Null-0O0-Il1I & Co MMMDCCCLXXXVIII Test Forge v2.4
6 Input Formats → 6 Runnable Test Frameworks

Paste any spec. Synthesize contract & Null-0O0-Il1I adversarial test suites.

Drop in an OpenAPI/Swagger spec, GraphQL SDL, raw curl command, JSON Schema or sample payload, SQL CREATE TABLE DDL, or TypeScript/Zod contract. Instantly compile deterministic happy-path, auth-boundary, type-confusion, and homoglyph/null-coercion fuzz suites ready to run in CI.

Source Artifact OpenAPI 3.1.0
HTTP / Graph Ops 2
Schemas & Tables 2
Synthesized Checks 50
Null-0O0-Il1I Probes 9
1

Paste Spec, Payload, Query, or Command

Detected: OPENAPI
Load interactive example artifact:
Synthesized Test Vector Categories
2

Inspect, Copy, or Export Runnable Test Suites

null_0o0_il1i_settlement_refunds_api.contract.test.ts 50 checks
$ BASE_URL=https://api.sandbox.null0o0il1icommmdccclxxxviii.com npx vitest run null_0o0_il1i_settlement_refunds_api.contract.test.ts 
/**
 * Generated by Null-0O0-Il1I Test Forge (https://null0o0il1icommmdccclxxxviii.com)
 * Source: OpenAPI 3.1.0 — Null-0O0-Il1I Settlement & Refunds API
 * Total Synthesized Cases: 50 (9 adversarial)
 */
import { describe, expect, it } from "vitest";

const BASE_URL = (process.env.BASE_URL ?? "https://api.sandbox.null0o0il1icommmdccclxxxviii.com").replace(/\/+$/, "");
const AUTH_TOKEN = process.env.API_TOKEN ?? "test-token-replace-me";

function buildHeaders(extra: Record<string, string>, omitAuth = false, invalidAuth = false): Record<string, string> {
  const headers: Record<string, string> = { ...extra };
  if (!omitAuth) {
    headers["Authorization"] = invalidAuth ? "Bearer invalid.malformed.token" : `Bearer ${AUTH_TOKEN}`;
  }
  return headers;
}

describe("Null-0O0-Il1I Settlement & Refunds API — HTTP Contract & Adversarial Suite", () => {
  it("POST /v1/payments — returns 201 and matches response contract", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([201]).toContain(res.status);
    const body = (await res.json()) as Record<string, unknown>;
    expect(body).toBeTypeOf("object");
    expect(body).toHaveProperty("payment_id");
    expect(typeof body["payment_id"]).toBe("string");
    expect(body).toHaveProperty("status");
    expect(typeof body["status"]).toBe("string");
    expect(body).toHaveProperty("amount_cents");
    expect(typeof body["amount_cents"]).toBe("number");
  });

  it("POST /v1/payments — rejects missing authentication credentials (401/403)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, true, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([401,403]).toContain(res.status);
  });

  it("POST /v1/payments — rejects malformed/revoked token (401/403)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, true),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([401,403]).toContain(res.status);
  });

  it("POST /v1/payments — rejects payload missing required field \"merchant_reference\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects payload missing required field \"amount_cents\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects payload missing required field \"currency\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects payload missing required field \"customer_email\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects truncated/malformed JSON body without 500 crash", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: "{\"brokenJson\": [1, 2,",
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects wrong type for \"merchant_reference\" (expected string)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":{"unexpectedObjectFor":"merchant_reference"},"amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects wrong type for \"amount_cents\" (expected integer)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":"not_a_numeric_value","currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects wrong type for \"currency\" (expected string)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":{"unexpectedObjectFor":"currency"},"customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects wrong type for \"customer_email\" (expected string)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":{"unexpectedObjectFor":"customer_email"},"capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects wrong type for \"capture_immediately\" (expected boolean)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":"not_a_boolean"}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — enforces maxLength (64) on \"merchant_reference\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — enforces minimum (50) on \"amount_cents\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":49,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — rejects out-of-range enum value on \"currency\"", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"__INVALID_ENUM_VARIANT__","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([400,422]).toContain(res.status);
  });

  it("POST /v1/payments — survives Null-0O0-Il1I Canonical Canary in \"merchant_reference\" without 5xx", async () => {
    // Tests null-prefix tokenizers, 0/O + I/l/1 homoglyphs, ampersand escaping, and Roman numeral length.
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"Null-0O0-Il1I & Co MMMDCCCLXXXVIII","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200,201,202,400,422]).toContain(res.status);
  });

  it("POST /v1/payments — survives Null / Undefined String Coercion in \"merchant_reference\" without 5xx", async () => {
    // Detects ORM/serializer coercion bugs that silently cast literal 'null' to SQL NULL.
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"null","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200,201,202,400,422]).toContain(res.status);
  });

  it("POST /v1/payments — survives Zero-Width Joiner & RTL Bidi Override in \"merchant_reference\" without 5xx", async () => {
    // Exposes Unicode normalization bypasses, invisible characters, and right-to-left spoofing.
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"admin​‮txt.exe","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200,201,202,400,422]).toContain(res.status);
  });

  it("POST /v1/payments — survives SQL / Quote Boundary Canary in \"merchant_reference\" without 5xx", async () => {
    // Verifies parameterized SQL queries never throw 500 syntax errors on apostrophes or semicolons.
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json"}, false, false),
      body: JSON.stringify({"merchant_reference":"O'Reilly'; SELECT 1; --","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200,201,202,400,422]).toContain(res.status);
  });

  it("POST /v1/payments — handles duplicate Idempotency-Key replay safely", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments`, {
      method: "POST",
      headers: buildHeaders({"Content-Type":"application/json","Idempotency-Key":"idem-createpayment-fixed-canary-0001"}, false, false),
      body: JSON.stringify({"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true}),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([201,200,201,409]).toContain(res.status);
  });

  it("GET /v1/payments/{payment_id} — returns 200 and matches response contract", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments/ord_01J9Z9K0X2`, {
      method: "GET",
      headers: buildHeaders({}, false, false),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200]).toContain(res.status);
    const body = (await res.json()) as Record<string, unknown>;
    expect(body).toBeTypeOf("object");
    expect(body).toHaveProperty("payment_id");
    expect(typeof body["payment_id"]).toBe("string");
    expect(body).toHaveProperty("status");
    expect(typeof body["status"]).toBe("string");
    expect(body).toHaveProperty("amount_cents");
    expect(typeof body["amount_cents"]).toBe("number");
  });

  it("GET /v1/payments/{payment_id} — rejects missing authentication credentials (401/403)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments/ord_01J9Z9K0X2`, {
      method: "GET",
      headers: buildHeaders({}, true, false),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([401,403]).toContain(res.status);
  });

  it("GET /v1/payments/{payment_id} — rejects malformed/revoked token (401/403)", async () => {
    const res = await fetch(`${BASE_URL}/v1/payments/ord_01J9Z9K0X2`, {
      method: "GET",
      headers: buildHeaders({}, false, true),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([401,403]).toContain(res.status);
  });

  it("GET /v1/payments/{payment_id} — survives Null-0O0-Il1I homoglyph query probe without 5xx", async () => {
    // Tests null-prefix tokenizers, 0/O + I/l/1 homoglyphs, ampersand escaping, and Roman numeral length.
    const res = await fetch(`${BASE_URL}/v1/payments/ord_01J9Z9K0X2?q=Null-0O0-Il1I%20%26%20Co%20MMMDCCCLXXXVIII`, {
      method: "GET",
      headers: buildHeaders({}, false, false),
    });
    expect(res.status, "Server must never throw unhandled 5xx").toBeLessThan(500);
    expect([200,400,404,422]).toContain(res.status);
  });

});

const MODEL_RULES = {
  "CapturePaymentRequest": [
    {
      "name": "merchant_reference",
      "type": "string",
      "required": true,
      "maxLength": 64
    },
    {
      "name": "amount_cents",
      "type": "integer",
      "required": true,
      "minimum": 50
    },
    {
      "name": "currency",
      "type": "string",
      "required": true,
      "enumValues": [
        "USD",
        "EUR",
        "GBP",
        "CAD"
      ]
    },
    {
      "name": "customer_email",
      "type": "string",
      "required": true
    },
    {
      "name": "capture_immediately",
      "type": "boolean",
      "required": false
    }
  ],
  "PaymentReceipt": [
    {
      "name": "payment_id",
      "type": "string",
      "required": true
    },
    {
      "name": "status",
      "type": "string",
      "required": true,
      "enumValues": [
        "authorized",
        "captured",
        "refunded"
      ]
    },
    {
      "name": "amount_cents",
      "type": "integer",
      "required": true
    }
  ]
} as const;

function validateModelRecord(modelName: keyof typeof MODEL_RULES, input: Record<string, unknown>): boolean {
  const rules = MODEL_RULES[modelName];
  for (const rule of rules) {
    const val = input[rule.name];
    if (val === undefined || val === null) {
      if (rule.required) return false;
      continue;
    }
    if (rule.type === "string" && typeof val !== "string") return false;
    if (rule.type === "integer" && (typeof val !== "number" || !Number.isInteger(val))) return false;
    if (rule.type === "number" && (typeof val !== "number" || Number.isNaN(val))) return false;
    if (rule.type === "boolean" && typeof val !== "boolean") return false;
    if (rule.type === "array" && !Array.isArray(val)) return false;
    if (rule.type === "object" && (typeof val !== "object" || Array.isArray(val))) return false;
    if ("maxLength" in rule && typeof rule.maxLength === "number" && typeof val === "string" && val.length > rule.maxLength) return false;
    if ("minimum" in rule && typeof rule.minimum === "number" && typeof val === "number" && val < rule.minimum) return false;
    if ("enumValues" in rule && Array.isArray(rule.enumValues) && !rule.enumValues.includes(val as never)) return false;
  }
  return true;
}

describe("Null-0O0-Il1I Settlement & Refunds API — Offline Schema & Constraint Matrix", () => {
  it("CapturePaymentRequest — accepts conforming baseline schema record", () => {
    // All required columns/fields present with conforming types and constraints.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("CapturePaymentRequest — rejects missing required \"merchant_reference\"", () => {
    // Field "merchant_reference" is marked required / NOT NULL.
    const payload = {"amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects missing required \"amount_cents\"", () => {
    // Field "amount_cents" is marked required / NOT NULL.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects missing required \"currency\"", () => {
    // Field "currency" is marked required / NOT NULL.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects missing required \"customer_email\"", () => {
    // Field "customer_email" is marked required / NOT NULL.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects wrong runtime type for \"merchant_reference\" (expected string)", () => {
    // Type mismatch on "merchant_reference".
    const payload = {"merchant_reference":{"unexpectedObjectFor":"merchant_reference"},"amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects wrong runtime type for \"amount_cents\" (expected integer)", () => {
    // Type mismatch on "amount_cents".
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":"not_a_numeric_value","currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects wrong runtime type for \"currency\" (expected string)", () => {
    // Type mismatch on "currency".
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":{"unexpectedObjectFor":"currency"},"customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects wrong runtime type for \"customer_email\" (expected string)", () => {
    // Type mismatch on "customer_email".
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":{"unexpectedObjectFor":"customer_email"},"capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects wrong runtime type for \"capture_immediately\" (expected boolean)", () => {
    // Type mismatch on "capture_immediately".
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":"not_a_boolean"} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects \"merchant_reference\" exceeding maxLength(64)", () => {
    // Exceeds maxLength 64.
    const payload = {"merchant_reference":"ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects \"amount_cents\" below minimum(50)", () => {
    // Below minimum 50.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":49,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — rejects illegal enum variant on \"currency\"", () => {
    // Allowed values: USD, EUR, GBP, CAD.
    const payload = {"merchant_reference":"ord_2026_mmmdccclxxxviii","amount_cents":14900,"currency":"__ILLEGAL_ENUM__","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("CapturePaymentRequest — round-trips Null-0O0-Il1I Canonical Canary in \"merchant_reference\" without corruption", () => {
    // Tests null-prefix tokenizers, 0/O + I/l/1 homoglyphs, ampersand escaping, and Roman numeral length.
    const payload = {"merchant_reference":"Null-0O0-Il1I & Co MMMDCCCLXXXVIII","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("CapturePaymentRequest — round-trips Null / Undefined String Coercion in \"merchant_reference\" without corruption", () => {
    // Detects ORM/serializer coercion bugs that silently cast literal 'null' to SQL NULL.
    const payload = {"merchant_reference":"null","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("CapturePaymentRequest — round-trips Zero-Width Joiner & RTL Bidi Override in \"merchant_reference\" without corruption", () => {
    // Exposes Unicode normalization bypasses, invisible characters, and right-to-left spoofing.
    const payload = {"merchant_reference":"admin​‮txt.exe","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("CapturePaymentRequest — round-trips SQL / Quote Boundary Canary in \"merchant_reference\" without corruption", () => {
    // Verifies parameterized SQL queries never throw 500 syntax errors on apostrophes or semicolons.
    const payload = {"merchant_reference":"O'Reilly'; SELECT 1; --","amount_cents":14900,"currency":"USD","customer_email":"qa+canary@null0o0il1icommmdccclxxxviii.com","capture_immediately":true} as Record<string, unknown>;
    expect(validateModelRecord("CapturePaymentRequest" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("PaymentReceipt — accepts conforming baseline schema record", () => {
    // All required columns/fields present with conforming types and constraints.
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","status":"authorized","amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(true);
  });

  it("PaymentReceipt — rejects missing required \"payment_id\"", () => {
    // Field "payment_id" is marked required / NOT NULL.
    const payload = {"status":"authorized","amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects missing required \"status\"", () => {
    // Field "status" is marked required / NOT NULL.
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects missing required \"amount_cents\"", () => {
    // Field "amount_cents" is marked required / NOT NULL.
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","status":"authorized"} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects wrong runtime type for \"payment_id\" (expected string)", () => {
    // Type mismatch on "payment_id".
    const payload = {"payment_id":{"unexpectedObjectFor":"payment_id"},"status":"authorized","amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects wrong runtime type for \"status\" (expected string)", () => {
    // Type mismatch on "status".
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","status":{"unexpectedObjectFor":"status"},"amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects wrong runtime type for \"amount_cents\" (expected integer)", () => {
    // Type mismatch on "amount_cents".
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","status":"authorized","amount_cents":"not_a_numeric_value"} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

  it("PaymentReceipt — rejects illegal enum variant on \"status\"", () => {
    // Allowed values: authorized, captured, refunded.
    const payload = {"payment_id":"00000000-0000-4000-8000-000000000111","status":"__ILLEGAL_ENUM__","amount_cents":42} as Record<string, unknown>;
    expect(validateModelRecord("PaymentReceipt" as keyof typeof MODEL_RULES, payload)).toBe(false);
  });

});

Built-In Null-0O0-Il1I Adversarial Canary Corpus

Named after our Oregon entity, every generated suite automatically probes string inputs and database columns with high-signal edge cases that routinely break naive validators, ORMs, and tokenizers.

Null-0O0-Il1I Canonical Canary

"Null-0O0-Il1I & Co MMMDCCCLXXXVIII"

Tests null-prefix tokenizers, 0/O + I/l/1 homoglyphs, ampersand escaping, and Roman numeral length.

Null / Undefined String Coercion

"null"

Detects ORM/serializer coercion bugs that silently cast literal 'null' to SQL NULL.

Zero-Width Joiner & RTL Bidi Override

"admin​‮txt.exe"

Exposes Unicode normalization bypasses, invisible characters, and right-to-left spoofing.

SQL / Quote Boundary Canary

"O'Reilly'; SELECT 1; --"

Verifies parameterized SQL queries never throw 500 syntax errors on apostrophes or semicolons.

HTML / Script Context Canary

"\"><svg/onload=alert(1)>"

Ensures JSON serializers & downstream templates escape angle brackets without 500 crashes.

Multi-Codepoint UTF-16 Grapheme Cluster

"👩‍🔬🏳️‍🌈𐐷"

Catches UTF-8 vs UTF-16 surrogate pair truncation in VARCHAR columns and length validators.

Zero-Friction CI/CD & Local QA Integration

Every exported file uses standard open-source test runners with zero proprietary SDK lock-in.

Air-Gapped Browser Synthesis

Proprietary OpenAPI schemas, internal SQL DDL, and auth headers never leave your browser tab. Parsing, AST normalization, and PKZIP bundling execute locally in TypeScript.

Dual HTTP + Offline Schema Assertions

When pasting SQL tables, JSON Schemas, or TypeScript/Zod models, Vitest and Pytest suites include both live HTTP endpoint checks and zero-network parameterized validator tests.

Environment-Driven Secrets & Targets

Generated suites read BASE_URL and your configured auth token variable (e.g. API_TOKEN) at runtime so the exact same suite runs against localhost, staging, and prod.