nestjs-slightly-better-auth 1.10.0 → 1.11.0

package/README.md

@@ -994,9 +994,23 @@ The principal-source kit passes each credential factory the instance the case ru
 
 Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on (`advanced.disableOriginCheck: false` and `advanced.disableCSRFCheck: false`), whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance, with the organization plugin and the organizations its `org` fixture names, and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `forwardDirectCalls`, `fieldResolverEnhancers`, `fieldResolverCoverage`, `federation` and `graphqlContext` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures, and the class decorators of `inherited.subclasses` and `graph.classDecorators`. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
-The policy kit judges principals through the real evaluator, and cases that need route planning, acceptance or principal resolution send in-process requests through the real `BetterAuthGuard`. Pass the sources of the requirement's other principal kinds in `sources` (for example `apiKeyPrincipal()`). Unit-specific cases run when the requirement contains the built-in admin policy (`Z-admin-*`), an organization policy (`Z-org-ref-types` and the organization row of `Z-apikey-quota-per-request`) or the API-key permission policy (its `Z-apikey-quota-per-request` row), and skip with the reason otherwise. They use the instance's configuration where it matters: `session.cookieCache.enabled` for the warm-cache rows and `apiKey({ enableSessionForAPIKeys: true })` for the API-key session and quota rows. The kit builds the instances that need another configuration (`customSession` role shapes, `adminUserIds`, a dynamic `baseURL`) with `createConformanceAuth()`.
+The policy kit judges principals through the real evaluator, and cases that need route planning, acceptance or principal resolution send in-process requests through the real `BetterAuthGuard`. Pass the sources of the requirement's other principal kinds in `sources` (for example `apiKeyPrincipal()`). Unit-specific cases run when the requirement contains the built-in admin policy (`Z-admin-*`), an organization policy (`Z-org-ref-types` and the organization row of `Z-apikey-quota-per-request`) or the API-key permission policy (its `Z-apikey-quota-per-request` row), and skip with the reason otherwise. They use the instance's configuration where it matters: `session.cookieCache.enabled` for the warm-cache rows and `apiKey({ enableSessionForAPIKeys: true })` for the API-key session and quota rows. The kit builds the instances that need another configuration (`customSession` role shapes, `adminUserIds`, a dynamic `baseURL`, an instance without `apiKey()`) with `variant(overrides)`, which defaults to `createConformanceAuth(overrides)`. A storage job passes a variant that builds the same instance on its own database: add what `createConformanceAuth()` adds (`testUtils()`, `bearer()`, `conformanceProbePlugin()`, `nestjs()` last, `session.updateAge: 0` and `advanced.disableOriginCheck: false`), and migrate the schema before returning it.
 
-This repository runs the platform kit against Express and Fastify, including the Fastify HTTP/2 adapter for the HTTP/2 rows; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session source (its `S-bridge-*` rows on Express and Fastify), the API-key source with user-owned and organization-owned keys, and the design's JWT source sketch with derived and explicit claims; and the policy kit against the admin, organization (also with `customSession`), API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, handing Better Auth no client IP, ignoring its proxy trust, dropping the request host or stripping forwarding headers, a kernel that unbinds hooks on `close()`, reports taking over a closed binding or keeps a microservice's binding open, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a transport that claims every context type, runs no metadata canary, claims classes without handlers or drops the `Host` header without declaring hostless calls, a planner that caches plans by handler function, ignores `@SkipOriginCheck()` or skips the origin check of safe operations, an HTTP transport whose invocation is not the handler's request (Fastify), a WebSocket transport whose messages on one socket share their invocation, a GraphQL transport that treats a completed request as live, ignores `connectionParams` credentials, treats socket operations as safe reads, exempts `connectionParams` tokens, serves inherited forwarding fields without field guards, omits `W_FIELD_RESOLVER_INHERITS` or `I_CLASS_METADATA_OPERATIONS_ONLY`, a planner that applies class-level acceptance to field resolvers or records a reading on a form-mode nested public field, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, API-key sources that report every failure as an invalid key, verify once per call, run without the outage probe or latency signal, probe on every invalid key, touch key rows, or map organization keys to users, a session source that trusts hook answers on authoritative routes, a source that wraps errors without the request's credentials, JWT sources that expect the basePath URL as issuer or deny a key-set outage, sources that drop the host or forwarded headers, a route planner that forwards every handler's direct calls, a `forwardForeignCookies()` without a declaration check or without forwarding, a policy widening delegated principals, a policy turning a lost session or a storage outage into a denial, an organization policy coercing non-string inputs or repeating its Better Auth call, admin policies that admit API keys by default, lack fresh identity or hostless calls, ignore a key owner's ban, judge the session's role or trust the stored user row, and boot validation or route planning that ignore request-scoped dependencies or a class policy's `requires` field.
+`deliveries` also sends the transport-specific rows through real transports. A `PolicyDelivery` has these members:
+
+- `name` names the delivery in case titles.
+- `createApp(handlers, auth, { principals, logger })` boots an app with `globalGuard` that exposes each kit handler (a `FixtureHandler`, as in `transportConformance`) under its name: a gateway message with explicit coverage, a message pattern or a GraphQL query field. The kit's only named input, `orgId`, keeps its JSON type; a GraphQL harness declares it as a JSON scalar argument.
+- `invoke(app, handler, headers, input)` sends one logical request.
+- Connection transports add `connect(app, headers)`, which opens one connection whose `invoke()` sends one message, or one subscription operation for GraphQL, after the previous one answered. They also add `connectionPrincipalTtlMs`, the transport's `principalTtlMs` or `subscriptionPrincipalTtlMs`.
+
+The kit sends the probe plugin's trusted `Origin` with every delivered request. For each delivery it adds these cases, titled `<name>: …`:
+
+- `Z-admin-rejects-api-key-session`
+- `Z-org-ref-types`, with junk `orgId` values in the transport's payload
+- `Z-apikey-quota-per-request`, the API-key session setup
+- `Z-admin-banned` on one connection. It runs when `connect` and a positive `connectionPrincipalTtlMs` are present, and first checks that a default-freshness handler reuses the connection's principal after sign-out.
+
+This repository runs the platform kit against Express and Fastify, including the Fastify HTTP/2 adapter for the HTTP/2 rows; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session source (its `S-bridge-*` rows on Express and Fastify), the API-key source with user-owned and organization-owned keys, and the design's JWT source sketch with derived and explicit claims; and the policy kit against the admin, organization (also with `customSession`), API-key and fresh-session policies. The policy kit's delivery rows run over Socket.IO and `ws` with a 300 s principal TTL, over RPC over TCP (standalone and hybrid), and over the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws with a 300 s subscription principal TTL. `Z-admin-null-role` also runs on PGlite with Better Auth's Kysely adapter and migrations. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, handing Better Auth no client IP, ignoring its proxy trust, dropping the request host or stripping forwarding headers, a kernel that unbinds hooks on `close()`, reports taking over a closed binding or keeps a microservice's binding open, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a transport that claims every context type, runs no metadata canary, claims classes without handlers or drops the `Host` header without declaring hostless calls, a planner that caches plans by handler function, ignores `@SkipOriginCheck()` or skips the origin check of safe operations, an HTTP transport whose invocation is not the handler's request (Fastify), a WebSocket transport whose messages on one socket share their invocation, a GraphQL transport that treats a completed request as live, ignores `connectionParams` credentials, treats socket operations as safe reads, exempts `connectionParams` tokens, serves inherited forwarding fields without field guards, omits `W_FIELD_RESOLVER_INHERITS` or `I_CLASS_METADATA_OPERATIONS_ONLY`, a planner that applies class-level acceptance to field resolvers or records a reading on a form-mode nested public field, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, API-key sources that report every failure as an invalid key, verify once per call, run without the outage probe or latency signal, probe on every invalid key, touch key rows, or map organization keys to users, a session source that trusts hook answers on authoritative routes, a source that wraps errors without the request's credentials, JWT sources that expect the basePath URL as issuer or deny a key-set outage, sources that drop the host or forwarded headers, a route planner that forwards every handler's direct calls, a `forwardForeignCookies()` without a declaration check or without forwarding, a policy widening delegated principals, a policy turning a lost session or a storage outage into a denial, an organization policy coercing non-string inputs (also over `ws`) or repeating its Better Auth call, admin policies that admit API keys by default, lack fresh identity (also over RPC) or hostless calls, ignore a key owner's ban, judge the session's role or trust the stored user row (also on PGlite), a request scope that reuses a connection's principal for authoritative handlers (Socket.IO, graphql-ws), a WebSocket transport that declares a principal TTL it does not apply, a graphql-ws delivery that opens a new socket for each operation, and boot validation or route planning that ignore request-scoped dependencies or a class policy's `requires` field.
 
 ## Develop in this monorepo
 

package/dist/testing/conformance.cjs

@@ -2152,6 +2152,10 @@ async function bridgeOf(auth) {
 }
 //#endregion
 //#region src/conformance-policy-harness.ts
+/** An instance with the given overrides, built by options.variant() or createConformanceAuth(). */
+async function variantOf$1(options, overrides) {
+	return options.variant ? await options.variant(overrides) : createConformanceAuth(overrides);
+}
 function requirementsOf(expression) {
 	return "anyOf" in expression ? expression.anyOf.flatMap(requirementsOf) : "allOf" in expression ? expression.allOf.flatMap(requirementsOf) : [expression];
 }
@@ -2346,7 +2350,6 @@ async function requestHarness(auth, options) {
 	return {
 		probe,
 		logger,
-		moduleRef,
 		async request(route, headers, input = {}) {
 			const key = {};
 			const args = [{
@@ -2386,8 +2389,61 @@ async function requestHarness(auth, options) {
 		close: () => moduleRef.close()
 	};
 }
-async function withRequests(auth, options, fn) {
-	const value = await requestHarness(auth, options);
+/** A delivery's answer as a request outcome: its status code (500 when it carries none), code and reason. */
+function deliveredOutcome(result) {
+	if (result.ok) return {
+		ok: true,
+		status: 200
+	};
+	return {
+		ok: false,
+		status: result.error?.statusCode ?? 500,
+		code: result.error?.code,
+		reason: result.error?.reason,
+		...result.error?.statusCode === void 0 ? { error: result.error?.message } : {}
+	};
+}
+/** The kit's routes as the delivery's handlers: no parameters, a safe operation, answering `{ ok: true }`. */
+function deliveryHandlers(routes) {
+	return Object.fromEntries(Object.entries(routes).map(([name, decorators]) => [name, {
+		decorators,
+		params: [],
+		operation: "read",
+		handle: () => ({ ok: true })
+	}]));
+}
+/** The request harness over a PolicyDelivery's real transport. */
+async function deliveryHarness(delivery, auth, options) {
+	if (options.providers?.length || options.session !== void 0) throw new require_auth_errors.BetterAuthConfigurationError("CONFORMANCE_DELIVERY_OPTIONS", "A policy delivery boots its own application: it takes routes and principal sources only.");
+	const probe = await probeOf(auth);
+	const logger = options.logger ?? new CapturingLogger();
+	const app = await delivery.createApp(deliveryHandlers(options.routes), auth, {
+		principals: options.sources ?? [],
+		logger
+	});
+	const connect = delivery.connect?.bind(delivery);
+	const browser = (headers) => {
+		const values = new Headers(headers);
+		if (!values.has("origin")) values.set("origin", PROBE_TRUSTED_ORIGIN);
+		return values;
+	};
+	return {
+		probe,
+		logger,
+		request: async (route, headers, input = {}) => deliveredOutcome(await delivery.invoke(app, route, browser(headers), input)),
+		...connect ? { async connect(headers) {
+			const connection = await connect(app, browser(headers));
+			return {
+				request: async (route, input = {}) => deliveredOutcome(await connection.invoke(route, input)),
+				close: () => connection.close()
+			};
+		} } : {},
+		close: () => app.close()
+	};
+}
+/** Runs `fn` with requests through the in-process guard, or through `delivery`'s transport when given. */
+async function withRequests(auth, options, fn, delivery) {
+	const value = delivery ? await deliveryHarness(delivery, auth, options) : await requestHarness(auth, options);
 	try {
 		return await fn(value);
 	} finally {
@@ -2584,7 +2640,7 @@ function assertDenied(outcome, status, reason, message) {
 /**
 * The unit-specific rows of design §14.1 and the core class-policy row. Each unit's cases run when the requirement
 * contains that built-in policy, and skip with the reason otherwise; instances the case needs in another configuration
-* (customSession shapes, adminUserIds, a dynamic baseURL) are built by the kit with createConformanceAuth().
+* (customSession shapes, adminUserIds, a dynamic baseURL) are built by options.variant(), createConformanceAuth() by default.
 */
 function unitPolicyCases(options, known) {
 	const { auth } = options;
@@ -2595,6 +2651,152 @@ function unitPolicyCases(options, known) {
 	const noOrg = orgLeaf ? void 0 : "the requirement contains no built-in organization policy";
 	const admin_ = adminPolicy;
 	const adminCase = (id, title, run, skip = noAdmin) => conformanceCase(id, title, run, skip);
+	/** Z-admin-rejects-api-key-session through the in-process guard, or through `delivery`'s transport. */
+	const rejectsApiKeySession = async (delivery) => {
+		if (!await hasPlugin(auth, "api-key")) return conformanceSkip("the instance has no apiKey() plugin");
+		const adminId = await kitUser(auth, { role: "admin" });
+		const otherId = await kitUser(auth, { role: "user" });
+		const key = await createKey$1(auth, adminId, { permissions: { project: ["read"] } });
+		if (!await keySessions(auth, key.key)) return conformanceSkip("the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)");
+		const keyHeaders = new Headers({ [SDK_KEY_HEADER]: key.key });
+		node_assert_strict.default.equal(await sdkStatus(() => api(auth).listUsers({
+			headers: keyHeaders,
+			query: {}
+		})), 401, "Better Auth's listUsers accepted an API-key session");
+		node_assert_strict.default.equal(await sdkStatus(() => api(auth).banUser({
+			headers: keyHeaders,
+			body: { userId: otherId }
+		})), 401, "Better Auth's banUser accepted an API-key session");
+		const cookie = (await sessionHeaders(auth, adminId)).get("cookie");
+		return withRequests(auth, { routes: {
+			ban: [require_auth_decorators.Require(adminRequirement(admin_, { user: ["ban"] }))],
+			authoritative: [require_auth_decorators.RequireAuth({ authoritative: true })],
+			ordinary: [require_auth_decorators.RequireAuth()]
+		} }, async ({ request }) => {
+			assertDenied(await request("ban", keyHeaders), 401, void 0, "x-api-key alone on @RequirePermission({ user: ['ban'] })");
+			assertDenied(await request("authoritative", keyHeaders), 401, void 0, "x-api-key alone on @RequireAuth({ authoritative: true })");
+			const ordinary = await request("ordinary", keyHeaders);
+			node_assert_strict.default.equal(ordinary.ok, true, `a default-freshness route rejected the key session: ${describeOutcome(ordinary)}`);
+			assertDenied(await request("authoritative", {
+				cookie,
+				[SDK_KEY_HEADER]: key.key
+			}), 401, void 0, "the admin's cookie with the key on an authoritative route (RK27)");
+		}, delivery);
+	};
+	/**
+	* Z-org-ref-types' input rows through the in-process guard, or through `delivery`'s transport: junk `orgId` values are
+	* denied ORGANIZATION_REQUIRED without a Better Auth call and without an error log, the owner's ID is allowed.
+	*/
+	const orgRefInputs = async (leaf, delivery) => {
+		const ownerId = await kitUser(auth);
+		const headers = await sessionHeaders(auth, ownerId);
+		const organizationId = await createOrganizationFor(auth, headers);
+		await withRequests(auth, { routes: { org: [require_auth_decorators.Require(withOrganization(leaf, require_organization.fromParam("orgId")))] } }, async ({ request, probe, logger }) => {
+			for (const value of [
+				{ $ne: null },
+				123,
+				["a"],
+				""
+			]) {
+				const from = probe.calls.length;
+				assertDenied(await request("org", headers, { orgId: value }), 403, "ORGANIZATION_REQUIRED", `orgId ${JSON.stringify(value)}`);
+				node_assert_strict.default.deepEqual(betterAuthCalls(probe, from), [], `orgId ${JSON.stringify(value)} reached Better Auth`);
+			}
+			const valid = await request("org", headers, { orgId: organizationId });
+			node_assert_strict.default.equal(valid.ok, true, `the owner's organization ID was denied: ${describeOutcome(valid)}`);
+			node_assert_strict.default.deepEqual(logger.errors().map((entry) => entry.text), [], "a rejected organization input was logged as an error");
+		}, delivery);
+		return {
+			headers,
+			organizationId
+		};
+	};
+	const quotaRoutes = () => {
+		const permission = require_organization.orgPermission({ organization: ["update"] }, { organization: require_organization.fromParam("orgId") });
+		const member = require_organization.orgMember({ organization: require_organization.fromParam("orgId") });
+		return {
+			routes: { quota: [require_auth_decorators.Require(permission, member)] },
+			permission,
+			member
+		};
+	};
+	/**
+	* Z-apikey-quota-per-request's first setup through the in-process guard, or through `delivery`'s transport: an API-key
+	* session on two org policies spends the key's quota 3 times per request. Returns the skip when the instance cannot.
+	*/
+	const quotaSpend = async (delivery) => {
+		if (!await hasPlugin(auth, "api-key")) return conformanceSkip("the instance has no apiKey() plugin");
+		const ownerId = await kitUser(auth);
+		const headers = await sessionHeaders(auth, ownerId);
+		const organizationId = await createOrganizationFor(auth, headers);
+		const key = await createKey$1(auth, ownerId, { remaining: 100 });
+		if (!await keySessions(auth, key.key)) return conformanceSkip("the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)");
+		return withRequests(auth, { routes: quotaRoutes().routes }, async ({ request }) => {
+			const before = await remainingOf(auth, key.id);
+			const outcome = await request("quota", { [SDK_KEY_HEADER]: key.key }, { orgId: organizationId });
+			node_assert_strict.default.equal(outcome.ok, true, `the key owner's organization route was denied: ${describeOutcome(outcome)}`);
+			node_assert_strict.default.equal(before - await remainingOf(auth, key.id), 3, "one request with two credential-presenting org policies must spend 3");
+		}, delivery);
+	};
+	/**
+	* Z-admin-banned on one connection of `delivery`, whose connections reuse their principal for its declared TTL: the
+	* connection keeps a signed-out user's principal for a default-freshness handler, while the authoritative admin handler
+	* denies a banned or signed-out admin with a warm cookie cache on the connection's next message.
+	*/
+	const bannedOnConnection = async (delivery) => {
+		if (!await cookieCacheEnabled(auth)) return conformanceSkip("the instance's session.cookieCache is off; run the kit on an instance with session.cookieCache.enabled");
+		const sdk = await sdkContext(auth);
+		const banning = await sessionHeaders(auth, await kitUser(auth, { role: "admin" }));
+		const ttl = delivery.connectionPrincipalTtlMs;
+		return withRequests(auth, { routes: {
+			list: [require_auth_decorators.Require(adminRequirement(admin_, { user: ["list"] }))],
+			ordinary: [require_auth_decorators.RequireAuth()]
+		} }, async ({ connect }) => {
+			const open = connect;
+			const reusing = await kitUser(auth, { role: "admin" });
+			const connection = await open(await sessionHeaders(auth, reusing));
+			try {
+				const first = await connection.request("ordinary");
+				node_assert_strict.default.equal(first.ok, true, `the connection's first message was denied: ${describeOutcome(first)}`);
+				await sdk.internalAdapter.deleteUserSessions(reusing);
+				const reused = await connection.request("ordinary");
+				node_assert_strict.default.equal(reused.ok, true, `the connection did not reuse its principal within its declared ${ttl} ms TTL: ${describeOutcome(reused)}`);
+				assertDenied(await connection.request("list"), 401, void 0, "an authoritative handler reused the connection's principal after sign-out");
+			} finally {
+				await connection.close();
+			}
+			for (const variant of ["banned", "signed out everywhere"]) {
+				const userId = await kitUser(auth, { role: "admin" });
+				const socket = await open(await sessionHeaders(auth, userId, { warmCache: true }));
+				try {
+					for (const route of ["list", "ordinary"]) {
+						const before = await socket.request(route);
+						node_assert_strict.default.equal(before.ok, true, `${variant}: ${route} denied the admin before: ${describeOutcome(before)}`);
+					}
+					if (variant === "banned") await api(auth).banUser({
+						headers: banning,
+						body: { userId }
+					});
+					else await sdk.internalAdapter.deleteUserSessions(userId);
+					assertDenied(await socket.request("list"), 401, void 0, `${variant}: the connection's next message still admitted the admin`);
+				} finally {
+					await socket.close();
+				}
+			}
+		}, delivery);
+	};
+	/** The delivery variants of the transport-specific rows, titled with the delivery's name. */
+	const deliveryCases = (delivery) => {
+		const title = (text) => `${delivery.name}: ${text}`;
+		return [
+			adminCase("Z-admin-rejects-api-key-session", title("an admin's API-key session is rejected on admin and authoritative handlers and accepted on default-freshness handlers"), () => rejectsApiKeySession(delivery)),
+			adminCase("Z-admin-banned", title("a banned or signed-out admin with a warm cookie cache is denied on the connection's next message despite its principal TTL"), () => bannedOnConnection(delivery), noAdmin ?? (!delivery.connect ? "the delivery opens no connections (connect())" : !(delivery.connectionPrincipalTtlMs > 0) ? "the delivery's connections reuse no principal (connectionPrincipalTtlMs); the row applies to a principal TTL" : void 0)),
+			conformanceCase("Z-org-ref-types", title("fromParam rejects non-string organization inputs without a Better Auth call"), async () => {
+				await orgRefInputs(orgLeaf, delivery);
+			}, noOrg),
+			conformanceCase("Z-apikey-quota-per-request", title("an API-key session on org policies spends 3 per request"), () => quotaSpend(delivery), noOrg)
+		];
+	};
 	return [
 		adminCase("Z-admin-rejects-api-key", "an admin-owned API-key principal is denied PRINCIPAL_NOT_SUPPORTED without a Better Auth call, and 401 on a request", async () => {
 			const principal = await options.delegatedPrincipal();
@@ -2626,37 +2828,7 @@ function unitPolicyCases(options, known) {
 				node_assert_strict.default.equal(keys.verifications, 0, "the route verified an API key it does not accept");
 			});
 		}, noAdmin ?? (options.delegatedPrincipal ? void 0 : "the options give no delegatedPrincipal()")),
-		adminCase("Z-admin-rejects-api-key-session", "an admin's API-key session is rejected on admin and authoritative routes and accepted on default-freshness routes", async () => {
-			if (!await hasPlugin(auth, "api-key")) return conformanceSkip("the instance has no apiKey() plugin");
-			const adminId = await kitUser(auth, { role: "admin" });
-			const otherId = await kitUser(auth, { role: "user" });
-			const key = await createKey$1(auth, adminId, { permissions: { project: ["read"] } });
-			if (!await keySessions(auth, key.key)) return conformanceSkip("the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)");
-			const keyHeaders = new Headers({ [SDK_KEY_HEADER]: key.key });
-			node_assert_strict.default.equal(await sdkStatus(() => api(auth).listUsers({
-				headers: keyHeaders,
-				query: {}
-			})), 401, "Better Auth's listUsers accepted an API-key session");
-			node_assert_strict.default.equal(await sdkStatus(() => api(auth).banUser({
-				headers: keyHeaders,
-				body: { userId: otherId }
-			})), 401, "Better Auth's banUser accepted an API-key session");
-			const cookie = (await sessionHeaders(auth, adminId)).get("cookie");
-			return withRequests(auth, { routes: {
-				ban: [require_auth_decorators.Require(adminRequirement(admin_, { user: ["ban"] }))],
-				authoritative: [require_auth_decorators.RequireAuth({ authoritative: true })],
-				ordinary: [require_auth_decorators.RequireAuth()]
-			} }, async ({ request }) => {
-				assertDenied(await request("ban", keyHeaders), 401, void 0, "x-api-key alone on @RequirePermission({ user: ['ban'] })");
-				assertDenied(await request("authoritative", keyHeaders), 401, void 0, "x-api-key alone on @RequireAuth({ authoritative: true })");
-				const ordinary = await request("ordinary", keyHeaders);
-				node_assert_strict.default.equal(ordinary.ok, true, `a default-freshness route rejected the key session: ${describeOutcome(ordinary)}`);
-				assertDenied(await request("authoritative", {
-					cookie,
-					[SDK_KEY_HEADER]: key.key
-				}), 401, void 0, "the admin's cookie with the key on an authoritative route (RK27)");
-			});
-		}),
+		adminCase("Z-admin-rejects-api-key-session", "an admin's API-key session is rejected on admin and authoritative routes and accepted on default-freshness routes", () => rejectsApiKeySession()),
 		adminCase("Z-admin-banned", "a banned or signed-out admin with a warm cookie cache is denied on the next request; a banned key owner until banExpires", async () => {
 			if (!await cookieCacheEnabled(auth)) return conformanceSkip("the instance's session.cookieCache is off; run the kit on an instance with session.cookieCache.enabled");
 			const sdk = await sdkContext(auth);
@@ -2703,7 +2875,7 @@ function unitPolicyCases(options, known) {
 				["a role computed from app data", (user) => computed.get(user.id) ?? "viewer"]
 			];
 			for (const [shape, roleOf] of shapes) {
-				const kitAuth = createConformanceAuth({ plugins: [(0, better_auth_plugins.admin)(), (0, better_auth_plugins.customSession)(async ({ user, session }) => ({
+				const kitAuth = await variantOf$1(options, { plugins: [(0, better_auth_plugins.admin)(), (0, better_auth_plugins.customSession)(async ({ user, session }) => ({
 					user: {
 						...user,
 						role: roleOf(user)
@@ -2757,7 +2929,7 @@ function unitPolicyCases(options, known) {
 		})),
 		adminCase("Z-admin-null-role", "a NULL or empty stored role answers 403 MISSING_PERMISSION as listUsers does, adminUserIds allows, never a 500", async () => {
 			const listedId = `conformance-listed-${globalThis.crypto.randomUUID()}`;
-			const kitAuth = createConformanceAuth({ plugins: [(0, better_auth_plugins.admin)({ adminUserIds: [listedId] })] });
+			const kitAuth = await variantOf$1(options, { plugins: [(0, better_auth_plugins.admin)({ adminUserIds: [listedId] })] });
 			const nullId = await kitUser(kitAuth, { role: "user" });
 			await kitUser(kitAuth, {
 				id: listedId,
@@ -2813,7 +2985,7 @@ function unitPolicyCases(options, known) {
 		adminCase("Z-admin-dynamic-base-url", "a dynamic baseURL without fallback fails boot (B20); with fallback the admin route is decided", async () => {
 			const allowedHosts = [new URL(KIT_BASE_URL).host];
 			const requirement = adminRequirement(admin_, { user: ["list"] });
-			const without = await settle(() => boot(createConformanceAuth({
+			const without = await settle(async () => boot(await variantOf$1(options, {
 				baseURL: { allowedHosts },
 				plugins: [(0, better_auth_plugins.admin)()]
 			}), requirement));
@@ -2822,7 +2994,7 @@ function unitPolicyCases(options, known) {
 				node_assert_strict.default.fail("a dynamic baseURL without fallback booted");
 			}
 			node_assert_strict.default.ok(bootIssueCodes(without.error).includes("DYNAMIC_BASE_URL_WITHOUT_FALLBACK"), String(without.error));
-			const kitAuth = createConformanceAuth({
+			const kitAuth = await variantOf$1(options, {
 				baseURL: {
 					allowedHosts,
 					fallback: KIT_BASE_URL
@@ -2839,24 +3011,7 @@ function unitPolicyCases(options, known) {
 		}),
 		conformanceCase("Z-org-ref-types", "fromParam rejects non-string organization inputs without a call; a literal 'active' is an ID; customSession shapes use getActiveMember", async () => {
 			const leaf = orgLeaf;
-			const ownerId = await kitUser(auth);
-			const headers = await sessionHeaders(auth, ownerId);
-			const organizationId = await createOrganizationFor(auth, headers);
-			await withRequests(auth, { routes: { org: [require_auth_decorators.Require(withOrganization(leaf, require_organization.fromParam("orgId")))] } }, async ({ request, probe, logger }) => {
-				for (const value of [
-					{ $ne: null },
-					123,
-					["a"],
-					""
-				]) {
-					const from = probe.calls.length;
-					assertDenied(await request("org", headers, { orgId: value }), 403, "ORGANIZATION_REQUIRED", `orgId ${JSON.stringify(value)}`);
-					node_assert_strict.default.deepEqual(betterAuthCalls(probe, from), [], `orgId ${JSON.stringify(value)} reached Better Auth`);
-				}
-				const valid = await request("org", headers, { orgId: organizationId });
-				node_assert_strict.default.equal(valid.ok, true, `the owner's organization ID was denied: ${describeOutcome(valid)}`);
-				node_assert_strict.default.deepEqual(logger.errors(), []);
-			});
+			const { headers, organizationId } = await orgRefInputs(leaf);
 			await api(auth).setActiveOrganization({
 				headers,
 				body: { organizationId }
@@ -2871,7 +3026,7 @@ function unitPolicyCases(options, known) {
 				node_assert_strict.default.equal(decision.effect, "allow", `the default ref denied the active organization: ${JSON.stringify(decision)}`);
 				node_assert_strict.default.equal(betterAuthCalls(probe, from).length, 2, `a literal 'active' and the default ref made ${betterAuthCalls(probe, from).length} calls`);
 			});
-			const shaped = createConformanceAuth({ plugins: [(0, better_auth_plugins.organization)(), (0, better_auth_plugins.customSession)(async ({ user, session }) => ({
+			const shaped = await variantOf$1(options, { plugins: [(0, better_auth_plugins.organization)(), (0, better_auth_plugins.customSession)(async ({ user, session }) => ({
 				user,
 				session: {
 					id: session.id,
@@ -2906,21 +3061,9 @@ function unitPolicyCases(options, known) {
 			});
 		}, noOrg),
 		conformanceCase("Z-apikey-quota-per-request", "an API-key session on org policies spends 3 per request, with W_API_KEY_SESSION_MULTIPLIER naming them", async () => {
-			if (!await hasPlugin(auth, "api-key")) return conformanceSkip("the instance has no apiKey() plugin");
-			const ownerId = await kitUser(auth);
-			const headers = await sessionHeaders(auth, ownerId);
-			const organizationId = await createOrganizationFor(auth, headers);
-			const key = await createKey$1(auth, ownerId, { remaining: 100 });
-			if (!await keySessions(auth, key.key)) return conformanceSkip("the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)");
-			const permission = require_organization.orgPermission({ organization: ["update"] }, { organization: require_organization.fromParam("orgId") });
-			const member = require_organization.orgMember({ organization: require_organization.fromParam("orgId") });
-			const routes = { quota: [require_auth_decorators.Require(permission, member)] };
-			await withRequests(auth, { routes }, async ({ request }) => {
-				const before = await remainingOf(auth, key.id);
-				const outcome = await request("quota", { [SDK_KEY_HEADER]: key.key }, { orgId: organizationId });
-				node_assert_strict.default.equal(outcome.ok, true, `the key owner's organization route was denied: ${describeOutcome(outcome)}`);
-				node_assert_strict.default.equal(before - await remainingOf(auth, key.id), 3, "one request with two credential-presenting org policies must spend 3");
-			});
+			const spent = await quotaSpend();
+			if (spent) return spent;
+			const { routes, permission, member } = quotaRoutes();
 			const advice = async (target, session) => {
 				const booted = await boot(target, void 0, {
 					routes,
@@ -2947,7 +3090,7 @@ function unitPolicyCases(options, known) {
 				for (const id of [permission.policy, member.policy].map((policy) => policy.id)) node_assert_strict.default.ok(multiplier.includes(id), `${label}: W_API_KEY_SESSION_MULTIPLIER does not name ${id}: ${multiplier}`);
 				for (const text of [full, multiplier]) node_assert_strict.default.equal(text.includes(conditional), !factual, `${label}: ${text}`);
 			}
-			for (const [label, lines] of [["with session.apiKeySessions: false", await advice(auth, { apiKeySessions: false })], ["without the api-key plugin", await advice(createConformanceAuth({ plugins: [(0, better_auth_plugins.organization)()] }))]]) node_assert_strict.default.deepEqual(lines.filter((text) => text.startsWith("W_API_KEY_")), [], `${label}: API-key session advice was emitted`);
+			for (const [label, lines] of [["with session.apiKeySessions: false", await advice(auth, { apiKeySessions: false })], ["without the api-key plugin", await advice(await variantOf$1(options, { plugins: [(0, better_auth_plugins.organization)()] }))]]) node_assert_strict.default.deepEqual(lines.filter((text) => text.startsWith("W_API_KEY_")), [], `${label}: API-key session advice was emitted`);
 		}, noOrg),
 		conformanceCase("Z-apikey-quota-per-request", "a key resolved by an API-key source on @RequireApiKeyPermission spends 1 per request", async () => {
 			const leaf = keyLeaf;
@@ -3066,7 +3209,8 @@ function unitPolicyCases(options, known) {
 				for (const route of ["freshClass", "freshToken"]) assertDenied(await request(route, mocked), 401, void 0, `${route}: a hook-placed session on a freshIdentity route`);
 				node_assert_strict.default.equal(evaluations.fresh, 0, "a freshIdentity class policy was evaluated for a hook-placed session");
 			});
-		})
+		}),
+		...(options.deliveries ?? []).flatMap(deliveryCases)
 	];
 }
 //#endregion
@@ -3348,7 +3492,7 @@ function policyConformance(options) {
 			node_assert_strict.default.ok(bootIssueCodes(scoped.error).includes("NON_SINGLETON_EXTENSION"), `boot did not report NON_SINGLETON_EXTENSION (B11): ${String(scoped.error)}`);
 		}),
 		conformanceCase("Z-boot-prerequisite", "an instance without the policy's plugin prerequisites fails boot", async () => {
-			const result = await settle(() => boot(createConformanceAuth(), options.requirement));
+			const result = await settle(async () => boot(await variantOf$1(options, {}), options.requirement));
 			if (result.ok) {
 				await result.value.moduleRef.close();
 				node_assert_strict.default.fail("an instance without the policy's plugins booted");