json-rest-api 1.0.21 → 1.0.22

package/audit/evidence/external/standard-rfc-snippets.txt

@@ -0,0 +1,168 @@
+# RFC9110 + RFC5789 key clauses (captured)
+captured_at=2026-03-01T16:01:55Z
+
+## RFC9110
+source=https://www.rfc-editor.org/rfc/rfc9110
+279:       15.5.1.  400 Bad Request
+282:       15.5.4.  403 Forbidden
+283:       15.5.5.  404 Not Found
+288:       15.5.10. 409 Conflict
+289:       15.5.11. 410 Gone
+290:       15.5.12. 411 Length Required
+291:       15.5.13. 412 Precondition Failed
+292:       15.5.14. 413 Content Too Large
+293:       15.5.15. 414 URI Too Long
+294:       15.5.16. 415 Unsupported Media Type
+295:       15.5.17. 416 Range Not Satisfiable
+296:       15.5.18. 417 Expectation Failed
+297:       15.5.19. 418 (Unused)
+386:   interface, extensible semantics, and self-descriptive messages to
+444:   All three major versions of HTTP rely on the semantics defined by
+450:   This revision of HTTP separates the definition of semantics (this
+453:   independently while referring to the same core semantics.
+466:   semantics in relation to the identified target resource, and responds
+469:   out, determining what to do next based on the status codes and
+472:   HTTP semantics include the intentions defined by each request method
+473:   (Section 9), extensions to those semantics that might be described in
+474:   request header fields, status codes that describe the response
+581:   the semantics of protocol elements sent.  For example, a client that
+631:   the semantics defined for it by this specification, including
+634:   implements what is implied by those semantics.  For example, an
+642:   specific error handling mechanisms except when they have a direct
+644:   require different error handling strategies.  For example, a Web
+647:   systems control client might consider any form of error recovery to
+662:   While HTTP's core semantics don't change between protocol versions,
+678:   semantics or implying additional capabilities of the sender.
+706:   request semantics, which is made possible by vesting the request
+707:   semantics in the request method (Section 9) and a few request-
+709:   manner inconsistent with the semantics of the method of the request.
+710:   For example, though the URI of a resource might imply semantics that
+769:   message's semantics can be understood in isolation, and that the
+800:   "response" messages, each including a status code (Section 15).  The
+803:   interpreted in accordance with the status code, and trailer fields to
+830:   reporting of errors to the user, it is acceptable for such reporting
+831:   to only be observable in an error console or log file.  Likewise,
+943:   mistakenly violating HTTP semantics.
+1217:   its presence as an error; it is likely being used to obscure the
+1272:   the semantics that users will associate with a URI, and the
+1273:   usefulness of those semantics is what ultimately transforms these
+1426:   error.  Automated clients MUST log the error to an appropriate audit
+1428:   certificate error).  Automated clients MAY provide a configuration
+1462:   semantics defined by that name.  For example, the Date header field
+1481:   their defined semantics allow them to be safely ignored by recipients
+1519:   the semantics of the message, by appending each subsequent field line
+1566:   specific field's semantics.
+1570:   appropriate 4xx (Client Error) status code.  Ignoring such header
+1575:   than the client wishes to process if the field semantics are such
+1577:   message framing or response semantics.
+1629:   detecting such errors improves interoperability.  Fields that expect
+1762:   OWS and RWS have the same semantics as a single SP.  Any content
+1771:   BWS has no semantics.  Any content known to be defined as BWS MAY be
+1824:   might not be case-sensitive, depending on the semantics of the
+1919:   semantics of day-name, day, month, year, and time-of-day are the same
+1944:   common structure, and capacity for conveying semantics.  This
+1975:   semantics, and trailer fields provide optional metadata that was
+2016:   level error indicates that it is not complete.
+2023:   Response message control data includes a status code (Section 15),
+2051:   from the response status code or header fields (e.g., Server) that
+2078:   semantics, describe the sender, define the content, or provide
+2110:   semantics (Section 9).
+2119:   method, response status code (Section 15), and response fields
+2123:   date (Section 6.6.1), whereas the content of the same status code in
+2132:   Response messages with an error status code usually contain content
+2133:   that represents the error condition, such that the content describes
+2134:   the error state and what steps are suggested for resolving it.
+2178:   1.  If the request method is HEAD or the response status code is 204
+2182:   2.  If the request method is GET and the response status code is 200
+2186:   3.  If the request method is GET and the response status code is 203
+2191:   4.  If the request method is GET and the response status code is 206
+2218:   fields in the header section to avoid contradicting message semantics
+2276:   name have the equivalent semantics as appending the multiple values
+2296:   message was originated, having the same semantics as the Origination
+2450:   semantics and, if so, where that request is to be directed.
+2494:   client to a different resource, respond with an error, or drop the
+2517:   The 421 (Misdirected Request) status code in a response indicates
+2528:   All responses, regardless of the status code (including interim
+
+## RFC5789
+source=https://www.rfc-editor.org/rfc/rfc5789.txt
+13:                         PATCH Method for HTTP
+20:   This proposal adds a new HTTP method, PATCH, to modify an existing
+60:RFC 5789                       HTTP PATCH                     March 2010
+66:   2. The PATCH Method ................................................2
+67:      2.1. A Simple PATCH Example .....................................4
+82:   This specification defines the new HTTP/1.1 [RFC2616] method, PATCH,
+83:   which is used to apply partial modifications to a resource.
+86:   errors.  The PUT method is already defined to overwrite a resource
+91:   discover patch format support).  PATCH was mentioned in earlier HTTP
+94:   In this document, the key words "MUST", "MUST NOT", "REQUIRED",
+95:   "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
+101:2.  The PATCH Method
+103:   The PATCH method requests that a set of changes described in the
+116:RFC 5789                       HTTP PATCH                     March 2010
+119:   The difference between the PUT and PATCH requests is reflected in the
+124:   be replaced.  With PATCH, however, the enclosed entity contains a set
+126:   origin server should be modified to produce a new version.  The PATCH
+130:   PATCH.
+132:   PATCH is neither safe nor idempotent as defined by [RFC2616], Section
+135:   A PATCH request can be issued in such a way as to be idempotent,
+137:   PATCH requests on the same resource in a similar time frame.
+138:   Collisions from multiple PATCH requests may be more dangerous than
+141:   using this kind of patch application SHOULD use a conditional request
+144:   can use a strong ETag [RFC2616] in an If-Match header on the PATCH
+152:   The server MUST apply the entire set of changes atomically and never
+155:   cannot be successfully applied, then the server MUST NOT apply any of
+157:   PATCH can vary depending on the patch document and the type of
+160:   directory hierarchy.  The atomicity requirement holds for all
+162:   details on status codes and possible error conditions.
+165:   one or more currently cached entities, those entries SHOULD be
+172:RFC 5789                       HTTP PATCH                     March 2010
+177:   header matching the Request-URI, indicating that the PATCH response
+178:   body is a resource representation.  A cached PATCH response can only
+179:   be used to respond to subsequent GET and HEAD requests; it MUST NOT
+180:   be used to respond to other methods (in particular, PATCH).
+183:   contained patch document and MUST NOT be applied to the resource
+186:   the patch document had a language.  Servers SHOULD NOT store such
+187:   headers except as trace information, and SHOULD NOT use such header
+193:   There is no guarantee that a resource can be modified with PATCH.
+198:   are required to support.  Servers MUST ensure that a received patch
+202:   Clients need to choose when to use PATCH rather than PUT.  For
+205:   sense to use PUT instead of PATCH.  A comparison to POST is even more
+207:   encompass PUT and PATCH-like operations if the server chooses.  If
+209:   URI in a predictable way, POST should be considered instead of PATCH
+212:2.1.  A Simple PATCH Example
+214:   PATCH /file.txt HTTP/1.1
+228:RFC 5789                       HTTP PATCH                     March 2010
+234:   Successful PATCH response to existing text file:
+245:   entity created by applying the PATCH, available at
+251:   There are several known conditions under which a PATCH request can
+256:      SHOULD return a 400 (Bad Request) response.  The definition of
+262:      identified by the Request-URI.  Such a response SHOULD include an
+274:      more specific errors like "Conflicting State" that could be
+275:      signaled with this status code, but the more specific error would
+284:RFC 5789                       HTTP PATCH                     March 2010
+301:      precondition failed, then the 412 (Precondition Failed) error is
+308:   Concurrent modification:  Some applications of PATCH might require
+313:      indicate this error by using a 409 (Conflict) response.
+325:   The entity body of error responses SHOULD contain enough information
+326:   to communicate the nature of the error to the client.  The content-
+340:RFC 5789                       HTTP PATCH                     March 2010
+345:   A server can advertise its support for the PATCH method by adding it
+347:   header defined in HTTP/1.1.  The PATCH method MAY appear in the
+355:   Accept-Patch SHOULD appear in the OPTIONS response for any resource
+356:   that supports the use of the PATCH method.  The presence of the
+358:   indication that PATCH is allowed on the resource identified by the
+383:   Allow: GET, PUT, POST, OPTIONS, HEAD, DELETE, PATCH
+386:   The examples show a server that supports PATCH generally using two
+396:RFC 5789                       HTTP PATCH                     March 2010
+416:   The security considerations for PATCH are nearly identical to the
+420:   transport errors or through accidental overwrites.  Whatever
+421:   mechanisms are used for PUT can be used for PATCH as well.  The
+422:   following considerations apply especially to PATCH.
+428:   Section 2.  If a PATCH request fails, the client can issue a GET
+431:   if the PATCH request can be resent, but in other cases, the attempt
+433:   of a failure of the underlying transport channel, where a PATCH
+442:   response.  The PATCH method complicates such watch-keeping because
+452:RFC 5789                       HTTP PATCH                     March 2010
+463:   documents.  Servers MUST take adequate precautions to ensure that
+465:   CPU, disk I/O) through the client's use of PATCH.

package/audit/evidence/external/standards-sources.txt

@@ -0,0 +1,6 @@
+# Standards references fetch time
+captured_at=2026-03-01T16:01:15Z
+jsonapi_format=https://jsonapi.org/format/
+rfc9110=https://www.rfc-editor.org/rfc/rfc9110
+rfc5789=https://www.rfc-editor.org/rfc/rfc5789
+fetch_cors=https://fetch.spec.whatwg.org/#http-cors-protocol

package/audit/evidence/runtime/baseline-commits.txt

@@ -0,0 +1,2 @@
+json-rest-api 72c08eec75f696a80c70b25608ed7c19eb505698
+json-rest-schema 9c30d3ba7317407a69231515fd58196862b25b34

package/audit/evidence/runtime/db-adapter-assumptions.txt

@@ -0,0 +1,3 @@
+json-rest-api package peerDeps: knex optional, express/socket.io optional
+json-rest-api tests default storage mode: knex (SQLite in-memory for fixtures)
+json-rest-schema tests: knex + sqlite3

package/audit/evidence/runtime/environment.txt

@@ -0,0 +1,4 @@
+date_utc=2026-03-01T15:32:20Z
+node=v20.19.0
+npm=11.6.2
+os=Linux merc-ThinkPad-X1-Carbon-Gen-8 6.14.0-37-generic #37~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 10:25:38 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

package/audit/evidence/runtime/invariant-runtime-mapping.md

@@ -0,0 +1,38 @@
+# Runtime-to-Invariant Mapping (M5)
+
+## Observed runtime/test failures
+
+1. `patchRelationship` failure path emits `ReferenceError: handleWriteMethodError is not defined`.
+- Evidence:
+  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+- Invariant impact:
+  - `INV-001` fail
+  - `INV-008` fail
+- Risk mapping:
+  - `RISK-001`
+
+2. Positioning multifilter suite has 2 assertion failures.
+- Evidence:
+  - [failing-tests-summary.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/failing-tests-summary.txt)
+- Invariant impact:
+  - `INV-010` partial
+  - `INV-012` partial
+- Risk mapping:
+  - `RISK-002`
+
+3. `json-rest-schema` suite has 1 failing import contract test.
+- Evidence:
+  - [npm-test-json-rest-schema.log](/home/merc/Development/current/json-rest-api/audit/evidence/tests/npm-test-json-rest-schema.log)
+- Invariant impact:
+  - `INV-012` partial
+- Risk mapping:
+  - `RISK-004`
+
+## Non-failing but risk-relevant runtime signal
+- Full `json-rest-api` run includes 324 passing tests with 10 skipped; skips concentrate in cursor multifield pagination suite.
+- Evidence:
+  - [test-summary.md](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/test-summary.md)
+  - [skipped-tests.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/skipped-tests.txt)
+- Invariant impact:
+  - `INV-007` partial
+  - `INV-012` partial

package/audit/evidence/runtime/probe-patch-relationship-error.exitcode

@@ -0,0 +1 @@
+1

package/audit/evidence/runtime/probe-patch-relationship-error.log

@@ -0,0 +1,76 @@
+2026-03-01T15:55:13.737Z [INFO] [basic-test-api] Installing plugin 'rest-api' {
+  options: {
+    simplifiedApi: false,
+    simplifiedTransport: false,
+    returnRecordApi: { post: true, put: false, patch: false },
+    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
+    sortableFields: [ 'id', 'title', 'country_id', 'publisher_id', 'name', 'code' ]
+  }
+}
+2026-03-01T15:55:13.741Z [INFO] [basic-test-api] Plugin 'rest-api' installed successfully { duration: '1ms' }
+2026-03-01T15:55:13.742Z [INFO] [basic-test-api] Installing plugin 'rest-api-knex' { options: '[Object with methods]' }
+2026-03-01T15:55:13.747Z [INFO] [basic-test-api:plugin:rest-api-knex] Database capabilities detected: { database: 'SQLite', version: '3.49.2', windowFunctions: true }
+2026-03-01T15:55:13.747Z [INFO] [basic-test-api:plugin:rest-api-knex] RestApiKnexPlugin installed - basic CRUD operations ready
+2026-03-01T15:55:13.747Z [INFO] [basic-test-api] Plugin 'rest-api-knex' installed successfully { duration: '5ms' }
+2026-03-01T15:55:13.748Z [INFO] [basic-test-api] Scope 'countries' added successfully
+2026-03-01T15:55:13.750Z [INFO] [basic-test-api:global] Routes registered for scope 'countries'
+2026-03-01T15:55:13.753Z [INFO] [basic-test-api] Scope 'publishers' added successfully
+2026-03-01T15:55:13.753Z [INFO] [basic-test-api:global] Routes registered for scope 'publishers'
+2026-03-01T15:55:13.754Z [INFO] [basic-test-api] Scope 'authors' added successfully
+2026-03-01T15:55:13.754Z [INFO] [basic-test-api:global] Routes registered for scope 'authors'
+2026-03-01T15:55:13.754Z [INFO] [basic-test-api] Scope 'books' added successfully
+2026-03-01T15:55:13.755Z [INFO] [basic-test-api:global] Routes registered for scope 'books'
+2026-03-01T15:55:13.755Z [INFO] [basic-test-api] Scope 'book_authors' added successfully
+2026-03-01T15:55:13.755Z [INFO] [basic-test-api:global] Routes registered for scope 'book_authors'
+
+=== invalid relationshipData type (string) ===
+2026-03-01T15:55:13.768Z [ERROR] [basic-test-api:books] Error in PATCH method {
+  scopeName: 'books',
+  method: 'patch',
+  inputRecord: { data: { type: 'books', id: '1', relationships: [Object] } },
+  error: {
+    name: 'RestApiPayloadError',
+    message: "Relationship 'authors': Resource identifier must be an object",
+    stack: "RestApiPayloadError: Relationship 'authors': Resource identifier must be an object\n" +
+      '    at validateResourceIdentifier (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:104:11)\n' +
+      '    at validateRelationship (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:232:5)\n' +
+      '    at file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1309:7\n' +
+      '    at Array.forEach (<anonymous>)\n' +
+      '    at validatePatchPayload (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1308:40)\n' +
+      '    at patchMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js:64:5)\n' +
+      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
+      '    at async patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:28:5)\n' +
+      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
+      '    at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-error.mjs:50:7)',
+    code: 'REST_API_PAYLOAD',
+    type: 'rest_api_payload',
+    path: "Relationship 'authors'",
+    details: {
+      path: "Relationship 'authors'",
+      expected: 'object',
+      received: 'string'
+    }
+  },
+  errorSummary: "Relationship 'authors': Resource identifier must be an object | code: REST_API_PAYLOAD"
+}
+2026-03-01T15:55:13.769Z [ERROR] [basic-test-api] Scope method 'patch' on 'books' failed {
+  error: "Relationship 'authors': Resource identifier must be an object",
+  duration: '2ms'
+}
+2026-03-01T15:55:13.769Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed { error: 'handleWriteMethodError is not defined', duration: '2ms' }
+RESULT: error
+NAME: ReferenceError
+MESSAGE: handleWriteMethodError is not defined
+STACK_HEAD: ReferenceError: handleWriteMethodError is not defined |     at patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53:5) |     at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34) |     at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-error.mjs:50:7)
+
+=== invalid relationshipData shape (object) ===
+2026-03-01T15:56:13.771Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed {
+  error: 'Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call?',
+  duration: '60002ms'
+}
+RESULT: error
+NAME: KnexTimeoutError
+MESSAGE: Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call?
+STACK_HEAD: KnexTimeoutError: Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call? |     at Client_BetterSQLite3.acquireConnection (/home/merc/Development/current/json-rest-api/node_modules/knex/lib/client.js:332:26) |     at async Transaction_Sqlite.acquireConnection (/home/merc/Development/current/json-rest-api/node_modules/knex/lib/execution/transaction.js:262:28)
+
+=== missing book id ===

package/audit/evidence/runtime/probe-patch-relationship-error.mjs

@@ -0,0 +1,67 @@
+import knexLib from 'knex'
+import { createBasicApi } from '../../../tests/fixtures/api-configs.js'
+import { createJsonApiDocument, createRelationship, resourceIdentifier } from '../../../tests/helpers/test-utils.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: { filename: ':memory:' },
+  useNullAsDefault: true
+})
+
+function header (name) { console.log(`\n=== ${name} ===`) }
+
+async function main () {
+  const api = await createBasicApi(knex, { includeExpress: false })
+
+  const country = await api.resources.countries.post({
+    inputRecord: createJsonApiDocument('countries', { name: 'USA', code: 'US' }),
+    simplified: false
+  })
+
+  const book = await api.resources.books.post({
+    inputRecord: createJsonApiDocument('books', { title: 'Book 1' }, {
+      country: createRelationship(resourceIdentifier('countries', country.data.id))
+    }),
+    simplified: false
+  })
+
+  const scenarios = [
+    {
+      name: 'invalid relationshipData type (string)',
+      args: { id: book.data.id, relationshipName: 'authors', relationshipData: 'bad-type' }
+    },
+    {
+      name: 'invalid relationshipData shape (object)',
+      args: { id: book.data.id, relationshipName: 'authors', relationshipData: { type: 'authors', id: 1 } }
+    },
+    {
+      name: 'missing book id',
+      args: { id: 999999, relationshipName: 'authors', relationshipData: [] }
+    },
+    {
+      name: 'unknown relationship name',
+      args: { id: book.data.id, relationshipName: 'nonexistentRelationship', relationshipData: [] }
+    }
+  ]
+
+  for (const s of scenarios) {
+    header(s.name)
+    try {
+      await api.resources.books.patchRelationship(s.args)
+      console.log('RESULT: success')
+    } catch (error) {
+      console.log('RESULT: error')
+      console.log('NAME:', error?.name)
+      console.log('MESSAGE:', error?.message)
+      console.log('STACK_HEAD:', String(error?.stack || '').split('\n').slice(0, 6).join(' | '))
+    }
+  }
+
+  await knex.destroy()
+}
+
+main().catch(async (e) => {
+  console.error('FATAL:', e)
+  await knex.destroy()
+  process.exitCode = 1
+})

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.exitcode

@@ -0,0 +1 @@
+0

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.log

@@ -0,0 +1,62 @@
+2026-03-01T15:57:20.166Z [INFO] [basic-test-api] Installing plugin 'rest-api' {
+  options: {
+    simplifiedApi: false,
+    simplifiedTransport: false,
+    returnRecordApi: { post: true, put: false, patch: false },
+    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
+    sortableFields: [ 'id', 'title', 'country_id', 'publisher_id', 'name', 'code' ]
+  }
+}
+2026-03-01T15:57:20.170Z [INFO] [basic-test-api] Plugin 'rest-api' installed successfully { duration: '1ms' }
+2026-03-01T15:57:20.171Z [INFO] [basic-test-api] Installing plugin 'rest-api-knex' { options: '[Object with methods]' }
+2026-03-01T15:57:20.177Z [INFO] [basic-test-api:plugin:rest-api-knex] Database capabilities detected: { database: 'SQLite', version: '3.49.2', windowFunctions: true }
+2026-03-01T15:57:20.177Z [INFO] [basic-test-api:plugin:rest-api-knex] RestApiKnexPlugin installed - basic CRUD operations ready
+2026-03-01T15:57:20.177Z [INFO] [basic-test-api] Plugin 'rest-api-knex' installed successfully { duration: '6ms' }
+2026-03-01T15:57:20.178Z [INFO] [basic-test-api] Scope 'countries' added successfully
+2026-03-01T15:57:20.180Z [INFO] [basic-test-api:global] Routes registered for scope 'countries'
+2026-03-01T15:57:20.184Z [INFO] [basic-test-api] Scope 'publishers' added successfully
+2026-03-01T15:57:20.184Z [INFO] [basic-test-api:global] Routes registered for scope 'publishers'
+2026-03-01T15:57:20.185Z [INFO] [basic-test-api] Scope 'authors' added successfully
+2026-03-01T15:57:20.185Z [INFO] [basic-test-api:global] Routes registered for scope 'authors'
+2026-03-01T15:57:20.186Z [INFO] [basic-test-api] Scope 'books' added successfully
+2026-03-01T15:57:20.186Z [INFO] [basic-test-api:global] Routes registered for scope 'books'
+2026-03-01T15:57:20.187Z [INFO] [basic-test-api] Scope 'book_authors' added successfully
+2026-03-01T15:57:20.187Z [INFO] [basic-test-api:global] Routes registered for scope 'book_authors'
+2026-03-01T15:57:20.204Z [ERROR] [basic-test-api:books] Error in PATCH method {
+  scopeName: 'books',
+  method: 'patch',
+  inputRecord: { data: { type: 'books', id: '1', relationships: [Object] } },
+  error: {
+    name: 'RestApiPayloadError',
+    message: "Relationship 'authors': Resource identifier must be an object",
+    stack: "RestApiPayloadError: Relationship 'authors': Resource identifier must be an object\n" +
+      '    at validateResourceIdentifier (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:104:11)\n' +
+      '    at validateRelationship (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:232:5)\n' +
+      '    at file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1309:7\n' +
+      '    at Array.forEach (<anonymous>)\n' +
+      '    at validatePatchPayload (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1308:40)\n' +
+      '    at patchMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js:64:5)\n' +
+      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
+      '    at async patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:28:5)\n' +
+      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
+      '    at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs:27:5)',
+    code: 'REST_API_PAYLOAD',
+    type: 'rest_api_payload',
+    path: "Relationship 'authors'",
+    details: {
+      path: "Relationship 'authors'",
+      expected: 'object',
+      received: 'string'
+    }
+  },
+  errorSummary: "Relationship 'authors': Resource identifier must be an object | code: REST_API_PAYLOAD"
+}
+2026-03-01T15:57:20.205Z [ERROR] [basic-test-api] Scope method 'patch' on 'books' failed {
+  error: "Relationship 'authors': Resource identifier must be an object",
+  duration: '2ms'
+}
+2026-03-01T15:57:20.205Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed { error: 'handleWriteMethodError is not defined', duration: '4ms' }
+PROBE_RESULT=error
+ERROR_NAME=ReferenceError
+ERROR_MESSAGE=handleWriteMethodError is not defined
+ERROR_STACK=ReferenceError: handleWriteMethodError is not defined |     at patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53:5) |     at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34) |     at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs:27:5)

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs

@@ -0,0 +1,47 @@
+import knexLib from 'knex'
+import { createBasicApi } from '../../../tests/fixtures/api-configs.js'
+import { createJsonApiDocument, createRelationship, resourceIdentifier } from '../../../tests/helpers/test-utils.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: { filename: ':memory:' },
+  useNullAsDefault: true
+})
+
+async function main () {
+  const api = await createBasicApi(knex, { includeExpress: false })
+
+  const country = await api.resources.countries.post({
+    inputRecord: createJsonApiDocument('countries', { name: 'USA', code: 'US' }),
+    simplified: false
+  })
+
+  const book = await api.resources.books.post({
+    inputRecord: createJsonApiDocument('books', { title: 'Book 1' }, {
+      country: createRelationship(resourceIdentifier('countries', country.data.id))
+    }),
+    simplified: false
+  })
+
+  try {
+    await api.resources.books.patchRelationship({
+      id: book.data.id,
+      relationshipName: 'authors',
+      relationshipData: 'bad-type'
+    })
+    console.log('PROBE_RESULT=unexpected_success')
+  } catch (error) {
+    console.log('PROBE_RESULT=error')
+    console.log('ERROR_NAME=' + (error?.name || ''))
+    console.log('ERROR_MESSAGE=' + (error?.message || ''))
+    console.log('ERROR_STACK=' + String(error?.stack || '').split('\n').slice(0, 4).join(' | '))
+  }
+
+  await knex.destroy()
+}
+
+main().catch(async (e) => {
+  console.error('PROBE_FATAL=' + (e?.message || e))
+  await knex.destroy()
+  process.exitCode = 1
+})

package/audit/evidence/runtime/test-exitcodes.txt

@@ -0,0 +1,4 @@
+json-rest-api:
+1
+json-rest-schema:
+1

package/audit/evidence/runtime/test-summary.md

@@ -0,0 +1,107 @@
+# Runtime test summary (non-anyapi)
+
+## json-rest-api npm test
+log: audit/evidence/tests/npm-test-json-rest-api.log
+5335:    ok 2 - auto assigns ownership when creating a project
+5340:    ok 3 - filters query results by ownership for non-admin users
+5345:    ok 4 - allows admin roles to bypass ownership filtering
+5350:    ok 5 - prevents users from accessing records they do not own
+5355:    ok 6 - enforces helper ownership checks
+5360:ok 28 - Access plugin
+5458:            ok 1 - should create a country
+5463:            ok 2 - should create a publisher with country relationship
+5468:            ok 3 - should fail to create resource with missing required field
+5473:        ok 1 - POST - Create Resources
+5480:            ok 1 - should retrieve a single resource
+5485:            ok 2 - should fail to retrieve non-existent resource
+5490:            ok 3 - should retrieve collection of resources
+5495:        ok 2 - GET - Retrieve Resources
+5502:            ok 1 - should partially update a resource
+5507:        ok 3 - PATCH - Update Resources
+5514:            ok 1 - should delete an existing resource
+5519:        ok 4 - DELETE - Remove Resources
+5525:    ok 1 - Basic CRUD Operations
+5531:ok 29 - REST API Tests
+5556:    ok 1 - should merge search:true fields with explicit searchSchema
+5561:    ok 2 - should work with only search:true fields (no explicit searchSchema)
+5566:    ok 3 - should work with only explicit searchSchema (no search:true)
+5571:    ok 4 - should allow filtering with merged searchSchema fields
+5576:ok 30 - SearchSchema Merge Behavior
+5619:        ok 1 - should receive minimal notifications for subscribed resources
+5631:        ok 2 - should not receive notifications for non-matching filters
+5636:    ok 1 - Basic Subscription and Notifications
+5656:        ok 1 - should validate filters against searchSchema
+5667:        ok 2 - should reject function filters without filterRecord
+5672:    ok 2 - Filter Validation
+5709:        ok 1 - should not broadcast when operations fail
+5717:        ok 2 - should broadcast after successful operations
+5722:    ok 3 - Transaction Safety
+5733:        ok 1 - should handle multiple subscriptions from same client
+5742:        ok 2 - should unsubscribe correctly
+5747:    ok 4 - Multiple Subscriptions
+5757:        ok 1 - should receive notifications for updates
+5765:        ok 2 - should receive notifications for deletes
+5770:    ok 5 - Update and Delete Notifications
+5784:        ok 1 - should filter by relationship fields
+5789:    ok 6 - Relationship Filters
+5795:ok 31 - WebSocket/Socket.IO Plugin
+5819:        ok 1 - should accept virtual fields in POST request
+5824:        ok 2 - should not store virtual fields in database
+5829:        ok 3 - should handle virtual fields in PATCH request
+5834:        ok 4 - should respect sparse fieldsets with virtual fields on PATCH
+5839:        ok 5 - should exclude virtual fields when not requested in sparse fieldsets
+5844:        ok 6 - should handle PUT requests with virtual fields
+5849:    ok 1 - Virtual field validation
+5856:        ok 1 - should handle both virtual and computed fields correctly
+5861:        ok 2 - should calculate computed fields regardless of input
+5866:    ok 2 - Virtual fields vs computed fields
+5872:ok 32 - Virtual Fields Tests
+5878:# tests 336
+5879:# suites 164
+5880:# pass 324
+5881:# fail 2
+5883:# skipped 10
+5885:# duration_ms 15332.355453
+
+## json-rest-schema npm test
+log: audit/evidence/tests/npm-test-json-rest-schema.log
+174:    ok 7 - type:'string' should process input undefined to undefined
+179:    ok 8 - type:'string' should fail for input: {}
+184:    ok 9 - type:'number' should process input "42.5" to 42.5
+189:    ok 10 - type:'number' should process input "" to 0
+194:    ok 11 - type:'number' should fail for input: null
+199:    ok 12 - type:'number' should fail for input: "abc"
+204:    ok 13 - type:'timestamp' should process input 1672531200000 to 1672531200000
+209:    ok 14 - type:'timestamp' should process input "0" to null
+214:    ok 15 - type:'timestamp' should fail for input: "abc"
+219:    ok 16 - type:'dateTime' should process input "2025-01-01T12:30:00Z" to "2025-01-01T12:30:00.000Z"
+224:    ok 17 - type:'dateTime' should process input "invalid" to null
+229:    ok 18 - type:'date' should process input "2025-01-01T12:30:00Z" to "2025-01-01T00:00:00.000Z"
+234:    ok 19 - type:'date' should process input "2025-01-01" to "2025-01-01T00:00:00.000Z"
+239:    ok 20 - type:'array' should process input "one" to ["one"]
+244:    ok 21 - type:'array' should process input ["one","two"] to ["one","two"]
+249:    ok 22 - type:'boolean' should process input "true" to true
+254:    ok 23 - type:'boolean' should process input "on" to true
+259:    ok 24 - type:'boolean' should process input "false" to false
+264:    ok 25 - type:'boolean' should process input 1 to true
+269:    ok 26 - type:'boolean' should process input 0 to false
+274:    ok 27 - type:'boolean' should process input "no" to false
+279:    ok 28 - type:'id' should process input "123" to 123
+284:    ok 29 - type:'id' should fail for input: "id-123"
+289:    ok 30 - type:'serialize' should process an object to a string
+294:    ok 31 - type:`serialize` should handle circular references
+299:ok 4 - 3. Core Plugin: Type Handlers
+306:    ok 1 - `min`/`max` validators should work for numbers, `minLength`/`maxLength` for strings
+311:    ok 2 - `validator` should work with a custom function (sync and async)
+316:    ok 3 - `uppercase`/`lowercase` should transform strings
+321:    ok 4 - `length` should truncate strings and error on long numbers
+326:    ok 5 - `notEmpty` should fail on empty strings
+331:ok 5 - 4. Core Plugin: Validator Handlers
+338:    ok 1 - should allow defining and using a custom plugin
+343:ok 6 - 5. Extensibility: Custom Plugins
+349:# tests 57
+350:# suites 6
+351:# pass 56
+352:# fail 1
+354:# skipped 0
+356:# duration_ms 163.644013