json-rest-api 1.0.22 → 1.0.24

package/audit/evidence/tests/relationship-test-signals.txt

@@ -1,223 +0,0 @@
-tests/custom-idproperty-relationships.test.js:114:    it('should create resource with belongsTo relationship using custom IDs', async () => {
-tests/custom-idproperty-relationships.test.js:125:      // Create publisher with country relationship
-tests/custom-idproperty-relationships.test.js:166:    it('should update belongsTo relationship via PATCH', async () => {
-tests/custom-idproperty-relationships.test.js:189:          relationships: {
-tests/custom-idproperty-relationships.test.js:253:    it('should create many-to-many relationships with custom IDs', async () => {
-tests/custom-idproperty-relationships.test.js:300:    it('should handle PATCH updates to many-to-many relationships', async () => {
-tests/custom-idproperty-relationships.test.js:317:          relationships: {
-tests/custom-idproperty-relationships.test.js:335:      // With include, we should get the authors relationship data
-tests/custom-idproperty-relationships.test.js:467:    it('should handle nested includes through custom ID relationships', async () => {
-tests/custom-idproperty-relationships.test.js:514:      // Verify nested relationship
-tests/custom-idproperty-relationships.test.js:515:      assert.equal(includedPublisher.relationships.country.data.id, country.data.id)
-tests/custom-idproperty-relationships.test.js:685:      // This should fail: trying to go too deep (if we had deeper relationships)
-tests/custom-idproperty-relationships.test.js:810:      // Verify all relationships were created
-tests/custom-idproperty-relationships.test.js:885:            relationships: {
-tests/curl.test.js:240:      // Create publisher with country relationship
-tests/queries.test.js:94:      // Create 5 books with various relationships
-tests/queries.test.js:303:      // Sort test books by country relationship for verification
-tests/queries.test.js:305:        const countryA = a.relationships.country.data.id
-tests/queries.test.js:306:        const countryB = b.relationships.country.data.id
-tests/queries.test.js:315:      assert.equal(sortedTestBooks[0].relationships.country.data.id, country1Result.data.id)
-tests/queries.test.js:316:      assert.equal(sortedTestBooks[1].relationships.country.data.id, country1Result.data.id)
-tests/queries.test.js:317:      assert.equal(sortedTestBooks[2].relationships.country.data.id, country2Result.data.id)
-tests/queries.test.js:318:      assert.equal(sortedTestBooks[3].relationships.country.data.id, country2Result.data.id)
-tests/queries.test.js:497:    it('should filter and include relationships', async () => {
-tests/socketio.test.js:366:        // Try to create a book without required country relationship
-tests/socketio.test.js:369:          // Missing required country relationship
-tests/socketio.test.js:379:          // Expected to fail due to missing required relationship
-tests/socketio.test.js:707:    it('should filter by relationship fields', async () => {
-tests/rest-api.test.js:90:      it('should create a publisher with country relationship', async () => {
-tests/rest-api.test.js:102:        // Create publisher with country relationship
-tests/rest-api.test.js:126:        // Verify data and relationship through API
-tests/nested-includes.test.js:59:      relationships: {
-tests/nested-includes.test.js:77:      relationships: {
-tests/nested-includes.test.js:100:      relationships: {
-tests/nested-includes.test.js:210:      // Create relationships
-tests/nested-includes.test.js:242:    it('should populate reverse relationships when using nested includes', async () => {
-tests/nested-includes.test.js:261:      // Verify each book has its authors relationship populated
-tests/nested-includes.test.js:263:        assert(book.relationships?.authors?.data, `Book ${book.id} should have authors relationship`)
-tests/nested-includes.test.js:266:          assert.equal(book.relationships.authors.data.length, 1, 'Book 1 should have 1 author')
-tests/nested-includes.test.js:267:          assert.equal(book.relationships.authors.data[0].id, '1', 'Book 1 should have Author 1')
-tests/nested-includes.test.js:269:          assert.equal(book.relationships.authors.data.length, 2, 'Book 2 should have 2 authors')
-tests/nested-includes.test.js:270:          const authorIds = book.relationships.authors.data.map(a => a.id).sort()
-tests/nested-includes.test.js:273:          assert.equal(book.relationships.authors.data.length, 1, 'Book 3 should have 1 author')
-tests/nested-includes.test.js:274:          assert.equal(book.relationships.authors.data[0].id, '2', 'Book 3 should have Author 2')
-tests/nested-includes.test.js:319:      assert(author1.relationships?.books?.data, 'Author 1 should have books relationship')
-tests/nested-includes.test.js:322:      const bookCount = author1.relationships.books.data.length
-tests/nested-includes.test.js:326:      // All included books should have their authors relationship populated
-tests/nested-includes.test.js:330:      // At least some books should have their authors relationship populated
-tests/nested-includes.test.js:332:        book.relationships?.authors?.data && book.relationships.authors.data.length > 0
-tests/nested-includes.test.js:334:      assert(booksWithAuthors.length > 0, 'At least some books should have authors relationship populated')
-tests/nested-includes.test.js:422:      // All defined relationships will be included when requested via ?include=
-tests/nested-includes.test.js:424:      // Verify nested relationships are populated
-tests/nested-includes.test.js:426:        assert(book.relationships?.publisher?.data, 'Book should have publisher relationship')
-tests/nested-includes.test.js:430:        assert(publisher.relationships?.country?.data, 'Publisher should have country relationship')
-tests/nested-includes.test.js:449:      // Authors should have their relationships populated
-tests/nested-includes.test.js:452:        assert(author.relationships?.country?.data, 'Author should have country relationship')
-tests/nested-includes.test.js:453:        assert(author.relationships?.books?.data, 'Author should have books relationship')
-tests/nested-includes.test.js:537:      // Note: Some internal fields like pages and _relationshipMetadata might still be present
-tests/nested-includes.test.js:547:      assert(book.relationships?.reviews?.data, 'Book should have reviews relationship')
-tests/nested-includes.test.js:553:      // Create simple circular relationship data
-tests/nested-includes.test.js:607:      // All relationships should be properly populated
-tests/nested-includes.test.js:609:        assert(book.relationships?.authors?.data, 'Book should have authors relationship')
-tests/nested-includes.test.js:613:        assert(author.relationships?.books?.data, 'Author should have books relationship')
-tests/rest-api-access.test.js:161:    const relatedUserIds = adminQuery.data.map((resource) => resource.relationships.user.data.id).sort()
-tests/computed-fields.test.js:293:    it('should always include minimal relationship objects regardless of sparse fieldsets', async () => {
-tests/computed-fields.test.js:301:      // Minimal relationship objects should still be included
-tests/computed-fields.test.js:311:    it('should include empty arrays for empty relationships', async () => {
-tests/includes.test.js:99:    it('should include single belongsTo relationship', async () => {
-tests/includes.test.js:121:    it('should include multiple relationships', async () => {
-tests/includes.test.js:149:    it('should include relationships in collection queries', async () => {
-tests/includes.test.js:210:    it('should include nested relationships', async () => {
-tests/includes.test.js:232:      // Verify the publisher has country relationship
-tests/includes.test.js:233:      assert(publisher.relationships?.country, 'Publisher should have country relationship')
-tests/includes.test.js:234:      assert.equal(publisher.relationships.country.data.id, country.id)
-tests/includes.test.js:238:      // Create an author to have more relationships
-tests/includes.test.js:250:          relationships: {
-tests/includes.test.js:343:    it('should include relationships with sparse fieldsets', async () => {
-tests/polymorphic-simple.test.js:83:    // Polymorphic fields are no longer in attributes, they're in relationships
-tests/polymorphic-simple.test.js:84:    assert.equal(retrievedReview.data.relationships.reviewable.data.type, 'books')
-tests/polymorphic-simple.test.js:85:    assert.equal(retrievedReview.data.relationships.reviewable.data.id, String(book.data.id))
-tests/polymorphic-simple.test.js:141:    // Polymorphic fields are no longer in attributes, they're in relationships
-tests/polymorphic-simple.test.js:142:    const bookReview = result.data.find(r => r.relationships.reviewable.data.type === 'books')
-tests/polymorphic-simple.test.js:143:    const authorReview = result.data.find(r => r.relationships.reviewable.data.type === 'authors')
-tests/include-depth-validation.test.js:27:    // Set up test data with nested relationships
-tests/include-depth-validation.test.js:47:          relationships: {
-tests/include-depth-validation.test.js:59:          relationships: {
-tests/include-depth-validation.test.js:71:          relationships: {
-tests/include-depth-validation.test.js:98:      // The included array may or may not be present depending on whether relationships exist
-tests/include-depth-validation.test.js:105:      // Note: The included array might be present even if some relationships don't have data
-tests/include-depth-validation.test.js:223:            relationships: {
-tests/include-depth-validation.test.js:235:            relationships: {
-tests/include-depth-validation.test.js:288:            relationships: {
-tests/include-depth-validation.test.js:300:            relationships: {
-tests/polymorphic-relationships.test.js:78:      // we need to GET the record to verify the relationship was saved correctly
-tests/polymorphic-relationships.test.js:102:      // Polymorphic fields are no longer in attributes, they're in relationships
-tests/polymorphic-relationships.test.js:103:      assert.equal(review.data.relationships.reviewable.data.type, 'authors')
-tests/polymorphic-relationships.test.js:104:      assert.equal(review.data.relationships.reviewable.data.id, String(author.data.id))
-tests/polymorphic-relationships.test.js:138:      // Polymorphic fields are no longer in attributes, they're in relationships
-tests/polymorphic-relationships.test.js:139:      assert.equal(review.data.relationships.reviewable.data.type, 'publishers')
-tests/polymorphic-relationships.test.js:140:      assert.equal(review.data.relationships.reviewable.data.id, String(publisher.data.id))
-tests/polymorphic-relationships.test.js:144:      // Skip this test for now - polymorphic validation happens at relationship level
-tests/polymorphic-relationships.test.js:145:      // not at the attribute level, so we need to create a proper relationship
-tests/polymorphic-relationships.test.js:342:        r.relationships.reviewable.data.type === 'books' &&
-tests/polymorphic-relationships.test.js:343:        String(r.relationships.reviewable.data.id) === String(book.data.id)
-tests/relationships.test.js:50:    it('should create resource with belongsTo relationship', async () => {
-tests/relationships.test.js:62:      // Create publisher with country relationship
-tests/relationships.test.js:99:    it('should update belongsTo relationship via PATCH', async () => {
-tests/relationships.test.js:130:          relationships: {
-tests/relationships.test.js:154:    it('should clear belongsTo relationship with null', async () => {
-tests/relationships.test.js:172:      // Clear the relationship
-tests/relationships.test.js:177:          relationships: {
-tests/relationships.test.js:189:      // Verify relationship cleared
-tests/relationships.test.js:195:      assert(getResult.data.relationships)
-tests/relationships.test.js:196:      assert.equal(getResult.data.relationships.country.data, null)
-tests/relationships.test.js:264:      assert(getResult.data.relationships.authors)
-tests/relationships.test.js:265:      assert.equal(getResult.data.relationships.authors.data.length, 2)
-tests/relationships.test.js:274:    it('should update many-to-many relationships via PUT (complete replacement)', async () => {
-tests/relationships.test.js:324:          relationships: {
-tests/relationships.test.js:345:      // GET to verify new relationships
-tests/relationships.test.js:352:      const authorIds = getResult.data.relationships.authors.data.map(a => a.id).sort()
-tests/relationships.test.js:356:    it('should update many-to-many relationships via PATCH (partial update)', async () => {
-tests/relationships.test.js:400:          relationships: {
-tests/relationships.test.js:423:      const authorIds = getResult.data.relationships.authors.data.map(a => a.id).sort()
-tests/relationships.test.js:432:    it('should clear all many-to-many relationships with empty array', async () => {
-tests/relationships.test.js:477:      // Clear all relationships
-tests/relationships.test.js:482:          relationships: {
-tests/relationships.test.js:505:      assert(getResult.data.relationships.authors)
-tests/relationships.test.js:506:      assert.equal(getResult.data.relationships.authors.data.length, 0)
-tests/relationships.test.js:517:    it('should create resource with multiple relationship types', async () => {
-tests/relationships.test.js:545:      // Create book with all relationships
-tests/relationships.test.js:576:      // Verify all relationships
-tests/relationships.test.js:577:      assert(getResult.data.relationships.publisher)
-tests/relationships.test.js:578:      assert(getResult.data.relationships.authors)
-tests/relationships.test.js:579:      assert(getResult.data.relationships.country)
-tests/relationships.test.js:588:      // Verify nested relationship (publisher.country)
-tests/relationships.test.js:590:      assert(publisher.relationships.country)
-tests/relationships.test.js:593:    it('should handle PUT with partial relationships object', async () => {
-tests/relationships.test.js:616:      // Create book with all relationships
-tests/relationships.test.js:643:      // PUT with only publisher relationship (should preserve authors since relationships object is partial)
-tests/relationships.test.js:651:          relationships: {
-tests/relationships.test.js:654:            // Note: authors not mentioned, but relationships object is present
-tests/relationships.test.js:674:      assert.equal(getResult.data.relationships.publisher.data.id, newPublisherResult.data.id)
-tests/relationships.test.js:676:      // Authors should be cleared (PUT with relationships object clears unmentioned relationships)
-tests/relationships.test.js:677:      assert(getResult.data.relationships.authors)
-tests/relationships.test.js:678:      assert.equal(getResult.data.relationships.authors.data.length, 0)
-tests/bulk-operations.test.js:134:    it('should create records with relationships', async () => {
-tests/bulk-operations.test.js:158:        assert.equal(publisher.relationships.country.data.id, countryResult.data.id)
-tests/bulk-operations.test.js:478:    it('should respect relationships when deleting', async () => {
-tests/bulk-operations.test.js:479:      // Create country and publishers with relationship
-tests/bulk-operations.test.js:619:    it('should maintain data integrity with relationships', async () => {
-tests/bulk-operations.test.js:630:      // Create publishers with country relationships
-tests/bulk-operations.test.js:648:      // Verify relationships were set correctly via API
-tests/bulk-operations.test.js:654:      assert.equal(usPublisher.relationships.country.data.id, countryIds[0])
-tests/query-limits.test.js:63:      relationships: {
-tests/query-limits.test.js:84:      relationships: {
-tests/query-limits.test.js:107:      relationships: {
-tests/query-limits.test.js:140:      relationships: {
-tests/query-limits.test.js:258:    it('should respect explicit limit in relationship config', async () => {
-tests/query-limits.test.js:344:              relationships: {
-tests/query-limits.test.js:362:                relationships: {
-tests/query-limits.test.js:416:            relationships: {
-tests/query-limits.test.js:468:                relationships: {
-tests/query-limits.test.js:491:          r.relationships.publisher.data.id === publisher.id
-tests/query-limits.test.js:508:    it('should apply window limits to many-to-many relationships', async () => {
-tests/query-limits.test.js:569:        // Check the author's relationships to see which books they have
-tests/query-limits.test.js:570:        const authorBookIds = author.relationships?.books?.data?.map(b => b.id) || []
-tests/query-limits.test.js:578:          `Author ${author.id} should have exactly 3 book relationships (configured limit)`)
-tests/relationship-endpoints.test.js:29:    // Initialize API with the relationships plugin
-tests/relationship-endpoints.test.js:97:    it('should get empty relationship data for new book', async () => {
-tests/relationship-endpoints.test.js:98:      const result = await api.resources.books.getRelationship({
-tests/relationship-endpoints.test.js:100:        relationshipName: 'authors'
-tests/relationship-endpoints.test.js:104:      assert.equal(result.links.self, `/books/${book1Id}/relationships/authors`)
-tests/relationship-endpoints.test.js:110:    it('should add authors to book via POST relationship endpoint', async () => {
-tests/relationship-endpoints.test.js:111:      // Add authors via relationship endpoint
-tests/relationship-endpoints.test.js:112:      await api.resources.books.postRelationship({
-tests/relationship-endpoints.test.js:114:        relationshipName: 'authors',
-tests/relationship-endpoints.test.js:115:        relationshipData: [
-tests/relationship-endpoints.test.js:121:      // Verify authors were added via getRelationship
-tests/relationship-endpoints.test.js:122:      const relResult = await api.resources.books.getRelationship({
-tests/relationship-endpoints.test.js:124:        relationshipName: 'authors'
-tests/relationship-endpoints.test.js:146:      assert(getResult.data.relationships.authors, 'Should have authors relationship')
-tests/relationship-endpoints.test.js:147:      assert.equal(getResult.data.relationships.authors.data.length, 2)
-tests/relationship-endpoints.test.js:152:      await api.resources.books.postRelationship({
-tests/relationship-endpoints.test.js:154:        relationshipName: 'authors',
-tests/relationship-endpoints.test.js:155:        relationshipData: [
-tests/relationship-endpoints.test.js:162:      const result = await api.resources.books.getRelated({
-tests/relationship-endpoints.test.js:164:        relationshipName: 'authors'
-tests/relationship-endpoints.test.js:177:    it('should remove specific authors via DELETE relationship endpoint', async () => {
-tests/relationship-endpoints.test.js:179:      await api.resources.books.postRelationship({
-tests/relationship-endpoints.test.js:181:        relationshipName: 'authors',
-tests/relationship-endpoints.test.js:182:        relationshipData: [
-tests/relationship-endpoints.test.js:194:      await api.resources.books.deleteRelationship({
-tests/relationship-endpoints.test.js:196:        relationshipName: 'authors',
-tests/relationship-endpoints.test.js:197:        relationshipData: [
-tests/relationship-endpoints.test.js:203:      const relResult = await api.resources.books.getRelationship({
-tests/relationship-endpoints.test.js:205:        relationshipName: 'authors'
-tests/relationship-endpoints.test.js:217:    it('should handle errors when relationship does not exist', async () => {
-tests/relationship-endpoints.test.js:219:        api.resources.books.getRelationship({
-tests/relationship-endpoints.test.js:221:          relationshipName: 'nonexistent'
-tests/relationship-endpoints.test.js:229:    it('should handle errors when posting to belongsTo relationship', async () => {
-tests/relationship-endpoints.test.js:231:        api.resources.books.postRelationship({
-tests/relationship-endpoints.test.js:233:          relationshipName: 'country',
-tests/relationship-endpoints.test.js:234:          relationshipData: [
-tests/relationship-endpoints.test.js:239:          message: /Cannot POST to to-one relationship/
-tests/relationship-endpoints.test.js:244:    it('should work with inverse relationship (authors to books)', async () => {
-tests/relationship-endpoints.test.js:245:      // First add the relationship from book side
-tests/relationship-endpoints.test.js:246:      await api.resources.books.postRelationship({
-tests/relationship-endpoints.test.js:248:        relationshipName: 'authors',
-tests/relationship-endpoints.test.js:249:        relationshipData: [
-tests/relationship-endpoints.test.js:255:      const relResult = await api.resources.authors.getRelationship({
-tests/relationship-endpoints.test.js:257:        relationshipName: 'books'
-tests/relationship-endpoints.test.js:264:      const booksResult = await api.resources.authors.getRelated({
-tests/relationship-endpoints.test.js:266:        relationshipName: 'books'
-tests/relationship-endpoints.test.js:333:    it('should get one-to-many relationship data', async () => {
-tests/relationship-endpoints.test.js:334:      const result = await api.resources.publishers.getRelationship({
-tests/relationship-endpoints.test.js:336:        relationshipName: 'books'
-tests/relationship-endpoints.test.js:340:      assert.equal(result.links.self, `/publishers/${publisherId}/relationships/books`)
-tests/relationship-endpoints.test.js:347:      const result = await api.resources.publishers.getRelated({
-tests/relationship-endpoints.test.js:349:        relationshipName: 'books'
-tests/relationship-endpoints.test.js:358:    // Note: belongsTo relationships (like 'publisher') are not accessible via relationship endpoints
-tests/relationship-endpoints.test.js:359:    // They are foreign key fields, not true JSON:API relationships
-tests/TEST_TEMPLATE.test.js:56: *    - Handle relationships correctly
-tests/pagination-enhanced.test.js:493:      const countryIds = result.data.map(b => b.relationships.country.data.id)

package/audit/evidence/tests/skipped-tests.txt

@@ -1,10 +0,0 @@
-tests/pagination-cursor-multifield.test.js:58:    it.skip('should handle cursor pagination with multi-field sorting without skipping records', async () => {
-tests/pagination-cursor-multifield.test.js:105:    it.skip('should handle DESC sorting with duplicates correctly', async () => {
-tests/pagination-cursor-multifield.test.js:192:    it.skip('should handle cursor pagination with numeric and text fields', async () => {
-tests/pagination-cursor-multifield.test.js:225:    it.skip('should generate correct cursor values for multi-field sorting', async () => {
-tests/pagination-cursor-multifield.test.js:247:    it.skip('should handle page[before] with multi-field sorting', async () => {
-tests/pagination-cursor-multifield.test.js:295:    it.skip('should handle all records having the same value in first sort field', async () => {
-tests/pagination-cursor-multifield.test.js:351:    it.skip('should handle empty results with multi-field cursor', async () => {
-tests/pagination-cursor-multifield.test.js:378:    it.skip('should handle special characters in multi-field cursors', async () => {
-tests/pagination-cursor-multifield.test.js:421:    it.skip('should maintain stable sorting with custom id property', async () => {
-tests/pagination-cursor-multifield.test.js:467:    it.skip('should handle the exact bug scenario - multiple fruits with same category', async () => {

package/audit/evidence/tests/test-suite-list-non-anyapi.txt

@@ -1,30 +0,0 @@
-/tests/TEST_TEMPLATE.test.js
-/tests/bulk-operations.test.js
-/tests/computed-fields.test.js
-/tests/cors.test.js
-/tests/curl.test.js
-/tests/custom-idproperty-relationships.test.js
-/tests/field-getters.test.js
-/tests/field-setters.test.js
-/tests/include-depth-validation.test.js
-/tests/includes.test.js
-/tests/multihome.test.js
-/tests/nested-includes.test.js
-/tests/ownership-optout.test.js
-/tests/pagination-cursor-multifield.test.js
-/tests/pagination-enhanced.test.js
-/tests/polymorphic-relationships.test.js
-/tests/polymorphic-simple.test.js
-/tests/positioning-advanced.test.js
-/tests/positioning-extended.test.js
-/tests/positioning-multifilter.test.js
-/tests/positioning.test.js
-/tests/queries.test.js
-/tests/query-limits.test.js
-/tests/relationship-endpoints.test.js
-/tests/relationships.test.js
-/tests/rest-api-access.test.js
-/tests/rest-api.test.js
-/tests/searchschema-merge.test.js
-/tests/socketio.test.js
-/tests/virtual-fields.test.js

package/audit/evidence/tests/test-suite-list.txt

@@ -1,32 +0,0 @@
-/tests/TEST_TEMPLATE.test.js
-/tests/anyapi-basic.test.js
-/tests/anyapi-cursor-pagination.test.js
-/tests/bulk-operations.test.js
-/tests/computed-fields.test.js
-/tests/cors.test.js
-/tests/curl.test.js
-/tests/custom-idproperty-relationships.test.js
-/tests/field-getters.test.js
-/tests/field-setters.test.js
-/tests/include-depth-validation.test.js
-/tests/includes.test.js
-/tests/multihome.test.js
-/tests/nested-includes.test.js
-/tests/ownership-optout.test.js
-/tests/pagination-cursor-multifield.test.js
-/tests/pagination-enhanced.test.js
-/tests/polymorphic-relationships.test.js
-/tests/polymorphic-simple.test.js
-/tests/positioning-advanced.test.js
-/tests/positioning-extended.test.js
-/tests/positioning-multifilter.test.js
-/tests/positioning.test.js
-/tests/queries.test.js
-/tests/query-limits.test.js
-/tests/relationship-endpoints.test.js
-/tests/relationships.test.js
-/tests/rest-api-access.test.js
-/tests/rest-api.test.js
-/tests/searchschema-merge.test.js
-/tests/socketio.test.js
-/tests/virtual-fields.test.js

package/audit/subsystems/docs-drift.md

@@ -1,49 +0,0 @@
-# Subsystem: docs-drift (Pass 1)
-
-## Scope
-- User-facing docs vs observed implementation behavior (both repos).
-
-## Purpose
-- Detect mismatches between claimed and actual behavior for critical features.
-
-## Findings
-- D-001:
-  - [Verified][C5] Internal docs/comments in `payload-validators` describe POST `included` validation support, but write orchestration rejects any `included` array for POST/PUT/PATCH.
-  - Evidence: `plugins/core/lib/querying-writing/payload-validators.js:658-735` vs `plugins/core/rest-api-plugin-methods/common.js:171-176`.
-- D-002:
-  - [Inferred][C3] Public docs claim broad/full JSON:API compliance; pass-1 code review has at least one envelope inconsistency in CORS blocked-origin response (`{ error: ... }` instead of `errors[]`).
-  - Evidence: `README.md:9`, `docs/COMPARISON.md:14`, `plugins/core/rest-api-cors-plugin.js:112-117`.
-- D-003:
-  - [Inferred][C3] Pagination documentation examples show clean links, but implementation-level query-link construction may emit duplicated delimiters in some permutations (seen in docs examples with `&&`; runtime confirmation pending).
-  - Evidence: `docs/GUIDE/GUIDE_2_7_Pagination_And_Ordering.md:972-975`, `1018-1021`, `1220-1223`, and query string assembly at `plugins/core/rest-api-knex-plugin.js:742-773`.
-
-## Strengths
-- [Verified][C4] Documentation breadth is high and includes operational examples for most major features.
-- [Verified][C4] `json-rest-schema` docs align with current module boundaries (runtime validation focus, no migration helper in core).
-
-## Risks
-- R-DOCS-001:
-  - [Verified][C5] Contradictory guidance around `included` in write payloads can mislead adopters.
-- R-DOCS-002:
-  - [Inferred][C3] Strong compliance claims without caveats can create expectation risk where edge semantics diverge.
-
-## Missing tests/docs actions
-- [Inferred][C4] Add docs contract test snippets (or executable examples) for write payload constraints and error envelope contract.
-- [Inferred][C3] Normalize CORS blocked-origin response to JSON:API `errors[]` or document exception explicitly.
-
-## Explicit unknowns
-- [Unknown][C2] Extent of additional drift across long-form guide sections not yet fully line-mapped in pass-1.
-
-## Pass-1 confidence
-- Overall: **C4** for identified drifts; **C2** for full corpus completeness.
-
-## Evidence links
-- `audit/evidence/docs/docs-claims-signals.txt`
-- `plugins/core/rest-api-plugin-methods/common.js`
-- `plugins/core/lib/querying-writing/payload-validators.js`
-- `plugins/core/rest-api-cors-plugin.js`
-- `/home/merc/Development/current/json-rest-schema/README.md`
-
-## Pass-2 cross-review status
-- Reconciled in [pass2-cross-review.md](/home/merc/Development/current/json-rest-api/audit/subsystems/pass2-cross-review.md).
-- Final assertion/confidence values in this report are considered pass-2 normalized.

package/audit/subsystems/pass2-cross-review.md

@@ -1,131 +0,0 @@
-# Subsystems Cross-Review (Pass 2)
-
-Perspective: challenge-first review focused on contradictory evidence, runtime corroboration, and severity normalization.
-Scope: non-anyapi only.
-
-## schema-core
-- Validated:
-  - [Verified][C4] Schema compile pipeline remains central source-of-truth (`compileSchemas` + `Schema.validate`).
-- Challenged:
-  - [Inferred][C3] Global registry mutation risk severity reduced to medium (no runtime failure observed in baseline tests).
-- Reconciliation:
-  - Keep risk as medium-operational, not correctness-critical.
-
-## rest-orchestration
-- Validated:
-  - [Verified][C5] Permission-before-write ordering confirmed in code path and passing CRUD tests.
-  - [Verified][C5] `patch-relationship` catch defect runtime-confirmed via probe (`ReferenceError`).
-- Challenged:
-  - None; findings strengthened by runtime probe.
-- Reconciliation:
-  - Elevate `patch-relationship` defect to high severity with C5 confidence.
-
-## transport-express
-- Validated:
-  - [Verified][C4] Canonical error mapping for known rest-api error codes.
-- Challenged:
-  - [Inferred][C3] Unknown-error leakage remains moderate risk; no direct exploit scenario found in baseline tests.
-- Reconciliation:
-  - Keep medium severity; recommend sanitization policy test.
-
-## storage-knex
-- Validated:
-  - [Verified][C4] Method layer calls storage helpers consistently.
-- Challenged:
-  - TOCTOU/concurrency concerns remain inferred; no direct failure evidence in current suite.
-- Reconciliation:
-  - Keep as medium/partial invariant impact, pending concurrency probes.
-
-## query-engine
-- Validated:
-  - [Verified][C4] Include and nested include functional tests pass.
-- Challenged:
-  - N+1/perf cliff claim remains inferred due missing query-count assertions.
-- Reconciliation:
-  - Keep performance risk medium with lower confidence.
-
-## relationships
-- Validated:
-  - [Verified][C5] POST/DELETE relationship endpoint paths are covered and passing.
-  - [Verified][C5] PATCH relationship endpoint failure-path defect confirmed at runtime.
-- Challenged:
-  - Success semantics of `patchRelationship` endpoint remain under-tested.
-- Reconciliation:
-  - Mark partial coverage; add explicit patch endpoint success and rollback tests.
-
-## plugins-access
-- Validated:
-  - [Verified][C4] Ownership filters and permission gating covered by tests.
-- Challenged:
-  - Mixed error typing impact not shown to break core suite behavior.
-- Reconciliation:
-  - Keep medium-low severity consistency risk.
-
-## plugins-cors
-- Validated:
-  - [Verified][C4] CORS behaviors and preflight handling covered by tests.
-- Challenged:
-  - JSON:API envelope mismatch on blocked origin remains code-verified; direct assertion missing in tests.
-- Reconciliation:
-  - Keep medium severity docs/contract consistency issue.
-
-## plugins-file
-- Validated:
-  - [Verified][C3] Schema-driven detection and validation pipeline present.
-- Challenged:
-  - Orphaned-file rollback concern remains inferred (no dedicated failure-path test run).
-- Reconciliation:
-  - Keep as medium operational risk with lower confidence.
-
-## plugins-positioning
-- Validated:
-  - [Verified][C5] Runtime suite currently fails 2 tests in multifilter edge cases.
-- Challenged:
-  - Failure severity constrained to plugin semantics; core CRUD invariants unaffected.
-- Reconciliation:
-  - Keep high-priority plugin correctness fix (medium-high severity).
-
-## plugins-multihome
-- Validated:
-  - [Verified][C4] Multi-tenant extraction and filter enforcement code + tests align.
-- Challenged:
-  - Bypass resistance across every alternate path remains partial (not exhaustively tested).
-- Reconciliation:
-  - Keep invariant as partial/pass with medium confidence.
-
-## plugins-socketio
-- Validated:
-  - [Verified][C4] Transaction-safety tests pass for success/failure notification behavior.
-- Challenged:
-  - High-load/backpressure concerns remain unknown.
-- Reconciliation:
-  - Keep as medium operational unknown.
-
-## plugins-bulk
-- Validated:
-  - [Verified][C4] Bulk atomic/non-atomic behavior covered in tests.
-- Challenged:
-  - Optimization hook dead-path risk remains inferred; no direct runtime trigger found.
-- Reconciliation:
-  - Keep as medium maintainability/performance risk.
-
-## tests
-- Validated:
-  - [Verified][C5] broad suite coverage, with explicit failing/skip signals captured.
-- Challenged:
-  - Invariant-to-test mapping completeness still incomplete for performance/error-envelope edges.
-- Reconciliation:
-  - Keep test quality as partial.
-
-## docs-drift
-- Validated:
-  - [Verified][C4] write `included` claim mismatch remains corroborated (code + docs mismatch).
-- Challenged:
-  - Additional docs drift breadth remains partial until broader executable doc checks exist.
-- Reconciliation:
-  - Maintain medium severity documentation reliability risk.
-
-## Unresolved runtime validation queue
-- Query-count budget assertions for deep includes.
-- File-upload success + downstream DB failure compensation path.
-- Full bypass attempt matrix across multihome + relationship endpoints + includes.

package/audit/subsystems/plugins-access.md

@@ -1,51 +0,0 @@
-# Subsystem: plugins-access (Pass 1)
-
-## Scope
-- Ownership/auth enforcement and query filtering plugin.
-
-## Purpose
-- Enforce auth rules (`public/authenticated/owns` + custom checkers), auto-attach ownership fields, and constrain query visibility.
-
-## Key entry points
-- `plugins/core/rest-api-access.js`
-
-## Core data flow
-- Walkthrough (ownership-filtered query):
-  - [Verified][C5] `knexQueryFiltering` hook appends owner filter when ownership is enabled and user is non-admin. Evidence: `rest-api-access.js:249-289`.
-  - [Verified][C4] `checkPermissions` evaluates configured rules and fails with 403 when no checker passes. Evidence: `rest-api-access.js:291-341`.
-
-## Hook/control flow
-- [Verified][C4] Auto-owner assignment occurs on `beforeProcessingPost/Patch/Put`, before schema validation/storage calls. Evidence: `rest-api-access.js:239-247`, `196-237`.
-- [Verified][C4] Separate ownership mismatch path converts single-resource unauthorized access into `Resource not found` to reduce disclosure. Evidence: `rest-api-access.js:343-383`.
-
-## Failure modes
-- [Inferred][C3] Some helper paths throw generic `Error` with `statusCode` instead of typed REST errors; transport mapping consistency depends on connector handling. Evidence: `rest-api-access.js:333-337`, `390-425`.
-
-## Strengths
-- [Verified][C5] Supports scope-level opt-out (`ownership:false`, `ownerField:false/null`) and admin bypass.
-- [Verified][C4] Adapter-aware filter translation reduces coupling to physical column naming.
-
-## Risks
-- R-ACCESS-001:
-  - [Inferred][C3] Mixed error typing can produce inconsistent envelopes in non-standard transports.
-- R-ACCESS-002:
-  - [Unknown][C2] Complex custom checker chains may become hard to reason about without tracing/audit logs.
-
-## Missing tests
-- [Inferred][C3] Add tests for mixed rule chains where checker throws vs returns false across all methods.
-
-## Explicit unknowns
-- [Unknown][C2] Operational behavior when custom checkers perform async external calls under high latency.
-
-## Pass-1 confidence
-- Overall: **C4**.
-
-## Evidence links
-- `plugins/core/rest-api-access.js`
-- `tests/rest-api-access.test.js`
-- `tests/ownership-optout.test.js`
-- `audit/evidence/tests/access-multitenancy-test-signals.txt`
-
-## Pass-2 cross-review status
-- Reconciled in [pass2-cross-review.md](/home/merc/Development/current/json-rest-api/audit/subsystems/pass2-cross-review.md).
-- Final assertion/confidence values in this report are considered pass-2 normalized.

package/audit/subsystems/plugins-bulk.md

@@ -1,50 +0,0 @@
-# Subsystem: plugins-bulk (Pass 1)
-
-## Scope
-- Bulk operation plugin (`bulkPost`, `bulkPatch`, `bulkDelete`) and route registration.
-
-## Purpose
-- Batch many create/update/delete operations with optional atomic transaction semantics.
-
-## Key entry points
-- `plugins/core/bulk-operations-plugin.js`
-
-## Core data flow
-- Walkthrough (atomic bulk POST):
-  - [Verified][C4] Validates input size, optionally opens transaction, loops records and delegates to `scope.post`, then commits or rolls back. Evidence: `bulk-operations-plugin.js:19-122`.
-
-## Hook/control flow
-- [Verified][C3] Plugin registers `beforeBulkPost` optimized hook path, but pass-1 static review found no invocation of `runHooks('beforeBulkPost')` in `bulkPost` flow.
-  - Evidence: `bulk-operations-plugin.js:19-122`, `418-476`.
-
-## Failure modes
-- [Verified][C4] Non-atomic mode can produce partial success responses with aggregated errors by design. Evidence: `bulk-operations-plugin.js:84-114`, `217-244`, `310-337`.
-- [Inferred][C4] Optimized path appears dead code unless another subsystem triggers `beforeBulkPost`; current file does not.
-
-## Strengths
-- [Verified][C4] Clear atomic vs non-atomic contract and per-item error reporting.
-- [Verified][C4] Reuses existing scope methods, preserving most validation/permission semantics.
-
-## Risks
-- R-BULK-001:
-  - [Verified][C4] Potential dead optimization hook path (`beforeBulkPost`) not invoked in visible flow.
-- R-BULK-002:
-  - [Inferred][C3] Large batch runtime cost due to per-record delegation may be high without optimization.
-
-## Missing tests
-- [Inferred][C3] Add explicit test proving whether `beforeBulkPost` optimization path can execute.
-- [Unknown][C2] Add throughput tests for max-batch boundaries and mixed-failure rollback behavior under load.
-
-## Explicit unknowns
-- [Unknown][C2] Whether external hook framework auto-invokes `beforeBulkPost` for scope methods without explicit calls.
-
-## Pass-1 confidence
-- Overall: **C3-C4**.
-
-## Evidence links
-- `plugins/core/bulk-operations-plugin.js`
-- `tests/bulk-operations.test.js`
-
-## Pass-2 cross-review status
-- Reconciled in [pass2-cross-review.md](/home/merc/Development/current/json-rest-api/audit/subsystems/pass2-cross-review.md).
-- Final assertion/confidence values in this report are considered pass-2 normalized.

package/audit/subsystems/plugins-cors.md

@@ -1,48 +0,0 @@
-# Subsystem: plugins-cors (Pass 1)
-
-## Scope
-- CORS policy plugin and transport response header integration.
-
-## Purpose
-- Provide cross-origin policy controls with wildcard OPTIONS routing and response header injection.
-
-## Key entry points
-- `plugins/core/rest-api-cors-plugin.js`
-
-## Core data flow
-- Walkthrough (preflight):
-  - [Verified][C5] Plugin registers `OPTIONS` route on transport match-all path and returns CORS headers + 204/403 depending on origin policy. Evidence: `rest-api-cors-plugin.js:79-127`.
-  - [Verified][C4] Non-OPTIONS responses are decorated through `transport:response` hook. Evidence: `rest-api-cors-plugin.js:129-178`.
-
-## Hook/control flow
-- [Verified][C4] Requires transport plugin presence (`vars.transport`) and integrates via hooks rather than connector-specific code paths.
-
-## Failure modes
-- [Verified][C4] 403 response for blocked origin returns `{ error: 'CORS origin not allowed' }`, not JSON:API `errors[]`, causing envelope inconsistency at least for this path. Evidence: `rest-api-cors-plugin.js:112-117`.
-
-## Strengths
-- [Verified][C4] Supports string/regex/array/function origin policies.
-- [Verified][C4] Correctly applies `Vary: Origin` when echoing origin.
-
-## Risks
-- R-CORS-001:
-  - [Verified][C4] Preflight rejection envelope shape differs from core transport error contract.
-- R-CORS-002:
-  - [Inferred][C3] Defaults (`credentials: true`, `origin: '*'`) require careful runtime pairing to avoid invalid browser semantics if misconfigured with wildcard behavior.
-
-## Missing tests
-- [Inferred][C3] Add explicit envelope consistency assertion for blocked origin path.
-
-## Explicit unknowns
-- [Unknown][C2] Behavior with custom transport plugins beyond Express not runtime-checked in this audit pass.
-
-## Pass-1 confidence
-- Overall: **C4**.
-
-## Evidence links
-- `plugins/core/rest-api-cors-plugin.js`
-- `tests/cors.test.js`
-
-## Pass-2 cross-review status
-- Reconciled in [pass2-cross-review.md](/home/merc/Development/current/json-rest-api/audit/subsystems/pass2-cross-review.md).
-- Final assertion/confidence values in this report are considered pass-2 normalized.