json-rest-api 1.0.22 → 1.0.24

package/audit/evidence/external/standard-rfc-snippets.txt

@@ -1,168 +0,0 @@
-# RFC9110 + RFC5789 key clauses (captured)
-captured_at=2026-03-01T16:01:55Z
-
-## RFC9110
-source=https://www.rfc-editor.org/rfc/rfc9110
-279:       15.5.1.  400 Bad Request
-282:       15.5.4.  403 Forbidden
-283:       15.5.5.  404 Not Found
-288:       15.5.10. 409 Conflict
-289:       15.5.11. 410 Gone
-290:       15.5.12. 411 Length Required
-291:       15.5.13. 412 Precondition Failed
-292:       15.5.14. 413 Content Too Large
-293:       15.5.15. 414 URI Too Long
-294:       15.5.16. 415 Unsupported Media Type
-295:       15.5.17. 416 Range Not Satisfiable
-296:       15.5.18. 417 Expectation Failed
-297:       15.5.19. 418 (Unused)
-386:   interface, extensible semantics, and self-descriptive messages to
-444:   All three major versions of HTTP rely on the semantics defined by
-450:   This revision of HTTP separates the definition of semantics (this
-453:   independently while referring to the same core semantics.
-466:   semantics in relation to the identified target resource, and responds
-469:   out, determining what to do next based on the status codes and
-472:   HTTP semantics include the intentions defined by each request method
-473:   (Section 9), extensions to those semantics that might be described in
-474:   request header fields, status codes that describe the response
-581:   the semantics of protocol elements sent.  For example, a client that
-631:   the semantics defined for it by this specification, including
-634:   implements what is implied by those semantics.  For example, an
-642:   specific error handling mechanisms except when they have a direct
-644:   require different error handling strategies.  For example, a Web
-647:   systems control client might consider any form of error recovery to
-662:   While HTTP's core semantics don't change between protocol versions,
-678:   semantics or implying additional capabilities of the sender.
-706:   request semantics, which is made possible by vesting the request
-707:   semantics in the request method (Section 9) and a few request-
-709:   manner inconsistent with the semantics of the method of the request.
-710:   For example, though the URI of a resource might imply semantics that
-769:   message's semantics can be understood in isolation, and that the
-800:   "response" messages, each including a status code (Section 15).  The
-803:   interpreted in accordance with the status code, and trailer fields to
-830:   reporting of errors to the user, it is acceptable for such reporting
-831:   to only be observable in an error console or log file.  Likewise,
-943:   mistakenly violating HTTP semantics.
-1217:   its presence as an error; it is likely being used to obscure the
-1272:   the semantics that users will associate with a URI, and the
-1273:   usefulness of those semantics is what ultimately transforms these
-1426:   error.  Automated clients MUST log the error to an appropriate audit
-1428:   certificate error).  Automated clients MAY provide a configuration
-1462:   semantics defined by that name.  For example, the Date header field
-1481:   their defined semantics allow them to be safely ignored by recipients
-1519:   the semantics of the message, by appending each subsequent field line
-1566:   specific field's semantics.
-1570:   appropriate 4xx (Client Error) status code.  Ignoring such header
-1575:   than the client wishes to process if the field semantics are such
-1577:   message framing or response semantics.
-1629:   detecting such errors improves interoperability.  Fields that expect
-1762:   OWS and RWS have the same semantics as a single SP.  Any content
-1771:   BWS has no semantics.  Any content known to be defined as BWS MAY be
-1824:   might not be case-sensitive, depending on the semantics of the
-1919:   semantics of day-name, day, month, year, and time-of-day are the same
-1944:   common structure, and capacity for conveying semantics.  This
-1975:   semantics, and trailer fields provide optional metadata that was
-2016:   level error indicates that it is not complete.
-2023:   Response message control data includes a status code (Section 15),
-2051:   from the response status code or header fields (e.g., Server) that
-2078:   semantics, describe the sender, define the content, or provide
-2110:   semantics (Section 9).
-2119:   method, response status code (Section 15), and response fields
-2123:   date (Section 6.6.1), whereas the content of the same status code in
-2132:   Response messages with an error status code usually contain content
-2133:   that represents the error condition, such that the content describes
-2134:   the error state and what steps are suggested for resolving it.
-2178:   1.  If the request method is HEAD or the response status code is 204
-2182:   2.  If the request method is GET and the response status code is 200
-2186:   3.  If the request method is GET and the response status code is 203
-2191:   4.  If the request method is GET and the response status code is 206
-2218:   fields in the header section to avoid contradicting message semantics
-2276:   name have the equivalent semantics as appending the multiple values
-2296:   message was originated, having the same semantics as the Origination
-2450:   semantics and, if so, where that request is to be directed.
-2494:   client to a different resource, respond with an error, or drop the
-2517:   The 421 (Misdirected Request) status code in a response indicates
-2528:   All responses, regardless of the status code (including interim
-
-## RFC5789
-source=https://www.rfc-editor.org/rfc/rfc5789.txt
-13:                         PATCH Method for HTTP
-20:   This proposal adds a new HTTP method, PATCH, to modify an existing
-60:RFC 5789                       HTTP PATCH                     March 2010
-66:   2. The PATCH Method ................................................2
-67:      2.1. A Simple PATCH Example .....................................4
-82:   This specification defines the new HTTP/1.1 [RFC2616] method, PATCH,
-83:   which is used to apply partial modifications to a resource.
-86:   errors.  The PUT method is already defined to overwrite a resource
-91:   discover patch format support).  PATCH was mentioned in earlier HTTP
-94:   In this document, the key words "MUST", "MUST NOT", "REQUIRED",
-95:   "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
-101:2.  The PATCH Method
-103:   The PATCH method requests that a set of changes described in the
-116:RFC 5789                       HTTP PATCH                     March 2010
-119:   The difference between the PUT and PATCH requests is reflected in the
-124:   be replaced.  With PATCH, however, the enclosed entity contains a set
-126:   origin server should be modified to produce a new version.  The PATCH
-130:   PATCH.
-132:   PATCH is neither safe nor idempotent as defined by [RFC2616], Section
-135:   A PATCH request can be issued in such a way as to be idempotent,
-137:   PATCH requests on the same resource in a similar time frame.
-138:   Collisions from multiple PATCH requests may be more dangerous than
-141:   using this kind of patch application SHOULD use a conditional request
-144:   can use a strong ETag [RFC2616] in an If-Match header on the PATCH
-152:   The server MUST apply the entire set of changes atomically and never
-155:   cannot be successfully applied, then the server MUST NOT apply any of
-157:   PATCH can vary depending on the patch document and the type of
-160:   directory hierarchy.  The atomicity requirement holds for all
-162:   details on status codes and possible error conditions.
-165:   one or more currently cached entities, those entries SHOULD be
-172:RFC 5789                       HTTP PATCH                     March 2010
-177:   header matching the Request-URI, indicating that the PATCH response
-178:   body is a resource representation.  A cached PATCH response can only
-179:   be used to respond to subsequent GET and HEAD requests; it MUST NOT
-180:   be used to respond to other methods (in particular, PATCH).
-183:   contained patch document and MUST NOT be applied to the resource
-186:   the patch document had a language.  Servers SHOULD NOT store such
-187:   headers except as trace information, and SHOULD NOT use such header
-193:   There is no guarantee that a resource can be modified with PATCH.
-198:   are required to support.  Servers MUST ensure that a received patch
-202:   Clients need to choose when to use PATCH rather than PUT.  For
-205:   sense to use PUT instead of PATCH.  A comparison to POST is even more
-207:   encompass PUT and PATCH-like operations if the server chooses.  If
-209:   URI in a predictable way, POST should be considered instead of PATCH
-212:2.1.  A Simple PATCH Example
-214:   PATCH /file.txt HTTP/1.1
-228:RFC 5789                       HTTP PATCH                     March 2010
-234:   Successful PATCH response to existing text file:
-245:   entity created by applying the PATCH, available at
-251:   There are several known conditions under which a PATCH request can
-256:      SHOULD return a 400 (Bad Request) response.  The definition of
-262:      identified by the Request-URI.  Such a response SHOULD include an
-274:      more specific errors like "Conflicting State" that could be
-275:      signaled with this status code, but the more specific error would
-284:RFC 5789                       HTTP PATCH                     March 2010
-301:      precondition failed, then the 412 (Precondition Failed) error is
-308:   Concurrent modification:  Some applications of PATCH might require
-313:      indicate this error by using a 409 (Conflict) response.
-325:   The entity body of error responses SHOULD contain enough information
-326:   to communicate the nature of the error to the client.  The content-
-340:RFC 5789                       HTTP PATCH                     March 2010
-345:   A server can advertise its support for the PATCH method by adding it
-347:   header defined in HTTP/1.1.  The PATCH method MAY appear in the
-355:   Accept-Patch SHOULD appear in the OPTIONS response for any resource
-356:   that supports the use of the PATCH method.  The presence of the
-358:   indication that PATCH is allowed on the resource identified by the
-383:   Allow: GET, PUT, POST, OPTIONS, HEAD, DELETE, PATCH
-386:   The examples show a server that supports PATCH generally using two
-396:RFC 5789                       HTTP PATCH                     March 2010
-416:   The security considerations for PATCH are nearly identical to the
-420:   transport errors or through accidental overwrites.  Whatever
-421:   mechanisms are used for PUT can be used for PATCH as well.  The
-422:   following considerations apply especially to PATCH.
-428:   Section 2.  If a PATCH request fails, the client can issue a GET
-431:   if the PATCH request can be resent, but in other cases, the attempt
-433:   of a failure of the underlying transport channel, where a PATCH
-442:   response.  The PATCH method complicates such watch-keeping because
-452:RFC 5789                       HTTP PATCH                     March 2010
-463:   documents.  Servers MUST take adequate precautions to ensure that
-465:   CPU, disk I/O) through the client's use of PATCH.

package/audit/evidence/external/standards-sources.txt

@@ -1,6 +0,0 @@
-# Standards references fetch time
-captured_at=2026-03-01T16:01:15Z
-jsonapi_format=https://jsonapi.org/format/
-rfc9110=https://www.rfc-editor.org/rfc/rfc9110
-rfc5789=https://www.rfc-editor.org/rfc/rfc5789
-fetch_cors=https://fetch.spec.whatwg.org/#http-cors-protocol

package/audit/evidence/runtime/baseline-commits.txt

@@ -1,2 +0,0 @@
-json-rest-api 72c08eec75f696a80c70b25608ed7c19eb505698
-json-rest-schema 9c30d3ba7317407a69231515fd58196862b25b34

package/audit/evidence/runtime/db-adapter-assumptions.txt

@@ -1,3 +0,0 @@
-json-rest-api package peerDeps: knex optional, express/socket.io optional
-json-rest-api tests default storage mode: knex (SQLite in-memory for fixtures)
-json-rest-schema tests: knex + sqlite3

package/audit/evidence/runtime/environment.txt

@@ -1,4 +0,0 @@
-date_utc=2026-03-01T15:32:20Z
-node=v20.19.0
-npm=11.6.2
-os=Linux merc-ThinkPad-X1-Carbon-Gen-8 6.14.0-37-generic #37~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 10:25:38 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

package/audit/evidence/runtime/invariant-runtime-mapping.md

@@ -1,38 +0,0 @@
-# Runtime-to-Invariant Mapping (M5)
-
-## Observed runtime/test failures
-
-1. `patchRelationship` failure path emits `ReferenceError: handleWriteMethodError is not defined`.
-- Evidence:
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Invariant impact:
-  - `INV-001` fail
-  - `INV-008` fail
-- Risk mapping:
-  - `RISK-001`
-
-2. Positioning multifilter suite has 2 assertion failures.
-- Evidence:
-  - [failing-tests-summary.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/failing-tests-summary.txt)
-- Invariant impact:
-  - `INV-010` partial
-  - `INV-012` partial
-- Risk mapping:
-  - `RISK-002`
-
-3. `json-rest-schema` suite has 1 failing import contract test.
-- Evidence:
-  - [npm-test-json-rest-schema.log](/home/merc/Development/current/json-rest-api/audit/evidence/tests/npm-test-json-rest-schema.log)
-- Invariant impact:
-  - `INV-012` partial
-- Risk mapping:
-  - `RISK-004`
-
-## Non-failing but risk-relevant runtime signal
-- Full `json-rest-api` run includes 324 passing tests with 10 skipped; skips concentrate in cursor multifield pagination suite.
-- Evidence:
-  - [test-summary.md](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/test-summary.md)
-  - [skipped-tests.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/skipped-tests.txt)
-- Invariant impact:
-  - `INV-007` partial
-  - `INV-012` partial

package/audit/evidence/runtime/probe-patch-relationship-error.exitcode

@@ -1 +0,0 @@
-1

package/audit/evidence/runtime/probe-patch-relationship-error.log

@@ -1,76 +0,0 @@
-2026-03-01T15:55:13.737Z [INFO] [basic-test-api] Installing plugin 'rest-api' {
-  options: {
-    simplifiedApi: false,
-    simplifiedTransport: false,
-    returnRecordApi: { post: true, put: false, patch: false },
-    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
-    sortableFields: [ 'id', 'title', 'country_id', 'publisher_id', 'name', 'code' ]
-  }
-}
-2026-03-01T15:55:13.741Z [INFO] [basic-test-api] Plugin 'rest-api' installed successfully { duration: '1ms' }
-2026-03-01T15:55:13.742Z [INFO] [basic-test-api] Installing plugin 'rest-api-knex' { options: '[Object with methods]' }
-2026-03-01T15:55:13.747Z [INFO] [basic-test-api:plugin:rest-api-knex] Database capabilities detected: { database: 'SQLite', version: '3.49.2', windowFunctions: true }
-2026-03-01T15:55:13.747Z [INFO] [basic-test-api:plugin:rest-api-knex] RestApiKnexPlugin installed - basic CRUD operations ready
-2026-03-01T15:55:13.747Z [INFO] [basic-test-api] Plugin 'rest-api-knex' installed successfully { duration: '5ms' }
-2026-03-01T15:55:13.748Z [INFO] [basic-test-api] Scope 'countries' added successfully
-2026-03-01T15:55:13.750Z [INFO] [basic-test-api:global] Routes registered for scope 'countries'
-2026-03-01T15:55:13.753Z [INFO] [basic-test-api] Scope 'publishers' added successfully
-2026-03-01T15:55:13.753Z [INFO] [basic-test-api:global] Routes registered for scope 'publishers'
-2026-03-01T15:55:13.754Z [INFO] [basic-test-api] Scope 'authors' added successfully
-2026-03-01T15:55:13.754Z [INFO] [basic-test-api:global] Routes registered for scope 'authors'
-2026-03-01T15:55:13.754Z [INFO] [basic-test-api] Scope 'books' added successfully
-2026-03-01T15:55:13.755Z [INFO] [basic-test-api:global] Routes registered for scope 'books'
-2026-03-01T15:55:13.755Z [INFO] [basic-test-api] Scope 'book_authors' added successfully
-2026-03-01T15:55:13.755Z [INFO] [basic-test-api:global] Routes registered for scope 'book_authors'
-
-=== invalid relationshipData type (string) ===
-2026-03-01T15:55:13.768Z [ERROR] [basic-test-api:books] Error in PATCH method {
-  scopeName: 'books',
-  method: 'patch',
-  inputRecord: { data: { type: 'books', id: '1', relationships: [Object] } },
-  error: {
-    name: 'RestApiPayloadError',
-    message: "Relationship 'authors': Resource identifier must be an object",
-    stack: "RestApiPayloadError: Relationship 'authors': Resource identifier must be an object\n" +
-      '    at validateResourceIdentifier (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:104:11)\n' +
-      '    at validateRelationship (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:232:5)\n' +
-      '    at file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1309:7\n' +
-      '    at Array.forEach (<anonymous>)\n' +
-      '    at validatePatchPayload (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1308:40)\n' +
-      '    at patchMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js:64:5)\n' +
-      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
-      '    at async patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:28:5)\n' +
-      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
-      '    at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-error.mjs:50:7)',
-    code: 'REST_API_PAYLOAD',
-    type: 'rest_api_payload',
-    path: "Relationship 'authors'",
-    details: {
-      path: "Relationship 'authors'",
-      expected: 'object',
-      received: 'string'
-    }
-  },
-  errorSummary: "Relationship 'authors': Resource identifier must be an object | code: REST_API_PAYLOAD"
-}
-2026-03-01T15:55:13.769Z [ERROR] [basic-test-api] Scope method 'patch' on 'books' failed {
-  error: "Relationship 'authors': Resource identifier must be an object",
-  duration: '2ms'
-}
-2026-03-01T15:55:13.769Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed { error: 'handleWriteMethodError is not defined', duration: '2ms' }
-RESULT: error
-NAME: ReferenceError
-MESSAGE: handleWriteMethodError is not defined
-STACK_HEAD: ReferenceError: handleWriteMethodError is not defined |     at patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53:5) |     at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34) |     at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-error.mjs:50:7)
-
-=== invalid relationshipData shape (object) ===
-2026-03-01T15:56:13.771Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed {
-  error: 'Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call?',
-  duration: '60002ms'
-}
-RESULT: error
-NAME: KnexTimeoutError
-MESSAGE: Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call?
-STACK_HEAD: KnexTimeoutError: Knex: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call? |     at Client_BetterSQLite3.acquireConnection (/home/merc/Development/current/json-rest-api/node_modules/knex/lib/client.js:332:26) |     at async Transaction_Sqlite.acquireConnection (/home/merc/Development/current/json-rest-api/node_modules/knex/lib/execution/transaction.js:262:28)
-
-=== missing book id ===

package/audit/evidence/runtime/probe-patch-relationship-error.mjs

@@ -1,67 +0,0 @@
-import knexLib from 'knex'
-import { createBasicApi } from '../../../tests/fixtures/api-configs.js'
-import { createJsonApiDocument, createRelationship, resourceIdentifier } from '../../../tests/helpers/test-utils.js'
-
-const knex = knexLib({
-  client: 'better-sqlite3',
-  connection: { filename: ':memory:' },
-  useNullAsDefault: true
-})
-
-function header (name) { console.log(`\n=== ${name} ===`) }
-
-async function main () {
-  const api = await createBasicApi(knex, { includeExpress: false })
-
-  const country = await api.resources.countries.post({
-    inputRecord: createJsonApiDocument('countries', { name: 'USA', code: 'US' }),
-    simplified: false
-  })
-
-  const book = await api.resources.books.post({
-    inputRecord: createJsonApiDocument('books', { title: 'Book 1' }, {
-      country: createRelationship(resourceIdentifier('countries', country.data.id))
-    }),
-    simplified: false
-  })
-
-  const scenarios = [
-    {
-      name: 'invalid relationshipData type (string)',
-      args: { id: book.data.id, relationshipName: 'authors', relationshipData: 'bad-type' }
-    },
-    {
-      name: 'invalid relationshipData shape (object)',
-      args: { id: book.data.id, relationshipName: 'authors', relationshipData: { type: 'authors', id: 1 } }
-    },
-    {
-      name: 'missing book id',
-      args: { id: 999999, relationshipName: 'authors', relationshipData: [] }
-    },
-    {
-      name: 'unknown relationship name',
-      args: { id: book.data.id, relationshipName: 'nonexistentRelationship', relationshipData: [] }
-    }
-  ]
-
-  for (const s of scenarios) {
-    header(s.name)
-    try {
-      await api.resources.books.patchRelationship(s.args)
-      console.log('RESULT: success')
-    } catch (error) {
-      console.log('RESULT: error')
-      console.log('NAME:', error?.name)
-      console.log('MESSAGE:', error?.message)
-      console.log('STACK_HEAD:', String(error?.stack || '').split('\n').slice(0, 6).join(' | '))
-    }
-  }
-
-  await knex.destroy()
-}
-
-main().catch(async (e) => {
-  console.error('FATAL:', e)
-  await knex.destroy()
-  process.exitCode = 1
-})

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.exitcode

@@ -1 +0,0 @@
-0

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.log

@@ -1,62 +0,0 @@
-2026-03-01T15:57:20.166Z [INFO] [basic-test-api] Installing plugin 'rest-api' {
-  options: {
-    simplifiedApi: false,
-    simplifiedTransport: false,
-    returnRecordApi: { post: true, put: false, patch: false },
-    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
-    sortableFields: [ 'id', 'title', 'country_id', 'publisher_id', 'name', 'code' ]
-  }
-}
-2026-03-01T15:57:20.170Z [INFO] [basic-test-api] Plugin 'rest-api' installed successfully { duration: '1ms' }
-2026-03-01T15:57:20.171Z [INFO] [basic-test-api] Installing plugin 'rest-api-knex' { options: '[Object with methods]' }
-2026-03-01T15:57:20.177Z [INFO] [basic-test-api:plugin:rest-api-knex] Database capabilities detected: { database: 'SQLite', version: '3.49.2', windowFunctions: true }
-2026-03-01T15:57:20.177Z [INFO] [basic-test-api:plugin:rest-api-knex] RestApiKnexPlugin installed - basic CRUD operations ready
-2026-03-01T15:57:20.177Z [INFO] [basic-test-api] Plugin 'rest-api-knex' installed successfully { duration: '6ms' }
-2026-03-01T15:57:20.178Z [INFO] [basic-test-api] Scope 'countries' added successfully
-2026-03-01T15:57:20.180Z [INFO] [basic-test-api:global] Routes registered for scope 'countries'
-2026-03-01T15:57:20.184Z [INFO] [basic-test-api] Scope 'publishers' added successfully
-2026-03-01T15:57:20.184Z [INFO] [basic-test-api:global] Routes registered for scope 'publishers'
-2026-03-01T15:57:20.185Z [INFO] [basic-test-api] Scope 'authors' added successfully
-2026-03-01T15:57:20.185Z [INFO] [basic-test-api:global] Routes registered for scope 'authors'
-2026-03-01T15:57:20.186Z [INFO] [basic-test-api] Scope 'books' added successfully
-2026-03-01T15:57:20.186Z [INFO] [basic-test-api:global] Routes registered for scope 'books'
-2026-03-01T15:57:20.187Z [INFO] [basic-test-api] Scope 'book_authors' added successfully
-2026-03-01T15:57:20.187Z [INFO] [basic-test-api:global] Routes registered for scope 'book_authors'
-2026-03-01T15:57:20.204Z [ERROR] [basic-test-api:books] Error in PATCH method {
-  scopeName: 'books',
-  method: 'patch',
-  inputRecord: { data: { type: 'books', id: '1', relationships: [Object] } },
-  error: {
-    name: 'RestApiPayloadError',
-    message: "Relationship 'authors': Resource identifier must be an object",
-    stack: "RestApiPayloadError: Relationship 'authors': Resource identifier must be an object\n" +
-      '    at validateResourceIdentifier (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:104:11)\n' +
-      '    at validateRelationship (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:232:5)\n' +
-      '    at file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1309:7\n' +
-      '    at Array.forEach (<anonymous>)\n' +
-      '    at validatePatchPayload (file:///home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js:1308:40)\n' +
-      '    at patchMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js:64:5)\n' +
-      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
-      '    at async patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:28:5)\n' +
-      '    at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34)\n' +
-      '    at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs:27:5)',
-    code: 'REST_API_PAYLOAD',
-    type: 'rest_api_payload',
-    path: "Relationship 'authors'",
-    details: {
-      path: "Relationship 'authors'",
-      expected: 'object',
-      received: 'string'
-    }
-  },
-  errorSummary: "Relationship 'authors': Resource identifier must be an object | code: REST_API_PAYLOAD"
-}
-2026-03-01T15:57:20.205Z [ERROR] [basic-test-api] Scope method 'patch' on 'books' failed {
-  error: "Relationship 'authors': Resource identifier must be an object",
-  duration: '2ms'
-}
-2026-03-01T15:57:20.205Z [ERROR] [basic-test-api] Scope method 'patchRelationship' on 'books' failed { error: 'handleWriteMethodError is not defined', duration: '4ms' }
-PROBE_RESULT=error
-ERROR_NAME=ReferenceError
-ERROR_MESSAGE=handleWriteMethodError is not defined
-ERROR_STACK=ReferenceError: handleWriteMethodError is not defined |     at patchRelationshipMethod (file:///home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53:5) |     at async Proxy.<anonymous> (file:///home/merc/Development/current/json-rest-api/node_modules/hooked-api/index.js:593:34) |     at async main (file:///home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs:27:5)

package/audit/evidence/runtime/probe-patch-relationship-referenceerror.mjs

@@ -1,47 +0,0 @@
-import knexLib from 'knex'
-import { createBasicApi } from '../../../tests/fixtures/api-configs.js'
-import { createJsonApiDocument, createRelationship, resourceIdentifier } from '../../../tests/helpers/test-utils.js'
-
-const knex = knexLib({
-  client: 'better-sqlite3',
-  connection: { filename: ':memory:' },
-  useNullAsDefault: true
-})
-
-async function main () {
-  const api = await createBasicApi(knex, { includeExpress: false })
-
-  const country = await api.resources.countries.post({
-    inputRecord: createJsonApiDocument('countries', { name: 'USA', code: 'US' }),
-    simplified: false
-  })
-
-  const book = await api.resources.books.post({
-    inputRecord: createJsonApiDocument('books', { title: 'Book 1' }, {
-      country: createRelationship(resourceIdentifier('countries', country.data.id))
-    }),
-    simplified: false
-  })
-
-  try {
-    await api.resources.books.patchRelationship({
-      id: book.data.id,
-      relationshipName: 'authors',
-      relationshipData: 'bad-type'
-    })
-    console.log('PROBE_RESULT=unexpected_success')
-  } catch (error) {
-    console.log('PROBE_RESULT=error')
-    console.log('ERROR_NAME=' + (error?.name || ''))
-    console.log('ERROR_MESSAGE=' + (error?.message || ''))
-    console.log('ERROR_STACK=' + String(error?.stack || '').split('\n').slice(0, 4).join(' | '))
-  }
-
-  await knex.destroy()
-}
-
-main().catch(async (e) => {
-  console.error('PROBE_FATAL=' + (e?.message || e))
-  await knex.destroy()
-  process.exitCode = 1
-})

package/audit/evidence/runtime/test-exitcodes.txt

@@ -1,4 +0,0 @@
-json-rest-api:
-1
-json-rest-schema:
-1

package/audit/evidence/runtime/test-summary.md

@@ -1,107 +0,0 @@
-# Runtime test summary (non-anyapi)
-
-## json-rest-api npm test
-log: audit/evidence/tests/npm-test-json-rest-api.log
-5335:    ok 2 - auto assigns ownership when creating a project
-5340:    ok 3 - filters query results by ownership for non-admin users
-5345:    ok 4 - allows admin roles to bypass ownership filtering
-5350:    ok 5 - prevents users from accessing records they do not own
-5355:    ok 6 - enforces helper ownership checks
-5360:ok 28 - Access plugin
-5458:            ok 1 - should create a country
-5463:            ok 2 - should create a publisher with country relationship
-5468:            ok 3 - should fail to create resource with missing required field
-5473:        ok 1 - POST - Create Resources
-5480:            ok 1 - should retrieve a single resource
-5485:            ok 2 - should fail to retrieve non-existent resource
-5490:            ok 3 - should retrieve collection of resources
-5495:        ok 2 - GET - Retrieve Resources
-5502:            ok 1 - should partially update a resource
-5507:        ok 3 - PATCH - Update Resources
-5514:            ok 1 - should delete an existing resource
-5519:        ok 4 - DELETE - Remove Resources
-5525:    ok 1 - Basic CRUD Operations
-5531:ok 29 - REST API Tests
-5556:    ok 1 - should merge search:true fields with explicit searchSchema
-5561:    ok 2 - should work with only search:true fields (no explicit searchSchema)
-5566:    ok 3 - should work with only explicit searchSchema (no search:true)
-5571:    ok 4 - should allow filtering with merged searchSchema fields
-5576:ok 30 - SearchSchema Merge Behavior
-5619:        ok 1 - should receive minimal notifications for subscribed resources
-5631:        ok 2 - should not receive notifications for non-matching filters
-5636:    ok 1 - Basic Subscription and Notifications
-5656:        ok 1 - should validate filters against searchSchema
-5667:        ok 2 - should reject function filters without filterRecord
-5672:    ok 2 - Filter Validation
-5709:        ok 1 - should not broadcast when operations fail
-5717:        ok 2 - should broadcast after successful operations
-5722:    ok 3 - Transaction Safety
-5733:        ok 1 - should handle multiple subscriptions from same client
-5742:        ok 2 - should unsubscribe correctly
-5747:    ok 4 - Multiple Subscriptions
-5757:        ok 1 - should receive notifications for updates
-5765:        ok 2 - should receive notifications for deletes
-5770:    ok 5 - Update and Delete Notifications
-5784:        ok 1 - should filter by relationship fields
-5789:    ok 6 - Relationship Filters
-5795:ok 31 - WebSocket/Socket.IO Plugin
-5819:        ok 1 - should accept virtual fields in POST request
-5824:        ok 2 - should not store virtual fields in database
-5829:        ok 3 - should handle virtual fields in PATCH request
-5834:        ok 4 - should respect sparse fieldsets with virtual fields on PATCH
-5839:        ok 5 - should exclude virtual fields when not requested in sparse fieldsets
-5844:        ok 6 - should handle PUT requests with virtual fields
-5849:    ok 1 - Virtual field validation
-5856:        ok 1 - should handle both virtual and computed fields correctly
-5861:        ok 2 - should calculate computed fields regardless of input
-5866:    ok 2 - Virtual fields vs computed fields
-5872:ok 32 - Virtual Fields Tests
-5878:# tests 336
-5879:# suites 164
-5880:# pass 324
-5881:# fail 2
-5883:# skipped 10
-5885:# duration_ms 15332.355453
-
-## json-rest-schema npm test
-log: audit/evidence/tests/npm-test-json-rest-schema.log
-174:    ok 7 - type:'string' should process input undefined to undefined
-179:    ok 8 - type:'string' should fail for input: {}
-184:    ok 9 - type:'number' should process input "42.5" to 42.5
-189:    ok 10 - type:'number' should process input "" to 0
-194:    ok 11 - type:'number' should fail for input: null
-199:    ok 12 - type:'number' should fail for input: "abc"
-204:    ok 13 - type:'timestamp' should process input 1672531200000 to 1672531200000
-209:    ok 14 - type:'timestamp' should process input "0" to null
-214:    ok 15 - type:'timestamp' should fail for input: "abc"
-219:    ok 16 - type:'dateTime' should process input "2025-01-01T12:30:00Z" to "2025-01-01T12:30:00.000Z"
-224:    ok 17 - type:'dateTime' should process input "invalid" to null
-229:    ok 18 - type:'date' should process input "2025-01-01T12:30:00Z" to "2025-01-01T00:00:00.000Z"
-234:    ok 19 - type:'date' should process input "2025-01-01" to "2025-01-01T00:00:00.000Z"
-239:    ok 20 - type:'array' should process input "one" to ["one"]
-244:    ok 21 - type:'array' should process input ["one","two"] to ["one","two"]
-249:    ok 22 - type:'boolean' should process input "true" to true
-254:    ok 23 - type:'boolean' should process input "on" to true
-259:    ok 24 - type:'boolean' should process input "false" to false
-264:    ok 25 - type:'boolean' should process input 1 to true
-269:    ok 26 - type:'boolean' should process input 0 to false
-274:    ok 27 - type:'boolean' should process input "no" to false
-279:    ok 28 - type:'id' should process input "123" to 123
-284:    ok 29 - type:'id' should fail for input: "id-123"
-289:    ok 30 - type:'serialize' should process an object to a string
-294:    ok 31 - type:`serialize` should handle circular references
-299:ok 4 - 3. Core Plugin: Type Handlers
-306:    ok 1 - `min`/`max` validators should work for numbers, `minLength`/`maxLength` for strings
-311:    ok 2 - `validator` should work with a custom function (sync and async)
-316:    ok 3 - `uppercase`/`lowercase` should transform strings
-321:    ok 4 - `length` should truncate strings and error on long numbers
-326:    ok 5 - `notEmpty` should fail on empty strings
-331:ok 5 - 4. Core Plugin: Validator Handlers
-338:    ok 1 - should allow defining and using a custom plugin
-343:ok 6 - 5. Extensibility: Custom Plugins
-349:# tests 57
-350:# suites 6
-351:# pass 56
-352:# fail 1
-354:# skipped 0
-356:# duration_ms 163.644013