: [{ id: 'vid_1' }] });
-const CATALOG_SCHEMA_EXTENDED = patchPort('asset', 'videos-out', (port) => ({ ...port, token: EXTENDED_VIDEOS }));
-const CATALOG_SCHEMA_DRIFT = patchPort('asset', 'videos-out', (port) => ({ ...port, token: DRIFTED_VIDEOS }));
-/** A dev engine whose dbAdmin op forgot its `infra:write` claim (J2-2). */
-const CATALOG_UNCLAIMED_PRIVILEGE = ENGINE_CATALOG.map((engine) => engine.id === 'dev'
-    ? { ...engine, ops: engine.ops.map((op) => (op.id === 'db-export' ? { id: op.id, requiredFeature: op.requiredFeature } : op)) }
-    : engine);
-/**
- * A system engine still exposing the deprecated `nes:rom-url` token — the NES toy
- * was pruned (02 §1.6), but external consumers of the token may still exist, so
- * removal goes through the deprecation flow and the compiler only warns.
- */
-const CATALOG_DEPRECATED_TOKEN = ENGINE_CATALOG.map((engine) => engine.id === 'system'
-    ? {
-        ...engine,
-        ports: [
-            ...engine.ports,
-            {
-                id: 'rom-out',
-                token: baseRegistry().get('nes:rom-url'),
-                direction: 'out',
-                required: false,
-                emission: 'versioned',
-                stormBudgetPerWindow: 200,
-            },
-        ],
-    }
-    : engine);
-/* -------------------------------------------------------- storage contract */
-const VALID_STORAGE = {
-    tables: [
-        {
-            name: 'k_items',
-            database: 'knowledge.db',
-            userScoped: true,
-            columns: [
-                { name: 'id', type: 'TEXT', notNull: true },
-                { name: 'tenant_id', type: 'TEXT', notNull: true },
-                { name: 'user_id', type: 'TEXT', notNull: true },
-                { name: 'kind', type: 'TEXT', notNull: true },
-            ],
-            declaredQueries: [{ columns: ['tenant_id', 'kind'] }],
-            indexes: [{ name: 'idx_k_items_tenant_kind', columns: ['tenant_id', 'kind'] }],
-            rlsPolicy: 'tenant_isolation',
-        },
-        {
-            name: 'secrets',
-            database: 'cc-registry.db',
-            columns: [
-                { name: 'app_id', type: 'TEXT', notNull: true },
-                { name: 'key', type: 'TEXT', notNull: true },
-                { name: 'envelope', type: 'BLOB', notNull: true },
-                { name: 'row_signature', type: 'BLOB', notNull: true },
-            ],
-            rowSignature: true,
-            rlsPolicy: 'app_isolation',
-        },
-        {
-            name: 'ports',
-            database: 'cc-registry.db',
-            columns: [
-                { name: 'port', type: 'INTEGER', notNull: true },
-                { name: 'app_id', type: 'TEXT', notNull: true },
-                { name: 'row_signature', type: 'BLOB', notNull: true },
-            ],
-            rowSignature: true,
-            rlsPolicy: 'app_isolation',
-        },
-        {
-            name: 'meter_events',
-            database: 'billing.db',
-            columns: [
-                { name: 'event_uuid', type: 'TEXT', notNull: true },
-                { name: 'tenant_id', type: 'TEXT', notNull: true },
-                { name: 'row_signature', type: 'BLOB', notNull: true },
-            ],
-            rowSignature: true,
-            rlsPolicy: 'tenant_isolation',
-        },
-    ],
-    migrations: [
-        { id: 'knowledge/0001_spine_and_satellites', targetDatabase: 'knowledge.db', ddl: true, issuedBy: 'app' },
-        { id: 'registry/0001_initial', targetDatabase: 'cc-registry.db', ddl: true, issuedBy: 'station' },
-    ],
-    pragmas: { ...CC_PRAGMAS },
-    transactionLifetimeGuardMs: 15_000,
-    portAllocation: 'socket-probed-insert-unique-retry',
-    keyMaterial: 'binary-buffer',
-    envelopeAad: ['app_id', 'key'],
-    backup: 'vacuum-into',
-    telemetry: { meterEventsSpillPath: true, apiCallsAwaitedOnRequestPath: false },
-    saasConnectionPool: 'single-shared-capped',
-};
-const storage = (patch) => ({ ...VALID_STORAGE, ...patch });
-/* ----------------------------------------------------------- marshallers */
-const RECORDS_MARSHALLER = {
-    id: 'sheet-rows',
-    tokenId: 'knowledge:records',
-    maxPayloadBytes: 2 * 1024 * 1024,
-    // Above the 512KB main-thread limit, so V3 requires a real offload entry.
-    workerEntry: './sheetRowsMarshalWorker.ts',
-    validate: (inbound) => typeof inbound === 'object' && inbound !== null,
-    transform: (inbound) => inbound,
-    targetZodSchema: z.object({ rows: z.array(z.record(z.string(), z.unknown())) }),
-};
-const UNBOUNDED_MARSHALLER = {
-    ...RECORDS_MARSHALLER,
-    id: 'sheet-rows-unbounded',
-    maxPayloadBytes: 0,
-    workerEntry: undefined,
-};
-/**
- * A marshaller with a perfectly good 2MB ceiling and NOWHERE to offload to —
- * the case the derived offload gate exists for (05 §B1). It is deliberately not
- * folded into `marshaller-unbounded`: that fixture's ceiling is 0, so it can
- * never reach the main-thread limit and the offload law does not apply to it.
- * One fixture, one law.
- */
-const NO_WORKER_MARSHALLER = {
-    ...RECORDS_MARSHALLER,
-    id: 'sheet-rows-no-worker',
-    workerEntry: undefined,
-};
-/* ------------------------------------------------------- staging fixtures */
-const stagingRoot = (name) => join(FIXTURES_DIR, name);
-/**
- * A reader that fails twice with a lock error before succeeding — the simulated
- * watcher-mid-write the retry guard exists for (J4-A).
- */
-export function lockedThenReadable(realRead = async (p) => readFileSync(p, 'utf8')) {
-    const attempts = new Map();
-    return async (path) => {
-        const seen = (attempts.get(path) ?? 0) + 1;
-        attempts.set(path, seen);
-        if (seen <= 2)
-            throw Object.assign(new Error(`EBUSY: resource busy or locked, read '${path}'`), { code: 'EBUSY' });
-        return realRead(path);
-    };
-}
-/* ------------------------------- event handler graphs (03 §6.4) ---------- */
-const DEPTH_BOMB_HANDLERS = [
-    { id: 'organizer', subscribes: 'NOTE_SAVED', emits: ['NOTE_INDEXED'] },
-    { id: 'indexer', subscribes: 'NOTE_INDEXED', emits: ['SEARCH_DIRTY'] },
-    { id: 'search', subscribes: 'SEARCH_DIRTY', emits: ['DASHBOARD_DIRTY'] },
-    { id: 'dashboard', subscribes: 'DASHBOARD_DIRTY', emits: ['WIDGET_REFRESH'] },
-    { id: 'widget', subscribes: 'WIDGET_REFRESH', emits: ['NOTE_TOUCHED'] },
-    { id: 'audit-interceptor', subscribes: 'NOTE_TOUCHED', emits: ['NOTE_SAVED'] },
-];
-const GUARDED_HANDLERS = DEPTH_BOMB_HANDLERS.map((handler) => handler.id === 'audit-interceptor' ? { ...handler, depthGuarded: true } : handler);
-/* ------------------------------------------------------------- the corpus */
-export const FIXTURES = [
-    /* ---------------------------- §4.1 core corpus --------------------------- */
-    {
-        name: 'av-baseline',
-        stages: 'V0–V6',
-        summary: 'video+hls on, wired media:videos from the vault source',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [VAULT_SOURCE],
-    },
-    {
-        name: 'av-hls-off-inbound-videos',
-        stages: 'V2',
-        summary: 'hls:false with inbound items carrying hlsUrl — declared progressive degradation',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [VAULT_SOURCE_12],
-    },
-    {
-        name: 'av-video-off-wired',
-        stages: 'V2',
-        summary: 'video:false with the same wire — the fail-closed law',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [VAULT_SOURCE],
-    },
-    {
-        name: 'av-hls-on-no-ffmpeg',
-        stages: 'V2',
-        summary: 'hls requested, host probe reports no ffmpeg',
-        moment: 'ci',
-        capabilities: NO_FFMPEG,
-        sources: [VAULT_SOURCE],
-    },
-    {
-        name: 'av-export-target-branch',
-        stages: 'V2',
-        summary: 'export from a no-ffmpeg CI host for an ffmpeg-capable target (J4-B)',
-        moment: 'export',
-        capabilities: NO_FFMPEG,
-        sources: [VAULT_SOURCE],
-    },
-    {
-        name: 'av-export-target-unspecified',
-        stages: 'V2',
-        summary: 'export with an empty deployTarget — optimistic-declared with a visible warning',
-        moment: 'export',
-        capabilities: NO_FFMPEG,
-        sources: [VAULT_SOURCE],
-    },
-    {
-        name: 'av-two-instances-divergent',
-        stages: 'V2',
-        summary: 'gallery (hls on) + editor (hls off) — per-instance effective features (C28)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'av-cycle-editor',
-        stages: 'V4',
-        summary: 'gallery↔editor cycle, declared cyclic, versioned emissions',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'av-cycle-unmarked',
-        stages: 'V4',
-        summary: 'the same loop without cyclic:true',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'av-cycle-unversioned',
-        stages: 'V4',
-        summary: 'declared cycle whose producer emits unversioned payloads',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_UNVERSIONED_EDITOR,
-    },
-    {
-        name: 'av-cycle-editor-off',
-        stages: 'V2,V4',
-        summary: 'declared cycle broken by turning the editor feature off',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'refresh-scoped-fanin',
-        stages: 'V4',
-        summary: 'three producers into one signal:refresh input, all scoped',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'refresh-unscoped-fanin',
-        stages: 'V4',
-        summary: 'the same fan-in with an unscoped producer and no consumer scope filter',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_UNSCOPED_FANIN,
-    },
-    {
-        name: 'eventbus-depth-bomb',
-        stages: 'V4',
-        summary: 'six-deep NOTE_SAVED → … → NOTE_SAVED handler chain through a hook interceptor',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: { eventHandlers: DEPTH_BOMB_HANDLERS },
-    },
-    {
-        name: 'eventbus-depth-guarded',
-        stages: 'V4',
-        summary: 'the same chain with a depth-guarded terminating handler',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: { eventHandlers: GUARDED_HANDLERS },
-    },
-    {
-        name: 'staging-token-extension',
-        stages: 'V0,V3',
-        summary: 'plugin-habits wiring x-habits:mark ⊑ signal:refresh',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        stagingRoot: stagingRoot('staging-habits'),
-    },
-    {
-        name: 'staging-token-extension-locked',
-        stages: 'V0',
-        summary: 'the same harvest while a watcher holds the file locked (J4-A)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        stagingRoot: stagingRoot('staging-habits'),
-        readStagingFile: lockedThenReadable(),
-    },
-    {
-        name: 'staging-token-collision',
-        stages: 'V3',
-        summary: 'a staging extension redeclaring media:videos',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        stagingRoot: stagingRoot('staging-collision'),
-    },
-    {
-        name: 'staging-export-leak',
-        stages: 'V5',
-        summary: 'an exported app still reaching x-habits:mark',
-        moment: 'export',
-        capabilities: FULL_CAPABILITIES,
-        stagingRoot: stagingRoot('staging-habits'),
-    },
-    {
-        name: 'token-schema-extended',
-        stages: 'V3',
-        summary: "producer schema is the consumer's shape plus one optional field (J4-D)",
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_SCHEMA_EXTENDED,
-    },
-    {
-        name: 'token-schema-drift',
-        stages: 'V3',
-        summary: 'producer and consumer disagree about the same token id',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_SCHEMA_DRIFT,
-    },
-    {
-        name: 'demo-source-studio',
-        stages: 'V5',
-        summary: 'a design wired to a non-exportable demo source, at studio',
-        moment: 'studio',
-        capabilities: FULL_CAPABILITIES,
-        sources: [DEMO_SOURCE],
-    },
-    {
-        name: 'demo-source-export',
-        stages: 'V5',
-        summary: 'the same design at export',
-        moment: 'export',
-        capabilities: FULL_CAPABILITIES,
-        sources: [DEMO_SOURCE],
-    },
-    {
-        name: 'unknown-key',
-        stages: 'V0',
-        summary: "an 'alowVideoHLS' typo inside a per-engine features block",
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'config-version-unknown',
-        stages: 'V0',
-        summary: 'a config version this compiler does not understand',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'cross-engine-private-media',
-        stages: 'V0',
-        summary: 'privateMedia:true with no guard engine (J2-1)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'cross-engine-oral-history',
-        stages: 'V0',
-        summary: 'oralHistory:true with no asset engine',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'cross-engine-saas-rbac',
-        stages: 'V0',
-        summary: 'saas profile without features.rbac on the guard instance',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'legacy-design-ids',
-        stages: 'V1',
-        summary: "a saved design still referencing 'video-gallery'",
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'route-collision',
-        stages: 'V1',
-        summary: 'two instances declaring /chat/:conversationId',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'deep-link-ambiguous',
-        stages: 'V1',
-        summary: 'two instances claiming the same deep-link entity',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'editor-unwired',
-        stages: 'V2',
-        summary: 'an editor instance whose required input port has no wire',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'infra-privilege-gate',
-        stages: 'V2',
-        summary: 'dbAdmin + configEditor enabled with their infra:write claims declared (J2-2)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'infra-privilege-unclaimed',
-        stages: 'V2',
-        summary: 'the same features with a mixin block that forgot the permission',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_UNCLAIMED_PRIVILEGE,
-    },
-    {
-        name: 'storage-contract',
-        stages: 'V6',
-        summary: 'spine table without tenant_id, telemetry in the registry, live-DB tar backup',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({
-            tables: [
-                {
-                    name: 'k_items',
-                    database: 'knowledge.db',
-                    columns: [
-                        { name: 'id', type: 'TEXT', notNull: true },
-                        { name: 'kind', type: 'TEXT', notNull: true },
-                    ],
-                },
-                {
-                    name: 'meter_events',
-                    database: 'cc-registry.db',
-                    columns: [
-                        { name: 'event_uuid', type: 'TEXT', notNull: true },
-                        { name: 'tenant_id', type: 'TEXT', notNull: true },
-                    ],
-                    rowSignature: true,
-                },
-            ],
-            backup: 'live-db-tar',
-        }),
-    },
-    {
-        name: 'storage-row-integrity',
-        stages: 'V6',
-        summary: 'a secrets table with no row-signature path',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({
-            tables: VALID_STORAGE.tables.map((table) => (table.name === 'secrets' ? { ...table, rowSignature: false } : table)),
-        }),
-    },
-    {
-        name: 'guard-legacy-vault',
-        stages: 'V6',
-        summary: 'a surviving Vault-era table and a plaintext secret column',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({
-            legacyVaultTables: ['vault_entries'],
-            tables: VALID_STORAGE.tables.map((table) => table.name === 'k_items' ? { ...table, plaintextSecretColumns: ['api_token'] } : table),
-        }),
-    },
-    {
-        name: 'config-drift',
-        stages: 'V6',
-        summary: 'registry, generated .env and deploy.env disagree about the port (01 §3.2)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: VALID_STORAGE,
-        provenance: { registryPort: 4801, envPort: 4801, deployEnvPort: 4900, manifestDefaultPort: 4700 },
-    },
-    {
-        name: 'registry-port-toctou',
-        stages: 'V6',
-        summary: 'port allocation that reads then writes (J4-C)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({ portAllocation: 'read-then-write' }),
-    },
-    {
-        name: 'promotion-offline-lock',
-        stages: 'V6',
-        summary: 'a promotion attempted while a registered app holds the DB open (J1-C)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({ promotionAgainstLiveDb: true }),
-    },
-    /* ------------------ §4.2 extended edge-case optimization ----------------- */
-    {
-        name: 'layout-resize-observer',
-        stages: 'V5',
-        summary: 'a virtualized grid outside CCResizeBoundary (J5-1)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: { virtualizedWithoutBoundary: [{ instanceId: 'gallery', view: 'video-feed' }] },
-    },
-    {
-        name: 'storage-wal-checkpoint',
-        stages: 'V6',
-        summary: 'no Maximum Transaction Lifetime Guard, so a long read can starve checkpoints',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({ transactionLifetimeGuardMs: undefined }),
-    },
-    {
-        name: 'saas-connection-pooling',
-        stages: 'V6',
-        summary: 'saas profile opening a connection per request (J5-4)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({ saasConnectionPool: 'per-request' }),
-    },
-    {
-        name: 'saas-rls-policy-missing',
-        stages: 'V6',
-        summary: 'saas profile declaring a domain table that has no Postgres chain entry (03 §3)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({
-            tables: [
-                ...VALID_STORAGE.tables,
-                {
-                    // `search_docs` is real, tenant-rooted, and deliberately has NO pg twin
-                    // (its FTS5/vector tier is a provider swap, not a dialect variant). A
-                    // saas app that declares it is declaring a table its database will not
-                    // have — and the old declarative check passed it on the strength of an
-                    // `rlsPolicy` string.
-                    name: 'search_docs',
-                    database: 'search.db',
-                    columns: [
-                        { name: 'id', type: 'INTEGER', notNull: true },
-                        { name: 'tenant_id', type: 'TEXT', notNull: true },
-                    ],
-                    rlsPolicy: 'tenant_isolation',
-                },
-            ],
-        }),
-    },
-    {
-        name: 'meter-spill-durability',
-        stages: 'V6',
-        summary: 'a meter_events writer with no durable spill path (J1-B)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        storage: storage({ telemetry: { meterEventsSpillPath: false, apiCallsAwaitedOnRequestPath: true } }),
-    },
-    /* ------------------- §4.3 advanced hardening fixtures -------------------- */
-    {
-        name: 'ai-prompt-injection-guard',
-        stages: 'V3',
-        summary: 'internal automation calling unstructured completion (H-1)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: {
-            unstructuredInternalCompletions: [
-                { site: 'knowledge/aiOrganizer.ts:organizeNotes', note: 'note bodies are user content' },
-            ],
-        },
-    },
-    {
-        name: 'execution-sandbox-jail',
-        stages: 'V4',
-        summary: 'raw argv exec call sites and an exec reference outside the dev mixin (H-2, J3-4)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: {
-            rawArgvExecSites: [{ site: 'dev/pipelines.ts:runStep' }],
-            execOutsideDevMixin: [{ site: 'knowledge/importer.ts:convert' }],
-        },
-    },
-    {
-        name: 'css-isolation-missing',
-        stages: 'V5',
-        summary: "a global stylesheet import under cssIsolation:'none' (J2-4)",
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        code: { globalStylesheetImports: [{ instanceId: 'gallery', site: 'asset/editor/vendor.css' }] },
-    },
-    {
-        name: 'marshaller-missing',
-        stages: 'V3',
-        summary: 'external-format payloads entering a token with no registered marshaller',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [SHEET_SOURCE],
-    },
-    {
-        name: 'marshaller-unbounded',
-        stages: 'V3',
-        summary: 'a marshaller with no payload ceiling',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [SHEET_SOURCE],
-        marshallers: [UNBOUNDED_MARSHALLER],
-    },
-    {
-        name: 'marshaller-worker-offload-missing',
-        stages: 'V3',
-        summary: 'a marshaller that can exceed the main-thread limit but declares no worker entry',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [SHEET_SOURCE],
-        marshallers: [NO_WORKER_MARSHALLER],
-    },
-    {
-        name: 'marshaller-ok',
-        stages: 'V3',
-        summary: 'a bounded marshaller with a real worker entry on the same wire',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        sources: [SHEET_SOURCE],
-        marshallers: [RECORDS_MARSHALLER],
-    },
-    {
-        name: 'token-deprecated',
-        stages: 'V3',
-        summary: 'a port still using the deprecated nes:rom-url token',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-        engines: CATALOG_DEPRECATED_TOKEN,
-    },
-    /* ---------------------- 05 §B5: the fixture backlog --------------------- */
-    //
-    // The corpus doctrine for these: the CONFIG half lands here as
-    // `app-config.json` + `expected.json`; any RUNTIME half lives in the paired V7
-    // probe, because a diagnostic the pipeline cannot produce cannot be pinned by
-    // a config. Six of the seven therefore expect a CLEAN compile — which is not a
-    // vacuous assertion: `corpus.spec.ts` also requires `ok === true` AND a
-    // non-null manifest, so each pins that the surface its probe exercises still
-    // COMPILES. `probes.spec.ts` then drives the paired probe against this very
-    // manifest, so none of them is decorative.
-    //
-    // `registry-port-race` from the spec's list is NOT added: it is the same
-    // scenario as the landed `registry-port-toctou`, whose name is the more
-    // precise one (a read-then-write port allocation is a TOCTOU by definition).
-    // Adding a second fixture for one diagnostic would be duplication dressed as
-    // coverage — the name is reconciled here rather than in a new directory.
-    {
-        name: 'rbac-viewer-403',
-        stages: 'V2 (+V7.3)',
-        summary: 'saas + rbac: the surface on which a VIEWER mutation must be a typed 403',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'lifecycle-abort',
-        stages: 'V1 (+V7.7)',
-        summary: 'a routed view: no state may be applied after its lifecycle aborts',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'deep-link-fallback',
-        stages: 'V1',
-        summary: 'a deep link whose entity token nothing produces — there is no route to fall back to',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'deep-link-cross-tenant',
-        stages: 'V1 (+V7.4b)',
-        summary: 'saas + a resolvable deep link: another tenant’s id must not resolve (J3-2)',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'mixin-surface-lock',
-        stages: 'V2 (+V7.1)',
-        summary: 'a STRICT one-engine subset — no other engine’s mixin may contribute a route',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'sse-jitter-reconnect',
-        stages: 'V1 (+V7.11)',
-        summary: 'a streamed surface: reconnecting clients must spread, not stampede',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-    {
-        name: 'security-csp-headers',
-        stages: 'V2 (+V7.10)',
-        summary: 'two engines compiling a connect-src allowlist the pinned CSP carries',
-        moment: 'ci',
-        capabilities: FULL_CAPABILITIES,
-    },
-];
-export const fixtureByName = (name) => FIXTURES.find((f) => f.name === name);
-/** Compare an actual diagnostic against one expectation — declared fields only. */
-export function matchesExpectation(actual, expected) {
-    if (actual.code !== expected.code || actual.severity !== expected.severity)
-        return false;
-    if (expected.instanceId !== undefined && actual.instanceId !== expected.instanceId)
-        return false;
-    if (expected.port !== undefined && actual.port !== expected.port)
-        return false;
-    if (expected.path !== undefined && actual.path !== expected.path)
-        return false;
-    return true;
-}
-//# sourceMappingURL=index.js.map