@substrat-run/contract-tests 0.98.1 → 0.103.0

package/README.md

@@ -42,6 +42,29 @@ scopeHostContractSuite('adapter-yours', async () => {
 The suite grows with the kernel (migration journal, crash-mid-migration,
 duplicate-delivery harnesses); adapters inherit new checks by upgrading.
 
+## Suites gated by mounting, not by a flag
+
+Most suites take a `ScopeHostFixture` and every adapter mounts every one. A few need
+something only some hosts can provide, and those are separate exports an adapter
+mounts only when it can satisfy the fixture. There is deliberately no capability flag
+that makes a shared suite skip on one adapter: a skipped test reads as coverage the
+adapter does not have.
+
+- **`grantExpiryContractSuite`** — the fixture returns `{ host, clock, cleanup }` where
+  `clock` is the `ManualClock` (from `@substrat-run/kernel`) the host was constructed
+  with. The suite grants a permission with an `expiresAt` an hour ahead, asserts it is
+  live, moves the clock past it and asserts the denial — the transition the wall clock
+  cannot show in a test. Mounted by `adapter-sqlite` (`new SqliteScopeHost({ dir,
+  clock: clock.read })`).
+
+  **Parity gap, stated:** `adapter-cloudflare` does not mount it. The Durable Object
+  reads the wall clock inside the DO, which workerd constructs — an option on
+  `CloudflareScopeHost` never reaches it, because the host only holds a stub. Getting a
+  clock there is a decision (caller-supplied `now` per invocation, a test-only seam, or
+  neither), tracked on #956. Until one is taken, the DO's checker runs the same
+  `expires_at` predicate against a `now` it reads itself, and the pure host is the one
+  held to the contract by this suite.
+
 ## Status
 
 Pre-release (0.x): the suite expands as kernel contracts land.

package/dist/grant-expiry-suite.d.ts

@@ -0,0 +1,14 @@
+import { type ManualClock, type ScopeHost } from '@substrat-run/kernel';
+/**
+ * What the fixture hands the suite. `clock` is the SAME `ManualClock` whose
+ * `read` the host was constructed with — the suite advances it and expects the
+ * host to notice. A fixture that built the host on a different clock would pass
+ * the "allowed" half and fail every "denied" one, which is the honest failure.
+ */
+export interface GrantExpiryFixture {
+    host: ScopeHost;
+    clock: ManualClock;
+    cleanup: () => Promise<void>;
+}
+export declare function grantExpiryContractSuite(adapterName: string, makeFixture: () => Promise<GrantExpiryFixture>): void;
+//# sourceMappingURL=grant-expiry-suite.d.ts.map

package/dist/grant-expiry-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-expiry-suite.d.ts","sourceRoot":"","sources":["../src/grant-expiry-suite.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAQ,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAM9E;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAKD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAC7C,IAAI,CAoJN"}

package/dist/grant-expiry-suite.js

@@ -0,0 +1,181 @@
+/**
+ * Contract suite for grant expiry under an injected clock (#956).
+ *
+ * What it pins is one sentence: **a grant with an `expiresAt` stops granting the
+ * moment the HOST's clock passes it — not the wall clock, the host's.**
+ *
+ * `permissionContractSuite` already proves an ALREADY-expired grant is refused
+ * (dave's, dated 2000). What it cannot prove is the transition: a grant that is
+ * live now and dead an hour later, because the only way to get there against the
+ * wall clock is to wait. The pure host takes a `clock` (#812), and since #1160 its
+ * checker judges `expires_at` against that clock rather than `new Date()` — this
+ * suite is what holds it there. Without it, a refactor that quietly reverted the
+ * checker to the wall clock would pass every other suite: the dead grant of 2000
+ * is dead on both clocks.
+ *
+ * **Mounted, not flagged.** The fixture returns a `ManualClock` the suite moves,
+ * so only an adapter that can hand its host a clock can mount it. That is the
+ * pure SQLite host today. It is deliberately NOT a capability flag on the shared
+ * fixture that skips on the other adapter: a skipped test reads as coverage the
+ * adapter does not have.
+ *
+ * **Why the Cloudflare adapter does not mount it (the parity gap, written down).**
+ * The Durable Object host reads the wall clock inside the DO
+ * (`packages/adapter-cloudflare/src/scope-do.ts`, the `at` read in `invoke`, and
+ * the entitlement / system-grant reads beside it). The DO is constructed by
+ * workerd, not by `CloudflareScopeHost`, so an option on the host factory never
+ * reaches it — the host only holds a stub. The three ways a clock could get there
+ * were each a decision rather than a patch, and none was taken unattended:
+ * (a) the host sends the instant with each invocation, which makes `now`
+ * caller-supplied — a different trust story; (b) a test-only seam (an env flag
+ * or a DO method a test calls), honest but explicitly not the production path;
+ * (c) leave the fact untestable there and say so. This suite is (c): the pure
+ * host is held to the contract, the DO's checker runs the same SQL predicate
+ * (`expires_at IS NULL OR expires_at > ?`) against a `now` it reads itself, and
+ * the day the DO can take a clock, mounting this suite is the whole change.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { instant, permissionKey, platformActorId, principalId, scopeId, tenantId, } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { permMod } from './modules.js';
+const PERM_READ = permissionKey.parse('perm:read');
+const PERM_USE = permissionKey.parse('perm:use');
+const START = '2026-03-01T09:00:00.000Z';
+const HOUR = 3_600_000;
+export function grantExpiryContractSuite(adapterName, makeFixture) {
+    describe(`grant expiry under an injected clock: ${adapterName}`, () => {
+        let fixture;
+        let host;
+        let clock;
+        const t1 = tenantId.parse(ulid());
+        const s1 = scopeId.parse(ulid());
+        const alice = principalId.parse(ulid()); // grantedBy
+        const nora = principalId.parse(ulid()); // node-level, timed
+        const eve = principalId.parse(ulid()); // entity-narrowed, timed
+        const staff = platformActorId.parse(ulid());
+        const box = { entityType: 'box', entityId: 'b1' };
+        const probe = async (who, permission, entity) => {
+            const stub = await host.getScope(who, t1, s1);
+            const decision = await stub.invoke('perm/probe', { permission, entity });
+            return decision.allowed;
+        };
+        const at = (ms) => instant.parse(new Date(Date.parse(START) + ms).toISOString());
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            clock = fixture.clock;
+            clock.set(START);
+            host.registerModule(permMod);
+            await host.admin.createTenant(staff, { id: t1, slug: 'expiry-tenant', name: 'Expiry Tenant' });
+            await host.admin.grantEntitlement(staff, t1, 'perm');
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s1, vertical: 'expiry-vertical' });
+            await host.admin.activateScope(staff, t1, s1);
+            // Both shapes a timed grant takes: node-level, and narrowed to one entity.
+            await host.admin.grant(staff, {
+                principalId: nora,
+                permission: PERM_READ,
+                node: { tenantId: t1, scopeId: s1 },
+                expiresAt: at(HOUR),
+                grantedBy: alice,
+            });
+            await host.admin.grant(staff, {
+                principalId: eve,
+                permission: PERM_READ,
+                node: { tenantId: t1, scopeId: s1 },
+                entity: box,
+                expiresAt: at(HOUR),
+                grantedBy: alice,
+            });
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        it('a node-level grant is live before its expiresAt', async () => {
+            expect(await probe(nora, PERM_READ)).toBe(true);
+        });
+        it('an entity-narrowed grant is live before its expiresAt', async () => {
+            expect(await probe(eve, PERM_READ, box)).toBe(true);
+        });
+        /**
+         * The transition the wall clock cannot show. Nothing is revoked and nothing is
+         * swept: the only thing that changes is what time the host thinks it is.
+         */
+        it('the node-level grant stops granting once the clock passes expiresAt', async () => {
+            clock.set(at(HOUR + 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+        });
+        it('the entity-narrowed grant stops granting once the clock passes expiresAt', async () => {
+            clock.set(at(HOUR + 60_000));
+            expect(await probe(eve, PERM_READ, box)).toBe(false);
+        });
+        /**
+         * The boundary is part of the contract, not an adapter detail: the predicate is
+         * `expires_at > now`, so at the expiry instant itself the grant is already gone.
+         * A `>=` would pass every other test in this suite and silently widen every
+         * timed grant on that adapter by one instant — so the suite pins both sides of
+         * the line, for both shapes of grant.
+         */
+        it('is gone at the expiry instant itself, not one past it', async () => {
+            clock.set(at(HOUR - 1));
+            expect(await probe(nora, PERM_READ)).toBe(true);
+            expect(await probe(eve, PERM_READ, box)).toBe(true);
+            clock.set(at(HOUR));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+            expect(await probe(eve, PERM_READ, box)).toBe(false);
+        });
+        /**
+         * Expiry is judged on every check, not cached at grant time — so the same
+         * grant reads as live again if the clock is moved back before it. This is
+         * what distinguishes "the checker consults the clock" from "the grant was
+         * tombstoned when the clock passed it". The case sets up its own expiry first
+         * rather than inheriting the clock an earlier case left behind, so it proves
+         * the rollback when run alone too.
+         */
+        it('is judged at check time — the same grant is live again with the clock before expiresAt', async () => {
+            clock.set(at(HOUR + 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+            expect(await probe(eve, PERM_READ, box)).toBe(false);
+            clock.set(at(HOUR - 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(true);
+            expect(await probe(eve, PERM_READ, box)).toBe(true);
+            clock.set(at(HOUR + 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+            expect(await probe(eve, PERM_READ, box)).toBe(false);
+        });
+        /**
+         * Expiry is not sticky: a later re-grant of the same (principal, permission,
+         * node) carries its own `expiresAt`, and the checker judges that one. How the
+         * adapter stores it is its own business — the SQLite host keys tuples on
+         * (subject, relation, object) and the re-grant REPLACES the expired row, so
+         * there is never a dead row beside a live one there. What the contract holds is
+         * only the outcome: the expired grant does not shadow the new one, and the new
+         * one dies on its own clock.
+         */
+        it('a re-grant after expiry grants again, on its own expiresAt', async () => {
+            clock.set(at(HOUR + 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+            await host.admin.grant(staff, {
+                principalId: nora,
+                permission: PERM_READ,
+                node: { tenantId: t1, scopeId: s1 },
+                expiresAt: at(3 * HOUR),
+                grantedBy: alice,
+            });
+            expect(await probe(nora, PERM_READ)).toBe(true);
+            clock.set(at(3 * HOUR + 60_000));
+            expect(await probe(nora, PERM_READ)).toBe(false);
+        });
+        /** An untimed grant is unaffected by any clock — the control for the whole suite. */
+        it('a grant with no expiresAt is not touched by the clock', async () => {
+            await host.admin.grant(staff, {
+                principalId: nora,
+                permission: PERM_USE,
+                node: { tenantId: t1, scopeId: s1 },
+                grantedBy: alice,
+            });
+            clock.set(at(365 * 24 * HOUR));
+            expect(await probe(nora, PERM_USE)).toBe(true);
+        });
+    });
+}
+//# sourceMappingURL=grant-expiry-suite.js.map

package/dist/grant-expiry-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-expiry-suite.js","sourceRoot":"","sources":["../src/grant-expiry-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,OAAO,EACP,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GAIT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAoC,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAcjD,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,IAAI,GAAG,SAAS,CAAC;AAEvB,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,WAA8C;IAE9C,QAAQ,CAAC,yCAAyC,WAAW,EAAE,EAAE,GAAG,EAAE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAe,CAAC;QACpB,IAAI,KAAkB,CAAC;QACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY;QAClE,MAAM,IAAI,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB;QACzE,MAAM,GAAG,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,yBAAyB;QAC7E,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAc,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE7D,MAAM,KAAK,GAAG,KAAK,EAAE,GAAgB,EAAE,UAAyB,EAAE,MAAkB,EAAE,EAAE;YACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAuB,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC;QAEF,MAAM,EAAE,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAEzF,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAE9C,2EAA2E;YAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC5B,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC5B,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnC,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH;;;WAGG;QACH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;YACxF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH;;;;;;WAMG;QACH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH;;;;;;;WAOG;QACH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;YACtG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH;;;;;;;;WAQG;QACH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC5B,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;gBACvB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,qFAAqF;QACrF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC5B,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACnC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -12,12 +12,14 @@ export { listContractSuite } from './list-suite.js';
 export { scheduleContractSuite } from './schedule-suite.js';
 export { inputParseContractSuite } from './input-parse-suite.js';
 export { spineGuardContractSuite } from './spine-guard-suite.js';
+export { grantExpiryContractSuite } from './grant-expiry-suite.js';
+export type { GrantExpiryFixture } from './grant-expiry-suite.js';
 export { entityCheckConformanceSuite, planEntityCheckCoverage } from './entity-check-suite.js';
 export type { EntityCheckFixture, EntityCheckSuiteOptions, PlannedCheck } from './entity-check-suite.js';
 export { nodeOnlySuite, declaredNodeOnlySuite } from './node-only-suite.js';
 export type { NodeOnlyOptions } from './node-only-suite.js';
 export { declareEntityChecks, declareNodeOnly, assertNodeOnly } from './conformance.js';
 export type { ConformanceDeclaration, DrivenConformance, DeclaredNodeOnlyConformance, AssertedNodeOnlyConformance, } from './conformance.js';
-export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, permMod, scheduleMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
+export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, permMod, scheduleMod, freshnessMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
 export { connectorCalls, connectorTestFetch, resetConnectorCalls, type ConnectorCall, } from './connector-fixture.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -11,9 +11,10 @@ export { listContractSuite } from './list-suite.js';
 export { scheduleContractSuite } from './schedule-suite.js';
 export { inputParseContractSuite } from './input-parse-suite.js';
 export { spineGuardContractSuite } from './spine-guard-suite.js';
+export { grantExpiryContractSuite } from './grant-expiry-suite.js';
 export { entityCheckConformanceSuite, planEntityCheckCoverage } from './entity-check-suite.js';
 export { nodeOnlySuite, declaredNodeOnlySuite } from './node-only-suite.js';
 export { declareEntityChecks, declareNodeOnly, assertNodeOnly } from './conformance.js';
-export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, permMod, scheduleMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
+export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, permMod, scheduleMod, freshnessMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
 export { connectorCalls, connectorTestFetch, resetConnectorCalls, } from './connector-fixture.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAE/F,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOxF,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAE/F,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOxF,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC"}

package/dist/modules.d.ts

@@ -53,6 +53,12 @@ export declare const testModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -156,6 +162,127 @@ export declare const scheduleModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
+    withdraws?: string[] | undefined;
+    entitlementKey: string;
+    envSpec?: {
+        key: string;
+        label?: string | undefined;
+        description: string;
+        placeholder?: string | undefined;
+        required: boolean;
+        secret: boolean;
+        default?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    ownerGrants?: (string & z.$brand<"PermissionKey">)[] | undefined;
+    entitlements?: string[] | undefined;
+    provides?: string[] | undefined;
+    requires?: string[] | undefined;
+    api?: string | undefined;
+    searchables?: {
+        entityType: string;
+        fields: string[];
+        table?: string | undefined;
+        idColumn?: string | undefined;
+        tokenizer?: "prefix" | "substring" | undefined;
+    }[] | undefined;
+    lists?: {
+        entityType: string;
+        sortable: string[];
+        filterable?: string[] | undefined;
+        table?: string | undefined;
+        idColumn?: string | undefined;
+    }[] | undefined;
+    ui?: {
+        routes?: {
+            path: string;
+            screen: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        nav?: {
+            label: string;
+            icon?: string | undefined;
+            to: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        entityViews?: {
+            entityType: string;
+            view: string;
+        }[] | undefined;
+        widgets?: {
+            slot: string;
+            component: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+        settingsPanels?: {
+            label: string;
+            component: string;
+            permission: string & z.$brand<"PermissionKey">;
+        }[] | undefined;
+    } | undefined;
+};
+/**
+ * #1232 regression fixture: a SECOND module expecting the same event type as
+ * scheduleMod, with a WIDER window. The evaluator must aggregate across modules
+ * to the tightest window and evaluate once per scope — per-module evaluation
+ * would fight over the shared gating-state key and dedupe unit.
+ */
+export declare const freshnessModManifest: {
+    id: string & z.$brand<"ModuleId">;
+    version: string;
+    kernelContract: string;
+    permissions: {
+        key: string & z.$brand<"PermissionKey">;
+        description: string;
+    }[];
+    events: {
+        emits: {
+            type: string;
+            schemaVersion: number;
+        }[];
+        consumes: {
+            type: string;
+            schemaVersion: number;
+        }[];
+    };
+    migrations: {
+        journalDir: string;
+        compatibleFrom: string;
+    };
+    attachmentTargets: {
+        entityType: string;
+        readPermission: string & z.$brand<"PermissionKey">;
+        writePermission?: (string & z.$brand<"PermissionKey">) | undefined;
+    }[];
+    entityRelations?: {
+        entityType: string;
+        parentType: string;
+    }[] | undefined;
+    guards?: {
+        before: string;
+        predicate: string;
+        config: Record<string, unknown>;
+    }[] | undefined;
+    schedules?: {
+        operation: string;
+        cadence: {
+            everyMinutes: number;
+        };
+        input?: Record<string, unknown> | undefined;
+        permissions: (string & z.$brand<"PermissionKey">)[];
+    }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -215,6 +342,7 @@ export declare const scheduleModManifest: {
         }[] | undefined;
     } | undefined;
 };
+export declare const freshnessMod: ModuleRegistration;
 export declare const flowModManifest: {
     id: string & z.$brand<"ModuleId">;
     version: string;
@@ -259,6 +387,12 @@ export declare const flowModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -362,6 +496,12 @@ export declare const atomicModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -465,6 +605,12 @@ export declare const lateModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -568,6 +714,12 @@ export declare const billedModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -671,6 +823,12 @@ export declare const guardedModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -774,6 +932,12 @@ export declare const withdrawEarlyManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -877,6 +1041,12 @@ export declare const victimModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -980,6 +1150,12 @@ export declare const withdrawLateManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1083,6 +1259,12 @@ export declare const gateModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1195,6 +1377,12 @@ export declare const impersonationEchoManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1298,6 +1486,12 @@ export declare const permModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1415,6 +1609,12 @@ export declare const connectorModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1549,6 +1749,12 @@ export declare const listModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1653,6 +1859,12 @@ export declare const searchModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1757,6 +1969,12 @@ export declare const parseModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1861,6 +2079,12 @@ export declare const concurrencyModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -1965,6 +2189,12 @@ export declare const idempotencyModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {
@@ -2070,6 +2300,12 @@ export declare const brokenModManifest: {
         input?: Record<string, unknown> | undefined;
         permissions: (string & z.$brand<"PermissionKey">)[];
     }[] | undefined;
+    freshness?: {
+        eventType: string;
+        within: {
+            hours: number;
+        };
+    }[] | undefined;
     withdraws?: string[] | undefined;
     entitlementKey: string;
     envSpec?: {