json-rest-api 1.0.22 → 1.0.24

package/audit/01-scope-map.md

@@ -1,84 +0,0 @@
-# Scope Map (M1)
-
-## Inventory Baseline (In Scope)
-- `json-rest-api`: 160 tracked files in scope (`audit/evidence/code/in-scope-files-json-rest-api.txt`)
-- `json-rest-schema`: 13 tracked files in scope (`audit/evidence/code/in-scope-files-json-rest-schema.txt`)
-- Coverage matrix rows: 173 files + header (`audit/02-coverage-matrix.csv`)
-
-## Architecture Boundaries (Expected Layer Contract)
-`transport -> REST methods -> helper contracts -> storage adapter -> DB`
-
-### schema-core
-- Repo: `json-rest-schema`
-- Core files: `src/index.js`, `src/Schema.js`, `src/CorePlugin.js`
-- Responsibility: field casting, validation pipeline, validator/type plugin system.
-
-### rest-orchestration
-- Repo: `json-rest-api`
-- Core files: `plugins/core/rest-api-plugin.js`, `plugins/core/rest-api-plugin-methods/*.js`, `plugins/core/rest-api-plugin-hooks/*.js`
-- Responsibility: request lifecycle orchestration, permission hook dispatch, transaction lifecycle, response shape mode.
-
-### transport-express
-- Core files: `plugins/core/connectors/express-plugin.js`, `plugins/core/connectors/lib/*`
-- Responsibility: HTTP ingress/egress, request parsing, status mapping, transport hooks.
-
-### storage-knex
-- Core files: `plugins/core/rest-api-knex-plugin.js`, `plugins/core/lib/storage/storage-adapter.js`, `plugins/core/lib/querying-writing/*`
-- Responsibility: data adapter abstraction, SQL query/write execution, schema compilation and ID/column translation.
-
-### query-engine
-- Core files: `plugins/core/lib/querying/*`, `plugins/core/rest-api-plugin-methods/query.js`, `.../get.js`
-- Responsibility: filtering/sorting/pagination/include processing and JSON:API assembly.
-
-### relationships
-- Core files: `plugins/core/lib/writing/relationship-processor.js`, `.../many-to-many-manipulations.js`, relationship endpoint methods
-- Responsibility: relation semantics across CRUD + relationship endpoints.
-
-### plugin subsystems
-- Access: `plugins/core/rest-api-access.js`
-- CORS: `plugins/core/rest-api-cors-plugin.js`
-- File: `plugins/core/file-handling-plugin.js`
-- Positioning: `plugins/core/rest-api-positioning-plugin.js`, `plugins/core/lib/fractional-positioning.js`
-- Multihome: `plugins/core/rest-api-multihome-plugin.js`
-- SocketIO: `plugins/core/socketio-plugin.js`
-- Bulk: `plugins/core/bulk-operations-plugin.js`
-
-## Primary Data/Control Flows
-### Read flow
-1. Route registration: `register-scope-routes.js` + `add-route.js`
-2. Transport ingress + parsing: `express-plugin.js`, `connectors-query-parser.js`
-3. Method orchestration: `query.js`/`get.js` -> payload validation -> `checkPermissions`
-4. Storage read: `rest-api-knex-plugin.js` (`helpers.dataQuery`/`helpers.dataGet`)
-5. Include/transform: `knex-process-includes.js`, `knex-relationship-includes.js`, `knex-json-api-transformers-querying.js`
-6. Field enrichment/filtering: `enrich-attributes.js`, `field-utils.js`
-7. Transport response/error mapping: `express-plugin.js`
-
-### Write flow
-1. Transport ingress/body validation.
-2. Method setup + transaction open: `common.js::setupCommonRequest`
-3. Payload validation and schema validation: `payload-validators.js` + `validateResourceAttributesBeforeWrite`
-4. Permission checks before storage side effects: `scope.checkPermissions`
-5. Storage mutation: `helpers.dataPost|dataPut|dataPatch|dataDelete`
-6. Relationship side effects: `relationship-processor.js`, `many-to-many-manipulations.js`
-7. Return mode and hooks: `handleRecordReturnAfterWrite`
-8. Commit/rollback path: `common.js::handleWriteMethodError` and method-level transaction logic
-
-## Early Silent Zones (Initial Detection)
-### Files with weak direct test linkage (heuristic)
-- Source: `audit/evidence/code/early-silent-zones-no-test-token.txt`
-- 54/67 runtime files had no direct token mention in tests (heuristic, not execution coverage).
-- Notable high-risk modules in this set: file upload detector libs, relationship endpoint methods, core helper glue, error formatting.
-
-### Docs claims with likely weak direct code/test mapping (to validate in M2/M6)
-- File upload guides vs no dedicated file-upload test suite name match.
-- Label plugin present (`rest-api-label-plugin.js`) with no dedicated test suite name match.
-- Transport helper internals (`connectors/lib/*`) lack targeted test files by name.
-
-### Weak call-site coverage candidates (initial static signal)
-- Relationship endpoint error path consistency needs runtime confirmation (`patch-relationship.js` catch path references symbols not declared in-file).
-- Cross-table/polymorphic filter branches require targeted scenario coverage beyond happy-path query tests.
-
-## Unknown Queue (Must Resolve)
-- Exact runtime path usage for some helper modules without explicit test targeting.
-- Relationship endpoint error envelope consistency under thrown failures.
-- Performance behavior under nested includes and cross-table filter combinations.

package/audit/02-coverage-matrix.csv

@@ -1,174 +0,0 @@
-"repo","path","layer","subsystem","criticality","review_pass_1","review_pass_2","runtime_touched","test_touched","notes_ref"
-"json-rest-api",".claude/agents/library-guide-expert.md","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api",".claude/agents/rest-api-internals-expert.md","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api",".gitignore","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","AGENTS.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","CLAUDE.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","connectors_ideas/fastify.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","connectors_ideas/koa-plugin.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","CRUSH.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/_config.yml","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/_layouts/default.html","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/.bundle/config","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/API.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/apple-touch-icon.svg","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/assets/css/style.scss","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/COMPARISON.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/favicon.svg","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/Gemfile","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/Gemfile.lock","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_1_Initial_Setup.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_1_The_Starting_Point.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_2_Manipulating_And_Searching_Tables.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_3_BelongsTo_Relationships.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_4_HasMany_Records.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_5_HasMany_Polymorphic.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_6_Many_To_Many.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_7_Pagination_And_Ordering.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_8_Effects_of_PUT_and_PATCH.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_9_Relationships_Urls.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_2_Data_And_Relations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_3_Field_Transformations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_4_Authentication_And_Permissions.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_5_Non-Db_Resources.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_6_Positioning.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_7_Hooks_Data_Management_And_Plugins.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_Bulk_Operations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_Cors.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_File_Uploads.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_Multihome.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_SocketIO.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_X_URL_Management.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/GUIDE_Y_Appendices.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/GUIDE/index.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/index.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/mini-guides/file-uploads-complete.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/ONBOARDING.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","docs/QUICKSTART.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","eslint.config.js","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","examples/url-override-example.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","index.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","lib/enhanced-logger.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","lib/error-formatter.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","lib/rest-api-errors.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","LICENSE","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","package-lock.json","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","package.json","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","plugins/core/bulk-operations-plugin.js","plugin","plugins-bulk","critical","yes","yes","yes","yes","audit/subsystems/plugins-bulk.md"
-"json-rest-api","plugins/core/connectors/express-plugin.js","transport","transport-express","critical","yes","yes","yes","yes","audit/subsystems/transport-express.md"
-"json-rest-api","plugins/core/connectors/lib/busboy-detector.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
-"json-rest-api","plugins/core/connectors/lib/formidable-detector.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
-"json-rest-api","plugins/core/connectors/lib/request-helpers.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
-"json-rest-api","plugins/core/file-handling-plugin.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
-"json-rest-api","plugins/core/lib/dbTablesOperations.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/fractional-positioning.js","plugin","plugins-positioning","critical","yes","yes","no","no","audit/subsystems/plugins-positioning.md"
-"json-rest-api","plugins/core/lib/querying-writing/compile-schemas.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/connectors-query-parser.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/database-capabilities.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/database-value-normalizers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/default-data-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/field-utils.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/knex-constants.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/knex-field-helpers.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/knex-json-api-transformers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/payload-validators.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/schema-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/scope-validations.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying-writing/simplified-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/querying/knex-cross-table-search.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-json-api-transformers-querying.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-pagination-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-process-includes.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-query-helpers-base.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-query-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-relationship-includes.js","runtime-query","query-engine","critical","yes","yes","yes","yes","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/knex-window-queries.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/querying/url-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/lib/storage/storage-adapter.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/lib/writing/knex-json-api-transformers-writing.js","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","plugins/core/lib/writing/many-to-many-manipulations.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/lib/writing/relationship-processor.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-access.js","plugin","plugins-access","critical","yes","yes","yes","yes","audit/subsystems/plugins-access.md"
-"json-rest-api","plugins/core/rest-api-cors-plugin.js","plugin","plugins-cors","critical","yes","yes","yes","yes","audit/subsystems/plugins-cors.md"
-"json-rest-api","plugins/core/rest-api-knex-plugin.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
-"json-rest-api","plugins/core/rest-api-label-plugin.js","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","plugins/core/rest-api-multihome-plugin.js","plugin","plugins-multihome","critical","yes","yes","yes","yes","audit/subsystems/plugins-multihome.md"
-"json-rest-api","plugins/core/rest-api-plugin-hooks/compile-resource-schemas.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-hooks/register-relationship-routes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-hooks/register-scope-routes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-hooks/turn-scope-init-into-vars.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-hooks/validate-include-configurations.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/add-route.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/check-permissions.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/common.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/delete-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/delete.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/enrich-attributes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/get-related.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/get-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/get.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/patch-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/patch.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/post-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/post.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/put.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/query.js","runtime-query","query-engine","critical","yes","yes","yes","yes","audit/subsystems/query-engine.md"
-"json-rest-api","plugins/core/rest-api-plugin-methods/release.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-plugin.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
-"json-rest-api","plugins/core/rest-api-positioning-plugin.js","plugin","plugins-positioning","critical","yes","yes","yes","yes","audit/subsystems/plugins-positioning.md"
-"json-rest-api","plugins/core/socketio-plugin.js","plugin","plugins-socketio","critical","yes","yes","yes","yes","audit/subsystems/plugins-socketio.md"
-"json-rest-api","plugins/storage/local-storage.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
-"json-rest-api","plugins/storage/s3-storage.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
-"json-rest-api","quickTest.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","README.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","scripts/run-docs.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","test-debug.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-api","tests/bulk-operations.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/computed-fields.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/cors.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/curl.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/custom-idproperty-relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/field-getters.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/field-setters.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/fixtures/api-configs.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/helpers/storage-mode.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/helpers/test-utils.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/include-depth-validation.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/includes.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/multihome.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/nested-includes.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/ownership-optout.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/pagination-cursor-multifield.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/pagination-enhanced.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/polymorphic-relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/polymorphic-simple.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/positioning-advanced.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/positioning-extended.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/positioning-multifilter.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/positioning.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/queries.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/query-limits.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/README.md","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/relationship-endpoints.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/rest-api-access.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/rest-api.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/searchschema-merge.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/socketio.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/TEST_TEMPLATE.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/test-development-guide.md","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","tests/virtual-fields.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-api","TODO.todo","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-schema",".gitignore","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-schema","eslint.config.js","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
-"json-rest-schema","example.js","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
-"json-rest-schema","FUTURE_MIGRATION_MODULE.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-schema","ONBOARDING.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-schema","package-lock.json","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
-"json-rest-schema","package.json","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
-"json-rest-schema","README.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
-"json-rest-schema","src/CorePlugin.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
-"json-rest-schema","src/index.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
-"json-rest-schema","src/Schema.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
-"json-rest-schema","test-knex-table-real.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
-"json-rest-schema","tests.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"

package/audit/03-invariants.md

@@ -1,123 +0,0 @@
-# Architecture Invariants (Final, non-anyapi)
-
-Scope note: anyapi-specific code paths are excluded from invariant evaluation.
-Status legend: `pass | fail | partial`.
-Assertion tags: `[Verified]`, `[Inferred]`.
-
-## Summary Table
-
-| Invariant | Status | Confidence | Key evidence |
-|---|---|---:|---|
-| INV-001 Transactional mutation + rollback safety | fail | C5 | `patchRelationship` runtime `ReferenceError` in error path; catch handler broken |
-| INV-002 Permission checks before irreversible side effects | pass | C4 | method ordering + access/multihome tests |
-| INV-003 Validation/type normalization before query/write | pass | C4 | payload validators before data helpers; runtime malformed payload rejection |
-| INV-004 Relationship semantics consistency across write + relationship endpoints | partial | C4 | post/delete endpoint pass + patch endpoint error-path defect |
-| INV-005 idProperty consistency in query/write/transform/response | pass | C4 | compile + knex idProperty paths + custom idProperty tests |
-| INV-006 Sparse fieldsets do not leak hidden/internal fields | pass | C4 | field helper behavior + virtual/computed/fieldset tests |
-| INV-007 Include processing avoids N+1 in standard scenarios | partial | C3 | include correctness tests pass; no query-count budget assertions |
-| INV-008 Error envelope consistency across transport and method paths | fail | C4 | CORS blocked-origin envelope mismatch + patchRelationship error-path mismatch |
-| INV-009 Multi-tenant/ownership filters non-bypassable across alternate paths | partial | C3 | access/multihome checks pass; bypass matrix not exhaustive |
-| INV-010 Plugin side effects scoped and contract-safe | partial | C4 | positioning test failures + inferred bulk optimization dead-path |
-| INV-011 Docs claims match observed critical behavior | partial | C4 | `included` write docs/code mismatch; compliance wording drift |
-| INV-012 Tests cover critical invariants (not just happy paths) | partial | C4 | broad suite + explicit gaps (skipped tests, missing patchRelationship regression) |
-
-## INV-001 Transactional mutation + rollback safety
-- [Verified][C5] `patch-relationship` catch path references undefined `handleWriteMethodError`, breaking canonical rollback/error handler path.
-- Code evidence:
-  - [patch-relationship.js:52](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:52)
-  - [common.js:198](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js:198)
-- Runtime evidence:
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Existing tests mapped:
-  - `tests/relationship-endpoints.test.js` covers post/delete but not patch failure path.
-- Scenario validation:
-  - malformed relationship payload -> `ReferenceError: handleWriteMethodError is not defined`.
-- Final: `fail`.
-- Remediation pointer: `ROADMAP-A-001`.
-
-## INV-002 Permission checks before irreversible side effects
-- [Verified][C4] CRUD method paths call `scope.checkPermissions` before `helpers.dataPost|Put|Patch|Delete`.
-- Code evidence: [post.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/post.js), [put.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/put.js), [patch.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js), [delete.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/delete.js).
-- Test evidence: `tests/rest-api-access.test.js`, `tests/multihome.test.js`, `tests/ownership-optout.test.js` (all in full suite run).
-- Final: `pass`.
-
-## INV-003 Validation/type normalization before query construction and writes
-- [Verified][C4] Method flows validate payload/query before storage helper calls.
-- Code evidence: [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js), [query.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/query.js), [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js).
-- Runtime evidence: malformed relationship payload rejected in probe before successful write (`REST_API_PAYLOAD` emitted before endpoint-level failure masking).
-- Final: `pass`.
-
-## INV-004 Relationship semantics consistency across POST/PUT/PATCH + relationship endpoints
-- [Verified][C4] POST/DELETE relationship endpoints pass in regression tests.
-- [Verified][C5] PATCH relationship endpoint has broken failure semantics (`ReferenceError`).
-- Evidence:
-  - [trace-relationship-endpoints.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-relationship-endpoints.md)
-  - `audit/evidence/tests/npm-test-json-rest-api.log:5050,5060`
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-A-001`, `ROADMAP-A-003`.
-
-## INV-005 idProperty consistency in query/write/transform/response
-- [Verified][C4] `idProperty` appears in compile metadata and knex read/write helpers.
-- Code evidence: [compile-schemas.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/compile-schemas.js), [rest-api-knex-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-knex-plugin.js).
-- Test evidence: `tests/custom-idproperty-relationships.test.js` passes in full run.
-- Final: `pass`.
-
-## INV-006 Sparse fieldsets do not leak hidden/internal fields
-- [Verified][C4] field helper enforces hidden/sparse behavior and throws on unknown fields.
-- Code evidence: [knex-field-helpers.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/knex-field-helpers.js).
-- Test evidence: `tests/virtual-fields.test.js`, `tests/computed-fields.test.js`, `tests/field-getters.test.js` pass in full suite.
-- Final: `pass`.
-
-## INV-007 Include processing avoids N+1 in standard scenarios
-- [Verified][C3] include behavior is functionally correct in test suite.
-- [Inferred][C3] batching present in include code; no direct query-count budget test.
-- Evidence:
-  - [knex-relationship-includes.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying/knex-relationship-includes.js)
-  - `tests/includes.test.js`, `tests/nested-includes.test.js`
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-B-003`.
-
-## INV-008 Error envelope consistency across transport and method paths
-- [Verified][C4] CORS blocked-origin path returns `{ error: ... }` shape, diverging from JSON:API `errors` envelope.
-- [Verified][C5] `patchRelationship` failure path returns runtime `ReferenceError` instead of normalized rest-api envelope.
-- Evidence:
-  - [rest-api-cors-plugin.js:112](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js:112)
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Final: `fail`.
-- Remediation pointer: `ROADMAP-A-001`, `ROADMAP-B-002`.
-
-## INV-009 Multi-tenant and ownership filters non-bypassable
-- [Verified][C4] plugin-level filtering + permission checks exist and tests pass.
-- [Inferred][C3] alternate-path bypass matrix (relationship endpoints + includes + custom filters) not exhaustively runtime-proven.
-- Evidence:
-  - [rest-api-access.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-access.js)
-  - [rest-api-multihome-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-multihome-plugin.js)
-  - `tests/rest-api-access.test.js`, `tests/multihome.test.js`
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-B-004`.
-
-## INV-010 Plugin side effects remain scoped and contract-safe
-- [Verified][C5] positioning plugin currently has failing multifilter edge tests.
-- [Inferred][C3] bulk optimization hook may be non-executed/dead path.
-- Evidence:
-  - `audit/evidence/tests/npm-test-json-rest-api.log:4235-4296`
-  - [bulk-operations-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/bulk-operations-plugin.js)
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-A-002`, `ROADMAP-B-001`.
-
-## INV-011 Documentation claims match observed behavior
-- [Verified][C4] docs/comments claim patterns conflict with runtime behavior for write `included` handling.
-- Evidence:
-  - [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js)
-  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
-  - [docs-drift.md](/home/merc/Development/current/json-rest-api/audit/subsystems/docs-drift.md)
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-B-005`.
-
-## INV-012 Tests cover critical invariants beyond happy paths
-- [Verified][C4] suite breadth is high, but critical gaps remain.
-- Gap evidence:
-  - skipped cursor tests: [skipped-tests.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/skipped-tests.txt)
-  - no direct regression for `patchRelationship` failure path before this audit probe.
-- Final: `partial`.
-- Remediation pointer: `ROADMAP-A-003`, `ROADMAP-B-003`.

package/audit/04-standards-rubric.md

@@ -1,56 +0,0 @@
-# Standards Rubric (M6, non-anyapi)
-
-## Corpus freeze and sources
-- JSON:API spec: `https://jsonapi.org/format/`
-- HTTP Semantics: `https://www.rfc-editor.org/rfc/rfc9110`
-- HTTP PATCH: `https://www.rfc-editor.org/rfc/rfc5789`
-- Source snapshots:
-  - [standard-jsonapi-snippets.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/standard-jsonapi-snippets.txt)
-  - [standard-rfc-snippets.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/standard-rfc-snippets.txt)
-
-Scoring scale: `1` poor, `3` mixed, `5` strong.
-
-## Criteria IDs
-- `STD-JAPI-01` JSON:API media/document envelope compliance.
-- `STD-JAPI-02` Relationship endpoint semantics and consistency.
-- `STD-HTTP-01` HTTP status code correctness.
-- `STD-HTTP-02` PATCH semantics and failure atomicity handling.
-- `STD-ERR-01` Error envelope quality/consistency.
-- `STD-SEC-01` Secure defaults and trust-boundary explicitness.
-- `STD-EXT-01` Extensibility/configurability hygiene.
-- `STD-OBS-01` Observability/operability diagnostics.
-- `STD-BC-01` Backward compatibility posture.
-- `STD-DOC-01` Documentation reliability.
-
-## Gap Matrix
-
-| ID | Score | Evidence-backed assessment | Gap class | Severity | Confidence |
-|---|---:|---|---|---|---|
-| STD-JAPI-01 | 3.5 | Core JSON:API document structures and media-type handling are broadly implemented; explicit JSON:API error object support exists in error classes. | design choice | medium | C4 |
-| STD-JAPI-02 | 2.5 | Relationship POST/DELETE endpoint paths pass; PATCH relationship error path is runtime-broken (`ReferenceError`), reducing conformance reliability. | defect | high | C5 |
-| STD-HTTP-01 | 4.0 | Transport maps major codes (400/403/404/415/500) and method-specific 201/204 behavior correctly in most paths. | design choice | low | C4 |
-| STD-HTTP-02 | 2.5 | PATCH baseline works for normal resource updates, but error-path handler defect in relationship PATCH violates robust failure handling expectations. | defect | high | C5 |
-| STD-ERR-01 | 2.0 | Envelope inconsistency observed: CORS blocked-origin returns `{ error: ... }`; relationship PATCH can surface raw `ReferenceError`. | defect | high | C4 |
-| STD-SEC-01 | 3.0 | Access/multitenancy plugins provide meaningful controls, but default CORS option combinations and error leakage behavior require explicit hardening guidance. | design choice | medium | C3 |
-| STD-EXT-01 | 3.5 | Hook/plugin architecture is flexible; bulk optimization hook path appears under-specified in execution wiring. | design choice | medium | C3 |
-| STD-OBS-01 | 3.0 | Logging is rich and structured, but unknown exceptions can surface raw messages; limited audit-style invariant telemetry. | design choice | medium | C3 |
-| STD-BC-01 | 2.5 | No explicit compatibility matrix/deprecation contract found; test failures indicate regression detection exists but policy is implicit. | documentation drift | medium | C3 |
-| STD-DOC-01 | 2.5 | Critical docs/comments drift found (`included` write behavior mismatch) and compliance language overstates edge consistency. | documentation drift | medium | C4 |
-
-## Rule-by-rule evidence pointers
-- Runtime and traces:
-  - [trace-write-patch.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-write-patch.md)
-  - [trace-relationship-endpoints.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-relationship-endpoints.md)
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Code:
-  - [patch-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js)
-  - [rest-api-cors-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js)
-  - [express-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/connectors/express-plugin.js)
-  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
-- Docs drift:
-  - [docs-drift.md](/home/merc/Development/current/json-rest-api/audit/subsystems/docs-drift.md)
-
-## Standards takeaways
-- Strongest: method ordering discipline (validation/permissions before writes), broad JSON:API-oriented structure support, plugin extensibility.
-- Weakest: failure-path consistency for relationship PATCH and error envelope uniformity.
-- Immediate standards-critical fixes: `STD-JAPI-02`, `STD-HTTP-02`, `STD-ERR-01`.

package/audit/05-competitor-rubric.md

@@ -1,77 +0,0 @@
-# Competitor Rubric (M6, non-anyapi)
-
-## Comparator set (frozen)
-1. `jsonapi-serializer`
-2. `json-api-serializer`
-3. `jsonapi-server` (used as closest available lineage for requested `@jsonapi/server`; npm package `@jsonapi/server` is not found)
-4. `fortune` (+ JSON:API plugin model)
-5. NestJS JSON:API ecosystem (`nestjs-json-api`, `@yaser2us/json-api-nestjs`)
-6. `@jsonapi-serde/server` (+ `@jsonapi-serde/openapi`)
-
-## Source evidence
-- Package metadata and recency:
-  - [npm-competitor-metadata.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/npm-competitor-metadata.txt)
-  - [npm-jsonapi-server.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/npm-jsonapi-server.txt)
-  - [npm-modern-jsonapi-metadata.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/npm-modern-jsonapi-metadata.txt)
-- Activity/adoption signal:
-  - [npm-download-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/npm-download-signals.txt)
-- Capability claims (maintainer readmes):
-  - [readme-jsonapi-serializer-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-jsonapi-serializer-signals.txt)
-  - [readme-json-api-serializer-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-json-api-serializer-signals.txt)
-  - [readme-jsonapi-server-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-jsonapi-server-signals.txt)
-  - [readme-fortune-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-fortune-signals.txt)
-  - [readme-nestjs-json-api-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-nestjs-json-api-signals.txt)
-  - [readme-yaser-json-api-nestjs-signals.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-yaser-json-api-nestjs-signals.txt)
-  - [readme-jsonapi-serde-server.md](/home/merc/Development/current/json-rest-api/audit/evidence/external/readme-jsonapi-serde-server.md)
-
-## Facts (separated from interpretation)
-- [Fact] `@jsonapi/server` package is not available on npm (404 in metadata capture).
-- [Fact] Recent updates (2026) are visible for `jsonapi-serializer` and `@jsonapi-serde/*`; several alternatives last modified in 2022.
-- [Fact] Download volume is highest for serializer-focused packages; full-server JSON:API frameworks show lower monthly downloads.
-- [Fact] `fortune` emphasizes graph relationships/inverse updates and adapter model; JSON:API is via plugin.
-- [Fact] NestJS ecosystem options expose decorator-based CRUD/relationship endpoints and query features.
-
-## Normalized scoring dimensions
-Scoring scale: `1` weak, `3` mixed, `5` strong.
-
-Dimensions:
-- compliance depth
-- architecture flexibility
-- extensibility model
-- relationship capability depth
-- query/include sophistication
-- performance strategy
-- operational ergonomics
-- security posture
-- DX/migration complexity
-- maintenance health
-
-## Scored matrix (interpretation)
-
-| Comparator | Compliance | Flexibility | Extensibility | Relationships | Query/Include | Performance | Ops ergonomics | Security posture | DX/migration | Maintenance |
-|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
-| jsonapi-serializer | 2.5 | 4.0 | 3.0 | 2.0 | 1.0 | 4.0 | 4.0 | 3.0 | 4.5 | 5.0 |
-| json-api-serializer | 2.5 | 4.0 | 3.0 | 2.0 | 1.0 | 4.0 | 3.5 | 3.0 | 4.0 | 2.0 |
-| jsonapi-server | 3.5 | 3.0 | 3.0 | 3.5 | 3.0 | 2.5 | 2.5 | 2.5 | 3.0 | 2.0 |
-| fortune (+JSON:API plugin) | 3.0 | 4.0 | 4.0 | 4.5 | 2.5 | 3.0 | 3.0 | 3.0 | 2.5 | 3.0 |
-| NestJS JSON:API ecosystem | 3.0 | 3.5 | 3.5 | 4.0 | 3.5 | 3.0 | 3.5 | 3.5 | 3.5 | 3.0 |
-| @jsonapi-serde/server | 2.5 | 4.0 | 4.0 | 2.0 | 1.0 | 4.0 | 3.5 | 3.0 | 3.5 | 5.0 |
-
-## Positioning of this repo (non-anyapi)
-- [Inferred][C4] `json-rest-api` is positioned as a full JSON:API-oriented server framework with richer runtime relationship/query behavior than serializer-only libraries.
-- [Verified][C5] Current competitive weakness is failure-path reliability consistency (`patchRelationship` defect) and partial observability/contract consistency gaps.
-
-## Strategic takeaways
-- Must-copy patterns:
-  - Strongly typed/OpenAPI-adjacent tooling direction from `@jsonapi-serde/openapi`.
-  - Minimal-surface serializer ergonomics from `jsonapi-serializer` for simpler migration paths.
-- Intentionally-different patterns:
-  - Keep hook/plugin orchestration and storage abstraction depth (a differentiator versus serializer-only tools).
-  - Keep relationship endpoint breadth and multihome/access plugin strategy.
-- Avoid patterns:
-  - Aging/unmaintained core dependencies without clear ownership path.
-  - Config-driven magic that obscures failure semantics or transaction guarantees.
-
-## Confidence notes
-- Compliance/flexibility scores: `C3-C4` (feature claims mostly from readmes).
-- Maintenance/adoption scores: `C5` (direct npm metadata/download signals).