@spacefast/common 0.0.21 → 0.0.24

package/dist/utils/grant-decision.fixtures.json

@@ -0,0 +1,2938 @@
+{
+    "comment": "Generated grant-decision conformance corpus. Two evaluators answer every case: packages/common/src/utils/grants.ts (evaluateGrants, the reference) and runtime/engine/runtime/access-rules.php (_stattic_grant_decision, the serving engine). Regenerate with `bun run generate:grant-fixtures` in packages/common; packages/common/src/utils/grants.test.ts fails on a stale file and runtime/tests/unit.php replays every case through the PHP engine. matchedGrantIds pins which Grant fired, so a right verdict from the wrong rule still fails. Beyond this corpus, `bun run fuzz:grants` (packages/common, opt-in) diffs the two evaluators over seeded random Grant/request pairs.",
+    "generator": "packages/common/scripts/generate-grant-decision-fixtures.ts",
+    "now": "2026-08-09T12:00:00.000Z",
+    "cases": [
+        {
+            "name": "zero grants admit nobody",
+            "category": "structural",
+            "spaceClaimed": true,
+            "grants": [],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an unclaimed Space keeps its config Grants closed",
+            "category": "source",
+            "spaceClaimed": false,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_config_public",
+                    "source": {
+                        "kind": "config",
+                        "reference": "sf.jsonc#$.access.public"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a claimed Space honours the same config Grant",
+            "category": "source",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_config_public",
+                    "source": {
+                        "kind": "config",
+                        "reference": "sf.jsonc#$.access.public"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_config_public"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an unclaimed Space still honours a system Grant",
+            "category": "source",
+            "spaceClaimed": false,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_preclaim"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_system_link",
+                    "source": {
+                        "kind": "system",
+                        "reference": "open:preclaim-author"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "linkIds": ["lnk_preclaim"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_system_link"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a public view Grant yields page.view",
+            "category": "capability",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_public_view",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_public_view"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a person Grant carries the whole manage capability set",
+            "category": "capability",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "person",
+                        "personId": "psn_owner"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": [
+                        "page.view",
+                        "comments.read",
+                        "comments.write",
+                        "content.publish",
+                        "access.manage"
+                    ],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_person_manage",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "personIds": ["psn_owner"]
+                }
+            },
+            "expected": {
+                "capabilities": [
+                    "access.manage",
+                    "comments.read",
+                    "comments.write",
+                    "content.publish",
+                    "page.view"
+                ],
+                "matchedGrantIds": ["grt_person_manage"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "capabilities union across two matching Grants",
+            "category": "capability",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_public_view",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view", "comments.read", "comments.write"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team_comment",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["comments.read", "comments.write", "page.view"],
+                "matchedGrantIds": ["grt_public_view", "grt_team_comment"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "root pattern matches the root path",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_root",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_root"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "root pattern does not reach a child path",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_root",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a trailing ** reaches an arbitrarily deep path",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_public_view",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a/b/c/d",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_public_view"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a trailing ** also matches zero segments",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_deep",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_docs_deep"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a single * matches exactly one segment",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/*"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_one",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/intro",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_docs_one"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a single * does not span two segments",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/*"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_one",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/intro/deep",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a single * requires a segment to be there",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/*"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_one",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an interior ** matches zero segments",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/a/**/z"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_interior",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a/z",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_interior"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an interior ** matches many segments",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/a/**/z"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_interior",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a/b/c/z",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_interior"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an interior ** still pins the suffix",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/a/**/z"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_interior",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a/b/c",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "consecutive ** collapse to one",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/a/**/**/z"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_collapsed",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/a/b/z",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_collapsed"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a trailing slash canonicalizes away before matching",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_exact_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_exact_docs"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "dot segments canonicalize away before matching",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_exact_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/./sub/..",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_exact_docs"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "the route lane collapses a terminal index.html",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_exact_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/index.html",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_exact_docs"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "the artifact lane keeps a terminal index.html",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_exact_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/index.html",
+                "resourceKind": "artifact",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an artifact index.html is reachable through a wildcard segment",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/*"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_one",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/index.html",
+                "resourceKind": "artifact",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_docs_one"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an include naming an index artifact does not grant the route it serves",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/index.html"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_docs_index",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an exclude naming an index artifact closes the route it serves",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/docs/index.html"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_broad_minus_index",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an exclude subtree carves out of a broad include",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/private/**"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_broad",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/private/notes",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an exclude subtree leaves the rest of the include intact",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/private/**"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_broad",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/public/notes",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_broad"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an exact exclude does not extend to children",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/secret"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_broad_exact",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/secret/child",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_broad_exact"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an exact exclude closes its own path",
+            "category": "path-glob",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/secret"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_broad_exact",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/secret",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a live Grant does not reach an immutable version",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_public_view",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "version",
+                    "versionId": "ver_one"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a version Grant matches its own version",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "version",
+                        "versionId": "ver_one"
+                    },
+                    "id": "grt_version",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "version",
+                    "versionId": "ver_one"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_version"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a version Grant ignores another version",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "version",
+                        "versionId": "ver_one"
+                    },
+                    "id": "grt_version",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "version",
+                    "versionId": "ver_two"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a branch Grant matches its own branch",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_branch"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "branch",
+                        "branch": "staging"
+                    },
+                    "id": "grt_branch",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "branch",
+                    "branch": "staging"
+                },
+                "principal": {
+                    "linkIds": ["lnk_branch"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_branch"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a branch Grant ignores another branch",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_branch"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "branch",
+                        "branch": "staging"
+                    },
+                    "id": "grt_branch",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "branch",
+                    "branch": "preview"
+                },
+                "principal": {
+                    "linkIds": ["lnk_branch"]
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "all_versions matches any immutable version",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "all_versions"
+                    },
+                    "id": "grt_all_versions",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "version",
+                    "versionId": "ver_anything"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_all_versions"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "all_versions does not reach the live route",
+            "category": "target",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "all_versions"
+                    },
+                    "id": "grt_all_versions",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_all_versions"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a team Grant admits a member of that team",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_team"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a team Grant ignores another team",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_other"]
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a person Grant admits that person",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "person",
+                        "personId": "psn_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_person",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "personIds": ["psn_one"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_person"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a link Grant admits the redeemed link",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_link",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "linkIds": ["lnk_one"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_link"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a password Grant admits the redeemed credential",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "password",
+                        "credentialId": "pwd_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_password",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "passwordCredentialIds": ["pwd_one"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_password"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a machine Grant admits the service token",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "machine",
+                        "machineId": "mch_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view", "content.publish"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_machine",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "machineIds": ["mch_one"]
+                }
+            },
+            "expected": {
+                "capabilities": ["content.publish", "page.view"],
+                "matchedGrantIds": ["grt_machine"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an external Grant admits its own issuer and subject",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "external",
+                        "issuer": "spacefast-membership",
+                        "subject": "mem_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_external",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "externalIdentities": [
+                        {
+                            "issuer": "spacefast-membership",
+                            "subject": "mem_one"
+                        }
+                    ]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_external"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an external Grant ignores another subject of the same issuer",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "external",
+                        "issuer": "spacefast-membership",
+                        "subject": "mem_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_external",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "externalIdentities": [
+                        {
+                            "issuer": "spacefast-membership",
+                            "subject": "mem_two"
+                        }
+                    ]
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an external Grant ignores the same subject from another issuer",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "external",
+                        "issuer": "https://idp-a.example",
+                        "subject": "alice"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_external",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "externalIdentities": [
+                        {
+                            "issuer": "https://idp-b.example",
+                            "subject": "alice"
+                        }
+                    ]
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an anonymous visitor gets nothing from a credential Grant",
+            "category": "audience",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_one"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_link",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an active window admits",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "notBefore": "2026-08-09T11:59:59.000Z",
+                        "expiresAt": "2026-08-09T12:00:01.000Z"
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_window",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_window"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "notBefore is closed one second early",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "notBefore": "2026-08-09T12:00:01.000Z"
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_scheduled",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "expiresAt closes on its own second",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "expiresAt": "2026-08-09T12:00:00.000Z"
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_expiring",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "expiresAt still admits the second before",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "expiresAt": "2026-08-09T12:00:01.000Z"
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_expiring",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_expiring"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "maxUses on a redeemed link admits",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "link",
+                        "linkId": "lnk_uses"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "maxUses": 1
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_link_uses",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "linkIds": ["lnk_uses"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_link_uses"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "maxUses on a public audience fails closed",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "id": "grt_public_uses",
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "maxUses": 5
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": false
+        },
+        {
+            "name": "requireVerifiedEmail admits a verified identity",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "person",
+                        "personId": "psn_verified"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "requireVerifiedEmail": true
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_verified",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "personIds": ["psn_verified"],
+                    "verifiedEmail": true
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_verified"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "requireVerifiedEmail closes an unverified identity",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "person",
+                        "personId": "psn_verified"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "requireVerifiedEmail": true
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_verified",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "personIds": ["psn_verified"]
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a country allowlist admits the listed country",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "countries": ["NL"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_country",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "NL",
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_country"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a country allowlist closes another country",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "countries": ["NL"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_country",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "US",
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an empty GeoIP fails a country allowlist closed",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "countries": ["NL"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_country",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an excluded country closes",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "excludedCountries": ["US"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_country_excluded",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "US",
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an empty GeoIP fails an exclusion list closed too",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "excludedCountries": ["US"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_country_excluded",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an excluded user-agent substring closes case-insensitively",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "excludedUserAgentSubstrings": ["GPTBot"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_agent",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "NL",
+                    "userAgent": "Mozilla/5.0 (compatible; gptbot/1.2)"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an unrelated user agent still passes the exclusion",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "excludedUserAgentSubstrings": ["GPTBot"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_agent",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "NL",
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_agent"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a missing user agent fails an exclusion list closed",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "excludedUserAgentSubstrings": ["GPTBot"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_agent",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "NL"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an IP constraint admits nobody",
+            "category": "constraint",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "network": {
+                            "ipCidrs": ["203.0.113.0/24"]
+                        }
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_ip",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "country": "NL",
+                    "userAgent": "Mozilla/5.0"
+                }
+            },
+            "expected": {
+                "capabilities": [],
+                "matchedGrantIds": []
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "one Grant's exclude does not suppress another Grant's include",
+            "category": "composition",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": ["/private/**"]
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_public_broad",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/private/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team_private",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/private/plan",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_team_private"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "an expired Grant loses to the live Grant with the same verdict",
+            "category": "composition",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {
+                        "expiresAt": "2020-01-01T00:00:00.000Z"
+                    },
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_expired_twin",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_live_twin",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {}
+            },
+            "expected": {
+                "capabilities": ["page.view"],
+                "matchedGrantIds": ["grt_live_twin"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "two Grants for one audience both report as matched",
+            "category": "composition",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team_view",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view", "comments.read", "comments.write"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_team_comments",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["comments.read", "comments.write", "page.view"],
+                "matchedGrantIds": ["grt_team_comments", "grt_team_view"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "a first-segment Grant and a fallback Grant both match under that segment",
+            "category": "composition",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_bucketed_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view", "comments.read", "comments.write"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_fallback_team",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/docs/intro",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["comments.read", "comments.write", "page.view"],
+                "matchedGrantIds": ["grt_bucketed_docs", "grt_fallback_team"]
+            },
+            "phpProjectionCompiles": true
+        },
+        {
+            "name": "another segment reaches only the fallback Grant",
+            "category": "composition",
+            "spaceClaimed": true,
+            "grants": [
+                {
+                    "audience": {
+                        "kind": "public"
+                    },
+                    "resources": {
+                        "include": ["/docs/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_bucketed_docs",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                },
+                {
+                    "audience": {
+                        "kind": "team",
+                        "teamId": "tm_conformance"
+                    },
+                    "resources": {
+                        "include": ["/**"],
+                        "exclude": []
+                    },
+                    "capabilities": ["page.view", "comments.read", "comments.write"],
+                    "constraints": {},
+                    "target": {
+                        "kind": "live"
+                    },
+                    "id": "grt_fallback_team",
+                    "source": {
+                        "kind": "managed",
+                        "reference": "conformance"
+                    }
+                }
+            ],
+            "request": {
+                "resource": "/blog/post",
+                "resourceKind": "route",
+                "target": {
+                    "kind": "live"
+                },
+                "principal": {
+                    "teamIds": ["tm_conformance"]
+                }
+            },
+            "expected": {
+                "capabilities": ["comments.read", "comments.write", "page.view"],
+                "matchedGrantIds": ["grt_fallback_team"]
+            },
+            "phpProjectionCompiles": true
+        }
+    ]
+}