@classytic/arc 2.28.0 → 2.31.0

package/dist/subscribe-helpers-C0Tb2aUp.mjs

@@ -0,0 +1,340 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as createEvent } from "./EventTransport-9mlTgqzE.mjs";
+//#region src/events/defineEvent.ts
+/**
+* defineEvent — Typed Event Definitions with Optional Schema Validation
+*
+* Provides:
+* 1. defineEvent() — declare an event with name, schema, version, description
+* 2. EventRegistry — catalog of all known events + payload validation
+* 3. .create() helper — build DomainEvent with auto-generated metadata
+*
+* The built-in validator checks: object type, required fields, and top-level
+* property types. It does NOT recurse into nested objects, validate arrays,
+* enums, patterns, formats, or $ref. This is intentional — it's a lightweight
+* guard, not a full JSON Schema engine.
+*
+* For full validation, pass a custom `validate` function to `createEventRegistry()`:
+*
+* @example
+* ```typescript
+* import Ajv from 'ajv';
+* const ajv = new Ajv();
+*
+* const registry = createEventRegistry({
+*   validate: (schema, payload) => {
+*     const valid = ajv.validate(schema, payload);
+*     return valid
+*       ? { valid: true }
+*       : { valid: false, errors: ajv.errorsText().split(', ') };
+*   },
+* });
+* ```
+*
+* @example
+* ```typescript
+* import { defineEvent, createEventRegistry } from '@classytic/arc/events';
+*
+* const OrderCreated = defineEvent({
+*   name: 'order.created',
+*   version: 1,
+*   schema: {
+*     type: 'object',
+*     properties: {
+*       orderId: { type: 'string' },
+*       total: { type: 'number' },
+*     },
+*     required: ['orderId', 'total'],
+*   },
+* });
+*
+* // Type-safe event creation
+* const event = OrderCreated.create({ orderId: 'o-1', total: 100 });
+* await fastify.events.publish(event.type, event.payload, event.meta);
+*
+* // Registry for introspection + validation
+* const registry = createEventRegistry();
+* registry.register(OrderCreated);
+* const result = registry.validate('order.created', payload);
+* ```
+*/
+/**
+* Define a typed event with optional schema validation.
+*
+* @example
+* const OrderCreated = defineEvent({
+*   name: 'order.created',
+*   schema: { type: 'object', properties: { orderId: { type: 'string' } }, required: ['orderId'] },
+* });
+*
+* const event = OrderCreated.create({ orderId: '123' });
+*/
+function defineEvent(input) {
+	const { name, schema, version = 1, description } = input;
+	return {
+		name,
+		schema,
+		version,
+		description,
+		create(payload, meta) {
+			return createEvent(name, payload, {
+				schemaVersion: version,
+				...meta
+			});
+		}
+	};
+}
+/**
+* Create an event registry for cataloging and validating events.
+*
+* The registry is opt-in — unregistered events pass validation.
+* This allows gradual adoption without breaking existing code.
+*
+* @param options.validate - Custom validator replacing the built-in minimal validator.
+*   The built-in validator only checks top-level object structure (type, required, property types).
+*   For nested objects, arrays, enums, patterns, or $ref, provide AJV or similar.
+*/
+function createEventRegistry(options) {
+	const customValidator = options?.validate;
+	const definitions = /* @__PURE__ */ new Map();
+	function registryKey(name, version) {
+		return `${name}:v${version}`;
+	}
+	return {
+		register(definition) {
+			const key = registryKey(definition.name, definition.version);
+			if (definitions.has(key)) throw new Error(`Event '${definition.name}' v${definition.version} is already registered. Use a different version number for schema evolution.`);
+			definitions.set(key, definition);
+		},
+		get(name, version) {
+			if (version !== void 0) return definitions.get(registryKey(name, version));
+			let latest;
+			let latestVersion = -1;
+			for (const def of definitions.values()) if (def.name === name && def.version > latestVersion) {
+				latest = def;
+				latestVersion = def.version;
+			}
+			return latest;
+		},
+		catalog() {
+			return Array.from(definitions.values()).map((def) => ({
+				name: def.name,
+				version: def.version,
+				description: def.description,
+				schema: def.schema
+			}));
+		},
+		validate(name, payload, version) {
+			let target = version !== void 0 ? definitions.get(registryKey(name, version)) : void 0;
+			if (!target && version === void 0) {
+				let latestVersion = -1;
+				for (const candidate of definitions.values()) if (candidate.name === name && candidate.version > latestVersion) {
+					target = candidate;
+					latestVersion = candidate.version;
+				}
+			}
+			if (!target) return { valid: true };
+			if (!target.schema) return { valid: true };
+			return customValidator ? customValidator(target.schema, payload) : validatePayload(payload, target.schema);
+		}
+	};
+}
+/**
+* Built-in minimal validator — lightweight guard, NOT a full JSON Schema engine.
+*
+* Checks:
+* - payload is an object (not null, not array)
+* - required fields are present
+* - top-level property types match (string, number, boolean, array, object)
+*
+* Does NOT check:
+* - nested object properties
+* - array item types
+* - enum, pattern, format, minLength, minimum, $ref
+*
+* For full validation, pass a custom `validate` function to `createEventRegistry()`.
+*/
+function validatePayload(payload, schema) {
+	const errors = [];
+	if (schema.type === "object") {
+		if (payload === null || payload === void 0 || typeof payload !== "object" || Array.isArray(payload)) return {
+			valid: false,
+			errors: ["Payload must be an object"]
+		};
+		const record = payload;
+		if (schema.required) {
+			for (const field of schema.required) if (!(field in record) || record[field] === void 0) errors.push(`Missing required field: '${field}'`);
+		}
+		if (schema.properties) {
+			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
+				const expectedType = propSchema.type;
+				if (expectedType) {
+					const value = record[key];
+					const actualType = Array.isArray(value) ? "array" : typeof value;
+					if (expectedType === "integer") {
+						if (actualType !== "number" || !Number.isInteger(value)) errors.push(`Field '${key}': expected integer, got ${actualType}`);
+					} else if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
+				}
+			}
+		}
+	}
+	return errors.length === 0 ? { valid: true } : {
+		valid: false,
+		errors
+	};
+}
+//#endregion
+//#region src/events/subscribe-helpers.ts
+/**
+* Subscribe-side helpers — close the symmetry that arc's publish-side
+* already has via [`eventPlugin({ registry, validateMode: 'reject' })`](./eventPlugin.ts).
+*
+* Two wrapper pairs, both transport-agnostic:
+*
+* - `wrapWithSchema` / `subscribeWithSchema` — read the schema from a
+*   typed `EventDefinitionOutput<T>` and validate `event.payload` before
+*   the handler runs. Single source of truth for event shape: declare
+*   once at `defineEvent`, enforced on BOTH sides without parallel Zod
+*   schemas in subscriber files.
+*
+* - `wrapWithBoundary` / `subscribeWithBoundary` — catch + log + swallow
+*   handler errors, for projection / cache-invalidation / fire-and-forget
+*   handlers where retry would just delay the next-event resync. Lighter
+*   than `withRetry` (no DLQ, no exponential backoff) and avoids the
+*   "single bad event poisons the bus" hazard.
+*
+* Both pairs compose with `withRetry` and with each other:
+*
+* ```ts
+* await subscribeWithSchema(
+*   fastify,
+*   OrderPaid,
+*   withRetry(handler, { maxRetries: 3 }),
+* );
+* ```
+*
+* @see [retry.ts](./retry.ts) for the retry + DLQ wrapper.
+* @see [defineEvent.ts](./defineEvent.ts) for `defineEvent` / `EventDefinitionOutput`.
+*/
+/**
+* Pure handler wrapper — returns a new `EventHandler` that validates
+* `event.payload` against the definition's schema before invoking the handler.
+*
+* The returned handler's input is `DomainEvent<unknown>` (since the transport
+* delivers untyped events) but the inner `handler` receives `DomainEvent<T>`.
+* No cast at the call site.
+*
+* @example
+* ```ts
+* await fastify.events.subscribe(
+*   OrderPaid.name,
+*   wrapWithSchema(OrderPaid, async (event) => {
+*     // event.payload is typed via the registered schema — no cast.
+*     await postSalesEntry(event.payload.orderId, event.payload.total);
+*   }),
+* );
+* ```
+*/
+function wrapWithSchema(definition, handler, options = {}) {
+	const { validate, registry, onInvalid, logger = console, name } = options;
+	const label = name ?? definition.name;
+	return async (event) => {
+		const eventVersion = typeof event.meta?.schemaVersion === "number" ? event.meta.schemaVersion : definition.version;
+		let result;
+		if (validate && definition.schema) result = validate(definition.schema, event.payload);
+		else if (registry) result = registry.validate(definition.name, event.payload, eventVersion);
+		else if (definition.schema) {
+			const adhoc = createEventRegistry();
+			adhoc.register(definition);
+			result = adhoc.validate(definition.name, event.payload);
+		} else result = { valid: true };
+		if (!result.valid) {
+			const errors = result.errors ?? ["payload failed validation"];
+			if (onInvalid) try {
+				await onInvalid(event, errors);
+			} catch (cbErr) {
+				logger.error(`[Arc Events] '${label}' onInvalid callback threw:`, cbErr);
+			}
+			else logger.warn(`[Arc Events] '${label}' skipped event ${event.meta?.id ?? "<no-id>"} — payload failed validation: ${errors.join("; ")}`);
+			return;
+		}
+		await handler(event);
+	};
+}
+/**
+* Convenience: validate + subscribe in one call. Equivalent to
+* `fastify.events.subscribe(definition.name, wrapWithSchema(definition, handler, options))`.
+*
+* Returns the unsubscribe function from the underlying transport.
+*
+* @example
+* ```ts
+* await subscribeWithSchema(fastify, OrderPaid, async (event) => {
+*   await postSalesEntry(event.payload.orderId, event.payload.total);
+* });
+*
+* // Compose with withRetry — schema validation runs FIRST, then retry on
+* // handler failure. Invalid payloads skip without burning retry attempts.
+* await subscribeWithSchema(
+*   fastify,
+*   OrderPaid,
+*   withRetry(handler, { maxRetries: 3 }),
+* );
+* ```
+*/
+async function subscribeWithSchema(fastify, definition, handler, options) {
+	return fastify.events.subscribe(definition.name, wrapWithSchema(definition, handler, options));
+}
+/**
+* Pure handler wrapper — returns a new `EventHandler` that catches handler
+* exceptions and routes them to `onError` (or logs and swallows). For
+* projection / cache-invalidation / fire-and-forget handlers where retry
+* would just delay the next-event resync, and where one bad event must NOT
+* stop processing of subsequent events.
+*
+* Lighter than `withRetry`: no exponential backoff, no DLQ. Composes with
+* `withRetry` if you want both ("retry, then log if exhausted, never throw").
+*
+* @example
+* ```ts
+* await fastify.events.subscribe(
+*   'product:variants.changed',
+*   wrapWithBoundary(async (event) => {
+*     cache.invalidate(event.payload.productId);
+*   }),
+* );
+* ```
+*/
+function wrapWithBoundary(handler, options = {}) {
+	const { onError, logger = console, name } = options;
+	const label = name ?? handler.name ?? "anonymous";
+	return async (event) => {
+		try {
+			await handler(event);
+		} catch (err) {
+			const error = err instanceof Error ? err : new Error(String(err));
+			if (onError) try {
+				await onError(error, event);
+			} catch (cbErr) {
+				logger.error(`[Arc Events] '${label}' onError callback threw:`, cbErr);
+			}
+			else logger.error(`[Arc Events] '${label}' threw on ${event.type} — swallowed (boundary): ${error.message}`, {
+				err: error,
+				event: event.type,
+				eventId: event.meta?.id,
+				handler: label
+			});
+		}
+	};
+}
+/**
+* Convenience: subscribe + error-boundary in one call. Equivalent to
+* `fastify.events.subscribe(pattern, wrapWithBoundary(handler, options))`.
+*
+* Returns the unsubscribe function from the underlying transport.
+*/
+async function subscribeWithBoundary(fastify, pattern, handler, options) {
+	return fastify.events.subscribe(pattern, wrapWithBoundary(handler, options));
+}
+//#endregion
+export { createEventRegistry as a, wrapWithSchema as i, subscribeWithSchema as n, defineEvent as o, wrapWithBoundary as r, subscribeWithBoundary as t };

package/dist/sync/changelog.d.mts

@@ -1,2 +1,3 @@
+
 import { ChangeEntry, ChangeLogAppendOptions, ChangeLogStore, ChangeOp, ChangesPage, ChangesSinceOptions, CursorExpiredError, MemoryChangeLogStore, PushMutation, PushVerdict, PushVerdictStatus } from "@classytic/repo-core/sync";
 export { type ChangeEntry, type ChangeLogAppendOptions, type ChangeLogStore, type ChangeOp, type ChangesPage, type ChangesSinceOptions, CursorExpiredError, MemoryChangeLogStore, type PushMutation, type PushVerdict, type PushVerdictStatus };

package/dist/sync/changelog.mjs

@@ -1,2 +1,3 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { CursorExpiredError, MemoryChangeLogStore } from "@classytic/repo-core/sync";
 export { CursorExpiredError, MemoryChangeLogStore };

package/dist/testing/cleanupStoreContract.d.mts

@@ -1,4 +1,5 @@
-import { D as CleanupRunStore } from "../types-C_ZZRcD6.mjs";
+
+import { D as CleanupRunStore } from "../types-C4QE8qnm.mjs";
 //#region src/testing/cleanupStoreContract.d.ts
 interface CleanupRunStoreContractSetupResult {
   store: CleanupRunStore;

package/dist/testing/cleanupStoreContract.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/cleanupStoreContract.ts
 /**

package/dist/testing/index.d.mts

@@ -1,8 +1,10 @@
-import { V as ResourceDefinition } from "../index-DPRH0Cme.mjs";
-import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
-import { n as ArcModuleInput } from "../types-Cu6vVJmh.mjs";
-import "../index-CZY4EGga.mjs";
-import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-CM4uUaFv.mjs";
+
+import { V as ResourceDefinition } from "../index-CpzxqePp.mjs";
+import { i as RequestScope } from "../types-ChuShpCP.mjs";
+import { l as AnyRecord, r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { n as ArcModuleInput } from "../types-CBgvkp8O.mjs";
+import "../index-CFThn1K9.mjs";
+import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-CyoJMSiO.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";
@@ -72,6 +74,41 @@ interface ArcAssertion {
 }
 declare function expectArc(response: ArcResponseLike): ArcAssertion;
 //#endregion
+//#region src/testing/authorizationConformance.d.ts
+/** One surface's observed enforcement: the HTTP status + the filter arc passed the repo. */
+interface SurfaceObservation {
+  /** HTTP status the surface returned (200 = allowed, 401/403 = denied). */
+  status: number;
+  /** The filter arc handed the repository for this surface (undefined if never reached). */
+  filter: AnyRecord | undefined;
+}
+/** Result of {@link runAuthorizationConformance} — one observation per surface. */
+interface AuthorizationConformance {
+  /** `GET /confs` — the CRUD list surface. */
+  list: SurfaceObservation;
+  /**
+   * `GET /confs/:id` — the SINGLE-RECORD surface. Its `filter` is the compound
+   * `buildIdFilter` output (route id AND policy AND tenant), so a policy that
+   * tried to redirect/widen the target would show here — the surface the
+   * filter-overwrite class of bug lives on.
+   */
+  get: SurfaceObservation;
+  /** `GET /confs/aggregations/tally` — the aggregation surface. */
+  aggregation: SurfaceObservation;
+  /** Close the throwaway app. Always call (e.g. in `finally`). */
+  close(): Promise<void>;
+}
+/**
+ * Boot a one-resource app gated by `permission` on both list + an aggregation,
+ * hit both surfaces anonymously, and report what arc enforced on each.
+ */
+declare function runAuthorizationConformance(opts: {
+  /** The permission under test — applied to `list` and the aggregation alike. */
+  permission: PermissionCheck;
+  /** Rows the mock repo returns for list (aggregation returns a count). */
+  rows?: AnyRecord[];
+}): Promise<AuthorizationConformance>;
+//#endregion
 //#region src/testing/authSession.d.ts
 /**
  * A concrete auth session — headers ready to drop into `app.inject`.
@@ -299,6 +336,81 @@ declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOpti
  */
 declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
 //#endregion
+//#region src/testing/testActor.d.ts
+/** The header the testing harness uses to carry a request's actor. */
+declare const TEST_ACTOR_HEADER = "x-test-actor";
+/**
+ * What a test wants to be. An `organizationId` produces a `member` scope (the
+ * org-scoped case); without one the actor is `authenticated`.
+ */
+interface TestActor {
+  /**
+   * Defaults to a synthetic id derived from the roles. Pass one explicitly when
+   * a test distinguishes two actors — ownership and audit assertions do, and
+   * two actors sharing roles would otherwise share an id.
+   */
+  userId?: string;
+  /** Global roles — what `requireRoles` reads. */
+  roles?: string[];
+  /** Tenant. Present ⇒ a `member` scope. */
+  organizationId?: string;
+  /** Org-level roles from membership records. Defaults to `roles`. */
+  orgRoles?: string[];
+  teamId?: string;
+  /** App-defined dimensions (branch, project, region) read via `getScopeContext`. */
+  context?: Record<string, string>;
+  /**
+   * Elevated (platform-admin) scope. The value is the `elevatedBy` audit string
+   * arc requires — an elevated scope must record who granted it. `true` is
+   * shorthand for `'test'`.
+   *
+   * An elevated scope carries no roles: elevation is a different kind of actor,
+   * not a role. A test needing a role gate AND elevation wants `member`.
+   */
+  elevated?: string | boolean;
+}
+/**
+ * Build the headers that make an injected request act as `actor`.
+ *
+ * A string is shorthand for a single role. `null` means "stay public", so a test
+ * can prove an endpoint is reachable anonymously.
+ *
+ * @example
+ * ```ts
+ * t.app.inject({ method: 'GET', url: '/pos/shifts/current',
+ *   headers: testActorHeaders('manager', ORG) });
+ * ```
+ */
+declare function testActorHeaders(actor: TestActor | string | null, organizationId?: string): Record<string, string>;
+/**
+ * Turn a spec into a `RequestScope`.
+ *
+ * `orgRoles` defaults to `roles`: a test that says "manager" means it at both
+ * levels, and making the caller repeat itself only produces tests that pass a
+ * global gate and mysteriously fail an org one.
+ */
+declare function scopeFromTestActor(spec: TestActor): RequestScope;
+/**
+ * Build the `auth` option that makes the test actor arc's authenticator.
+ *
+ * It must be an authenticator, not a hook. Fastify encapsulates plugins and
+ * modules register DURING `createApp`, so a hook added to the root instance
+ * afterwards never runs for their routes — every request still resolves as
+ * public and every role gate still answers 401, which reads exactly like a
+ * broken authorization rule in the code under test. Registering as
+ * `auth: { type: 'authenticator' }` puts the scope where arc's own auth would,
+ * at the phase arc expects, so tenant filtering and permission checks behave
+ * identically to production.
+ *
+ * `defaultActor` applies to requests carrying no header. A malformed header
+ * REJECTS rather than falling back to public — a test that meant to be an admin
+ * and got quietly demoted is the most expensive way to fail.
+ */
+declare function testActorAuth(defaultActor?: TestActor): {
+  type: "authenticator";
+  authenticate: (request: unknown) => Promise<void>;
+};
+//#endregion
 //#region src/testing/bootModuleApp.d.ts
 /** Handed to a modules factory — the in-memory DB is live at call time. */
 /**
@@ -322,8 +434,6 @@ type TestDatabaseFactory<TConn = unknown> = (opts: {
 interface TestkitContext<TConn = unknown> {
   /** The provisioned database's connection string. */
   uri: string;
-  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
-  mongoUri: string;
   /**
    * Driver connection handle (the default factory yields mongoose's
    * DEFAULT connection). Generic so DB-typed wrappers assert the driver
@@ -349,13 +459,20 @@ interface BootModuleAppOptions<TConn = unknown> {
    * boot when a module genuinely exercises one).
    */
   app?: Partial<CreateAppOptions>;
+  /**
+   * Default actor for every injected request that carries no `x-test-actor` header.
+   *
+   * The harness boots with `auth: false`, so without this every request is
+   * `PUBLIC_SCOPE` and role-gated routes answer 401 — correct, but it left tests with
+   * no supported way to be somebody. See `testActor.ts` for why the seam lives in the
+   * testing entrypoint and can never be reached from production.
+   */
+  actor?: TestActor;
 }
 interface ModuleTestApp<TConn = unknown> {
   app: FastifyInstance;
   /** The provisioned database's connection string. */
   uri: string;
-  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
-  mongoUri: string;
   /** The mongoose `Connection` handed to the modules factory. */
   connection: TConn;
   /**
@@ -527,13 +644,26 @@ declare function createSpy<T extends (...args: unknown[]) => unknown>(_name?: st
   getLastCall(): unknown[];
 };
 /**
- * Wait for a condition to be true
+ * Wait until `condition` holds — the standard way to assert on asynchronous
+ * effects in arc's suites.
+ *
+ * **Prefer this over `await sleep(n)` + assert.** A fixed delay encodes a guess
+ * about scheduling: too short and it flakes the moment the pool is busy, too
+ * long and every run pays for the worst case. Polling returns as soon as the
+ * effect lands, so the fast path stays fast and a loaded machine simply waits —
+ * and the failure mode becomes "this never happened", which is the thing worth
+ * asserting.
+ *
+ * Supply `label`: without it a timeout reports only its own duration, which is
+ * the least useful sentence a flaky test can print.
  *
- * Useful for async testing
+ * @example
+ * await waitFor(() => runs >= 3, { label: "3 scheduler ticks" });
  */
 declare function waitFor(condition: () => boolean | Promise<boolean>, options?: {
   timeout?: number;
   interval?: number;
+  label?: string;
 }): Promise<void>;
 /**
  * Create a test timer that can be controlled
@@ -545,6 +675,31 @@ declare function createTestTimer(): {
   reset: () => void;
 };
 //#endregion
+//#region src/testing/scopeRoleGate.d.ts
+/**
+ * Grants iff the caller is an org member holding one of `allowed` as an ORG role.
+ *
+ * This is `requireOrgRole` under a name package tests reach for — deliberately a
+ * delegation, not a reimplementation. It previously read `scope.userRoles` while
+ * requiring an organization, so it disagreed with production for any actor whose
+ * global and org roles differ: given
+ * `{ roles: ["employee"], orgRoles: ["manager"], organizationId: "org-1" }`,
+ * `requireOrgRole("manager")` allowed and this denied. The tests never caught it
+ * because `scopeFromTestActor` defaults `orgRoles` to `roles`, making the two
+ * dimensions identical for the common actor.
+ *
+ * Delegating also inherits the semantics a hand-rolled gate kept missing:
+ * elevated scopes pass, and a service (API-key) identity is refused with a
+ * message naming `requireServiceScope` instead of silently failing a role test.
+ *
+ * **Pair it with an org-bearing actor.** `testActorHeaders('manager', ORG)`
+ * yields a `member` scope and passes; `testActorHeaders('manager')` yields an
+ * `authenticated` scope with no tenant, which is refused — arc's generated CRUD
+ * filters by tenant, so a gate that waves a tenant-less request through is how a
+ * green test reads another org's rows.
+ */
+declare function scopeRoleGate(...allowed: string[]): PermissionCheck;
+//#endregion
 //#region src/testing/testApp.d.ts
 type DbMode = "in-memory" | {
   uri: string;
@@ -622,4 +777,4 @@ declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppC
  */
 declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };