permdock 0.0.0 → 0.2.0

package/dist/testing/index.js

@@ -0,0 +1,3672 @@
+import { _ as listPermissions, b as resource, n as definePermissions } from "../permissions-DVoF6dMt.js";
+import { r as principal } from "../refs-KYb4ntaz.js";
+import { _ as memoryLimitStore, a as definePolicy, m as role, t as allow } from "../policy-xyWg7QdR.js";
+import { _ as memoryRoleSource, u as snapshotFor } from "../src-CSbUiozF.js";
+import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
+import { a as normalizeMemberships, d as scopeList } from "../scopes-CVdPrWN-.js";
+import { n as parseSnapshot, p as evaluateCondition } from "../snapshot-Enxd0n-s.js";
+import { i as parsePolicyDocument, r as mergeHostedGrants } from "../hosted-DJQw46hn.js";
+import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-CzqXjCpU.js";
+import { t as byCodePoint } from "../compare-pfyVnBjE.js";
+import { n as fromSnapshot } from "../from-snapshot-C3sHpZNS.js";
+import { o as parseCredential } from "../credential-8P81ff4u.js";
+import { o as problemFromDecision } from "../problem-B43ztKIm.js";
+import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-DMAWwAJV.js";
+import { o as resolveApproval } from "../helpers-H_KARDVC.js";
+import { a as parseApiKey } from "../server-DlZ28Oz5.js";
+import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-BFGBBAqR.js";
+import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
+import { a as quoteSqlTable, r as quoteSqlIdent, t as SQL_IDENT } from "../sql-xdg5f4Fi.js";
+import { i as saasPermissions } from "../permissions-CpZrivYv.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-Bj_FFkjN.js";
+import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
+//#region src/testing/describe-policy.ts
+function isOutcomeCell(value) {
+	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);
+}
+/** Asserts `deniedBy` against the trace of a fresh `explain` call for the same arguments. */
+function assertDeniedBy(instance, permission, data, cell) {
+	if (typeof cell !== "object" || cell.deniedBy === void 0) return;
+	const explained = instance.explain(permission, data);
+	expect(explained.outcome).toBe("denied");
+	expect(explained.trace.denies[0]?.name).toBe(cell.deniedBy);
+}
+function expectedOutcome(cell) {
+	return typeof cell === "string" ? cell : cell.outcome ?? "denied";
+}
+function assertCell(decision, cell) {
+	expect(decision.outcome).toBe(expectedOutcome(cell));
+	if (typeof cell === "object" && cell.denials !== void 0 && decision.outcome === "denied") for (const denial of cell.denials) expect(decision.denials.some((item) => item.reason === denial.reason && (denial.role === void 0 || item.role === denial.role))).toBe(true);
+	if (typeof cell === "object" && cell.alternatives !== void 0 && decision.outcome === "denied") expect(decision.alternatives.map((leaf) => leaf.key)).toEqual(cell.alternatives);
+	if (typeof cell === "object" && cell.obligations !== void 0 && decision.outcome === "granted") expect((decision.obligations ?? []).map((item) => item.kind)).toEqual(cell.obligations);
+}
+function assertSnapshotCell(instance, permission, data, cell) {
+	const outcome = expectedOutcome(cell);
+	if (outcome === "approval-required") return;
+	const client = fromSnapshot(JSON.parse(JSON.stringify(instance.snapshot())));
+	expect(client.can(permission, data), "snapshot client disagrees with the server").toBe(outcome === "granted");
+}
+function describePolicy(policy, config) {
+	describe("policy matrix", () => {
+		const permissions = listPermissions(policy.permissions);
+		const permdocks = /* @__PURE__ */ new Map();
+		beforeAll(async () => {
+			for (const [name, user] of Object.entries(config.subjects)) permdocks.set(name, await createPermDock(policy, user, config.options));
+		});
+		it("covers every permission", () => {
+			if (config.exhaustive === false) return;
+			for (const permission of permissions) expect(config.matrix[permission.key], `missing matrix for ${permission.key}`).toBeDefined();
+		});
+		for (const permission of permissions) {
+			const spec = config.matrix[permission.key];
+			if (spec === void 0) continue;
+			describe(permission.key, () => {
+				if (!Object.values(spec).some((value) => !isOutcomeCell(value))) {
+					for (const [subjectName, cell] of Object.entries(spec)) it(`${subjectName}`, async () => {
+						const instance = permdocks.get(subjectName) ?? await createPermDock(policy, config.subjects[subjectName], config.options);
+						const data = permission.kind === "instance" ? Object.values(config.fixtures ?? {})[0] : void 0;
+						assertCell(instance.decide(permission, data), cell);
+						assertDeniedBy(instance, permission, data, cell);
+						if (config.snapshot === true) assertSnapshotCell(instance, permission, data, cell);
+					});
+					return;
+				}
+				for (const [fixtureName, row] of Object.entries(spec)) {
+					if (isOutcomeCell(row)) continue;
+					for (const [subjectName, cell] of Object.entries(row)) it(`${fixtureName} / ${subjectName}`, async () => {
+						const instance = permdocks.get(subjectName) ?? await createPermDock(policy, config.subjects[subjectName], config.options);
+						const fixture = config.fixtures?.[fixtureName];
+						assertCell(instance.decide(permission, fixture), cell);
+						assertDeniedBy(instance, permission, fixture, cell);
+						if (config.snapshot === true) assertSnapshotCell(instance, permission, fixture, cell);
+					});
+				}
+			});
+		}
+	});
+}
+//#endregion
+//#region src/testing/rls-parity.ts
+function toSubject(input) {
+	return {
+		principal: {
+			id: input.id,
+			roles: input.roles ?? [],
+			...input.tenant === void 0 ? {} : { tenant: input.tenant },
+			memberships: input.memberships ?? [],
+			...input.claims === void 0 ? {} : { claims: input.claims }
+		},
+		context: {}
+	};
+}
+function rowId(row) {
+	return row["id"];
+}
+function setting(name, value) {
+	return {
+		sql: "select set_config($1, $2, true)",
+		values: [name, value]
+	};
+}
+/**
+* The session state the generated helpers read: JWT claims for `supabase`,
+* GUCs for `guc` (roles as a comma list, memberships as JSON).
+*/
+function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes) {
+	const roles = subject.roles ?? [];
+	const memberships = membershipsClaim(subject.memberships ?? [], customRoles, scopes);
+	if (dialect === "supabase" || dialect === "neon") {
+		const claims = {
+			...subject.claims,
+			sub: subject.id,
+			role: "authenticated",
+			[roleClaim]: roles.length === 1 ? roles[0] : roles,
+			[tenantClaim]: subject.tenant,
+			memberships
+		};
+		return [setting("request.jwt.claims", JSON.stringify(claims))];
+	}
+	const settings = [
+		...Object.entries(subject.claims ?? {}).map(([name, value]) => {
+			if (!SQL_IDENT.test(name)) throw new Error(`PermDock: unsafe claim name '${name}'`);
+			return setting(`${gucPrefix}.${name}`, typeof value === "string" ? value : JSON.stringify(value));
+		}),
+		setting(`${gucPrefix}.user_id`, subject.id),
+		setting(`${gucPrefix}.${roleClaim}`, roles.join(",")),
+		setting(`${gucPrefix}.memberships`, JSON.stringify(memberships))
+	];
+	return subject.tenant === void 0 ? settings : [...settings, setting(`${gucPrefix}.${tenantClaim}`, subject.tenant)];
+}
+/**
+* The statement a case runs. With field views it reads back only the key, so
+* a base table whose restricted columns are revoked does not reject it.
+*/
+function statementSql(action, table, keyOnly) {
+	const quoted = quoteSqlTable(table);
+	const id = quoteSqlIdent("id");
+	const back = keyOnly ? id : "*";
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return `select ${back} from ${quoted} where ${id} = $1`;
+		case "update": return `update ${quoted} set ${id} = ${id} where ${id} = $1 returning ${back}`;
+		case "create": return `insert into ${quoted} (${id}) values ($1) returning ${back}`;
+		case "delete": return `delete from ${quoted} where ${id} = $1 returning ${back}`;
+		default: return `select ${back} from ${quoted} where ${id} = $1`;
+	}
+}
+function valued(row) {
+	if (row === null || typeof row !== "object") return [];
+	const record = row;
+	return Object.keys(record).filter((name) => record[name] !== null && record[name] !== void 0).toSorted();
+}
+function isRead(action) {
+	return action === "read" || action === "get" || action === "list";
+}
+async function viewColumns(query, table, key) {
+	const id = quoteSqlIdent("id");
+	await query("savepoint permdock_fields");
+	const view = await query(`select * from ${quoteSqlTable(`${table}_visible`)} where ${id} = $1`, [key]);
+	if (view.code === void 0) return valued(view.rows[0]);
+	await query("rollback to savepoint permdock_fields");
+	if (view.code !== "42P01") return view.code;
+	const base = await query(`select * from ${quoteSqlTable(table)} where ${id} = $1`, [key]);
+	return base.code ?? valued(base.rows[0]);
+}
+function dbOutcome(result) {
+	if (result.code === "42501") return "rejected";
+	return (result.rowCount ?? result.rows.length) > 0 ? "allowed" : "filtered";
+}
+async function rlsParity(policy, options) {
+	const dialect = options.dialect ?? "guc";
+	const gucPrefix = options.gucPrefix ?? "app";
+	const tenantClaim = options.tenantClaim ?? "tenant_id";
+	const roleClaim = options.roleClaim ?? "user_role";
+	const role = options.role ?? "authenticated";
+	const customRoles = options.customRoles ?? [];
+	const scopes = scopeList(policy.scopes);
+	async function runCase(fixture) {
+		const permdock = await createPermDock(policy, toSubject(fixture.subject), { customRoles: memoryRoleSource(customRoles) });
+		const granted = fixture.permission.kind === "collection" ? permdock.can(fixture.permission, fixture.row) : permdock.can(fixture.permission, fixture.row);
+		let fromClient;
+		if (options.snapshot === true) {
+			const snapshot = permdock.snapshot();
+			if (typeof snapshot !== "object" || snapshot instanceof Promise) throw new TypeError("PermDock: rlsParity needs an unsigned snapshot");
+			fromClient = fromSnapshot(parseSnapshot(JSON.stringify(snapshot))).can(fixture.permission, fixture.row);
+		}
+		await options.query("begin");
+		try {
+			await options.query(`set local role ${quoteSqlIdent(role === "anon" && dialect === "neon" ? "anonymous" : role)}`);
+			for (const item of subjectSettings(dialect, fixture.subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes)) await options.query(item.sql, item.values);
+			const database = dbOutcome(await options.query(statementSql(fixture.permission.action, fixture.table, options.fieldViews === true), [rowId(fixture.row)]));
+			const agrees = granted ? database === "allowed" : database === "filtered" || database === "rejected";
+			let fields;
+			if (options.fieldViews === true && fixture.permission.kind === "instance" && isRead(fixture.permission.action)) {
+				const key = policy.resources.get(fixture.permission.resource)?.id ?? "id";
+				const kept = new Set(granted ? valued(permdock.pick(fixture.permission, fixture.row)) : []);
+				if (granted && fixture.row[key] !== null && fixture.row[key] !== void 0) kept.add(key);
+				fields = {
+					app: [...kept].toSorted(),
+					database: await viewColumns(options.query, fixture.table, rowId(fixture.row))
+				};
+			}
+			const fieldsOk = fields === void 0 || typeof fields.database !== "string" && fields.database.join("\0") === fields.app.join("\0");
+			const ok = agrees && fieldsOk && (fromClient === void 0 || fromClient === granted);
+			return {
+				name: fixture.name,
+				granted,
+				database,
+				...fromClient === void 0 ? {} : { snapshot: fromClient },
+				...fields === void 0 ? {} : { fields },
+				ok
+			};
+		} finally {
+			await options.query("rollback");
+		}
+	}
+	async function runAll(remaining, acc) {
+		const [head, ...tail] = remaining;
+		if (head === void 0) return acc;
+		return runAll(tail, [...acc, await runCase(head)]);
+	}
+	const results = await runAll(options.fixtures, []);
+	return {
+		ok: results.every((item) => item.ok),
+		results
+	};
+}
+//#endregion
+//#region src/testing/orm-parity.ts
+function sortedIds(values) {
+	return values.map(String).toSorted();
+}
+function subsetOf(small, large) {
+	return small.every((value) => large.includes(value));
+}
+/**
+* ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
+* must be exactly the rows the database returns for `toWhere(permdock.where())`.
+* With a `relations` option, the graph is loaded for the rows first, so the
+* in-memory side walks the same graph the database query does.
+* A partial `where()` (a closure grant it cannot compile) may be refused or
+* return fewer rows, never more.
+*/
+async function ormParity(policy, scenarios, options) {
+	const idField = options.id ?? "id";
+	async function runCase(scenario) {
+		const permdock = await createPermDock(policy, scenario.user, scenario.options);
+		if (scenario.options?.relations !== void 0) await permdock.loadRelations(scenario.permission, scenario.rows);
+		const expected = sortedIds(permdock.filter(scenario.permission, scenario.rows).map((row) => row[idField]));
+		const where = permdock.where(scenario.permission);
+		try {
+			const actual = sortedIds(await options.run({
+				scenario,
+				where
+			}));
+			const ok = where.partial ? subsetOf(actual, expected) : actual.length === expected.length && subsetOf(actual, expected);
+			return {
+				name: scenario.name,
+				expected,
+				actual,
+				partial: where.partial,
+				ok
+			};
+		} catch (error) {
+			return {
+				name: scenario.name,
+				expected,
+				actual: [],
+				partial: where.partial,
+				error: error instanceof Error ? error.message : String(error),
+				ok: where.partial
+			};
+		}
+	}
+	const results = [];
+	for (const scenario of scenarios) results.push(await runCase(scenario));
+	return {
+		ok: results.every((item) => item.ok),
+		results
+	};
+}
+//#endregion
+//#region src/testing/client-parity.ts
+async function outcomes(policy, entry, options) {
+	const server = await createPermDock(policy, entry.user, {
+		...entry.tenant === void 0 ? {} : { tenant: entry.tenant },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles }
+	});
+	const client = fromSnapshot(parseSnapshot(JSON.stringify(server.snapshot())));
+	return {
+		server: server.can(entry.permission, entry.row),
+		client: client.can(entry.permission, entry.row)
+	};
+}
+/**
+* Asserts that `fromSnapshot(permdock.snapshot())` never grants what the
+* server denies, and matches it exactly unless a case is marked `stricter`.
+*/
+function testClientParity(policy, cases, options = {}) {
+	for (const entry of cases) it(`client parity: ${entry.name}`, async () => {
+		const result = await outcomes(policy, entry, options);
+		if (!result.server) {
+			expect(result.client, "client granted what the server denied").toBe(false);
+			return;
+		}
+		if (entry.stricter !== true) expect(result.client, "client denied what the server granted").toBe(true);
+	});
+}
+//#endregion
+//#region src/testing/client-store.ts
+const p = saasPermissions;
+function snapshotOf(user, tenant, tenants) {
+	return snapshotFor(saasPolicy, saasPrincipal(user, tenant), {
+		tenant,
+		...tenants === void 0 ? {} : { tenants }
+	});
+}
+/** gina leads team-a in both orgs, so `doc.update` needs the endpoint in each. */
+function leadSnapshot() {
+	return snapshotFor(saasPolicy, saasPrincipal("gina", "acme"), {
+		tenant: "acme",
+		tenants: "all",
+		memberships: [
+			...saasMemberships("gina"),
+			{
+				tenant: "globex",
+				roles: ["viewer"]
+			},
+			{
+				tenant: "globex",
+				team: "team-a",
+				roles: ["lead"]
+			}
+		]
+	});
+}
+function json(value, status = 200) {
+	return new Response(JSON.stringify(value), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+function ignore() {}
+function deferred() {
+	let resolve = ignore;
+	return {
+		promise: new Promise((release) => {
+			resolve = release;
+		}),
+		resolve
+	};
+}
+function recorder(respond) {
+	const calls = [];
+	const impl = async (input, init) => {
+		const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+		const body = typeof init?.body === "string" ? JSON.parse(init.body) : void 0;
+		const call = {
+			url,
+			method: init?.method ?? "GET",
+			body
+		};
+		calls.push(call);
+		return respond(call);
+	};
+	return {
+		fetch: impl,
+		calls
+	};
+}
+/** Maps opaque compact tokens to snapshot claims; no key material involved. */
+function stubVerifier(tokens) {
+	return { verify(token) {
+		const snapshot = tokens.get(token);
+		return Promise.resolve(snapshot === void 0 ? {
+			ok: false,
+			reason: "invalid-token",
+			cause: "invalid-signature"
+		} : {
+			ok: true,
+			claims: { snapshot },
+			header: {
+				alg: "ES256",
+				typ: "permdock-snapshot+jwt"
+			}
+		});
+	} };
+}
+async function settle() {
+	for (let tick = 0; tick < 10; tick += 1) await new Promise((resolve) => {
+		setTimeout(resolve, 0);
+	});
+}
+function denied() {
+	return {
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "deny"
+		}],
+		alternatives: []
+	};
+}
+function unreachable() {
+	throw new Error("no request expected");
+}
+/**
+* Race and cache scenarios for a client snapshot store: tenant switches,
+* `replace` and `refresh`, logout and a second user during a refresh, stale
+* and signed snapshots, and endpoint answers cached per tenant. Runs against
+* the saas domain; `createStore` wraps the store an adapter ships.
+*/
+function testClientStore(name, createStore) {
+	const acmeProject = saasProject("p1");
+	const globexProject = saasProject("g1");
+	const acmeDoc = saasDoc("d1");
+	describe(`client store: ${name}`, () => {
+		it("switches to a tenant the snapshot carries without a request", async () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: snapshotOf("erin", "acme", "all"),
+				snapshotUrl: "/api/snapshot",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			expect(store.get().can(p.project.update, acmeProject)).toBe(true);
+			await store.get().refresh({ tenant: "globex" });
+			expect(store.get().can(p.project.update, globexProject)).toBe(true);
+			expect(store.get().can(p.project.update, acmeProject)).toBe(false);
+			expect(store.get().status()).toBe("ready");
+			expect(net.calls).toHaveLength(0);
+		});
+		it("fetches another tenant with one query string and commits it only on success", async () => {
+			let fail = true;
+			const net = recorder(() => fail ? json({ error: "down" }, 503) : json(snapshotOf("erin", "globex")));
+			const store = createStore({
+				snapshot: snapshotOf("erin", "acme"),
+				snapshotUrl: "/api/snapshot?v=1",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			await store.get().refresh({ tenant: "globex" });
+			expect(net.calls.map((call) => call.url)).toEqual(["/api/snapshot?v=1&tenant=globex"]);
+			expect(store.get().subject.principal?.tenant).toBe("acme");
+			expect(store.get().can(p.project.update, acmeProject)).toBe(true);
+			expect(store.get().status()).toBe("stale");
+			fail = false;
+			await store.get().refresh({ tenant: "globex" });
+			expect(store.get().subject.principal?.tenant).toBe("globex");
+			expect(store.get().can(p.project.update, globexProject)).toBe(true);
+			expect(store.get().status()).toBe("ready");
+		});
+		it("reports pending while a refresh is in flight", async () => {
+			const gate = deferred();
+			const net = recorder(() => gate.promise);
+			const store = createStore({
+				snapshot: snapshotOf("erin", "acme"),
+				snapshotUrl: "/api/snapshot",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const pending = store.get().refresh();
+			expect(store.get().status()).toBe("pending");
+			gate.resolve(json(snapshotOf("erin", "acme")));
+			await pending;
+			expect(store.get().status()).toBe("ready");
+		});
+		it("drops a refresh that resolves after logout", async () => {
+			const gate = deferred();
+			const net = recorder(() => gate.promise);
+			const store = createStore({
+				snapshot: snapshotOf("erin", "acme"),
+				snapshotUrl: "/api/snapshot",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const pending = store.get().refresh();
+			store.get().clear();
+			gate.resolve(json(snapshotOf("erin", "acme")));
+			await pending;
+			await settle();
+			expect(store.get().subject.principal).toBeNull();
+			expect(store.get().can(p.project.read, acmeProject)).toBe(false);
+			expect(store.get().status()).toBe("server-only");
+		});
+		it("drops a refresh for the previous user after a replace", async () => {
+			const gate = deferred();
+			const net = recorder(() => gate.promise);
+			const store = createStore({
+				snapshot: snapshotOf("erin", "acme"),
+				snapshotUrl: "/api/snapshot",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const pending = store.get().refresh({ tenant: "globex" });
+			store.replace(snapshotOf("bob", "acme"));
+			gate.resolve(json(snapshotOf("erin", "globex")));
+			await pending;
+			await settle();
+			expect(store.get().subject.principal?.id).toBe("bob");
+			expect(store.get().subject.principal?.tenant).toBe("acme");
+			expect(store.get().can(p.project.update, globexProject)).toBe(false);
+		});
+		it("marks an expired snapshot stale until a fresh one replaces it", () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: {
+					...snapshotOf("erin", "acme"),
+					expiresAt: 1
+				},
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			expect(store.get().status()).toBe("stale");
+			expect(store.get().status(p.project.read, acmeProject)).toBe("stale");
+			store.replace(snapshotOf("erin", "acme"));
+			expect(store.get().status()).toBe("ready");
+		});
+		it("boots a signed snapshot through the verifier", async () => {
+			const token = "header.seed.signature";
+			const store = createStore({
+				snapshot: token,
+				tenant: "acme",
+				fetch: recorder(unreachable).fetch,
+				verifier: stubVerifier(/* @__PURE__ */ new Map([[token, snapshotOf("erin", "acme")]]))
+			});
+			await settle();
+			expect(store.get().subject.principal?.id).toBe("erin");
+			expect(store.get().can(p.project.update, acmeProject)).toBe(true);
+			expect(store.get().status()).toBe("ready");
+		});
+		it("rejects a signed snapshot the verifier refuses", async () => {
+			const store = createStore({
+				snapshot: "header.forged.signature",
+				tenant: "acme",
+				fetch: recorder(unreachable).fetch,
+				verifier: stubVerifier(/* @__PURE__ */ new Map())
+			});
+			await settle();
+			expect(store.get().subject.principal).toBeNull();
+			expect(store.get().can(p.project.read, acmeProject)).toBe(false);
+		});
+		it("verifies a signed refresh response", async () => {
+			const seed = "header.seed.signature";
+			const next = "header.next.signature";
+			const store = createStore({
+				snapshot: seed,
+				snapshotUrl: "/api/snapshot",
+				tenant: "acme",
+				fetch: recorder(() => json(next)).fetch,
+				verifier: stubVerifier(/* @__PURE__ */ new Map([[seed, snapshotOf("erin", "acme")], [next, snapshotOf("erin", "globex")]]))
+			});
+			await settle();
+			await store.get().refresh({ tenant: "globex" });
+			await settle();
+			expect(store.get().subject.principal?.tenant).toBe("globex");
+			expect(store.get().can(p.project.update, globexProject)).toBe(true);
+		});
+		it("caches endpoint answers per tenant and settles the store status", async () => {
+			const net = recorder((call) => {
+				const body = call.body;
+				return json({ evaluations: body.evaluations.map(() => ({
+					decision: false,
+					context: { permdock: denied() }
+				})) });
+			});
+			const store = createStore({
+				snapshot: leadSnapshot(),
+				endpoint: "/api/permdock",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			expect(store.get().status(p.doc.update, acmeDoc)).toBe("pending");
+			await settle();
+			expect(store.get().status(p.doc.update, acmeDoc)).toBe("ready");
+			expect(store.get().status()).toBe("ready");
+			expect(net.calls).toHaveLength(1);
+			store.get().status(p.doc.update, acmeDoc);
+			await settle();
+			expect(net.calls).toHaveLength(1);
+			await store.get().refresh({ tenant: "globex" });
+			const sameIdInGlobex = {
+				...acmeDoc,
+				orgId: "globex"
+			};
+			expect(store.get().status(p.doc.update, sameIdInGlobex)).toBe("pending");
+			await settle();
+			expect(net.calls).toHaveLength(2);
+		});
+		it("forgets endpoint answers when a new snapshot arrives", async () => {
+			const net = recorder((call) => {
+				const body = call.body;
+				return json({ evaluations: body.evaluations.map(() => ({
+					decision: false,
+					context: { permdock: denied() }
+				})) });
+			});
+			const store = createStore({
+				snapshot: snapshotOf("gina", "acme"),
+				endpoint: "/api/permdock",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			store.get().status(p.doc.update, acmeDoc);
+			await settle();
+			expect(net.calls).toHaveLength(1);
+			store.replace(snapshotOf("gina", "acme"));
+			expect(store.get().status(p.doc.update, acmeDoc)).toBe("pending");
+			await settle();
+			expect(net.calls).toHaveLength(2);
+		});
+		it("answers a row edited in place once the task that read it ends", async () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: snapshotOf("bob", "acme"),
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const row = {
+				...acmeProject,
+				ownerId: "bob"
+			};
+			expect(store.get().status(p.project.update, row)).toBe("ready");
+			expect(store.get().can(p.project.update, row)).toBe(true);
+			row.ownerId = "alice";
+			await settle();
+			expect(store.get().can(p.project.update, row)).toBe(false);
+		});
+		it("answers a check on a row that throws as denied, without throwing", () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: snapshotOf("bob", "acme"),
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const hostile = new Proxy({}, { get() {
+				throw new Error("hostile row");
+			} });
+			expect(store.get().status(p.project.update, hostile)).not.toBe("pending");
+			expect(store.get().can(p.project.update, hostile)).toBe(false);
+		});
+		it("notifies every subscriber of a logout when one of them throws", () => {
+			const reported = vi.fn();
+			vi.stubGlobal("reportError", reported);
+			try {
+				const net = recorder(unreachable);
+				const store = createStore({
+					snapshot: snapshotOf("bob", "acme"),
+					tenant: "acme",
+					fetch: net.fetch
+				});
+				let after = 0;
+				const offThrowing = store.get().subscribe(() => {
+					throw new Error("subscriber failed");
+				});
+				const offCounting = store.get().subscribe(() => {
+					after += 1;
+				});
+				store.get().clear();
+				expect(after).toBe(1);
+				expect(reported).toHaveBeenCalled();
+				expect(store.get().can(p.project.read, acmeProject)).toBe(false);
+				offThrowing();
+				offCounting();
+			} finally {
+				vi.unstubAllGlobals();
+			}
+		});
+		it("does not notify subscribers synchronously from a status read", () => {
+			const net = recorder(() => json({ evaluations: [] }));
+			const store = createStore({
+				snapshot: snapshotOf("gina", "acme"),
+				endpoint: "/api/permdock",
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			let notified = 0;
+			store.get().subscribe(() => {
+				notified += 1;
+			});
+			store.get().status(p.doc.update, acmeDoc);
+			expect(notified).toBe(0);
+		});
+	});
+}
+//#endregion
+//#region src/testing/snapshot-fixture.ts
+async function snapshotFixture(policy, subject, options = {}) {
+	const instance = await createPermDock(policy, subject, options.tenant === void 0 ? {} : { tenant: options.tenant });
+	const target = options.simulated === true ? instance.simulate({}) : instance;
+	if (Array.isArray(target)) throw new Error("PermDock: snapshotFixture expected a PermDock instance");
+	const snapshot = options.include === void 0 && options.tenants === void 0 ? target.snapshot() : target.snapshot({
+		...options.include === void 0 ? {} : { include: options.include },
+		...options.tenants === void 0 ? {} : { tenants: options.tenants }
+	});
+	if (typeof snapshot === "string" || snapshot instanceof Promise) throw new Error("PermDock: snapshotFixture expected a JSON snapshot");
+	return snapshot;
+}
+//#endregion
+//#region src/testing/http-adapter.ts
+function project$1(id) {
+	const row = saasSeed.projects.find((candidate) => candidate.id === id);
+	if (row === void 0) throw new Error(`no seed project ${id}`);
+	return row;
+}
+function bearerToken(authorization) {
+	if (typeof authorization !== "string") return null;
+	return /^Bearer (\S+)$/u.exec(authorization)?.[1] ?? null;
+}
+function orgOf(path) {
+	const [segment] = path.replace(/^\/+/u, "").split("/");
+	return segment === void 0 || segment.length === 0 ? void 0 : saasOrg(segment)?.id;
+}
+async function pause(ms, signal) {
+	await new Promise((resolve) => {
+		const timer = setTimeout(done, ms);
+		function done() {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", done);
+			resolve();
+		}
+		signal.addEventListener("abort", done, { once: true });
+	});
+}
+async function* ticks(org, signal) {
+	const rows = saasSeed.projects.filter((row) => row.orgId === org);
+	if (rows.length === 0) return;
+	while (!signal.aborted) for (const row of rows) {
+		await pause(20, signal);
+		if (signal.aborted) return;
+		yield row;
+	}
+}
+function demotionKey(user, org) {
+	return JSON.stringify([user, org]);
+}
+function createDomain$1() {
+	const demoted = /* @__PURE__ */ new Set();
+	const principalOf = (sub, path) => {
+		const principal = saasPrincipal(sub, orgOf(path));
+		return {
+			...principal,
+			memberships: (principal.memberships ?? []).filter((membership) => membership.tenant === void 0 || !demoted.has(demotionKey(sub, membership.tenant)))
+		};
+	};
+	return {
+		policy: saasPolicy,
+		async subject(authorization, path) {
+			const verified = await verifySaasSession(bearerToken(authorization));
+			return verified === null ? null : principalOf(verified.sub, path);
+		},
+		async session(authorization, path) {
+			const verified = await verifySaasSession(bearerToken(authorization));
+			return verified === null ? null : {
+				principal: principalOf(verified.sub, path),
+				context: {},
+				expiresAt: verified.expiresAt
+			};
+		},
+		revocations: memoryRevocationFeed(),
+		ticks,
+		demote(user, org) {
+			const key = demotionKey(user, org);
+			demoted.add(key);
+			return () => {
+				demoted.delete(key);
+			};
+		},
+		org: orgOf,
+		customRoles: memoryRoleSource(saasCustomRoles),
+		store: memoryApprovalStore(),
+		limits: memoryLimitStore(),
+		project: (id) => id === void 0 ? null : saasSeed.projects.find((row) => row.id === id) ?? null
+	};
+}
+function restRequest(base, call) {
+	const headers = new Headers();
+	if (call.authorization !== null) headers.set("authorization", call.authorization);
+	if (call.approval !== void 0) headers.set(APPROVAL_HEADER, call.approval);
+	const json = (method, path, body) => {
+		headers.set("content-type", "application/json");
+		return new Request(`${base}${path}`, {
+			method,
+			headers,
+			body: JSON.stringify(body)
+		});
+	};
+	const plain = (method, path) => new Request(`${base}${path}`, {
+		method,
+		headers
+	});
+	switch (call.op) {
+		case "project.get": return plain("GET", `/${call.org}/projects/${call.id}`);
+		case "project.update": return json("PATCH", `/${call.org}/projects/${call.id}`, { name: "Renamed" });
+		case "project.create": return json("POST", `/${call.org}/projects`, call.body);
+		case "project.delete": return plain("DELETE", `/${call.org}/projects/${call.id}`);
+		case "project.upload": {
+			const form = new FormData();
+			form.set("file", new Blob([call.file.content]), call.file.name);
+			return new Request(`${base}/${call.org}/projects/${call.id}/files`, {
+				method: "POST",
+				headers,
+				body: form
+			});
+		}
+		case "analytics.read": return plain("GET", `/${call.org}/analytics`);
+		case "apiKey.create": return plain("POST", `/${call.org}/api-keys`);
+		case "apiKey.revokeAll": return plain("POST", `/${call.org}/api-keys/revoke-all`);
+		case "admin.members": return plain("GET", `/${call.org}/admin/members`);
+		case "evaluations": return json("POST", `/${call.org}/permdock/access/v1/evaluations`, call.body);
+		default: return call;
+	}
+}
+async function readResult(response) {
+	const text = await response.text();
+	if (text.length === 0) return {
+		status: response.status,
+		body: null
+	};
+	try {
+		const body = JSON.parse(text);
+		return {
+			status: response.status,
+			body
+		};
+	} catch {
+		return {
+			status: response.status,
+			body: text
+		};
+	}
+}
+function field(body, key) {
+	return body !== null && typeof body === "object" ? body[key] : void 0;
+}
+function reasonsOf(body) {
+	const denials = field(body, "denials");
+	return Array.isArray(denials) ? denials.map((denial) => field(denial, "reason")) : [];
+}
+async function approverSubject(user, tenant) {
+	return (await createPermDock(saasPolicy, saasPrincipal(user, tenant), { tenant })).subject;
+}
+const PARALLEL = [
+	{
+		user: "alice",
+		org: "acme",
+		id: "p1",
+		status: 200
+	},
+	{
+		user: "alice",
+		org: "globex",
+		id: "g1",
+		status: 200
+	},
+	{
+		user: "alice",
+		org: "acme",
+		id: "g1",
+		status: 403
+	},
+	{
+		user: "bob",
+		org: "acme",
+		id: "p1",
+		status: 200
+	},
+	{
+		user: "bob",
+		org: "globex",
+		id: "g1",
+		status: 403
+	},
+	{
+		user: "hank",
+		org: "acme",
+		id: "p3",
+		status: 200
+	},
+	{
+		user: "mallory",
+		org: "acme",
+		id: "p1",
+		status: 403
+	},
+	{
+		user: null,
+		org: "acme",
+		id: "p1",
+		status: 401
+	},
+	{
+		user: "erin",
+		org: "globex",
+		id: "g1",
+		status: 200
+	},
+	{
+		user: "frank",
+		org: "acme",
+		id: "p1",
+		status: 403
+	}
+];
+const STREAM_WAIT_MS = 4e3;
+async function within(promise, what) {
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`timed out waiting for ${what}`));
+		}, STREAM_WAIT_MS);
+	});
+	try {
+		return await Promise.race([promise, timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+function parseFrame(raw) {
+	let event = "message";
+	const data = [];
+	for (const line of raw.split(/\r?\n/u)) if (line.startsWith("event:")) event = line.slice(6).trim();
+	else if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+	return data.length === 0 ? void 0 : {
+		event,
+		data: data.join("\n")
+	};
+}
+function eventStream(response) {
+	const reader = response.body?.pipeThrough(new TextDecoderStream()).getReader();
+	let buffer = "";
+	const next = async () => {
+		if (reader === void 0) return;
+		for (;;) {
+			const end = /\r?\n\r?\n/u.exec(buffer);
+			if (end !== null) {
+				const frame = parseFrame(buffer.slice(0, end.index));
+				buffer = buffer.slice(end.index + end[0].length);
+				if (frame !== void 0) return frame;
+				continue;
+			}
+			const chunk = await within(reader.read(), "an SSE frame");
+			if (chunk.done) return;
+			buffer += chunk.value;
+		}
+	};
+	return {
+		status: response.status,
+		next,
+		cancel: async () => {
+			await reader?.cancel().catch(() => void 0);
+		}
+	};
+}
+/** Reads frames until the `permdock` frame and the end of the stream. */
+async function untilEnd(stream) {
+	for (;;) {
+		const frame = await stream.next();
+		if (frame === void 0) return {
+			problem: void 0,
+			ended: true
+		};
+		if (frame.event === "permdock") return {
+			problem: JSON.parse(frame.data),
+			ended: await stream.next() === void 0
+		};
+	}
+}
+/**
+* Real-life HTTP scenarios over the shared SaaS domain. `mount` builds the
+* application once with the adapter under test; every expectation below is
+* written by hand, never computed with PermDock.
+*/
+function testHttpAdapter(options) {
+	const scenario = (name, title, run, timeout) => {
+		const reason = options.skip?.[name] ?? (name.startsWith("stream-") && options.streams !== true ? "no events stream" : void 0);
+		it.skipIf(reason !== void 0)(reason === void 0 ? title : `${title} (${reason})`, run, timeout);
+	};
+	describe(`${options.name}: real-life HTTP scenarios`, () => {
+		const domain = createDomain$1();
+		const tokens = /* @__PURE__ */ new Map();
+		let mounted;
+		beforeAll(async () => {
+			mounted = await options.mount(domain);
+			for (const user of [
+				"alice",
+				"bob",
+				"carol",
+				"dave",
+				"erin",
+				"frank",
+				"hank",
+				"mallory"
+			]) tokens.set(user, `Bearer ${await signSaasToken(user, { memberships: false })}`);
+		});
+		afterAll(async () => {
+			await mounted.close?.();
+		});
+		const send = async (user, op, approval) => {
+			const call = {
+				...op,
+				authorization: user === null ? null : tokens.get(user) ?? null,
+				...approval === void 0 ? {} : { approval }
+			};
+			if (mounted.call !== void 0) return mounted.call(call);
+			if (mounted.fetch === void 0) throw new Error(`${options.name}: mount returned neither fetch nor call`);
+			return readResult(await mounted.fetch(restRequest("http://app.test", call)));
+		};
+		const openStream = async (authorization, org, id) => {
+			if (mounted.fetch === void 0) throw new Error(`${options.name}: streams need a fetch mount`);
+			const headers = new Headers({ accept: "text/event-stream" });
+			if (authorization !== null) headers.set("authorization", authorization);
+			return eventStream(await mounted.fetch(new Request(`http://app.test/${org}/projects/${id}/events`, { headers })));
+		};
+		scenario("tenant", "resolves the tenant from the path on every protect", async () => {
+			expect((await send("alice", {
+				op: "project.get",
+				org: "acme",
+				id: "p2"
+			})).status).toBe(200);
+			expect((await send("alice", {
+				op: "project.get",
+				org: "globex",
+				id: "g1"
+			})).status).toBe(200);
+			expect((await send("alice", {
+				op: "project.get",
+				org: "acme",
+				id: "g1"
+			})).status).toBe(403);
+			expect((await send("mallory", {
+				op: "project.get",
+				org: "acme",
+				id: "p1"
+			})).status).toBe(403);
+			expect((await send(null, {
+				op: "project.get",
+				org: "acme",
+				id: "p1"
+			})).status).toBe(401);
+		});
+		scenario("roles", "applies the role held in the requested org", async () => {
+			expect((await send("alice", {
+				op: "project.update",
+				org: "acme",
+				id: "p1"
+			})).status).toBe(200);
+			expect((await send("alice", {
+				op: "project.update",
+				org: "globex",
+				id: "g1"
+			})).status).toBe(403);
+			expect((await send("bob", {
+				op: "project.update",
+				org: "acme",
+				id: "p1"
+			})).status).toBe(200);
+			expect((await send("bob", {
+				op: "project.update",
+				org: "acme",
+				id: "p2"
+			})).status).toBe(403);
+		});
+		scenario("custom-roles", "grants through an org custom role", async () => {
+			const body = {
+				id: "c1",
+				orgId: "acme",
+				ownerId: "dave",
+				name: "Contract",
+				archived: false
+			};
+			expect((await send("dave", {
+				op: "project.create",
+				org: "acme",
+				body
+			})).status).toBe(201);
+			expect((await send("hank", {
+				op: "project.create",
+				org: "acme",
+				body
+			})).status).toBe(403);
+		});
+		scenario("plans", "gates a feature on the plan of the requested org", async () => {
+			expect((await send("erin", {
+				op: "analytics.read",
+				org: "globex"
+			})).status).toBe(200);
+			const upgrade = await send("erin", {
+				op: "analytics.read",
+				org: "acme"
+			});
+			expect(upgrade.status).toBe(403);
+			expect(new Set(reasonsOf(upgrade.body))).toEqual(/* @__PURE__ */ new Set(["not-entitled"]));
+		});
+		scenario("expired", "ignores an expired membership", async () => {
+			expect((await send("frank", {
+				op: "project.get",
+				org: "acme",
+				id: "p1"
+			})).status).toBe(403);
+		});
+		scenario("limits", "counts a quota per subject and tenant", async () => {
+			for (let index = 0; index < 5; index += 1) expect((await send("erin", {
+				op: "apiKey.create",
+				org: "acme"
+			})).status).toBe(201);
+			const exhausted = await send("erin", {
+				op: "apiKey.create",
+				org: "acme"
+			});
+			expect(exhausted.status).toBe(429);
+			expect(reasonsOf(exhausted.body)).toContain("limit");
+			expect((await send("erin", {
+				op: "apiKey.create",
+				org: "globex"
+			})).status).toBe(201);
+		});
+		scenario("validation", "validates an untrusted body before the check", async () => {
+			const valid = {
+				id: "n2",
+				orgId: "acme",
+				ownerId: "bob",
+				name: "New",
+				archived: false
+			};
+			expect((await send("bob", {
+				op: "project.create",
+				org: "acme",
+				body: valid
+			})).status).toBe(201);
+			const invalid = await send("bob", {
+				op: "project.create",
+				org: "acme",
+				body: {
+					...valid,
+					name: 42
+				}
+			});
+			expect(invalid.status).toBe(400);
+			expect((await send("bob", {
+				op: "project.create",
+				org: "acme",
+				body: {
+					...valid,
+					orgId: "globex"
+				}
+			})).status).toBe(403);
+		});
+		scenario("assert", "maps assert inside a handler to the Problem protect sends", async () => {
+			const denied = await send("bob", {
+				op: "project.delete",
+				org: "acme",
+				id: "p2"
+			});
+			expect(denied.status).toBe(403);
+			expect(field(denied.body, "type")).toBe("https://permdock.com/problems/denied");
+			const bob = await createPermDock(saasPolicy, saasPrincipal("bob", "acme"), { tenant: "acme" });
+			const permission = saasPolicy.permissions.project.delete;
+			const fromProtect = await readResult(problemFromDecision(bob.decide(permission, project$1("p2")), permission, bob.subject));
+			expect(denied.status).toBe(fromProtect.status);
+			for (const key of [
+				"type",
+				"title",
+				"permission",
+				"denials"
+			]) expect(field(denied.body, key)).toEqual(field(fromProtect.body, key));
+			expect((await send("bob", {
+				op: "project.delete",
+				org: "acme",
+				id: "p3"
+			})).status).toBe(204);
+			expect((await send("bob", {
+				op: "project.delete",
+				org: "acme",
+				id: "p4"
+			})).status).toBe(403);
+		});
+		scenario("approval", "asks for approval, resumes once and refuses a replay", async () => {
+			const asked = await send("alice", {
+				op: "apiKey.revokeAll",
+				org: "acme"
+			});
+			expect(asked.status).toBe(403);
+			expect(field(asked.body, "type")).toBe("https://permdock.com/problems/approval-required");
+			const token = field(asked.body, "token");
+			expect(typeof token).toBe("string");
+			await resolveApproval(domain.store, String(token), {
+				status: "approved",
+				by: await approverSubject("carol", "acme")
+			});
+			expect((await send("alice", {
+				op: "apiKey.revokeAll",
+				org: "acme"
+			}, String(token))).status).toBe(204);
+			expect((await send("alice", {
+				op: "apiKey.revokeAll",
+				org: "acme"
+			}, String(token))).status).toBe(403);
+			expect((await send("carol", {
+				op: "apiKey.revokeAll",
+				org: "acme"
+			})).status).toBe(204);
+		});
+		scenario("stale-approval", "ignores an approval header meant for another request", async () => {
+			expect((await send("bob", {
+				op: "project.get",
+				org: "acme",
+				id: "p1"
+			}, "pd1.not-a-real-token")).status).toBe(200);
+		});
+		scenario("evaluations", "answers the decision endpoint in the path tenant", async () => {
+			const result = await send("bob", {
+				op: "evaluations",
+				org: "acme",
+				body: { evaluations: [{
+					action: { name: "project.update" },
+					resource: {
+						type: "project",
+						id: "p1",
+						properties: project$1("p1")
+					}
+				}, {
+					action: { name: "project.update" },
+					resource: {
+						type: "project",
+						id: "p2",
+						properties: project$1("p2")
+					}
+				}] }
+			});
+			expect(result.status).toBe(200);
+			const rows = field(result.body, "evaluations");
+			expect(Array.isArray(rows) ? rows.map((row) => field(row, "decision")) : rows).toEqual([true, false]);
+		});
+		scenario("upload", "leaves a multipart body to the framework parser", async () => {
+			const file = {
+				name: "notes.txt",
+				content: "hello"
+			};
+			const uploaded = await send("bob", {
+				op: "project.upload",
+				org: "acme",
+				id: "p1",
+				file
+			});
+			expect(uploaded.status).toBe(201);
+			expect(uploaded.body).toEqual({
+				name: "notes.txt",
+				size: 5
+			});
+			expect((await send("bob", {
+				op: "project.upload",
+				org: "acme",
+				id: "p2",
+				file
+			})).status).toBe(403);
+		});
+		scenario("sub-app", "protects a route inside a sub-app", async () => {
+			expect((await send("alice", {
+				op: "admin.members",
+				org: "acme"
+			})).status).toBe(200);
+			expect((await send("bob", {
+				op: "admin.members",
+				org: "acme"
+			})).status).toBe(403);
+		});
+		scenario("parallel", "keeps 50 parallel requests with mixed subjects apart", async () => {
+			const calls = Array.from({ length: 50 }, (_, index) => {
+				const entry = PARALLEL[index * 7 % PARALLEL.length];
+				if (entry === void 0) throw new Error("parallel table is empty");
+				return entry;
+			});
+			const statuses = await Promise.all(calls.map(async (entry) => (await send(entry.user, {
+				op: "project.get",
+				org: entry.org,
+				id: entry.id
+			})).status));
+			expect(statuses).toEqual(calls.map((entry) => entry.status));
+		});
+		scenario("stream-revoked", "closes an open stream when the session is revoked", async () => {
+			expect((await openStream(null, "acme", "p1")).status).toBe(401);
+			const stream = await openStream(tokens.get("bob") ?? null, "acme", "p1");
+			try {
+				expect(stream.status).toBe(200);
+				expect((await stream.next())?.event).toBe("message");
+				await domain.revocations.revoke({
+					principal: "bob",
+					kind: "session-revoked"
+				});
+				const end = await untilEnd(stream);
+				expect(end.problem).toMatchObject({
+					type: "https://permdock.com/problems/unauthenticated",
+					status: 401,
+					detail: "session-revoked"
+				});
+				expect(end.ended).toBe(true);
+			} finally {
+				await stream.cancel();
+			}
+		});
+		scenario("stream-demoted", "closes an open stream when a membership change re-denies it", async () => {
+			const stream = await openStream(tokens.get("bob") ?? null, "acme", "p1");
+			const restore = domain.demote("bob", "acme");
+			try {
+				expect(stream.status).toBe(200);
+				expect((await stream.next())?.event).toBe("message");
+				await domain.revocations.revoke({
+					principal: "bob",
+					tenant: "acme",
+					kind: "changed"
+				});
+				const end = await untilEnd(stream);
+				expect(end.problem).toMatchObject({
+					type: "https://permdock.com/problems/denied",
+					status: 403
+				});
+				expect(end.ended).toBe(true);
+			} finally {
+				restore();
+				await stream.cancel();
+			}
+		});
+		scenario("stream-filter", "drops the items a subscriber cannot read and keeps the stream open", async () => {
+			const stream = await openStream(tokens.get("bob") ?? null, "acme", "p1");
+			try {
+				expect(stream.status).toBe(200);
+				const ids = [];
+				while (ids.length < 7) {
+					const frame = await stream.next();
+					expect(frame?.event).toBe("message");
+					ids.push(String(field(JSON.parse(frame?.data ?? "{}"), "id")));
+				}
+				expect(new Set(ids)).toEqual(/* @__PURE__ */ new Set([
+					"p1",
+					"p3",
+					"p4"
+				]));
+			} finally {
+				await stream.cancel();
+			}
+		});
+		scenario("stream-expired", "closes an open stream when the token expires", async () => {
+			const stream = await openStream(`Bearer ${await signSaasToken("bob", {
+				memberships: false,
+				ttl: 2
+			})}`, "acme", "p1");
+			try {
+				expect(stream.status).toBe(200);
+				expect((await stream.next())?.event).toBe("message");
+				const end = await untilEnd(stream);
+				expect(end.problem).toMatchObject({
+					type: "https://permdock.com/problems/unauthenticated",
+					detail: "expired"
+				});
+				expect(end.ended).toBe(true);
+			} finally {
+				await stream.cancel();
+			}
+		}, 1e4);
+	});
+}
+//#endregion
+//#region src/testing/agent-adapter.ts
+/** The user whose subject resolver throws. */
+const AGENT_THROWING_USER = "throws";
+/** The project id whose loader throws. */
+const AGENT_THROWING_ROW = "throws";
+const SCENARIOS = [
+	{
+		name: "granted",
+		title: "grants a member reading a project in their org",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "granted"
+	},
+	{
+		name: "denied",
+		title: "denies a user with no membership",
+		call: {
+			user: "mallory",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "cross-tenant",
+		title: "denies a row from another org",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "g1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "anonymous",
+		title: "denies a call with no user",
+		call: {
+			user: null,
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "subject-throws",
+		title: "denies when the subject resolver throws",
+		call: {
+			user: AGENT_THROWING_USER,
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "loader-throws",
+		title: "denies when the row loader throws",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: AGENT_THROWING_ROW }
+		},
+		expected: "denied"
+	},
+	{
+		name: "missing-row",
+		title: "denies when the row does not exist",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "missing" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "approval-required",
+		title: "asks for approval before revoking every API key",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "api_keys_revoke_all",
+			args: {}
+		},
+		expected: "approval-required"
+	}
+];
+function loadProject(args) {
+	const id = typeof args === "object" && args !== null ? args.id : void 0;
+	if (id === "throws") throw new Error("project store unavailable");
+	return saasSeed.projects.find((row) => row.id === id) ?? null;
+}
+function createDomain() {
+	return {
+		policy: saasPolicy,
+		subject: (user, org) => {
+			if (user === "throws") throw new Error("session store unavailable");
+			return user === null ? null : saasPrincipal(user, org);
+		},
+		tools: {
+			project_read: {
+				permission: saasPermissions.project.read,
+				data: loadProject
+			},
+			api_keys_revoke_all: { permission: saasPermissions.apiKey.revokeAll }
+		},
+		customRoles: memoryRoleSource(saasCustomRoles),
+		store: memoryApprovalStore()
+	};
+}
+/**
+* Runs the same tool calls through an agent adapter: a grant, the denials an
+* attacker or an outage produces, and an approval. Every failure denies.
+*/
+function testAgentAdapter(options) {
+	describe(`${options.name}: agent adapter scenarios`, () => {
+		const domain = createDomain();
+		let mounted;
+		beforeAll(async () => {
+			mounted = await options.mount(domain);
+		});
+		afterAll(async () => {
+			await mounted.close?.();
+		});
+		const outcomeOf = (call) => mounted.call(call);
+		for (const scenario of SCENARIOS) {
+			const reason = options.skip?.[scenario.name];
+			it.skipIf(reason !== void 0)(reason === void 0 ? scenario.title : `${scenario.title} (${reason})`, async () => {
+				expect(await outcomeOf(scenario.call)).toBe(scenario.expected);
+			});
+		}
+	});
+}
+//#endregion
+//#region src/testing/authzen.ts
+function sortKey(value) {
+	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => byCodePoint(a, b))));
+}
+/** Runs AuthZEN 1.0 interop vectors against an Authorization API endpoint. */
+function testAuthZen(handle, options) {
+	const origin = options.origin ?? "https://pdp.example.com";
+	const post = async (path, body) => {
+		const response = await handle(new Request(`${origin}${path}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...options.headers
+			},
+			body: JSON.stringify(body)
+		}));
+		expect(response.status).toBe(200);
+		return response.json();
+	};
+	if (options.discovery ?? true) it("publishes the AuthZEN metadata document", async () => {
+		const response = await handle(new Request(`${origin}/.well-known/authzen-configuration`, { headers: { ...options.headers } }));
+		expect(response.status).toBe(200);
+		const document = await response.json();
+		expect(document["policy_decision_point"]).toBe(origin);
+		expect(document["access_evaluation_endpoint"]).toBe(`${origin}/access/v1/evaluation`);
+		for (const [name, value] of Object.entries(document)) if (name.endsWith("_endpoint")) expect(String(value).startsWith(origin)).toBe(true);
+	});
+	for (const [index, vector] of (options.vectors.evaluation ?? []).entries()) {
+		const { subject, action, resource: target } = vector.request;
+		it(`evaluation ${index}: ${subject.id ?? "?"} ${action.name} ${target.type}:${target.id ?? ""} is ${String(vector.expected)}`, async () => {
+			const body = await post("/access/v1/evaluation", vector.request);
+			expect(body.decision).toBe(vector.expected);
+		});
+	}
+	for (const [index, vector] of (options.vectors.evaluations ?? []).entries()) it(`evaluations ${index}: ${vector.request.evaluations.length} items`, async () => {
+		const body = await post("/access/v1/evaluations", vector.request);
+		expect(body.evaluations.map((row) => ({ decision: row.decision }))).toEqual(vector.expected);
+	});
+	const search = options.vectors.search ?? {};
+	for (const kind of [
+		"subject",
+		"resource",
+		"action"
+	]) for (const [index, vector] of (search[kind] ?? []).entries()) it(`search/${kind} ${index}`, async () => {
+		const body = await post(`/access/v1/search/${kind}`, vector.request);
+		expect(body.results.map(sortKey).toSorted()).toEqual(vector.expected.results.map(sortKey).toSorted());
+	});
+}
+/** The AuthZEN interop Todo directory: each user is addressable by email or by identity. */
+const authzenTodoUsers = Object.freeze([
+	{
+		id: "rick@the-citadel.com",
+		identity: "CiRmZDA2MTRkMy1jMzlhLTQ3ODEtYjdiZC04Yjk2ZjVhNTEwMGQSBWxvY2Fs",
+		roles: ["admin", "evil_genius"]
+	},
+	{
+		id: "morty@the-citadel.com",
+		identity: "CiRmZDE2MTRkMy1jMzlhLTQ3ODEtYjdiZC04Yjk2ZjVhNTEwMGQSBWxvY2Fs",
+		roles: ["editor"]
+	},
+	{
+		id: "summer@the-smiths.com",
+		identity: "CiRmZDI2MTRkMy1jMzlhLTQ3ODEtYjdiZC04Yjk2ZjVhNTEwMGQSBWxvY2Fs",
+		roles: ["editor"]
+	},
+	{
+		id: "beth@the-smiths.com",
+		identity: "CiRmZDM2MTRkMy1jMzlhLTQ3ODEtYjdiZC04Yjk2ZjVhNTEwMGQSBWxvY2Fs",
+		roles: ["viewer"]
+	},
+	{
+		id: "jerry@the-smiths.com",
+		identity: "CiRmZDQ2MTRkMy1jMzlhLTQ3ODEtYjdiZC04Yjk2ZjVhNTEwMGQSBWxvY2Fs",
+		roles: ["viewer"]
+	}
+]);
+const authzenTodoPermissions = definePermissions({
+	user: resource({
+		id: "id",
+		actions: ["can_read_user"]
+	}),
+	todo: resource({
+		id: "id",
+		actions: [
+			"can_read_todos",
+			"can_create_todo",
+			"can_update_todo",
+			"can_delete_todo"
+		]
+	})
+});
+const todo = authzenTodoPermissions.todo;
+const everyone = [allow(authzenTodoPermissions.user.can_read_user), allow(todo.can_read_todos)];
+/** The interop Todo rules: viewers read, editors write their own, admins delete and evil geniuses update anything. */
+const authzenTodoPolicy = definePolicy(authzenTodoPermissions, {
+	roles: [
+		role("viewer", everyone),
+		role("editor", [
+			...everyone,
+			allow(todo.can_create_todo),
+			allow(todo.can_update_todo, { where: { ownerID: principal.id } }),
+			allow(todo.can_delete_todo, { where: { ownerID: principal.id } })
+		]),
+		role("admin", [
+			...everyone,
+			allow(todo.can_create_todo),
+			allow(todo.can_delete_todo)
+		]),
+		role("evil_genius", [...everyone, allow(todo.can_update_todo)]),
+		role("pep", [])
+	],
+	principal: (user) => {
+		const id = user !== null && typeof user === "object" && "id" in user ? user.id : void 0;
+		if (id === "pep") return {
+			id: "pep",
+			roles: ["pep"]
+		};
+		const found = authzenTodoUsers.find((entry) => entry.id === id || entry.identity === id);
+		return found === void 0 ? null : {
+			id: found.id,
+			roles: found.roles
+		};
+	}
+});
+const TODOS = Object.freeze(authzenTodoUsers.map((user, index) => ({
+	id: `todo-${String(index + 1)}`,
+	ownerID: user.id
+})));
+/** Rows for `resources.todo.list` and records for `subjects.list` in the Todo domain. */
+const authzenTodoData = Object.freeze({
+	todos: TODOS,
+	users: Object.freeze(authzenTodoUsers.map((user) => ({ id: user.id })))
+});
+function expectedFor(user, action, ownerID) {
+	const own = ownerID === user.id;
+	const has = (name) => user.roles.includes(name);
+	switch (action) {
+		case "can_read_user":
+		case "can_read_todos": return true;
+		case "can_create_todo": return has("admin") || has("editor");
+		case "can_update_todo": return has("evil_genius") || has("editor") && own;
+		case "can_delete_todo": return has("admin") || has("editor") && own;
+		default: return false;
+	}
+}
+/**
+* PermDock's vectors over the interop Todo domain, in the interop layout:
+* every user against every action on their own and on Rick's todo, one batch
+* per user, and the three searches.
+*/
+function authzenTodoVectors() {
+	const rick = authzenTodoUsers[0];
+	const actions = [
+		"can_read_todos",
+		"can_create_todo",
+		"can_update_todo",
+		"can_delete_todo"
+	];
+	const evaluation = [];
+	const evaluations = [];
+	for (const user of authzenTodoUsers) {
+		const subject = {
+			type: "user",
+			id: user.identity
+		};
+		evaluation.push({
+			request: {
+				subject,
+				action: { name: "can_read_user" },
+				resource: {
+					type: "user",
+					id: rick?.id ?? ""
+				}
+			},
+			expected: true
+		});
+		for (const action of actions) for (const ownerID of /* @__PURE__ */ new Set([user.id, rick?.id ?? ""])) evaluation.push({
+			request: {
+				subject,
+				action: { name: action },
+				resource: {
+					type: "todo",
+					id: `t-${ownerID}`,
+					properties: { ownerID }
+				}
+			},
+			expected: expectedFor(user, action, ownerID)
+		});
+		const owners = authzenTodoUsers.map((entry) => entry.id);
+		evaluations.push({
+			request: {
+				subject,
+				action: { name: "can_update_todo" },
+				evaluations: owners.map((ownerID) => ({ resource: {
+					type: "todo",
+					id: `t-${ownerID}`,
+					properties: { ownerID }
+				} }))
+			},
+			expected: owners.map((ownerID) => ({ decision: expectedFor(user, "can_update_todo", ownerID) }))
+		});
+	}
+	const morty = authzenTodoUsers[1];
+	const mortyTodo = TODOS.find((row) => row.ownerID === morty?.id);
+	return {
+		evaluation,
+		evaluations,
+		search: {
+			action: [{
+				request: {
+					subject: {
+						type: "user",
+						id: morty?.id
+					},
+					resource: {
+						type: "todo",
+						id: mortyTodo?.id,
+						properties: mortyTodo
+					}
+				},
+				expected: { results: actions.map((name) => ({ name })) }
+			}],
+			resource: [{
+				request: {
+					subject: {
+						type: "user",
+						id: morty?.id
+					},
+					action: { name: "can_delete_todo" },
+					resource: { type: "todo" }
+				},
+				expected: { results: [{
+					type: "todo",
+					id: mortyTodo?.id
+				}] }
+			}],
+			subject: [{
+				request: {
+					subject: { type: "user" },
+					action: { name: "can_delete_todo" },
+					resource: {
+						type: "todo",
+						id: mortyTodo?.id,
+						properties: mortyTodo
+					}
+				},
+				expected: { results: authzenTodoUsers.filter((user) => expectedFor(user, "can_delete_todo", morty?.id ?? "")).map((user) => ({
+					type: "user",
+					id: user.id
+				})) }
+			}]
+		}
+	};
+}
+//#endregion
+//#region src/testing/jwt-fixtures.ts
+const jwtFixtureJwks = { keys: [{
+	crv: "Ed25519",
+	x: "79ab4WR6Eb9LkefWpmh5ZlvjXg7wqVGNMwIEHQqduIQ",
+	kty: "OKP",
+	kid: "2026-09",
+	alg: "Ed25519",
+	use: "sig"
+}] };
+const jwtFixtureIssuer = "https://login.example.com";
+const jwtFixtureAudience = "https://api.example.com";
+const jwtFixtureTokens = {
+	valid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJjbGllbnRfaWQiOiJhcHAiLCJyb2xlcyI6WyJtZW1iZXIiXSwianRpIjoianRpLXZhbGlkIiwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5leGFtcGxlLmNvbSIsImF1ZCI6Imh0dHBzOi8vYXBpLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjIwMDAwMDAwMDB9.ENFMmLSyVde-2s4Gdz4iP7srZvU0Xuy_ZLz-OJGHD_-W1lEayEBeSPTnab0L_TBdj8p5BmkFrT-7VE7o20GbAw",
+	expired: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjEwMDAwMDAwMDAsImV4cCI6MTEwMDAwMDAwMH0.9X3d6kH3_2nmrbqMxuoxzFW-wsWJVCe-lR-aQ-MmsGGXlEUBMgQ-4MtAq1UR9lLE0h2b5JrE_GfjzuC04h5xCg",
+	wrongAud: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9vdGhlci5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.PgWdzi56J31OwoMqH4ysHzVKSKUDhi-AtHFUp1ewFzi-qGE-tknzrNKnKhDOncVzj0okb_flyy3vQgfzJwG5AQ",
+	wrongIss: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2V2aWwuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.tIcLHLa9JLtKz1gqjRGdr5DFbUzRDs5KsoPsJCxspvbBcsFfRFG2G0XJnd1h4QHyZ_5B4OhY3W_jIIsnOPD9Bg",
+	unknownKid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoibm9wZSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MjAwMDAwMDAwMH0.walgG5GvpCVBnkMtkdw-epi5c93JqfvAM_N4EWR9Tqhiw_cnzITnlQyoVfihECmV1fqtFrhwM1RCIRJvd38zAQ",
+	none: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJleHAiOjIwMDAwMDAwMDAsImlhdCI6MTcwMDAwMDAwMH0.",
+	snapshot: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLXNuYXBzaG90K2p3dCJ9.eyJzbmFwc2hvdCI6eyJ2IjoyLCJpc3N1ZWRBdCI6MTcwMDAwMDAwMCwic3ViamVjdCI6eyJwcmluY2lwYWwiOnsiaWQiOiJ1XzEiLCJyb2xlcyI6WyJtZW1iZXIiXX0sImNvbnRleHQiOnt9fSwicm9sZXMiOlsibWVtYmVyIl0sImdyYW50cyI6W10sInRlbmFudHMiOltdfSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJzbmFwX2ZpeHR1cmUifQ.4itaYctluoCwU-syytUxArtS_FRyNAti2SZxuSH-nKIMr7-Sb3h1Q3xugn_vPR1eupV4fVNIe6dH27_EiyDvCA",
+	approval: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWFwcHJvdmFsK2p3dCJ9.eyJhcHByb3ZhbCI6eyJ0b2tlbiI6InBkMS5hYmMiLCJwZXJtaXNzaW9uIjoicG9zdC5kZWxldGUiLCJyZXNvdXJjZSI6eyJ0eXBlIjoicG9zdCIsImlkIjoiNDIifSwic3RhdHVzIjoiYXBwcm92ZWQifSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJhcHJfZml4dHVyZSJ9.UHsoSzQCo68G7ee-EFqdzMLvmqaKlFIMdQKFuqZEM4yUQnJsJJTXbld_aCXcyfN-IdjF9cj2F5EHzsV4nLKbBg",
+	decisions: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWRlY2lzaW9ucytqd3QifQ.eyJldmVudHMiOltdLCJpc3MiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJkZWNfZml4dHVyZSJ9.UZhJd72yFGxHOdjYbzcGYUPgYjvLwOPCtHKxEbLu56SdKSKUDCREXmEBI9WaCPKWjlTBnnIKMYwjG8I8RATJCg"
+};
+//#endregion
+//#region src/testing/conformance.ts
+function testSubjectResolver(resolver, options) {
+	it("never throws and fails closed to anonymous", async () => {
+		let result;
+		try {
+			result = await resolver(options.invalid);
+		} catch {
+			throw new Error("SubjectResolver must not throw");
+		}
+		expect(result.principal).toBeNull();
+	});
+}
+function testMembershipSource(source, options) {
+	const query = options.tenant === void 0 ? {} : { tenant: options.tenant };
+	it("returns well-formed memberships and fails closed on throw", async () => {
+		for (const principal of options.principals) {
+			let memberships = [];
+			try {
+				memberships = await source.membershipsFor(principal, query);
+			} catch {
+				memberships = [];
+			}
+			for (const membership of memberships) {
+				const shapes = [
+					membership.scope !== void 0,
+					membership.tenant !== void 0 || membership.team !== void 0,
+					membership.on !== void 0
+				].filter(Boolean);
+				expect(shapes.length).toBe(1);
+				expect(Array.isArray(membership.roles)).toBe(true);
+				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
+			}
+			const expected = options.expect?.[principal.id];
+			if (expected !== void 0) expect(memberships).toEqual(expected);
+		}
+	});
+	if (source.list !== void 0) it("lists every member of an instance it returns a membership for", async () => {
+		for (const principal of options.principals) {
+			let memberships = [];
+			try {
+				memberships = await source.membershipsFor(principal, query);
+			} catch {
+				continue;
+			}
+			for (const membership of memberships) {
+				if (membership.scope === void 0 || membership.id === void 0) continue;
+				const members = await source.list?.({
+					scope: membership.scope,
+					id: membership.id
+				}) ?? [];
+				expect(members.some((entry) => entry.principal.id === principal.id && entry.membership.scope === membership.scope && entry.membership.id === membership.id)).toBe(true);
+			}
+		}
+	});
+	if (source.version !== void 0) it("reports a finite version or none", async () => {
+		for (const principal of options.principals) {
+			const version = await source.version?.({ id: principal.id });
+			expect(version === void 0 || typeof version === "number" && Number.isFinite(version)).toBe(true);
+		}
+	});
+}
+function holderKey(holder) {
+	return "group" in holder ? `${holder.group.resource}:${holder.group.id}#${holder.group.relation}` : holder.principal.id;
+}
+/**
+* A `RelationSource` answers facts only: well-formed chains nearest first and
+* no longer than `depth`, holders with principal ids or group references and
+* numeric instants, a `truncated` chain only when more ancestors exist, and
+* empty answers (never a throw) for an object it does not know. `expect` pins
+* the chains, holders and links for `objects`, keyed `resource:id`,
+* `resource:id#relation` and `resource:id>link`; a group holder is written
+* `resource:id#relation`.
+*/
+function testRelationSource(source, options) {
+	it("returns chains nearest first, within depth, and truncated only when more exist", async () => {
+		for (const object of options.objects) {
+			const full = await source.ancestors({
+				resource: object.resource,
+				id: object.id,
+				through: "parent",
+				depth: 32
+			});
+			expect(Array.isArray(full.ancestors)).toBe(true);
+			for (const ancestor of full.ancestors) {
+				expect(typeof ancestor.id).toBe("string");
+				expect(ancestor.id).not.toBe("");
+			}
+			expect(full.ancestors.length).toBeLessThanOrEqual(32);
+			const expected = options.expect?.ancestors?.[`${object.resource}:${object.id}`];
+			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toEqual(expected);
+			if (full.ancestors.length > 1) {
+				const short = await source.ancestors({
+					resource: object.resource,
+					id: object.id,
+					through: "parent",
+					depth: 1
+				});
+				expect(short.ancestors.map((ancestor) => ancestor.id)).toEqual([full.ancestors[0]?.id]);
+				expect(short.truncated).toBe(true);
+			}
+			const none = await source.ancestors({
+				resource: object.resource,
+				id: object.id,
+				through: "parent",
+				depth: 0
+			});
+			expect(none.ancestors).toEqual([]);
+		}
+	});
+	it("returns well-formed holders", async () => {
+		for (const object of options.objects) {
+			if (object.relation === void 0) continue;
+			const holders = await source.related({
+				resource: object.resource,
+				id: object.id,
+				relation: object.relation
+			});
+			expect(Array.isArray(holders)).toBe(true);
+			for (const holder of holders) {
+				if ("group" in holder) for (const part of [
+					holder.group.resource,
+					holder.group.id,
+					holder.group.relation
+				]) {
+					expect(typeof part).toBe("string");
+					expect(part).not.toBe("");
+				}
+				else expect(typeof holder.principal.id).toBe("string");
+				for (const instant of [holder.startsAt, holder.expiresAt]) expect(instant === void 0 || typeof instant === "number" && Number.isFinite(instant)).toBe(true);
+			}
+			const expected = options.expect?.holders?.[`${object.resource}:${object.id}#${object.relation}`];
+			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toEqual([...expected].toSorted());
+		}
+	});
+	it("follows each link to exactly one instance", async () => {
+		for (const [key, id] of Object.entries(options.expect?.links ?? {})) {
+			const [object, through] = key.split(">");
+			const [resource, objectId] = (object ?? "").split(":");
+			if (resource === void 0 || objectId === void 0 || through === void 0) throw new Error(`expect.links key "${key}" is not resource:id>link.`);
+			const linked = await source.ancestors({
+				resource,
+				id: objectId,
+				through,
+				depth: 1
+			});
+			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
+		}
+	});
+	it("reads each object's row as an object, or null when there is none", async () => {
+		if (source.row === void 0) return;
+		const read = (query) => source.row?.(query);
+		for (const object of options.objects) {
+			const row = await read({
+				resource: object.resource,
+				id: object.id
+			});
+			expect(row === null || row === void 0 || typeof row === "object" && !Array.isArray(row)).toBe(true);
+		}
+		const missing = await read({
+			resource: options.objects[0]?.resource ?? "",
+			id: "permdock-missing-object"
+		});
+		expect(missing ?? null).toBeNull();
+	});
+	it("answers an unknown object with nothing instead of throwing", async () => {
+		const first = options.objects[0];
+		if (first === void 0) return;
+		const missing = {
+			resource: first.resource,
+			id: "permdock-missing-object"
+		};
+		expect((await source.ancestors({
+			...missing,
+			through: "parent",
+			depth: 16
+		})).ancestors).toEqual([]);
+		if (first.relation !== void 0) expect(await source.related({
+			...missing,
+			relation: first.relation
+		})).toEqual([]);
+	});
+}
+function testEntitlementSource(source, options) {
+	it("returns plan names for a tenant and none without one", async () => {
+		const found = await source.entitlementsFor(options.principal, { tenant: options.tenant });
+		expect(Array.isArray(found)).toBe(true);
+		for (const name of found) expect(typeof name).toBe("string");
+		if (options.expect !== void 0) expect([...found].toSorted()).toEqual([...options.expect].toSorted());
+		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
+	});
+}
+function testRoleSource(source, options) {
+	it("only resolves declared role names", async () => {
+		const declared = options.declared.map((item) => typeof item === "string" ? item : item.key);
+		const roles = await source.rolesFor(options.tenant);
+		for (const role of roles) {
+			expect(role.tenant).toBe(options.tenant);
+			for (const included of role.includes ?? []) expect(declared).toContain(included);
+			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toEqual([]);
+		}
+		if (source.assignable !== void 0) {
+			const assignable = await source.assignable(options.tenant);
+			for (const name of assignable) expect(declared).toContain(name);
+		}
+	});
+	const every = options.every;
+	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
+		const roles = await source.rolesFor(options.tenant, { held: [] });
+		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
+	});
+}
+function testLimitStore(store) {
+	it("counts down synchronously and fails closed when exhausted", async () => {
+		const input = {
+			key: "report.export",
+			subjectId: "u_1",
+			count: 2,
+			per: "hour",
+			now: 17e8
+		};
+		const first = await store.consume(input);
+		expect(first.remaining).toBeGreaterThanOrEqual(0);
+		const peeked = store.remaining(input);
+		if (peeked !== void 0) {
+			expect(typeof peeked.remaining).toBe("number");
+			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
+		}
+		await store.consume(input);
+		const exhausted = await store.consume(input);
+		expect(exhausted.remaining).toBeLessThan(0);
+	});
+}
+function testDecisionSink(sink) {
+	it("accepts batches and never propagates write errors", async () => {
+		await expect(Promise.resolve(sink.write([{
+			type: "membership",
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			source: "app",
+			operation: "changed",
+			principal: { id: "u_1" },
+			roles: {
+				added: ["admin"],
+				removed: ["member"]
+			}
+		}]))).resolves.toBeUndefined();
+		await expect(Promise.resolve(sink.write([]))).resolves.toBeUndefined();
+		if (sink.flush !== void 0) {
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+		}
+	});
+}
+function testSnapshotSource(source) {
+	it("round-trips a snapshot", async () => {
+		const snapshot = await source.get();
+		expect(snapshot === null || snapshot === void 0).toBe(false);
+		if (typeof snapshot === "object" && snapshot !== null && "v" in snapshot) expect(snapshot.v).toBe(1);
+		if (source.subscribe !== void 0) source.subscribe(() => void 0)();
+	});
+}
+function testPolicySource(source, options = {}) {
+	const readCurrent = () => {
+		const document = source.current();
+		expect(document !== null && typeof document === "object" && "then" in document && typeof document.then === "function").toBe(false);
+		return document;
+	};
+	it("returns null or a v1 policy document synchronously", () => {
+		const document = readCurrent();
+		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+	});
+	it("refreshes without rejecting and keeps current() synchronous", async () => {
+		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
+		const document = readCurrent();
+		if (document !== null) expect(document.v).toBe(1);
+	});
+	if (options.policy !== void 0) {
+		const policy = options.policy;
+		it("merges only grants on hostable permissions", () => {
+			const document = readCurrent();
+			const merged = mergeHostedGrants(policy, document);
+			for (const grant of merged.policy.grants) if (grant.hosted !== void 0) expect(policy.hostable).toContain(grant.permission.key);
+			for (const dropped of merged.dropped) expect(dropped.kind).toBe("hosted-grant-dropped");
+		});
+	}
+}
+function sampleApproval(token) {
+	return {
+		v: 1,
+		token,
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: {
+			type: "post",
+			id: "42"
+		},
+		subject: {
+			principal: {
+				id: "u_1",
+				roles: ["member"]
+			},
+			actor: {
+				id: "agent-1",
+				kind: "eve"
+			}
+		},
+		detail: "post.delete requires human approval.",
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: new Date(Date.now() + 36e5).toISOString(),
+		status: "pending"
+	};
+}
+const approver = {
+	principal: {
+		id: "u_9",
+		roles: ["admin"]
+	},
+	context: {}
+};
+const secondApprover = {
+	principal: {
+		id: "u_10",
+		roles: ["admin"]
+	},
+	context: {}
+};
+const admin = {
+	kind: "role",
+	role: "admin",
+	scope: "global"
+};
+function testReplayStore(store) {
+	it("records a jti after remember and reports it as seen", async () => {
+		const jti = "jti-1";
+		expect(await store.seen(jti)).toBe(false);
+		await store.remember(jti);
+		expect(await store.seen(jti)).toBe(true);
+		expect(await store.seen("jti-2")).toBe(false);
+	});
+	it("forgets a jti whose expiresAt has passed", async () => {
+		await store.remember("ttl-jti", Math.floor(Date.now() / 1e3) - 1);
+		expect(await store.seen("ttl-jti")).toBe(false);
+	});
+	it("claims a key once under concurrency and releases it for a retry", async (context) => {
+		if (store.claim === void 0 || store.release === void 0) {
+			context.skip();
+			return;
+		}
+		const expiresAt = Math.floor(Date.now() / 1e3) + 60;
+		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
+		expect(results.toSorted()).toEqual([false, true]);
+		expect(await store.seen("claim-key")).toBe(true);
+		await store.release("claim-key");
+		expect(await store.claim("claim-key", expiresAt)).toBe(true);
+	});
+}
+function testRevocationFeed(feed) {
+	it("delivers each event to every subscriber until it unsubscribes", async () => {
+		const first = [];
+		const second = [];
+		const stopFirst = feed.subscribe((event) => {
+			first.push(event);
+		});
+		const stopSecond = feed.subscribe((event) => {
+			second.push(event);
+		});
+		const revoked = {
+			principal: "u-feed",
+			session: "s-feed",
+			kind: "session-revoked"
+		};
+		await feed.revoke(revoked);
+		await vi.waitFor(() => {
+			expect(first).toEqual([revoked]);
+			expect(second).toEqual([revoked]);
+		});
+		stopFirst();
+		const changed = {
+			principal: "u-feed",
+			tenant: "t-feed",
+			kind: "changed"
+		};
+		await feed.revoke(changed);
+		await vi.waitFor(() => {
+			expect(second).toEqual([revoked, changed]);
+		});
+		expect(first).toEqual([revoked]);
+		stopSecond();
+	});
+	it("keeps delivering when a listener throws", async () => {
+		const seen = [];
+		const stopThrowing = feed.subscribe(() => {
+			throw new Error("listener failed");
+		});
+		const stop = feed.subscribe((event) => {
+			seen.push(event);
+		});
+		const event = {
+			principal: "u-throw",
+			kind: "changed"
+		};
+		await feed.revoke(event);
+		await vi.waitFor(() => {
+			expect(seen).toEqual([event]);
+		});
+		stopThrowing();
+		stop();
+	});
+	it("rejects an event without a principal or with an unknown kind", async () => {
+		const seen = [];
+		const stop = feed.subscribe((event) => {
+			seen.push(event);
+		});
+		for (const event of [{
+			principal: "",
+			kind: "changed"
+		}, {
+			principal: "u-bad",
+			kind: "granted"
+		}]) await expect((async () => {
+			await feed.revoke(event);
+		})()).rejects.toThrow(TypeError);
+		expect(seen).toEqual([]);
+		stop();
+	});
+}
+function testDirectoryStore(store, options) {
+	const [home, other] = options.tenants;
+	it("round-trips users and groups, isolates tenants, and drops inactive memberships", async () => {
+		const created = await store.putUser(home, {
+			id: "",
+			userName: "ada",
+			externalId: "00u1",
+			active: true,
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		});
+		expect(created.id).not.toBe("");
+		expect(await store.getUser(home, created.id)).toMatchObject({
+			userName: "ada",
+			externalId: "00u1"
+		});
+		expect(await store.getUser(other, created.id)).toBeNull();
+		await expect(store.putUser(home, {
+			id: "",
+			userName: "ada",
+			active: true,
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		})).rejects.toThrow(/userName/);
+		const group = await store.putGroup(home, {
+			id: "g_editors",
+			displayName: "Editors",
+			members: [{ value: created.id }],
+			roles: ["editor"],
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		});
+		expect(await store.groupsFor(home, created.id)).toEqual([expect.objectContaining({
+			id: group.id,
+			displayName: "Editors"
+		})]);
+		expect(await store.groupsFor(other, created.id)).toEqual([]);
+		const patched = await store.patchUser(home, created.id, [{
+			op: "replace",
+			path: "active",
+			value: false
+		}]);
+		expect(patched.active).toBe(false);
+		const source = directoryMembershipSource(store, { assignable: ["editor"] });
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([]);
+		await store.patchUser(home, created.id, [{
+			op: "replace",
+			path: "active",
+			value: true
+		}]);
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([{
+			tenant: home,
+			roles: ["editor"],
+			via: `group:${group.id}`,
+			managedBy: "idp"
+		}]);
+		await store.patchGroup(home, group.id, [{
+			op: "remove",
+			path: "members",
+			value: [{ value: created.id }]
+		}]);
+		expect(await store.groupsFor(home, created.id)).toEqual([]);
+	});
+	it("ends sessions when scimHandler deactivates a user in this store", async () => {
+		const feed = memoryRevocationFeed();
+		const seen = [];
+		feed.subscribe((event) => {
+			seen.push(event);
+		});
+		const kinds = [];
+		const token = "conformance-scim-token";
+		const handle = scimHandler({
+			store,
+			tenant: home,
+			token: {
+				hash: "sha256",
+				lookup: () => sha256Hex(token)
+			},
+			revocations: feed,
+			onChange: (change) => {
+				kinds.push(change.kind);
+			}
+		});
+		const call = (path, method, body) => handle(new Request(`https://app.example.com/scim/v2${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/scim+json"
+			},
+			body: JSON.stringify(body)
+		}));
+		const created = await call("/Users", "POST", {
+			schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
+			userName: "grace",
+			active: true
+		});
+		expect(created.status).toBe(201);
+		const id = String((await created.json()).id);
+		seen.length = 0;
+		const patched = await call(`/Users/${id}`, "PATCH", {
+			schemas: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+			Operations: [{
+				op: "replace",
+				path: "active",
+				value: false
+			}]
+		});
+		expect(patched.status).toBe(200);
+		expect(seen).toContainEqual({
+			principal: "grace",
+			tenant: home,
+			kind: "session-revoked"
+		});
+		expect(seen.every((event) => event.kind === "session-revoked")).toBe(true);
+		expect(kinds).toEqual(["changed", "session-revoked"]);
+	});
+}
+function tenantApproval(token, tenant) {
+	const base = sampleApproval(token);
+	return {
+		...base,
+		subject: {
+			...base.subject,
+			principal: {
+				id: "u_1",
+				roles: ["member"],
+				tenant
+			}
+		}
+	};
+}
+function tenantApprover(tenant) {
+	return {
+		principal: {
+			id: "u_9",
+			roles: [],
+			memberships: [{
+				tenant,
+				roles: ["admin"]
+			}]
+		},
+		context: {}
+	};
+}
+function testApprovalStore(store, options = {}) {
+	it("keeps the existing record when the same call asks again", async () => {
+		await store.create(sampleApproval("dup-token"));
+		await store.resolve("dup-token", {
+			status: "approved",
+			by: approver
+		});
+		await store.create(sampleApproval("dup-token"));
+		expect((await store.get("dup-token"))?.status).toBe("approved");
+	});
+	it("consumes an approved request exactly once", async () => {
+		await store.create(sampleApproval("once-token"));
+		expect(await store.consume("once-token")).toBeNull();
+		await store.resolve("once-token", {
+			status: "approved",
+			by: approver
+		});
+		const [first, second] = await Promise.all([store.consume("once-token"), store.consume("once-token")]);
+		expect([first, second].filter((item) => item !== null)).toHaveLength(1);
+		expect((first ?? second)?.consumedAt).toEqual(expect.any(String));
+		expect(await store.consume("once-token")).toBeNull();
+		expect((await store.get("once-token"))?.consumedAt).toEqual(expect.any(String));
+	});
+	it("refuses an approver from another tenant", async () => {
+		await store.create(tenantApproval("tenant-token", "o_1"));
+		await expect(Promise.resolve().then(() => store.resolve("tenant-token", {
+			status: "approved",
+			by: tenantApprover("o_2")
+		}))).rejects.toThrow(/tenant|eligible/u);
+		expect((await store.get("tenant-token"))?.status).toBe("pending");
+	});
+	it.skipIf(options.reopen === void 0)("resumes an approval after a restart", async () => {
+		await store.create(sampleApproval("restart-token"));
+		await store.resolve("restart-token", {
+			status: "approved",
+			by: approver
+		});
+		const reopened = await options.reopen();
+		expect((await reopened.get("restart-token"))?.status).toBe("approved");
+		expect(await reopened.consume("restart-token")).not.toBeNull();
+		expect(await store.consume("restart-token")).toBeNull();
+	});
+	it("creates, gets, lists, resolves and expires", async () => {
+		const request = sampleApproval("opaque-token");
+		await store.create(request);
+		const loaded = await store.get("opaque-token");
+		expect(loaded).toEqual(request);
+		expect(JSON.parse(JSON.stringify(loaded))).toEqual(request);
+		const listed = await store.list({ status: "pending" });
+		expect(listed.items.some((item) => item.token === "opaque-token")).toBe(true);
+		const resolved = await store.resolve("opaque-token", {
+			status: "approved",
+			by: approver
+		});
+		expect(resolved.status).toBe("approved");
+		await expect(Promise.resolve().then(() => store.resolve("opaque-token", {
+			status: "rejected",
+			by: approver
+		}))).rejects.toThrow(/not pending/);
+		await store.create(sampleApproval("stale-token"));
+		const expired = await store.expire(new Date(Date.now() + 72e5));
+		expect(expired).toBeGreaterThanOrEqual(1);
+	});
+	it("pages list results with limit and an opaque cursor", async () => {
+		const base = Date.parse("2026-01-01T00:00:00.000Z");
+		await Promise.all([
+			"page-a",
+			"page-b",
+			"page-c"
+		].map(async (token, index) => store.create({
+			...sampleApproval(token),
+			subject: { principal: {
+				id: "u_pager",
+				roles: ["member"]
+			} },
+			createdAt: new Date(base + index * 1e3).toISOString()
+		})));
+		const first = await store.list({
+			principalId: "u_pager",
+			limit: 2
+		});
+		expect(first.items.map((item) => item.token)).toEqual(["page-a", "page-b"]);
+		expect(typeof first.next).toBe("string");
+		const second = await store.list({
+			principalId: "u_pager",
+			limit: 2,
+			cursor: first.next
+		});
+		expect(second.items.map((item) => item.token)).toEqual(["page-c"]);
+		expect(second.next).toBeUndefined();
+		expect((await store.list({
+			principalId: "u_pager",
+			cursor: "not a cursor"
+		})).items).toEqual([]);
+	});
+	it("refuses an approver who does not match request.approvers", async () => {
+		const request = {
+			...sampleApproval("gated-token"),
+			approvers: { by: {
+				kind: "role",
+				role: "admin",
+				scope: "global"
+			} }
+		};
+		await store.create(request);
+		const member = {
+			principal: {
+				id: "u_2",
+				roles: ["member"]
+			},
+			context: {}
+		};
+		await expect(Promise.resolve().then(() => store.resolve("gated-token", {
+			status: "approved",
+			by: member
+		}))).rejects.toThrow(/eligible|not pending|not found/);
+	});
+	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
+		const principal = {
+			principal: {
+				id: "u_1",
+				roles: ["admin"]
+			},
+			context: {}
+		};
+		const shapes = [
+			["self-human", void 0],
+			["self-by", { by: admin }],
+			["self-distinct", {
+				by: admin,
+				distinct: true
+			}]
+		];
+		for (const [token, approvers] of shapes) {
+			await store.create(approvers === void 0 ? sampleApproval(token) : {
+				...sampleApproval(token),
+				approvers
+			});
+			await expect(Promise.resolve().then(() => store.resolve(token, {
+				status: "approved",
+				by: principal
+			}))).rejects.toThrow(/principal/u);
+			expect((await store.get(token))?.status).toBe("pending");
+		}
+		await store.create({
+			...sampleApproval("self-optout"),
+			approvers: {
+				by: admin,
+				distinct: false
+			}
+		});
+		const resolved = await store.resolve("self-optout", {
+			status: "approved",
+			by: principal
+		});
+		expect(resolved.resolvedBy).toBe("u_1");
+	});
+	it("stays pending until the quorum is met and counts an approver once", async () => {
+		await store.create({
+			...sampleApproval("quorum-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
+		});
+		const first = await store.resolve("quorum-token", {
+			status: "approved",
+			by: approver
+		});
+		expect(first.status).toBe("pending");
+		expect(first.approvals).toEqual([{
+			by: "u_9",
+			at: expect.any(String)
+		}]);
+		expect(await store.consume("quorum-token")).toBeNull();
+		await expect(Promise.resolve().then(() => store.resolve("quorum-token", {
+			status: "approved",
+			by: approver
+		}))).rejects.toThrow(/already approved/u);
+		const second = await store.resolve("quorum-token", {
+			status: "approved",
+			by: secondApprover
+		});
+		expect(second.status).toBe("approved");
+		expect(second.approvals?.map((item) => item.by)).toEqual(["u_9", "u_10"]);
+		expect(second.resolvedBy).toBe("u_10");
+		expect(await store.consume("quorum-token")).not.toBeNull();
+	});
+	it("resolves a vouched verdict at once, records its rule, and still refuses the requester", async () => {
+		await store.create({
+			...sampleApproval("vouched-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
+		});
+		await expect(Promise.resolve().then(() => store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_1",
+					roles: []
+				},
+				context: {}
+			},
+			vouched: "app-rule"
+		}))).rejects.toThrow(/principal/u);
+		const resolved = await store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_outsider",
+					roles: []
+				},
+				context: {}
+			},
+			vouched: "app-rule"
+		});
+		expect(resolved.status).toBe("approved");
+		expect(resolved.vouched).toBe("app-rule");
+		expect(resolved.approvals).toEqual([{
+			by: "u_outsider",
+			at: expect.any(String),
+			vouched: "app-rule"
+		}]);
+	});
+	it("lets one rejection end a quorum request", async () => {
+		await store.create({
+			...sampleApproval("veto-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
+		});
+		const rejected = await store.resolve("veto-token", {
+			status: "rejected",
+			by: approver
+		});
+		expect(rejected.status).toBe("rejected");
+		expect(rejected.approvals).toBeUndefined();
+	});
+	it("admits the escalation grantee only once the request has waited", async () => {
+		const auditor = {
+			principal: {
+				id: "u_11",
+				roles: ["auditor"]
+			},
+			context: {}
+		};
+		const escalation = {
+			after: "1h",
+			to: {
+				kind: "role",
+				role: "auditor",
+				scope: "global"
+			}
+		};
+		await store.create({
+			...sampleApproval("fresh-escalation"),
+			approvers: {
+				by: admin,
+				escalation
+			}
+		});
+		await expect(Promise.resolve().then(() => store.resolve("fresh-escalation", {
+			status: "approved",
+			by: auditor
+		}))).rejects.toThrow(/eligible/u);
+		await store.create({
+			...sampleApproval("waited-escalation"),
+			createdAt: (/* @__PURE__ */ new Date(Date.now() - 72e5)).toISOString(),
+			approvers: {
+				by: admin,
+				escalation
+			}
+		});
+		const resolved = await store.resolve("waited-escalation", {
+			status: "approved",
+			by: auditor
+		});
+		expect(resolved.status).toBe("approved");
+		expect(resolved.resolvedBy).toBe("u_11");
+	});
+	it("completes sequential stages in order and records each stage", async () => {
+		await store.create({
+			...sampleApproval("stages-token"),
+			approvers: {
+				mode: "sequential",
+				stages: [{ by: {
+					kind: "user",
+					id: "u_10"
+				} }, { by: admin }]
+			}
+		});
+		await expect(Promise.resolve().then(() => store.resolve("stages-token", {
+			status: "approved",
+			by: approver
+		}))).rejects.toThrow(/eligible/u);
+		const first = await store.resolve("stages-token", {
+			status: "approved",
+			by: secondApprover
+		});
+		expect(first.status).toBe("pending");
+		expect(first.approvals).toEqual([{
+			by: "u_10",
+			at: expect.any(String),
+			stage: 0
+		}]);
+		const second = await store.resolve("stages-token", {
+			status: "approved",
+			by: approver
+		});
+		expect(second.status).toBe("approved");
+		expect(second.approvals?.map((item) => item.stage)).toEqual([0, 1]);
+	});
+	it("matches a relation approver only through the verdict's relations", async () => {
+		const manager = {
+			kind: "relation",
+			resource: "post",
+			relation: "manager"
+		};
+		await store.create({
+			...sampleApproval("relation-token"),
+			approvers: { by: manager }
+		});
+		await expect(Promise.resolve().then(() => store.resolve("relation-token", {
+			status: "approved",
+			by: approver
+		}))).rejects.toThrow(/eligible/u);
+		const resolved = await store.resolve("relation-token", {
+			status: "approved",
+			by: approver,
+			relations: [JSON.stringify([
+				"post",
+				"manager",
+				null,
+				null
+			])]
+		});
+		expect(resolved.status).toBe("approved");
+	});
+}
+function decodeHeader(token) {
+	const [encoded] = token.split(".");
+	if (encoded === void 0) return {};
+	const padded = encoded.replaceAll("-", "+").replaceAll("_", "/");
+	const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+	return JSON.parse(atob(`${padded}${pad}`));
+}
+function testTokenVerifier(verifier, options) {
+	const audience = options?.audience ?? "https://api.example.com";
+	const issuer = options?.issuer ?? "https://login.example.com";
+	it("never throws and maps the JWT behaviour table", async () => {
+		const valid = await verifier.verify(jwtFixtureTokens.valid, {
+			audience,
+			issuer
+		});
+		expect(valid.ok).toBe(true);
+		if (valid.ok) {
+			expect(valid.claims.sub).toBe("u_1");
+			expect(valid.header.alg).toBe("Ed25519");
+		}
+		const rows = [
+			{
+				token: jwtFixtureTokens.none,
+				cause: "alg-none"
+			},
+			{
+				token: jwtFixtureTokens.expired,
+				cause: "expired"
+			},
+			{
+				token: jwtFixtureTokens.wrongAud,
+				cause: "wrong-audience"
+			},
+			{
+				token: jwtFixtureTokens.wrongIss,
+				cause: "wrong-issuer"
+			},
+			{
+				token: jwtFixtureTokens.unknownKid,
+				cause: "unknown-kid"
+			},
+			{
+				token: "not-a-jwt",
+				cause: "malformed"
+			},
+			{
+				token: "a.b.c.d.e",
+				cause: "encrypted-token"
+			}
+		];
+		for (const row of rows) {
+			let result;
+			try {
+				result = await verifier.verify(row.token, {
+					audience,
+					issuer
+				});
+			} catch {
+				throw new Error("TokenVerifier must not throw");
+			}
+			expect(result.ok).toBe(false);
+			if (!result.ok) expect(result.cause).toBe(row.cause);
+		}
+	});
+}
+/** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
+function testSettingsSource(source, options) {
+	it("answers per tenant with plain settings and nothing for an unknown tenant", async () => {
+		const settings = await source.settingsFor(options.tenant);
+		if (settings !== void 0) {
+			expect(typeof settings).toBe("object");
+			const credentials = settings.credentials;
+			if (credentials !== void 0) {
+				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
+				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service")).toBe(true);
+			}
+			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
+		}
+		expect(await source.settingsFor(options.unknown ?? "__permdock_unknown__")).toBeUndefined();
+	});
+}
+/**
+* Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
+* queried tenant or to none, and every entry loads against `policy` (an
+* entry that does not would deny every call).
+*/
+function testApprovalPolicySource(source, options) {
+	it("answers per tenant with plain entries that load against the policy", async () => {
+		const entries = await source.approvalPoliciesFor({ tenants: [options.tenant] });
+		expect(Array.isArray(entries)).toBe(true);
+		for (const entry of entries) {
+			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect([void 0, options.tenant]).toContain(entry.tenant);
+		}
+		const loaded = await approvalPoliciesFor(options.policy, source, [options.tenant], []);
+		expect(loaded).not.toBe("failed");
+		const other = await source.approvalPoliciesFor({ tenants: [options.unknown ?? "__permdock_unknown__"] });
+		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
+	});
+}
+function flipLast(value) {
+	const last = value.at(-1);
+	return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
+}
+/**
+* `key` is a live key the verifier knows, or a function issuing one (called
+* once). `revoke`, when given, revokes it; the runner then expects the key
+* to stop verifying.
+*/
+function testCredentialVerifier(verifier, options) {
+	let issued;
+	const live = () => {
+		const source = options.key;
+		issued ??= Promise.resolve(typeof source === "string" ? source : source());
+		return issued;
+	};
+	it("verifies the live key to a v1 credential with the key id", async () => {
+		const key = await live();
+		const parts = parseApiKey(key);
+		expect(parts).toBeDefined();
+		const credential = parseCredential(await verifier.verify(key));
+		expect(credential).toBeDefined();
+		expect(credential?.id).toBe(parts?.id);
+		expect(parseCredential(await verifier.verify(key))).toEqual(credential);
+	});
+	it("never throws and answers null for every other key", async () => {
+		const key = await live();
+		const parts = parseApiKey(key);
+		const others = [
+			"",
+			"garbage",
+			"pdk_",
+			`${key}x`,
+			flipLast(key),
+			`pdk_${parts?.id ?? "x"}-other_${parts?.secret ?? ""}`,
+			key.replace(/^pdk_/u, "sk_")
+		];
+		for (const other of others) {
+			let result;
+			try {
+				result = await verifier.verify(other);
+			} catch {
+				throw new Error("CredentialVerifier must not throw");
+			}
+			expect(result).toBeNull();
+		}
+	});
+	if (verifier.touch !== void 0) it("accepts a touch without changing what the key verifies to", async () => {
+		const key = await live();
+		const before = parseCredential(await verifier.verify(key));
+		const id = parseApiKey(key)?.id ?? "";
+		await verifier.touch?.(id, Math.floor(Date.now() / 1e3));
+		await verifier.touch?.("unknown-id", Math.floor(Date.now() / 1e3));
+		expect(parseCredential(await verifier.verify(key))).toEqual(before);
+	});
+	if (options.revoke !== void 0) {
+		const revoke = options.revoke;
+		it("stops verifying a revoked key", async () => {
+			const key = await live();
+			await revoke();
+			expect(await verifier.verify(key)).toBeNull();
+		});
+	}
+}
+function testTokenSigner(signer, options) {
+	it("emits compact JWS with only alg, kid and typ", async () => {
+		const token = await signer.sign({
+			snapshot: { v: 1 },
+			sub: "u_1"
+		}, {
+			typ: "permdock-snapshot+jwt",
+			audience: "https://app.example.com"
+		});
+		const header = decodeHeader(token);
+		expect(Object.keys(header).toSorted()).toEqual([
+			"alg",
+			"kid",
+			"typ"
+		]);
+		expect(header["typ"]).toBe("permdock-snapshot+jwt");
+		expect(header["alg"]).not.toBe("none");
+		const verified = await options.verifier.verify(token, {
+			typ: "permdock-snapshot+jwt",
+			audience: "https://app.example.com"
+		});
+		expect(verified.ok).toBe(true);
+		if (signer.jwks !== void 0) {
+			const jwks = await signer.jwks();
+			expect(jwks.keys.length).toBeGreaterThan(0);
+			expect(jwks.keys[0]).not.toHaveProperty("d");
+		}
+	});
+}
+const WHERE_ROWS = [
+	{
+		id: "r1",
+		authorId: "u1",
+		score: 5,
+		title: "Plan 100%",
+		archived: false,
+		note: null
+	},
+	{
+		id: "r2",
+		authorId: "u2",
+		score: 10,
+		title: "plan_b",
+		archived: true,
+		note: "kept"
+	},
+	{
+		id: "r3",
+		authorId: null,
+		score: null,
+		title: null,
+		archived: null,
+		note: null
+	}
+];
+const WHERE_CASES = [
+	["eq", {
+		op: "eq",
+		field: "authorId",
+		value: "u1"
+	}],
+	["ne", {
+		op: "ne",
+		field: "authorId",
+		value: "u1"
+	}],
+	["eq on a boolean", {
+		op: "eq",
+		field: "archived",
+		value: false
+	}],
+	["gt", {
+		op: "gt",
+		field: "score",
+		value: 5
+	}],
+	["gte", {
+		op: "gte",
+		field: "score",
+		value: 5
+	}],
+	["lt", {
+		op: "lt",
+		field: "score",
+		value: 10
+	}],
+	["lte", {
+		op: "lte",
+		field: "score",
+		value: 10
+	}],
+	["contains a literal %", {
+		op: "contains",
+		field: "title",
+		value: "100%"
+	}],
+	["contains a literal _", {
+		op: "contains",
+		field: "title",
+		value: "n_b"
+	}],
+	["in", {
+		op: "in",
+		field: "authorId",
+		value: ["u1", "u2"]
+	}],
+	["notIn", {
+		op: "notIn",
+		field: "authorId",
+		value: ["u1"]
+	}],
+	["isNull", {
+		op: "isNull",
+		field: "note",
+		value: true
+	}],
+	["is not null", {
+		op: "isNull",
+		field: "note",
+		value: false
+	}],
+	["and", {
+		op: "and",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "lt",
+			field: "score",
+			value: 10
+		}]
+	}],
+	["or", {
+		op: "or",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "eq",
+			field: "archived",
+			value: true
+		}]
+	}],
+	["not over a NULL field", {
+		op: "not",
+		condition: {
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}
+	}],
+	["not over and", {
+		op: "not",
+		condition: {
+			op: "and",
+			conditions: [{
+				op: "eq",
+				field: "authorId",
+				value: "u2"
+			}, {
+				op: "gt",
+				field: "score",
+				value: 5
+			}]
+		}
+	}],
+	["and of nothing", {
+		op: "and",
+		conditions: []
+	}],
+	["not of the empty allow set", {
+		op: "not",
+		condition: {
+			op: "or",
+			conditions: []
+		}
+	}]
+];
+const WHERE_SUBJECT = {
+	principal: null,
+	context: {}
+};
+/**
+* `matches` answers whether the compiled output selects `row`, for example
+* by running it against a table holding only that row. With it, every case
+* must select the rows the in-memory evaluator keeps, including rows whose
+* fields are NULL.
+*/
+function testWhereCompiler(compiler, options) {
+	const { matches } = options;
+	it.skipIf(matches === void 0).each(WHERE_CASES)("selects the rows the evaluator keeps: %s", async (_name, condition) => {
+		if (matches === void 0) return;
+		const compiled = compiler(condition, options.target);
+		const selected = [];
+		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
+		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
+	});
+	it("fails closed on an empty allow set", () => {
+		const compiled = compiler({
+			op: "or",
+			conditions: []
+		}, options.target);
+		const closed = options.isFailClosed === void 0 ? compiled === false || compiled === void 0 || compiled === null : options.isFailClosed(compiled);
+		expect(closed).toBe(true);
+	});
+	it("compiles a sqlFunction through its twin", () => {
+		const twin = {
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		};
+		expect(() => compiler({
+			op: "sqlFunction",
+			name: "job_permitted",
+			args: [{ field: "id" }],
+			twin
+		}, options.target)).not.toThrow();
+	});
+}
+//#endregion
+//#region src/testing/supabase-fixtures.ts
+const base = {
+	sub: "6f1c2c1e-5d0a-4d9e-9a51-6b1f0e7c2a10",
+	aud: "authenticated",
+	role: "authenticated",
+	iss: "https://project.supabase.co/auth/v1",
+	iat: 179e7,
+	exp: 1790003600,
+	aal: "aal1",
+	session_id: "b7a8f9c0-1111-4222-8333-944455556666",
+	is_anonymous: false
+};
+const id = base.sub;
+const org = "0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6";
+const project = "3b2a1c0d-9e8f-4a7b-8c6d-5e4f3a2b1c0d";
+const customer = "c7d8e9f0-1a2b-4c3d-9e4f-5a6b7c8d9e0f";
+const supportAdmin = "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d";
+const supportSessionId = "4e5f6a7b-8c9d-4e0f-9a1b-2c3d4e5f6a7b";
+const ownerMembership = {
+	scope: "organization",
+	id: org,
+	roles: ["owner"],
+	via: "direct",
+	expiresAt: 19e8,
+	grantedBy: "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
+	reason: "founding member",
+	managedBy: "idp",
+	entitlements: ["seat:pro"]
+};
+const projectMembership = {
+	scope: "project",
+	id: project,
+	within: { organization: org },
+	roles: ["editor"]
+};
+const shareMembership = {
+	on: {
+		resource: "document",
+		id: "doc-1"
+	},
+	roles: ["viewer"],
+	via: "share"
+};
+const contactMembership = {
+	scope: "customer",
+	id: customer,
+	within: { organization: org },
+	roles: ["contact"],
+	via: "contact"
+};
+const supabaseClaimFixtures = {
+	topLevelRole: {
+		claims: {
+			...base,
+			user_role: "admin",
+			app_metadata: { provider: "email" }
+		},
+		expect: {
+			id,
+			roles: ["admin"],
+			memberships: []
+		}
+	},
+	appMetadataRole: {
+		claims: {
+			...base,
+			app_metadata: {
+				provider: "email",
+				user_role: "moderator"
+			}
+		},
+		expect: {
+			id,
+			roles: ["moderator"],
+			memberships: []
+		}
+	},
+	nullTopLevelFallsBack: {
+		claims: {
+			...base,
+			user_role: null,
+			app_metadata: { user_role: "moderator" }
+		},
+		expect: {
+			id,
+			roles: ["moderator"],
+			memberships: []
+		}
+	},
+	arrayRoles: {
+		claims: {
+			...base,
+			user_role: ["admin", "moderator"]
+		},
+		expect: {
+			id,
+			roles: ["admin", "moderator"],
+			memberships: []
+		}
+	},
+	missingRole: {
+		claims: { ...base },
+		expect: {
+			id,
+			roles: [],
+			memberships: []
+		}
+	},
+	nullRole: {
+		claims: {
+			...base,
+			user_role: null,
+			app_metadata: { user_role: null }
+		},
+		expect: {
+			id,
+			roles: [],
+			memberships: []
+		}
+	},
+	userMetadataIgnored: {
+		claims: {
+			...base,
+			user_metadata: {
+				user_role: "admin",
+				memberships: [{
+					tenant: "acme",
+					roles: ["owner"]
+				}]
+			}
+		},
+		expect: {
+			id,
+			roles: [],
+			memberships: []
+		}
+	},
+	multiOrg: {
+		claims: {
+			...base,
+			tenant_id: "acme",
+			memberships: [{
+				tenant: "acme",
+				roles: ["admin"]
+			}, {
+				tenant: "globex",
+				roles: ["viewer"]
+			}]
+		},
+		expect: {
+			id,
+			roles: [],
+			tenant: "acme",
+			memberships: [{
+				tenant: "acme",
+				roles: ["admin"]
+			}, {
+				tenant: "globex",
+				roles: ["viewer"]
+			}]
+		}
+	},
+	tenantPlans: {
+		claims: {
+			...base,
+			user_role: null,
+			tenant_id: "0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6",
+			memberships: [{
+				scope: "tenant",
+				id: "0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6",
+				roles: ["admin"]
+			}, {
+				scope: "tenant",
+				id: "7e6d5c4b-3a29-4817-9605-f4e3d2c1b0a9",
+				roles: ["viewer"]
+			}],
+			features: {
+				"0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6": ["pro"],
+				"7e6d5c4b-3a29-4817-9605-f4e3d2c1b0a9": ["free"]
+			},
+			authz_ver: 3
+		},
+		options: { plans: "features" },
+		expect: {
+			id,
+			roles: [],
+			tenant: "0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6",
+			memberships: [{
+				scope: "tenant",
+				id: "0d8c5a2e-3f4b-4c6d-8e9f-a1b2c3d4e5f6",
+				roles: ["admin"]
+			}, {
+				scope: "tenant",
+				id: "7e6d5c4b-3a29-4817-9605-f4e3d2c1b0a9",
+				roles: ["viewer"]
+			}],
+			plans: ["pro"]
+		}
+	},
+	full: {
+		claims: {
+			...base,
+			user_role: ["admin"],
+			roles: ["admin"],
+			tenant_id: org,
+			memberships: [
+				{
+					...ownerMembership,
+					grants: { analyst: ["post.read", "-post.delete"] }
+				},
+				projectMembership,
+				shareMembership
+			],
+			memberships_truncated: true,
+			attrs: {
+				department: "finance",
+				clearance: 2
+			},
+			authz_ver: 7,
+			datetime_preferences: {
+				timezone: "Europe/Amsterdam",
+				week_start: "monday",
+				date_format: "dd-MM-yyyy",
+				time_format: "24h"
+			},
+			app_metadata: {
+				provider: "email",
+				providers: ["email"]
+			}
+		},
+		expect: {
+			id,
+			roles: ["admin"],
+			tenant: org,
+			memberships: [
+				ownerMembership,
+				projectMembership,
+				shareMembership
+			]
+		}
+	},
+	portalContact: {
+		claims: {
+			...base,
+			user_role: null,
+			tenant_id: org,
+			memberships: [contactMembership]
+		},
+		expect: {
+			id,
+			roles: [],
+			tenant: org,
+			memberships: [contactMembership]
+		}
+	},
+	oauthClient: {
+		claims: {
+			...base,
+			client_id: "5f0e4d3c-2b1a-4098-8776-655443322110",
+			scope: "openid email posts:read",
+			user_role: "member"
+		},
+		expect: {
+			id,
+			roles: ["member"],
+			memberships: [],
+			actor: {
+				id: "5f0e4d3c-2b1a-4098-8776-655443322110",
+				kind: "oauth-client"
+			},
+			delegation: { scopes: ["posts:read"] }
+		}
+	},
+	actChain: {
+		claims: {
+			...base,
+			scope: "posts:read",
+			act: {
+				sub: "agent-runner",
+				act: { sub: "mcp-client-42" }
+			}
+		},
+		expect: {
+			id,
+			roles: [],
+			memberships: [],
+			actor: {
+				id: "agent-runner",
+				kind: "oauth-client"
+			},
+			delegation: {
+				scopes: ["posts:read"],
+				chain: {
+					sub: "agent-runner",
+					act: { sub: "mcp-client-42" }
+				}
+			}
+		}
+	},
+	supportSession: {
+		claims: {
+			...base,
+			user_role: "member",
+			act: {
+				kind: "support",
+				sub: supportAdmin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: false
+			}
+		},
+		expect: {
+			id,
+			roles: ["member"],
+			memberships: [],
+			actor: {
+				id: supportAdmin,
+				kind: "support",
+				sessionId: supportSessionId,
+				readOnly: false
+			}
+		}
+	},
+	supportSessionReadOnly: {
+		claims: {
+			...base,
+			user_role: "member",
+			act: {
+				kind: "support",
+				sub: supportAdmin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: true
+			}
+		},
+		expect: {
+			id,
+			roles: ["member"],
+			memberships: [],
+			actor: {
+				id: supportAdmin,
+				kind: "support",
+				sessionId: supportSessionId,
+				readOnly: true
+			}
+		}
+	},
+	impersonation: {
+		claims: {
+			...base,
+			user_role: "member",
+			act: {
+				kind: "impersonation",
+				sub: supportAdmin,
+				reason: "ticket 42"
+			}
+		},
+		expect: {
+			id,
+			roles: ["member"],
+			memberships: [],
+			actor: {
+				id: supportAdmin,
+				kind: "impersonation"
+			}
+		}
+	},
+	anonymousSignIn: {
+		claims: {
+			...base,
+			is_anonymous: true
+		},
+		options: { anonymousSignIns: "deny" },
+		expect: {
+			id: null,
+			roles: [],
+			memberships: []
+		}
+	},
+	anon: {
+		claims: {
+			...base,
+			role: "anon",
+			sub: ""
+		},
+		expect: {
+			id: null,
+			roles: [],
+			memberships: []
+		}
+	},
+	serviceRole: {
+		claims: {
+			...base,
+			role: "service_role",
+			user_role: "admin"
+		},
+		expect: {
+			id: null,
+			roles: [],
+			memberships: []
+		}
+	}
+};
+const supabaseClaimVectors = {
+	feature: "auth.session.get_claims",
+	cases: Object.entries(supabaseClaimFixtures).map(([name, fixture]) => ({
+		name,
+		input: {
+			claims: fixture.claims,
+			...fixture.options === void 0 ? {} : { options: fixture.options }
+		},
+		expected: fixture.expect
+	}))
+};
+/**
+* The `permdock supabase inspect --json` manifest for a policy with one
+* `tenant` scope, the default `supabase.hook` and a `features` claim from
+* `public.feature_claims`. A package that reads the manifest tests its
+* parser against this value.
+*/
+const supabaseHookManifestFixture = {
+	$schema: "https://permdock.com/schemas/supabase-manifest-v1.json",
+	version: 1,
+	hook: {
+		schema: "permdock",
+		function: "custom_access_token_hook",
+		out: "supabase/permdock-hook.sql"
+	},
+	helpers: {
+		schema: "permdock",
+		functions: [
+			"permdock_has",
+			"permitted_tenant_ids",
+			"member_tenant_ids",
+			"member_tenant_ids_for"
+		]
+	},
+	tenantClaim: "tenant_id",
+	budget: {
+		bytes: 1024,
+		measure: "octet_length(memberships::text) + octet_length(attrs::text)"
+	},
+	claims: [
+		{
+			name: "user_role",
+			source: "permdock",
+			budget: false
+		},
+		{
+			name: "roles",
+			source: "permdock",
+			budget: false
+		},
+		{
+			name: "memberships",
+			source: "permdock",
+			budget: true
+		},
+		{
+			name: "memberships_truncated",
+			source: "permdock",
+			budget: false
+		},
+		{
+			name: "tenant_id",
+			source: "permdock",
+			budget: false
+		},
+		{
+			name: "authz_ver",
+			source: "permdock",
+			budget: false
+		},
+		{
+			name: "features",
+			source: "public.feature_claims",
+			budget: false
+		}
+	],
+	authzVersion: true,
+	authzVersionBump: {
+		schema: "permdock",
+		function: "permdock_bump_authz_version_for",
+		args: "p_users uuid[]"
+	},
+	memberships: [{
+		table: "public.memberships",
+		user: { column: "user_id" },
+		scope: { column: "scope" },
+		id: { column: "scope_id" },
+		role: { column: "role" },
+		columns: [
+			"user_id",
+			"scope",
+			"scope_id",
+			"role"
+		]
+	}],
+	rls: {
+		schema: "permdock",
+		mode: "jwt",
+		tenantClaim: "tenant_id",
+		scopes: [{
+			name: "tenant",
+			type: "uuid"
+		}],
+		helpers: [
+			{
+				name: "permdock_has",
+				args: "p_grant text",
+				returns: "boolean",
+				execute: ["authenticated"]
+			},
+			{
+				name: "permitted_tenant_ids",
+				args: "p_grant text",
+				returns: "setof uuid",
+				execute: ["authenticated"]
+			},
+			{
+				name: "member_tenant_ids",
+				args: "",
+				returns: "setof uuid",
+				execute: ["authenticated"]
+			},
+			{
+				name: "member_tenant_ids_for",
+				args: "p_user uuid",
+				returns: "setof uuid",
+				execute: ["supabase_auth_admin"]
+			},
+			{
+				name: "permdock_user_id",
+				args: "",
+				returns: "uuid",
+				execute: ["authenticated"]
+			}
+		],
+		memberships: [{
+			table: "public.memberships",
+			user: { column: "user_id" },
+			scope: { column: "scope" },
+			id: { column: "scope_id" },
+			role: { column: "role" },
+			columns: [
+				"user_id",
+				"scope",
+				"scope_id",
+				"role"
+			]
+		}],
+		customRoles: false,
+		roles: {
+			table: "permdock.user_roles",
+			user: { column: "user_id" },
+			role: { column: "role" }
+		}
+	},
+	decidingColumns: [
+		"public.memberships.role",
+		"public.memberships.scope",
+		"public.memberships.scope_id",
+		"public.memberships.user_id"
+	],
+	markers: {
+		hook: "v1",
+		grants: "v1"
+	},
+	requires: {
+		matrix: "capability-matrix-v1.12.0",
+		capabilities: ["auth.session.get_claims"]
+	}
+};
+//#endregion
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, ormParity, rlsParity, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAgentAdapter, testApprovalPolicySource, testApprovalStore, testAuthZen, testClientParity, testClientStore, testCredentialVerifier, testDecisionSink, testDirectoryStore, testEntitlementSource, testHttpAdapter, testLimitStore, testMembershipSource, testPolicySource, testRelationSource, testReplayStore, testRevocationFeed, testRoleSource, testSettingsSource, testSnapshotSource, testSubjectResolver, testTokenSigner, testTokenVerifier, testWhereCompiler };