permdock 0.3.1 → 0.4.0

package/dist/testing/index.js

@@ -1,24 +1,24 @@
-import { _ as listPermissions, b as resource, n as definePermissions } from "../permissions-DVoF6dMt.js";
-import { r as principal } from "../refs-KYb4ntaz.js";
-import { _ as memoryLimitStore, a as definePolicy, m as role, t as allow } from "../policy-xyWg7QdR.js";
-import { _ as memoryRoleSource, u as snapshotFor } from "../src-BDwEZWrZ.js";
+import { r as principal } from "../refs-f3imMjNW.js";
+import { n as role, r as allow, u as memoryLimitStore } from "../role-builder-B4GbKM-i.js";
+import { c as snapshotFor, g as memoryRoleSource, s as definePermissions } from "../src-Bb7no-hS.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { a as normalizeMemberships, d as scopeList } from "../scopes-CVdPrWN-.js";
-import { n as parseSnapshot, p as evaluateCondition } from "../snapshot-Enxd0n-s.js";
-import { i as parsePolicyDocument, r as mergeHostedGrants } from "../hosted-DJQw46hn.js";
-import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-CbgvLnuo.js";
+import { a as normalizeMemberships, d as scopeList } from "../scopes-tvpa34ep.js";
+import { _ as evaluateCondition, n as parseSnapshot } from "../snapshot-Dc9CHPME.js";
+import { _ as resource, c as listPermissions } from "../permission-registry-BsblpB-z.js";
+import { i as parsePolicyDocument, o as definePolicy, r as mergeHostedGrants } from "../hosted-CBHgkzDl.js";
+import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-L26udHSk.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { n as fromSnapshot } from "../from-snapshot-CTLijvdm.js";
-import { o as parseCredential } from "../credential-8P81ff4u.js";
-import { o as problemFromDecision } from "../problem-B43ztKIm.js";
-import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-DMAWwAJV.js";
-import { o as resolveApproval } from "../helpers-H_KARDVC.js";
-import { a as parseApiKey } from "../server-DlZ28Oz5.js";
-import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-BFGBBAqR.js";
+import { n as fromSnapshot } from "../from-snapshot-7REQZe0H.js";
+import { o as parseCredential } from "../credential-kue0qpbm.js";
+import { s as problemFromDecision } from "../problem-CnWraVhC.js";
+import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-ILkLUj_o.js";
+import { o as resolveApproval } from "../helpers-C9YmyBIa.js";
+import { a as parseApiKey } from "../server-ZYEHtNHS.js";
+import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-vFR1O5oG.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as quoteSqlTable, r as quoteSqlIdent, t as SQL_IDENT } from "../sql-xdg5f4Fi.js";
-import { i as saasPermissions } from "../permissions-RJrovw98.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DhpJjnBA.js";
+import { a as quoteSqlIdent, s as quoteSqlTable, t as SQL_IDENT } from "../sql-t8teWOfo.js";
+import { i as saasPermissions } from "../permissions-CCJ6lmxB.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DtaA4JuW.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
 function isOutcomeCell(value) {
@@ -707,7 +707,7 @@ async function snapshotFixture(policy, subject, options = {}) {
 	return snapshot;
 }
 //#endregion
-//#region src/testing/http-adapter.ts
+//#region src/testing/http-adapter/domain.ts
 function project$1(id) {
 	const row = saasSeed.projects.find((candidate) => candidate.id === id);
 	if (row === void 0) throw new Error(`no seed project ${id}`);
@@ -783,6 +783,11 @@ function createDomain$1() {
 		project: (id) => id === void 0 ? null : saasSeed.projects.find((row) => row.id === id) ?? null
 	};
 }
+async function approverSubject(user, tenant) {
+	return (await createPermDock(saasPolicy, saasPrincipal(user, tenant), { tenant })).subject;
+}
+//#endregion
+//#region src/testing/http-adapter/wire.ts
 function restRequest(base, call) {
 	const headers = new Headers();
 	if (call.authorization !== null) headers.set("authorization", call.authorization);
@@ -847,9 +852,6 @@ function reasonsOf(body) {
 	const denials = field(body, "denials");
 	return Array.isArray(denials) ? denials.map((denial) => field(denial, "reason")) : [];
 }
-async function approverSubject(user, tenant) {
-	return (await createPermDock(saasPolicy, saasPrincipal(user, tenant), { tenant })).subject;
-}
 const PARALLEL = [
 	{
 		user: "alice",
@@ -976,6 +978,8 @@ async function untilEnd(stream) {
 		};
 	}
 }
+//#endregion
+//#region src/testing/http-adapter/scenarios.ts
 /**
 * Real-life HTTP scenarios over the shared SaaS domain. `mount` builds the
 * application once with the adapter under test; every expectation below is
@@ -1768,1329 +1772,1339 @@ function authzenTodoVectors() {
 	};
 }
 //#endregion
-//#region src/testing/jwt-fixtures.ts
-const jwtFixtureJwks = { keys: [{
-	crv: "Ed25519",
-	x: "79ab4WR6Eb9LkefWpmh5ZlvjXg7wqVGNMwIEHQqduIQ",
-	kty: "OKP",
-	kid: "2026-09",
-	alg: "Ed25519",
-	use: "sig"
-}] };
-const jwtFixtureIssuer = "https://login.example.com";
-const jwtFixtureAudience = "https://api.example.com";
-const jwtFixtureTokens = {
-	valid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJjbGllbnRfaWQiOiJhcHAiLCJyb2xlcyI6WyJtZW1iZXIiXSwianRpIjoianRpLXZhbGlkIiwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5leGFtcGxlLmNvbSIsImF1ZCI6Imh0dHBzOi8vYXBpLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjIwMDAwMDAwMDB9.ENFMmLSyVde-2s4Gdz4iP7srZvU0Xuy_ZLz-OJGHD_-W1lEayEBeSPTnab0L_TBdj8p5BmkFrT-7VE7o20GbAw",
-	expired: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjEwMDAwMDAwMDAsImV4cCI6MTEwMDAwMDAwMH0.9X3d6kH3_2nmrbqMxuoxzFW-wsWJVCe-lR-aQ-MmsGGXlEUBMgQ-4MtAq1UR9lLE0h2b5JrE_GfjzuC04h5xCg",
-	wrongAud: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9vdGhlci5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.PgWdzi56J31OwoMqH4ysHzVKSKUDhi-AtHFUp1ewFzi-qGE-tknzrNKnKhDOncVzj0okb_flyy3vQgfzJwG5AQ",
-	wrongIss: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2V2aWwuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.tIcLHLa9JLtKz1gqjRGdr5DFbUzRDs5KsoPsJCxspvbBcsFfRFG2G0XJnd1h4QHyZ_5B4OhY3W_jIIsnOPD9Bg",
-	unknownKid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoibm9wZSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MjAwMDAwMDAwMH0.walgG5GvpCVBnkMtkdw-epi5c93JqfvAM_N4EWR9Tqhiw_cnzITnlQyoVfihECmV1fqtFrhwM1RCIRJvd38zAQ",
-	none: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJleHAiOjIwMDAwMDAwMDAsImlhdCI6MTcwMDAwMDAwMH0.",
-	snapshot: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLXNuYXBzaG90K2p3dCJ9.eyJzbmFwc2hvdCI6eyJ2IjoyLCJpc3N1ZWRBdCI6MTcwMDAwMDAwMCwic3ViamVjdCI6eyJwcmluY2lwYWwiOnsiaWQiOiJ1XzEiLCJyb2xlcyI6WyJtZW1iZXIiXX0sImNvbnRleHQiOnt9fSwicm9sZXMiOlsibWVtYmVyIl0sImdyYW50cyI6W10sInRlbmFudHMiOltdfSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJzbmFwX2ZpeHR1cmUifQ.4itaYctluoCwU-syytUxArtS_FRyNAti2SZxuSH-nKIMr7-Sb3h1Q3xugn_vPR1eupV4fVNIe6dH27_EiyDvCA",
-	approval: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWFwcHJvdmFsK2p3dCJ9.eyJhcHByb3ZhbCI6eyJ0b2tlbiI6InBkMS5hYmMiLCJwZXJtaXNzaW9uIjoicG9zdC5kZWxldGUiLCJyZXNvdXJjZSI6eyJ0eXBlIjoicG9zdCIsImlkIjoiNDIifSwic3RhdHVzIjoiYXBwcm92ZWQifSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJhcHJfZml4dHVyZSJ9.UHsoSzQCo68G7ee-EFqdzMLvmqaKlFIMdQKFuqZEM4yUQnJsJJTXbld_aCXcyfN-IdjF9cj2F5EHzsV4nLKbBg",
-	decisions: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWRlY2lzaW9ucytqd3QifQ.eyJldmVudHMiOltdLCJpc3MiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJkZWNfZml4dHVyZSJ9.UZhJd72yFGxHOdjYbzcGYUPgYjvLwOPCtHKxEbLu56SdKSKUDCREXmEBI9WaCPKWjlTBnnIKMYwjG8I8RATJCg"
-};
-//#endregion
-//#region src/testing/conformance.ts
-function testSubjectResolver(resolver, options) {
-	it("never throws and fails closed to anonymous", async () => {
-		let result;
-		try {
-			result = await resolver(options.invalid);
-		} catch {
-			throw new Error("SubjectResolver must not throw");
-		}
-		expect(result.principal).toBeNull();
-	});
-}
-function testMembershipSource(source, options) {
-	const query = options.tenant === void 0 ? {} : { tenant: options.tenant };
-	it("returns well-formed memberships and fails closed on throw", async () => {
-		for (const principal of options.principals) {
-			let memberships = [];
-			try {
-				memberships = await source.membershipsFor(principal, query);
-			} catch {
-				memberships = [];
-			}
-			for (const membership of memberships) {
-				const shapes = [
-					membership.scope !== void 0,
-					membership.tenant !== void 0 || membership.team !== void 0,
-					membership.on !== void 0
-				].filter(Boolean);
-				expect(shapes.length).toBe(1);
-				expect(Array.isArray(membership.roles)).toBe(true);
-				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
-			}
-			const expected = options.expect?.[principal.id];
-			if (expected !== void 0) expect(memberships).toEqual(expected);
-		}
-	});
-	if (source.list !== void 0) it("lists every member of an instance it returns a membership for", async () => {
-		for (const principal of options.principals) {
-			let memberships = [];
-			try {
-				memberships = await source.membershipsFor(principal, query);
-			} catch {
-				continue;
+//#region src/testing/conformance/approvals.ts
+function sampleApproval(token) {
+	return {
+		v: 1,
+		token,
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: {
+			type: "post",
+			id: "42"
+		},
+		subject: {
+			principal: {
+				id: "u_1",
+				roles: ["member"]
+			},
+			actor: {
+				id: "agent-1",
+				kind: "eve"
 			}
-			for (const membership of memberships) {
-				if (membership.scope === void 0 || membership.id === void 0) continue;
-				const members = await source.list?.({
-					scope: membership.scope,
-					id: membership.id
-				}) ?? [];
-				expect(members.some((entry) => entry.principal.id === principal.id && entry.membership.scope === membership.scope && entry.membership.id === membership.id)).toBe(true);
+		},
+		detail: "post.delete requires human approval.",
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: new Date(Date.now() + 36e5).toISOString(),
+		status: "pending"
+	};
+}
+const approver = {
+	principal: {
+		id: "u_9",
+		roles: ["admin"]
+	},
+	context: {}
+};
+const secondApprover = {
+	principal: {
+		id: "u_10",
+		roles: ["admin"]
+	},
+	context: {}
+};
+const admin = {
+	kind: "role",
+	role: "admin",
+	scope: "global"
+};
+function tenantApproval(token, tenant) {
+	const base = sampleApproval(token);
+	return {
+		...base,
+		subject: {
+			...base.subject,
+			principal: {
+				id: "u_1",
+				roles: ["member"],
+				tenant
 			}
 		}
-	});
-	if (source.version !== void 0) it("reports a finite version or none", async () => {
-		for (const principal of options.principals) {
-			const version = await source.version?.({ id: principal.id });
-			expect(version === void 0 || typeof version === "number" && Number.isFinite(version)).toBe(true);
-		}
-	});
+	};
 }
-function holderKey(holder) {
-	return "group" in holder ? `${holder.group.resource}:${holder.group.id}#${holder.group.relation}` : holder.principal.id;
+function tenantApprover(tenant) {
+	return {
+		principal: {
+			id: "u_9",
+			roles: [],
+			memberships: [{
+				tenant,
+				roles: ["admin"]
+			}]
+		},
+		context: {}
+	};
 }
-/**
-* A `RelationSource` answers facts only: well-formed chains nearest first and
-* no longer than `depth`, holders with principal ids or group references and
-* numeric instants, a `truncated` chain only when more ancestors exist, and
-* empty answers (never a throw) for an object it does not know. `expect` pins
-* the chains, holders and links for `objects`, keyed `resource:id`,
-* `resource:id#relation` and `resource:id>link`; a group holder is written
-* `resource:id#relation`.
-*/
-function testRelationSource(source, options) {
-	it("returns chains nearest first, within depth, and truncated only when more exist", async () => {
-		for (const object of options.objects) {
-			const full = await source.ancestors({
-				resource: object.resource,
-				id: object.id,
-				through: "parent",
-				depth: 32
-			});
-			expect(Array.isArray(full.ancestors)).toBe(true);
-			for (const ancestor of full.ancestors) {
-				expect(typeof ancestor.id).toBe("string");
-				expect(ancestor.id).not.toBe("");
-			}
-			expect(full.ancestors.length).toBeLessThanOrEqual(32);
-			const expected = options.expect?.ancestors?.[`${object.resource}:${object.id}`];
-			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toEqual(expected);
-			if (full.ancestors.length > 1) {
-				const short = await source.ancestors({
-					resource: object.resource,
-					id: object.id,
-					through: "parent",
-					depth: 1
-				});
-				expect(short.ancestors.map((ancestor) => ancestor.id)).toEqual([full.ancestors[0]?.id]);
-				expect(short.truncated).toBe(true);
-			}
-			const none = await source.ancestors({
-				resource: object.resource,
-				id: object.id,
-				through: "parent",
-				depth: 0
-			});
-			expect(none.ancestors).toEqual([]);
-		}
+function testApprovalStore(store, options = {}) {
+	it("keeps the existing record when the same call asks again", async () => {
+		await store.create(sampleApproval("dup-token"));
+		await store.resolve("dup-token", {
+			status: "approved",
+			by: approver
+		});
+		await store.create(sampleApproval("dup-token"));
+		expect((await store.get("dup-token"))?.status).toBe("approved");
 	});
-	it("returns well-formed holders", async () => {
-		for (const object of options.objects) {
-			if (object.relation === void 0) continue;
-			const holders = await source.related({
-				resource: object.resource,
-				id: object.id,
-				relation: object.relation
-			});
-			expect(Array.isArray(holders)).toBe(true);
-			for (const holder of holders) {
-				if ("group" in holder) for (const part of [
-					holder.group.resource,
-					holder.group.id,
-					holder.group.relation
-				]) {
-					expect(typeof part).toBe("string");
-					expect(part).not.toBe("");
-				}
-				else expect(typeof holder.principal.id).toBe("string");
-				for (const instant of [holder.startsAt, holder.expiresAt]) expect(instant === void 0 || typeof instant === "number" && Number.isFinite(instant)).toBe(true);
-			}
-			const expected = options.expect?.holders?.[`${object.resource}:${object.id}#${object.relation}`];
-			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toEqual([...expected].toSorted());
-		}
+	it("consumes an approved request exactly once", async () => {
+		await store.create(sampleApproval("once-token"));
+		expect(await store.consume("once-token")).toBeNull();
+		await store.resolve("once-token", {
+			status: "approved",
+			by: approver
+		});
+		const [first, second] = await Promise.all([store.consume("once-token"), store.consume("once-token")]);
+		expect([first, second].filter((item) => item !== null)).toHaveLength(1);
+		expect((first ?? second)?.consumedAt).toEqual(expect.any(String));
+		expect(await store.consume("once-token")).toBeNull();
+		expect((await store.get("once-token"))?.consumedAt).toEqual(expect.any(String));
 	});
-	it("follows each link to exactly one instance", async () => {
-		for (const [key, id] of Object.entries(options.expect?.links ?? {})) {
-			const [object, through] = key.split(">");
-			const [resource, objectId] = (object ?? "").split(":");
-			if (resource === void 0 || objectId === void 0 || through === void 0) throw new Error(`expect.links key "${key}" is not resource:id>link.`);
-			const linked = await source.ancestors({
-				resource,
-				id: objectId,
-				through,
-				depth: 1
-			});
-			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
-		}
+	it("refuses an approver from another tenant", async () => {
+		await store.create(tenantApproval("tenant-token", "o_1"));
+		await expect(Promise.resolve().then(() => store.resolve("tenant-token", {
+			status: "approved",
+			by: tenantApprover("o_2")
+		}))).rejects.toThrow(/tenant|eligible/u);
+		expect((await store.get("tenant-token"))?.status).toBe("pending");
 	});
-	it("reads each object's row as an object, or null when there is none", async () => {
-		if (source.row === void 0) return;
-		const read = (query) => source.row?.(query);
-		for (const object of options.objects) {
-			const row = await read({
-				resource: object.resource,
-				id: object.id
-			});
-			expect(row === null || row === void 0 || typeof row === "object" && !Array.isArray(row)).toBe(true);
-		}
-		const missing = await read({
-			resource: options.objects[0]?.resource ?? "",
-			id: "permdock-missing-object"
+	it.skipIf(options.reopen === void 0)("resumes an approval after a restart", async () => {
+		await store.create(sampleApproval("restart-token"));
+		await store.resolve("restart-token", {
+			status: "approved",
+			by: approver
 		});
-		expect(missing ?? null).toBeNull();
-	});
-	it("answers an unknown object with nothing instead of throwing", async () => {
-		const first = options.objects[0];
-		if (first === void 0) return;
-		const missing = {
-			resource: first.resource,
-			id: "permdock-missing-object"
-		};
-		expect((await source.ancestors({
-			...missing,
-			through: "parent",
-			depth: 16
-		})).ancestors).toEqual([]);
-		if (first.relation !== void 0) expect(await source.related({
-			...missing,
-			relation: first.relation
-		})).toEqual([]);
+		const reopened = await options.reopen();
+		expect((await reopened.get("restart-token"))?.status).toBe("approved");
+		expect(await reopened.consume("restart-token")).not.toBeNull();
+		expect(await store.consume("restart-token")).toBeNull();
 	});
-}
-function testEntitlementSource(source, options) {
-	it("returns plan names for a tenant and none without one", async () => {
-		const found = await source.entitlementsFor(options.principal, { tenant: options.tenant });
-		expect(Array.isArray(found)).toBe(true);
-		for (const name of found) expect(typeof name).toBe("string");
-		if (options.expect !== void 0) expect([...found].toSorted()).toEqual([...options.expect].toSorted());
-		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
+	it("creates, gets, lists, resolves and expires", async () => {
+		const request = sampleApproval("opaque-token");
+		await store.create(request);
+		const loaded = await store.get("opaque-token");
+		expect(loaded).toEqual(request);
+		expect(JSON.parse(JSON.stringify(loaded))).toEqual(request);
+		const listed = await store.list({ status: "pending" });
+		expect(listed.items.some((item) => item.token === "opaque-token")).toBe(true);
+		const resolved = await store.resolve("opaque-token", {
+			status: "approved",
+			by: approver
+		});
+		expect(resolved.status).toBe("approved");
+		await expect(Promise.resolve().then(() => store.resolve("opaque-token", {
+			status: "rejected",
+			by: approver
+		}))).rejects.toThrow(/not pending/);
+		await store.create(sampleApproval("stale-token"));
+		const expired = await store.expire(new Date(Date.now() + 72e5));
+		expect(expired).toBeGreaterThanOrEqual(1);
 	});
-}
-function testRoleSource(source, options) {
-	it("only resolves declared role names", async () => {
-		const declared = options.declared.map((item) => typeof item === "string" ? item : item.key);
-		const roles = await source.rolesFor(options.tenant);
-		for (const role of roles) {
-			expect(role.tenant).toBe(options.tenant);
-			for (const included of role.includes ?? []) expect(declared).toContain(included);
-			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toEqual([]);
-		}
-		if (source.assignable !== void 0) {
-			const assignable = await source.assignable(options.tenant);
-			for (const name of assignable) expect(declared).toContain(name);
-		}
+	it("pages list results with limit and an opaque cursor", async () => {
+		const base = Date.parse("2026-01-01T00:00:00.000Z");
+		await Promise.all([
+			"page-a",
+			"page-b",
+			"page-c"
+		].map(async (token, index) => store.create({
+			...sampleApproval(token),
+			subject: { principal: {
+				id: "u_pager",
+				roles: ["member"]
+			} },
+			createdAt: new Date(base + index * 1e3).toISOString()
+		})));
+		const first = await store.list({
+			principalId: "u_pager",
+			limit: 2
+		});
+		expect(first.items.map((item) => item.token)).toEqual(["page-a", "page-b"]);
+		expect(typeof first.next).toBe("string");
+		const second = await store.list({
+			principalId: "u_pager",
+			limit: 2,
+			cursor: first.next
+		});
+		expect(second.items.map((item) => item.token)).toEqual(["page-c"]);
+		expect(second.next).toBeUndefined();
+		expect((await store.list({
+			principalId: "u_pager",
+			cursor: "not a cursor"
+		})).items).toEqual([]);
 	});
-	const every = options.every;
-	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
-		const roles = await source.rolesFor(options.tenant, { held: [] });
-		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
+	it("refuses an approver who does not match request.approvers", async () => {
+		const request = {
+			...sampleApproval("gated-token"),
+			approvers: { by: {
+				kind: "role",
+				role: "admin",
+				scope: "global"
+			} }
+		};
+		await store.create(request);
+		const member = {
+			principal: {
+				id: "u_2",
+				roles: ["member"]
+			},
+			context: {}
+		};
+		await expect(Promise.resolve().then(() => store.resolve("gated-token", {
+			status: "approved",
+			by: member
+		}))).rejects.toThrow(/eligible|not pending|not found/);
 	});
-}
-function testLimitStore(store) {
-	it("counts down synchronously and fails closed when exhausted", async () => {
-		const input = {
-			key: "report.export",
-			subjectId: "u_1",
-			count: 2,
-			per: "hour",
-			now: 17e8
+	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
+		const principal = {
+			principal: {
+				id: "u_1",
+				roles: ["admin"]
+			},
+			context: {}
 		};
-		const first = await store.consume(input);
-		expect(first.remaining).toBeGreaterThanOrEqual(0);
-		const peeked = store.remaining(input);
-		if (peeked !== void 0) {
-			expect(typeof peeked.remaining).toBe("number");
-			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
+		const shapes = [
+			["self-human", void 0],
+			["self-by", { by: admin }],
+			["self-distinct", {
+				by: admin,
+				distinct: true
+			}]
+		];
+		for (const [token, approvers] of shapes) {
+			await store.create(approvers === void 0 ? sampleApproval(token) : {
+				...sampleApproval(token),
+				approvers
+			});
+			await expect(Promise.resolve().then(() => store.resolve(token, {
+				status: "approved",
+				by: principal
+			}))).rejects.toThrow(/principal/u);
+			expect((await store.get(token))?.status).toBe("pending");
 		}
-		await store.consume(input);
-		const exhausted = await store.consume(input);
-		expect(exhausted.remaining).toBeLessThan(0);
+		await store.create({
+			...sampleApproval("self-optout"),
+			approvers: {
+				by: admin,
+				distinct: false
+			}
+		});
+		const resolved = await store.resolve("self-optout", {
+			status: "approved",
+			by: principal
+		});
+		expect(resolved.resolvedBy).toBe("u_1");
 	});
-}
-function testDecisionSink(sink) {
-	it("accepts batches and never propagates write errors", async () => {
-		await expect(Promise.resolve(sink.write([{
-			type: "membership",
-			at: (/* @__PURE__ */ new Date()).toISOString(),
-			source: "app",
-			operation: "changed",
-			principal: { id: "u_1" },
-			roles: {
-				added: ["admin"],
-				removed: ["member"]
+	it("stays pending until the quorum is met and counts an approver once", async () => {
+		await store.create({
+			...sampleApproval("quorum-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
 			}
-		}]))).resolves.toBeUndefined();
-		await expect(Promise.resolve(sink.write([]))).resolves.toBeUndefined();
-		if (sink.flush !== void 0) {
-			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
-			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
-		}
+		});
+		const first = await store.resolve("quorum-token", {
+			status: "approved",
+			by: approver
+		});
+		expect(first.status).toBe("pending");
+		expect(first.approvals).toEqual([{
+			by: "u_9",
+			at: expect.any(String)
+		}]);
+		expect(await store.consume("quorum-token")).toBeNull();
+		await expect(Promise.resolve().then(() => store.resolve("quorum-token", {
+			status: "approved",
+			by: approver
+		}))).rejects.toThrow(/already approved/u);
+		const second = await store.resolve("quorum-token", {
+			status: "approved",
+			by: secondApprover
+		});
+		expect(second.status).toBe("approved");
+		expect(second.approvals?.map((item) => item.by)).toEqual(["u_9", "u_10"]);
+		expect(second.resolvedBy).toBe("u_10");
+		expect(await store.consume("quorum-token")).not.toBeNull();
 	});
-}
-function testSnapshotSource(source) {
-	it("round-trips a snapshot", async () => {
-		const snapshot = await source.get();
-		expect(snapshot === null || snapshot === void 0).toBe(false);
-		if (typeof snapshot === "object" && snapshot !== null && "v" in snapshot) expect(snapshot.v).toBe(1);
-		if (source.subscribe !== void 0) source.subscribe(() => void 0)();
-	});
-}
-function testPolicySource(source, options = {}) {
-	const readCurrent = () => {
-		const document = source.current();
-		expect(document !== null && typeof document === "object" && "then" in document && typeof document.then === "function").toBe(false);
-		return document;
-	};
-	it("returns null or a v1 policy document synchronously", () => {
-		const document = readCurrent();
-		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
-	});
-	it("refreshes without rejecting and keeps current() synchronous", async () => {
-		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
-		const document = readCurrent();
-		if (document !== null) expect(document.v).toBe(1);
-	});
-	if (options.policy !== void 0) {
-		const policy = options.policy;
-		it("merges only grants on hostable permissions", () => {
-			const document = readCurrent();
-			const merged = mergeHostedGrants(policy, document);
-			for (const grant of merged.policy.grants) if (grant.hosted !== void 0) expect(policy.hostable).toContain(grant.permission.key);
-			for (const dropped of merged.dropped) expect(dropped.kind).toBe("hosted-grant-dropped");
+	it("resolves a vouched verdict at once, records its rule, and still refuses the requester", async () => {
+		await store.create({
+			...sampleApproval("vouched-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
 		});
-	}
-}
-function sampleApproval(token) {
-	return {
-		v: 1,
-		token,
-		permission: "post.delete",
-		scope: "post:delete",
-		resource: {
-			type: "post",
-			id: "42"
-		},
-		subject: {
-			principal: {
-				id: "u_1",
-				roles: ["member"]
+		await expect(Promise.resolve().then(() => store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_1",
+					roles: []
+				},
+				context: {}
 			},
-			actor: {
-				id: "agent-1",
-				kind: "eve"
-			}
-		},
-		detail: "post.delete requires human approval.",
-		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-		expiresAt: new Date(Date.now() + 36e5).toISOString(),
-		status: "pending"
-	};
-}
-const approver = {
-	principal: {
-		id: "u_9",
-		roles: ["admin"]
-	},
-	context: {}
-};
-const secondApprover = {
-	principal: {
-		id: "u_10",
-		roles: ["admin"]
-	},
-	context: {}
-};
-const admin = {
-	kind: "role",
-	role: "admin",
-	scope: "global"
-};
-function testReplayStore(store) {
-	it("records a jti after remember and reports it as seen", async () => {
-		const jti = "jti-1";
-		expect(await store.seen(jti)).toBe(false);
-		await store.remember(jti);
-		expect(await store.seen(jti)).toBe(true);
-		expect(await store.seen("jti-2")).toBe(false);
-	});
-	it("forgets a jti whose expiresAt has passed", async () => {
-		await store.remember("ttl-jti", Math.floor(Date.now() / 1e3) - 1);
-		expect(await store.seen("ttl-jti")).toBe(false);
-	});
-	it("claims a key once under concurrency and releases it for a retry", async (context) => {
-		if (store.claim === void 0 || store.release === void 0) {
-			context.skip();
-			return;
-		}
-		const expiresAt = Math.floor(Date.now() / 1e3) + 60;
-		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
-		expect(results.toSorted()).toEqual([false, true]);
-		expect(await store.seen("claim-key")).toBe(true);
-		await store.release("claim-key");
-		expect(await store.claim("claim-key", expiresAt)).toBe(true);
+			vouched: "app-rule"
+		}))).rejects.toThrow(/principal/u);
+		const resolved = await store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_outsider",
+					roles: []
+				},
+				context: {}
+			},
+			vouched: "app-rule"
+		});
+		expect(resolved.status).toBe("approved");
+		expect(resolved.vouched).toBe("app-rule");
+		expect(resolved.approvals).toEqual([{
+			by: "u_outsider",
+			at: expect.any(String),
+			vouched: "app-rule"
+		}]);
 	});
-}
-function testRevocationFeed(feed) {
-	it("delivers each event to every subscriber until it unsubscribes", async () => {
-		const first = [];
-		const second = [];
-		const stopFirst = feed.subscribe((event) => {
-			first.push(event);
+	it("lets one rejection end a quorum request", async () => {
+		await store.create({
+			...sampleApproval("veto-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
 		});
-		const stopSecond = feed.subscribe((event) => {
-			second.push(event);
+		const rejected = await store.resolve("veto-token", {
+			status: "rejected",
+			by: approver
 		});
-		const revoked = {
-			principal: "u-feed",
-			session: "s-feed",
-			kind: "session-revoked"
+		expect(rejected.status).toBe("rejected");
+		expect(rejected.approvals).toBeUndefined();
+	});
+	it("admits the escalation grantee only once the request has waited", async () => {
+		const auditor = {
+			principal: {
+				id: "u_11",
+				roles: ["auditor"]
+			},
+			context: {}
 		};
-		await feed.revoke(revoked);
-		await vi.waitFor(() => {
-			expect(first).toEqual([revoked]);
-			expect(second).toEqual([revoked]);
-		});
-		stopFirst();
-		const changed = {
-			principal: "u-feed",
-			tenant: "t-feed",
-			kind: "changed"
+		const escalation = {
+			after: "1h",
+			to: {
+				kind: "role",
+				role: "auditor",
+				scope: "global"
+			}
 		};
-		await feed.revoke(changed);
-		await vi.waitFor(() => {
-			expect(second).toEqual([revoked, changed]);
+		await store.create({
+			...sampleApproval("fresh-escalation"),
+			approvers: {
+				by: admin,
+				escalation
+			}
 		});
-		expect(first).toEqual([revoked]);
-		stopSecond();
+		await expect(Promise.resolve().then(() => store.resolve("fresh-escalation", {
+			status: "approved",
+			by: auditor
+		}))).rejects.toThrow(/eligible/u);
+		await store.create({
+			...sampleApproval("waited-escalation"),
+			createdAt: (/* @__PURE__ */ new Date(Date.now() - 72e5)).toISOString(),
+			approvers: {
+				by: admin,
+				escalation
+			}
+		});
+		const resolved = await store.resolve("waited-escalation", {
+			status: "approved",
+			by: auditor
+		});
+		expect(resolved.status).toBe("approved");
+		expect(resolved.resolvedBy).toBe("u_11");
 	});
-	it("keeps delivering when a listener throws", async () => {
-		const seen = [];
-		const stopThrowing = feed.subscribe(() => {
-			throw new Error("listener failed");
+	it("completes sequential stages in order and records each stage", async () => {
+		await store.create({
+			...sampleApproval("stages-token"),
+			approvers: {
+				mode: "sequential",
+				stages: [{ by: {
+					kind: "user",
+					id: "u_10"
+				} }, { by: admin }]
+			}
 		});
-		const stop = feed.subscribe((event) => {
-			seen.push(event);
+		await expect(Promise.resolve().then(() => store.resolve("stages-token", {
+			status: "approved",
+			by: approver
+		}))).rejects.toThrow(/eligible/u);
+		const first = await store.resolve("stages-token", {
+			status: "approved",
+			by: secondApprover
 		});
-		const event = {
-			principal: "u-throw",
-			kind: "changed"
-		};
-		await feed.revoke(event);
-		await vi.waitFor(() => {
-			expect(seen).toEqual([event]);
+		expect(first.status).toBe("pending");
+		expect(first.approvals).toEqual([{
+			by: "u_10",
+			at: expect.any(String),
+			stage: 0
+		}]);
+		const second = await store.resolve("stages-token", {
+			status: "approved",
+			by: approver
 		});
-		stopThrowing();
-		stop();
+		expect(second.status).toBe("approved");
+		expect(second.approvals?.map((item) => item.stage)).toEqual([0, 1]);
 	});
-	it("rejects an event without a principal or with an unknown kind", async () => {
-		const seen = [];
-		const stop = feed.subscribe((event) => {
-			seen.push(event);
-		});
-		for (const event of [{
-			principal: "",
-			kind: "changed"
-		}, {
-			principal: "u-bad",
-			kind: "granted"
-		}]) await expect((async () => {
-			await feed.revoke(event);
-		})()).rejects.toThrow(TypeError);
-		expect(seen).toEqual([]);
-		stop();
-	});
-}
-function testDirectoryStore(store, options) {
-	const [home, other] = options.tenants;
-	it("round-trips users and groups, isolates tenants, and drops inactive memberships", async () => {
-		const created = await store.putUser(home, {
-			id: "",
-			userName: "ada",
-			externalId: "00u1",
-			active: true,
-			meta: {
-				created: "",
-				lastModified: ""
-			}
-		});
-		expect(created.id).not.toBe("");
-		expect(await store.getUser(home, created.id)).toMatchObject({
-			userName: "ada",
-			externalId: "00u1"
-		});
-		expect(await store.getUser(other, created.id)).toBeNull();
-		await expect(store.putUser(home, {
-			id: "",
-			userName: "ada",
-			active: true,
-			meta: {
-				created: "",
-				lastModified: ""
-			}
-		})).rejects.toThrow(/userName/);
-		const group = await store.putGroup(home, {
-			id: "g_editors",
-			displayName: "Editors",
-			members: [{ value: created.id }],
-			roles: ["editor"],
-			meta: {
-				created: "",
-				lastModified: ""
-			}
-		});
-		expect(await store.groupsFor(home, created.id)).toEqual([expect.objectContaining({
-			id: group.id,
-			displayName: "Editors"
-		})]);
-		expect(await store.groupsFor(other, created.id)).toEqual([]);
-		const patched = await store.patchUser(home, created.id, [{
-			op: "replace",
-			path: "active",
-			value: false
-		}]);
-		expect(patched.active).toBe(false);
-		const source = directoryMembershipSource(store, { assignable: ["editor"] });
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([]);
-		await store.patchUser(home, created.id, [{
-			op: "replace",
-			path: "active",
-			value: true
-		}]);
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([{
-			tenant: home,
-			roles: ["editor"],
-			via: `group:${group.id}`,
-			managedBy: "idp"
-		}]);
-		await store.patchGroup(home, group.id, [{
-			op: "remove",
-			path: "members",
-			value: [{ value: created.id }]
-		}]);
-		expect(await store.groupsFor(home, created.id)).toEqual([]);
-	});
-	it("ends sessions when scimHandler deactivates a user in this store", async () => {
-		const feed = memoryRevocationFeed();
-		const seen = [];
-		feed.subscribe((event) => {
-			seen.push(event);
-		});
-		const kinds = [];
-		const token = "conformance-scim-token";
-		const handle = scimHandler({
-			store,
-			tenant: home,
-			token: {
-				hash: "sha256",
-				lookup: () => sha256Hex(token)
-			},
-			revocations: feed,
-			onChange: (change) => {
-				kinds.push(change.kind);
-			}
-		});
-		const call = (path, method, body) => handle(new Request(`https://app.example.com/scim/v2${path}`, {
-			method,
-			headers: {
-				authorization: `Bearer ${token}`,
-				"content-type": "application/scim+json"
-			},
-			body: JSON.stringify(body)
-		}));
-		const created = await call("/Users", "POST", {
-			schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
-			userName: "grace",
-			active: true
-		});
-		expect(created.status).toBe(201);
-		const id = String((await created.json()).id);
-		seen.length = 0;
-		const patched = await call(`/Users/${id}`, "PATCH", {
-			schemas: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-			Operations: [{
-				op: "replace",
-				path: "active",
-				value: false
-			}]
-		});
-		expect(patched.status).toBe(200);
-		expect(seen).toContainEqual({
-			principal: "grace",
-			tenant: home,
-			kind: "session-revoked"
-		});
-		expect(seen.every((event) => event.kind === "session-revoked")).toBe(true);
-		expect(kinds).toEqual(["changed", "session-revoked"]);
-	});
-}
-function tenantApproval(token, tenant) {
-	const base = sampleApproval(token);
-	return {
-		...base,
-		subject: {
-			...base.subject,
-			principal: {
-				id: "u_1",
-				roles: ["member"],
-				tenant
-			}
-		}
-	};
-}
-function tenantApprover(tenant) {
-	return {
-		principal: {
-			id: "u_9",
-			roles: [],
-			memberships: [{
-				tenant,
-				roles: ["admin"]
-			}]
-		},
-		context: {}
-	};
-}
-function testApprovalStore(store, options = {}) {
-	it("keeps the existing record when the same call asks again", async () => {
-		await store.create(sampleApproval("dup-token"));
-		await store.resolve("dup-token", {
-			status: "approved",
-			by: approver
-		});
-		await store.create(sampleApproval("dup-token"));
-		expect((await store.get("dup-token"))?.status).toBe("approved");
-	});
-	it("consumes an approved request exactly once", async () => {
-		await store.create(sampleApproval("once-token"));
-		expect(await store.consume("once-token")).toBeNull();
-		await store.resolve("once-token", {
-			status: "approved",
-			by: approver
+	it("matches a relation approver only through the verdict's relations", async () => {
+		const manager = {
+			kind: "relation",
+			resource: "post",
+			relation: "manager"
+		};
+		await store.create({
+			...sampleApproval("relation-token"),
+			approvers: { by: manager }
 		});
-		const [first, second] = await Promise.all([store.consume("once-token"), store.consume("once-token")]);
-		expect([first, second].filter((item) => item !== null)).toHaveLength(1);
-		expect((first ?? second)?.consumedAt).toEqual(expect.any(String));
-		expect(await store.consume("once-token")).toBeNull();
-		expect((await store.get("once-token"))?.consumedAt).toEqual(expect.any(String));
-	});
-	it("refuses an approver from another tenant", async () => {
-		await store.create(tenantApproval("tenant-token", "o_1"));
-		await expect(Promise.resolve().then(() => store.resolve("tenant-token", {
-			status: "approved",
-			by: tenantApprover("o_2")
-		}))).rejects.toThrow(/tenant|eligible/u);
-		expect((await store.get("tenant-token"))?.status).toBe("pending");
-	});
-	it.skipIf(options.reopen === void 0)("resumes an approval after a restart", async () => {
-		await store.create(sampleApproval("restart-token"));
-		await store.resolve("restart-token", {
+		await expect(Promise.resolve().then(() => store.resolve("relation-token", {
 			status: "approved",
 			by: approver
-		});
-		const reopened = await options.reopen();
-		expect((await reopened.get("restart-token"))?.status).toBe("approved");
-		expect(await reopened.consume("restart-token")).not.toBeNull();
-		expect(await store.consume("restart-token")).toBeNull();
-	});
-	it("creates, gets, lists, resolves and expires", async () => {
-		const request = sampleApproval("opaque-token");
-		await store.create(request);
-		const loaded = await store.get("opaque-token");
-		expect(loaded).toEqual(request);
-		expect(JSON.parse(JSON.stringify(loaded))).toEqual(request);
-		const listed = await store.list({ status: "pending" });
-		expect(listed.items.some((item) => item.token === "opaque-token")).toBe(true);
-		const resolved = await store.resolve("opaque-token", {
+		}))).rejects.toThrow(/eligible/u);
+		const resolved = await store.resolve("relation-token", {
 			status: "approved",
-			by: approver
+			by: approver,
+			relations: [JSON.stringify([
+				"post",
+				"manager",
+				null,
+				null
+			])]
 		});
 		expect(resolved.status).toBe("approved");
-		await expect(Promise.resolve().then(() => store.resolve("opaque-token", {
-			status: "rejected",
-			by: approver
-		}))).rejects.toThrow(/not pending/);
-		await store.create(sampleApproval("stale-token"));
-		const expired = await store.expire(new Date(Date.now() + 72e5));
-		expect(expired).toBeGreaterThanOrEqual(1);
 	});
-	it("pages list results with limit and an opaque cursor", async () => {
-		const base = Date.parse("2026-01-01T00:00:00.000Z");
-		await Promise.all([
-			"page-a",
-			"page-b",
-			"page-c"
-		].map(async (token, index) => store.create({
-			...sampleApproval(token),
-			subject: { principal: {
-				id: "u_pager",
-				roles: ["member"]
-			} },
-			createdAt: new Date(base + index * 1e3).toISOString()
-		})));
-		const first = await store.list({
-			principalId: "u_pager",
-			limit: 2
-		});
-		expect(first.items.map((item) => item.token)).toEqual(["page-a", "page-b"]);
-		expect(typeof first.next).toBe("string");
-		const second = await store.list({
-			principalId: "u_pager",
-			limit: 2,
-			cursor: first.next
+}
+/**
+* Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
+* queried tenant or to none, and every entry loads against `policy` (an
+* entry that does not would deny every call).
+*/
+function testApprovalPolicySource(source, options) {
+	it("answers per tenant with plain entries that load against the policy", async () => {
+		const entries = await source.approvalPoliciesFor({ tenants: [options.tenant] });
+		expect(Array.isArray(entries)).toBe(true);
+		for (const entry of entries) {
+			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect([void 0, options.tenant]).toContain(entry.tenant);
+		}
+		const loaded = await approvalPoliciesFor(options.policy, source, [options.tenant], []);
+		expect(loaded).not.toBe("failed");
+		const other = await source.approvalPoliciesFor({ tenants: [options.unknown ?? "__permdock_unknown__"] });
+		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
+	});
+}
+//#endregion
+//#region src/testing/conformance/where.ts
+const WHERE_ROWS = [
+	{
+		id: "r1",
+		authorId: "u1",
+		score: 5,
+		title: "Plan 100%",
+		archived: false,
+		note: null
+	},
+	{
+		id: "r2",
+		authorId: "u2",
+		score: 10,
+		title: "plan_b",
+		archived: true,
+		note: "kept"
+	},
+	{
+		id: "r3",
+		authorId: null,
+		score: null,
+		title: null,
+		archived: null,
+		note: null
+	}
+];
+const WHERE_CASES = [
+	["eq", {
+		op: "eq",
+		field: "authorId",
+		value: "u1"
+	}],
+	["ne", {
+		op: "ne",
+		field: "authorId",
+		value: "u1"
+	}],
+	["eq on a boolean", {
+		op: "eq",
+		field: "archived",
+		value: false
+	}],
+	["gt", {
+		op: "gt",
+		field: "score",
+		value: 5
+	}],
+	["gte", {
+		op: "gte",
+		field: "score",
+		value: 5
+	}],
+	["lt", {
+		op: "lt",
+		field: "score",
+		value: 10
+	}],
+	["lte", {
+		op: "lte",
+		field: "score",
+		value: 10
+	}],
+	["contains a literal %", {
+		op: "contains",
+		field: "title",
+		value: "100%"
+	}],
+	["contains a literal _", {
+		op: "contains",
+		field: "title",
+		value: "n_b"
+	}],
+	["in", {
+		op: "in",
+		field: "authorId",
+		value: ["u1", "u2"]
+	}],
+	["notIn", {
+		op: "notIn",
+		field: "authorId",
+		value: ["u1"]
+	}],
+	["isNull", {
+		op: "isNull",
+		field: "note",
+		value: true
+	}],
+	["is not null", {
+		op: "isNull",
+		field: "note",
+		value: false
+	}],
+	["and", {
+		op: "and",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "lt",
+			field: "score",
+			value: 10
+		}]
+	}],
+	["or", {
+		op: "or",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "eq",
+			field: "archived",
+			value: true
+		}]
+	}],
+	["not over a NULL field", {
+		op: "not",
+		condition: {
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}
+	}],
+	["not over and", {
+		op: "not",
+		condition: {
+			op: "and",
+			conditions: [{
+				op: "eq",
+				field: "authorId",
+				value: "u2"
+			}, {
+				op: "gt",
+				field: "score",
+				value: 5
+			}]
+		}
+	}],
+	["and of nothing", {
+		op: "and",
+		conditions: []
+	}],
+	["not of the empty allow set", {
+		op: "not",
+		condition: {
+			op: "or",
+			conditions: []
+		}
+	}]
+];
+const WHERE_SUBJECT = {
+	principal: null,
+	context: {}
+};
+/**
+* `matches` answers whether the compiled output selects `row`, for example
+* by running it against a table holding only that row. With it, every case
+* must select the rows the in-memory evaluator keeps, including rows whose
+* fields are NULL.
+*/
+function testWhereCompiler(compiler, options) {
+	const { matches } = options;
+	it.skipIf(matches === void 0).each(WHERE_CASES)("selects the rows the evaluator keeps: %s", async (_name, condition) => {
+		if (matches === void 0) return;
+		const compiled = compiler(condition, options.target);
+		const selected = [];
+		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
+		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
+	});
+	it("fails closed on an empty allow set", () => {
+		const compiled = compiler({
+			op: "or",
+			conditions: []
+		}, options.target);
+		const closed = options.isFailClosed === void 0 ? compiled === false || compiled === void 0 || compiled === null : options.isFailClosed(compiled);
+		expect(closed).toBe(true);
+	});
+	it("compiles a sqlFunction through its twin", () => {
+		const twin = {
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		};
+		expect(() => compiler({
+			op: "sqlFunction",
+			name: "job_permitted",
+			args: [{ field: "id" }],
+			twin
+		}, options.target)).not.toThrow();
+	});
+}
+//#endregion
+//#region src/testing/jwt-fixtures.ts
+const jwtFixtureJwks = { keys: [{
+	crv: "Ed25519",
+	x: "79ab4WR6Eb9LkefWpmh5ZlvjXg7wqVGNMwIEHQqduIQ",
+	kty: "OKP",
+	kid: "2026-09",
+	alg: "Ed25519",
+	use: "sig"
+}] };
+const jwtFixtureIssuer = "https://login.example.com";
+const jwtFixtureAudience = "https://api.example.com";
+const jwtFixtureTokens = {
+	valid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJjbGllbnRfaWQiOiJhcHAiLCJyb2xlcyI6WyJtZW1iZXIiXSwianRpIjoianRpLXZhbGlkIiwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5leGFtcGxlLmNvbSIsImF1ZCI6Imh0dHBzOi8vYXBpLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjIwMDAwMDAwMDB9.ENFMmLSyVde-2s4Gdz4iP7srZvU0Xuy_ZLz-OJGHD_-W1lEayEBeSPTnab0L_TBdj8p5BmkFrT-7VE7o20GbAw",
+	expired: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjEwMDAwMDAwMDAsImV4cCI6MTEwMDAwMDAwMH0.9X3d6kH3_2nmrbqMxuoxzFW-wsWJVCe-lR-aQ-MmsGGXlEUBMgQ-4MtAq1UR9lLE0h2b5JrE_GfjzuC04h5xCg",
+	wrongAud: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9vdGhlci5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.PgWdzi56J31OwoMqH4ysHzVKSKUDhi-AtHFUp1ewFzi-qGE-tknzrNKnKhDOncVzj0okb_flyy3vQgfzJwG5AQ",
+	wrongIss: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2V2aWwuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.tIcLHLa9JLtKz1gqjRGdr5DFbUzRDs5KsoPsJCxspvbBcsFfRFG2G0XJnd1h4QHyZ_5B4OhY3W_jIIsnOPD9Bg",
+	unknownKid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoibm9wZSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MjAwMDAwMDAwMH0.walgG5GvpCVBnkMtkdw-epi5c93JqfvAM_N4EWR9Tqhiw_cnzITnlQyoVfihECmV1fqtFrhwM1RCIRJvd38zAQ",
+	none: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJleHAiOjIwMDAwMDAwMDAsImlhdCI6MTcwMDAwMDAwMH0.",
+	snapshot: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLXNuYXBzaG90K2p3dCJ9.eyJzbmFwc2hvdCI6eyJ2IjoyLCJpc3N1ZWRBdCI6MTcwMDAwMDAwMCwic3ViamVjdCI6eyJwcmluY2lwYWwiOnsiaWQiOiJ1XzEiLCJyb2xlcyI6WyJtZW1iZXIiXX0sImNvbnRleHQiOnt9fSwicm9sZXMiOlsibWVtYmVyIl0sImdyYW50cyI6W10sInRlbmFudHMiOltdfSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJzbmFwX2ZpeHR1cmUifQ.4itaYctluoCwU-syytUxArtS_FRyNAti2SZxuSH-nKIMr7-Sb3h1Q3xugn_vPR1eupV4fVNIe6dH27_EiyDvCA",
+	approval: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWFwcHJvdmFsK2p3dCJ9.eyJhcHByb3ZhbCI6eyJ0b2tlbiI6InBkMS5hYmMiLCJwZXJtaXNzaW9uIjoicG9zdC5kZWxldGUiLCJyZXNvdXJjZSI6eyJ0eXBlIjoicG9zdCIsImlkIjoiNDIifSwic3RhdHVzIjoiYXBwcm92ZWQifSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJhcHJfZml4dHVyZSJ9.UHsoSzQCo68G7ee-EFqdzMLvmqaKlFIMdQKFuqZEM4yUQnJsJJTXbld_aCXcyfN-IdjF9cj2F5EHzsV4nLKbBg",
+	decisions: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWRlY2lzaW9ucytqd3QifQ.eyJldmVudHMiOltdLCJpc3MiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJkZWNfZml4dHVyZSJ9.UZhJd72yFGxHOdjYbzcGYUPgYjvLwOPCtHKxEbLu56SdKSKUDCREXmEBI9WaCPKWjlTBnnIKMYwjG8I8RATJCg"
+};
+//#endregion
+//#region src/testing/conformance/credentials.ts
+function testReplayStore(store) {
+	it("records a jti after remember and reports it as seen", async () => {
+		const jti = "jti-1";
+		expect(await store.seen(jti)).toBe(false);
+		await store.remember(jti);
+		expect(await store.seen(jti)).toBe(true);
+		expect(await store.seen("jti-2")).toBe(false);
+	});
+	it("forgets a jti whose expiresAt has passed", async () => {
+		await store.remember("ttl-jti", Math.floor(Date.now() / 1e3) - 1);
+		expect(await store.seen("ttl-jti")).toBe(false);
+	});
+	it("claims a key once under concurrency and releases it for a retry", async (context) => {
+		if (store.claim === void 0 || store.release === void 0) {
+			context.skip();
+			return;
+		}
+		const expiresAt = Math.floor(Date.now() / 1e3) + 60;
+		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
+		expect(results.toSorted()).toEqual([false, true]);
+		expect(await store.seen("claim-key")).toBe(true);
+		await store.release("claim-key");
+		expect(await store.claim("claim-key", expiresAt)).toBe(true);
+	});
+}
+function testRevocationFeed(feed) {
+	it("delivers each event to every subscriber until it unsubscribes", async () => {
+		const first = [];
+		const second = [];
+		const stopFirst = feed.subscribe((event) => {
+			first.push(event);
 		});
-		expect(second.items.map((item) => item.token)).toEqual(["page-c"]);
-		expect(second.next).toBeUndefined();
-		expect((await store.list({
-			principalId: "u_pager",
-			cursor: "not a cursor"
-		})).items).toEqual([]);
+		const stopSecond = feed.subscribe((event) => {
+			second.push(event);
+		});
+		const revoked = {
+			principal: "u-feed",
+			session: "s-feed",
+			kind: "session-revoked"
+		};
+		await feed.revoke(revoked);
+		await vi.waitFor(() => {
+			expect(first).toEqual([revoked]);
+			expect(second).toEqual([revoked]);
+		});
+		stopFirst();
+		const changed = {
+			principal: "u-feed",
+			tenant: "t-feed",
+			kind: "changed"
+		};
+		await feed.revoke(changed);
+		await vi.waitFor(() => {
+			expect(second).toEqual([revoked, changed]);
+		});
+		expect(first).toEqual([revoked]);
+		stopSecond();
 	});
-	it("refuses an approver who does not match request.approvers", async () => {
-		const request = {
-			...sampleApproval("gated-token"),
-			approvers: { by: {
-				kind: "role",
-				role: "admin",
-				scope: "global"
-			} }
+	it("keeps delivering when a listener throws", async () => {
+		const seen = [];
+		const stopThrowing = feed.subscribe(() => {
+			throw new Error("listener failed");
+		});
+		const stop = feed.subscribe((event) => {
+			seen.push(event);
+		});
+		const event = {
+			principal: "u-throw",
+			kind: "changed"
 		};
-		await store.create(request);
-		const member = {
-			principal: {
-				id: "u_2",
-				roles: ["member"]
+		await feed.revoke(event);
+		await vi.waitFor(() => {
+			expect(seen).toEqual([event]);
+		});
+		stopThrowing();
+		stop();
+	});
+	it("rejects an event without a principal or with an unknown kind", async () => {
+		const seen = [];
+		const stop = feed.subscribe((event) => {
+			seen.push(event);
+		});
+		for (const event of [{
+			principal: "",
+			kind: "changed"
+		}, {
+			principal: "u-bad",
+			kind: "granted"
+		}]) await expect((async () => {
+			await feed.revoke(event);
+		})()).rejects.toThrow(TypeError);
+		expect(seen).toEqual([]);
+		stop();
+	});
+}
+function decodeHeader(token) {
+	const [encoded] = token.split(".");
+	if (encoded === void 0) return {};
+	const padded = encoded.replaceAll("-", "+").replaceAll("_", "/");
+	const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+	return JSON.parse(atob(`${padded}${pad}`));
+}
+function testTokenVerifier(verifier, options) {
+	const audience = options?.audience ?? "https://api.example.com";
+	const issuer = options?.issuer ?? "https://login.example.com";
+	it("never throws and maps the JWT behaviour table", async () => {
+		const valid = await verifier.verify(jwtFixtureTokens.valid, {
+			audience,
+			issuer
+		});
+		expect(valid.ok).toBe(true);
+		if (valid.ok) {
+			expect(valid.claims.sub).toBe("u_1");
+			expect(valid.header.alg).toBe("Ed25519");
+		}
+		const rows = [
+			{
+				token: jwtFixtureTokens.none,
+				cause: "alg-none"
 			},
-			context: {}
-		};
-		await expect(Promise.resolve().then(() => store.resolve("gated-token", {
-			status: "approved",
-			by: member
-		}))).rejects.toThrow(/eligible|not pending|not found/);
+			{
+				token: jwtFixtureTokens.expired,
+				cause: "expired"
+			},
+			{
+				token: jwtFixtureTokens.wrongAud,
+				cause: "wrong-audience"
+			},
+			{
+				token: jwtFixtureTokens.wrongIss,
+				cause: "wrong-issuer"
+			},
+			{
+				token: jwtFixtureTokens.unknownKid,
+				cause: "unknown-kid"
+			},
+			{
+				token: "not-a-jwt",
+				cause: "malformed"
+			},
+			{
+				token: "a.b.c.d.e",
+				cause: "encrypted-token"
+			}
+		];
+		for (const row of rows) {
+			let result;
+			try {
+				result = await verifier.verify(row.token, {
+					audience,
+					issuer
+				});
+			} catch {
+				throw new Error("TokenVerifier must not throw");
+			}
+			expect(result.ok).toBe(false);
+			if (!result.ok) expect(result.cause).toBe(row.cause);
+		}
+	});
+}
+function flipLast(value) {
+	const last = value.at(-1);
+	return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
+}
+/**
+* `key` is a live key the verifier knows, or a function issuing one (called
+* once). `revoke`, when given, revokes it; the runner then expects the key
+* to stop verifying.
+*/
+function testCredentialVerifier(verifier, options) {
+	let issued;
+	const live = () => {
+		const source = options.key;
+		issued ??= Promise.resolve(typeof source === "string" ? source : source());
+		return issued;
+	};
+	it("verifies the live key to a v1 credential with the key id", async () => {
+		const key = await live();
+		const parts = parseApiKey(key);
+		expect(parts).toBeDefined();
+		const credential = parseCredential(await verifier.verify(key));
+		expect(credential).toBeDefined();
+		expect(credential?.id).toBe(parts?.id);
+		expect(parseCredential(await verifier.verify(key))).toEqual(credential);
 	});
-	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
-		const principal = {
-			principal: {
-				id: "u_1",
-				roles: ["admin"]
-			},
-			context: {}
-		};
-		const shapes = [
-			["self-human", void 0],
-			["self-by", { by: admin }],
-			["self-distinct", {
-				by: admin,
-				distinct: true
-			}]
+	it("never throws and answers null for every other key", async () => {
+		const key = await live();
+		const parts = parseApiKey(key);
+		const others = [
+			"",
+			"garbage",
+			"pdk_",
+			`${key}x`,
+			flipLast(key),
+			`pdk_${parts?.id ?? "x"}-other_${parts?.secret ?? ""}`,
+			key.replace(/^pdk_/u, "sk_")
 		];
-		for (const [token, approvers] of shapes) {
-			await store.create(approvers === void 0 ? sampleApproval(token) : {
-				...sampleApproval(token),
-				approvers
-			});
-			await expect(Promise.resolve().then(() => store.resolve(token, {
-				status: "approved",
-				by: principal
-			}))).rejects.toThrow(/principal/u);
-			expect((await store.get(token))?.status).toBe("pending");
-		}
-		await store.create({
-			...sampleApproval("self-optout"),
-			approvers: {
-				by: admin,
-				distinct: false
+		for (const other of others) {
+			let result;
+			try {
+				result = await verifier.verify(other);
+			} catch {
+				throw new Error("CredentialVerifier must not throw");
 			}
-		});
-		const resolved = await store.resolve("self-optout", {
-			status: "approved",
-			by: principal
-		});
-		expect(resolved.resolvedBy).toBe("u_1");
+			expect(result).toBeNull();
+		}
 	});
-	it("stays pending until the quorum is met and counts an approver once", async () => {
-		await store.create({
-			...sampleApproval("quorum-token"),
-			approvers: {
-				by: admin,
-				quorum: 2
-			}
-		});
-		const first = await store.resolve("quorum-token", {
-			status: "approved",
-			by: approver
-		});
-		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
-			by: "u_9",
-			at: expect.any(String)
-		}]);
-		expect(await store.consume("quorum-token")).toBeNull();
-		await expect(Promise.resolve().then(() => store.resolve("quorum-token", {
-			status: "approved",
-			by: approver
-		}))).rejects.toThrow(/already approved/u);
-		const second = await store.resolve("quorum-token", {
-			status: "approved",
-			by: secondApprover
-		});
-		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.by)).toEqual(["u_9", "u_10"]);
-		expect(second.resolvedBy).toBe("u_10");
-		expect(await store.consume("quorum-token")).not.toBeNull();
+	if (verifier.touch !== void 0) it("accepts a touch without changing what the key verifies to", async () => {
+		const key = await live();
+		const before = parseCredential(await verifier.verify(key));
+		const id = parseApiKey(key)?.id ?? "";
+		await verifier.touch?.(id, Math.floor(Date.now() / 1e3));
+		await verifier.touch?.("unknown-id", Math.floor(Date.now() / 1e3));
+		expect(parseCredential(await verifier.verify(key))).toEqual(before);
 	});
-	it("resolves a vouched verdict at once, records its rule, and still refuses the requester", async () => {
-		await store.create({
-			...sampleApproval("vouched-token"),
-			approvers: {
-				by: admin,
-				quorum: 2
-			}
-		});
-		await expect(Promise.resolve().then(() => store.resolve("vouched-token", {
-			status: "approved",
-			by: {
-				principal: {
-					id: "u_1",
-					roles: []
-				},
-				context: {}
-			},
-			vouched: "app-rule"
-		}))).rejects.toThrow(/principal/u);
-		const resolved = await store.resolve("vouched-token", {
-			status: "approved",
-			by: {
-				principal: {
-					id: "u_outsider",
-					roles: []
-				},
-				context: {}
-			},
-			vouched: "app-rule"
+	if (options.revoke !== void 0) {
+		const revoke = options.revoke;
+		it("stops verifying a revoked key", async () => {
+			const key = await live();
+			await revoke();
+			expect(await verifier.verify(key)).toBeNull();
 		});
-		expect(resolved.status).toBe("approved");
-		expect(resolved.vouched).toBe("app-rule");
-		expect(resolved.approvals).toEqual([{
-			by: "u_outsider",
-			at: expect.any(String),
-			vouched: "app-rule"
-		}]);
-	});
-	it("lets one rejection end a quorum request", async () => {
-		await store.create({
-			...sampleApproval("veto-token"),
-			approvers: {
-				by: admin,
-				quorum: 2
-			}
+	}
+}
+function testTokenSigner(signer, options) {
+	it("emits compact JWS with only alg, kid and typ", async () => {
+		const token = await signer.sign({
+			snapshot: { v: 1 },
+			sub: "u_1"
+		}, {
+			typ: "permdock-snapshot+jwt",
+			audience: "https://app.example.com"
 		});
-		const rejected = await store.resolve("veto-token", {
-			status: "rejected",
-			by: approver
+		const header = decodeHeader(token);
+		expect(Object.keys(header).toSorted()).toEqual([
+			"alg",
+			"kid",
+			"typ"
+		]);
+		expect(header["typ"]).toBe("permdock-snapshot+jwt");
+		expect(header["alg"]).not.toBe("none");
+		const verified = await options.verifier.verify(token, {
+			typ: "permdock-snapshot+jwt",
+			audience: "https://app.example.com"
 		});
-		expect(rejected.status).toBe("rejected");
-		expect(rejected.approvals).toBeUndefined();
+		expect(verified.ok).toBe(true);
+		if (signer.jwks !== void 0) {
+			const jwks = await signer.jwks();
+			expect(jwks.keys.length).toBeGreaterThan(0);
+			expect(jwks.keys[0]).not.toHaveProperty("d");
+		}
 	});
-	it("admits the escalation grantee only once the request has waited", async () => {
-		const auditor = {
-			principal: {
-				id: "u_11",
-				roles: ["auditor"]
-			},
-			context: {}
-		};
-		const escalation = {
-			after: "1h",
-			to: {
-				kind: "role",
-				role: "auditor",
-				scope: "global"
-			}
+}
+//#endregion
+//#region src/testing/conformance/runtime-stores.ts
+function testLimitStore(store) {
+	it("counts down synchronously and fails closed when exhausted", async () => {
+		const input = {
+			key: "report.export",
+			subjectId: "u_1",
+			count: 2,
+			per: "hour",
+			now: 17e8
 		};
-		await store.create({
-			...sampleApproval("fresh-escalation"),
-			approvers: {
-				by: admin,
-				escalation
+		const first = await store.consume(input);
+		expect(first.remaining).toBeGreaterThanOrEqual(0);
+		const peeked = store.remaining(input);
+		if (peeked !== void 0) {
+			expect(typeof peeked.remaining).toBe("number");
+			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
+		}
+		await store.consume(input);
+		const exhausted = await store.consume(input);
+		expect(exhausted.remaining).toBeLessThan(0);
+	});
+}
+function testDecisionSink(sink) {
+	it("accepts batches and never propagates write errors", async () => {
+		await expect(Promise.resolve(sink.write([{
+			type: "membership",
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			source: "app",
+			operation: "changed",
+			principal: { id: "u_1" },
+			roles: {
+				added: ["admin"],
+				removed: ["member"]
 			}
+		}]))).resolves.toBeUndefined();
+		await expect(Promise.resolve(sink.write([]))).resolves.toBeUndefined();
+		if (sink.flush !== void 0) {
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+		}
+	});
+}
+function testSnapshotSource(source) {
+	it("round-trips a snapshot", async () => {
+		const snapshot = await source.get();
+		expect(snapshot === null || snapshot === void 0).toBe(false);
+		if (typeof snapshot === "object" && snapshot !== null && "v" in snapshot) expect(snapshot.v).toBe(1);
+		if (source.subscribe !== void 0) source.subscribe(() => void 0)();
+	});
+}
+function testPolicySource(source, options = {}) {
+	const readCurrent = () => {
+		const document = source.current();
+		expect(document !== null && typeof document === "object" && "then" in document && typeof document.then === "function").toBe(false);
+		return document;
+	};
+	it("returns null or a v1 policy document synchronously", () => {
+		const document = readCurrent();
+		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+	});
+	it("refreshes without rejecting and keeps current() synchronous", async () => {
+		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
+		const document = readCurrent();
+		if (document !== null) expect(document.v).toBe(1);
+	});
+	if (options.policy !== void 0) {
+		const policy = options.policy;
+		it("merges only grants on hostable permissions", () => {
+			const document = readCurrent();
+			const merged = mergeHostedGrants(policy, document);
+			for (const grant of merged.policy.grants) if (grant.hosted !== void 0) expect(policy.hostable).toContain(grant.permission.key);
+			for (const dropped of merged.dropped) expect(dropped.kind).toBe("hosted-grant-dropped");
 		});
-		await expect(Promise.resolve().then(() => store.resolve("fresh-escalation", {
-			status: "approved",
-			by: auditor
-		}))).rejects.toThrow(/eligible/u);
-		await store.create({
-			...sampleApproval("waited-escalation"),
-			createdAt: (/* @__PURE__ */ new Date(Date.now() - 72e5)).toISOString(),
-			approvers: {
-				by: admin,
-				escalation
+	}
+}
+//#endregion
+//#region src/testing/conformance/relations.ts
+function holderKey(holder) {
+	return "group" in holder ? `${holder.group.resource}:${holder.group.id}#${holder.group.relation}` : holder.principal.id;
+}
+/**
+* A `RelationSource` answers facts only: well-formed chains nearest first and
+* no longer than `depth`, holders with principal ids or group references and
+* numeric instants, a `truncated` chain only when more ancestors exist, and
+* empty answers (never a throw) for an object it does not know. `expect` pins
+* the chains, holders and links for `objects`, keyed `resource:id`,
+* `resource:id#relation` and `resource:id>link`; a group holder is written
+* `resource:id#relation`.
+*/
+function testRelationSource(source, options) {
+	it("returns chains nearest first, within depth, and truncated only when more exist", async () => {
+		for (const object of options.objects) {
+			const full = await source.ancestors({
+				resource: object.resource,
+				id: object.id,
+				through: "parent",
+				depth: 32
+			});
+			expect(Array.isArray(full.ancestors)).toBe(true);
+			for (const ancestor of full.ancestors) {
+				expect(typeof ancestor.id).toBe("string");
+				expect(ancestor.id).not.toBe("");
 			}
-		});
-		const resolved = await store.resolve("waited-escalation", {
-			status: "approved",
-			by: auditor
-		});
-		expect(resolved.status).toBe("approved");
-		expect(resolved.resolvedBy).toBe("u_11");
+			expect(full.ancestors.length).toBeLessThanOrEqual(32);
+			const expected = options.expect?.ancestors?.[`${object.resource}:${object.id}`];
+			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toEqual(expected);
+			if (full.ancestors.length > 1) {
+				const short = await source.ancestors({
+					resource: object.resource,
+					id: object.id,
+					through: "parent",
+					depth: 1
+				});
+				expect(short.ancestors.map((ancestor) => ancestor.id)).toEqual([full.ancestors[0]?.id]);
+				expect(short.truncated).toBe(true);
+			}
+			const none = await source.ancestors({
+				resource: object.resource,
+				id: object.id,
+				through: "parent",
+				depth: 0
+			});
+			expect(none.ancestors).toEqual([]);
+		}
 	});
-	it("completes sequential stages in order and records each stage", async () => {
-		await store.create({
-			...sampleApproval("stages-token"),
-			approvers: {
-				mode: "sequential",
-				stages: [{ by: {
-					kind: "user",
-					id: "u_10"
-				} }, { by: admin }]
+	it("returns well-formed holders", async () => {
+		for (const object of options.objects) {
+			if (object.relation === void 0) continue;
+			const holders = await source.related({
+				resource: object.resource,
+				id: object.id,
+				relation: object.relation
+			});
+			expect(Array.isArray(holders)).toBe(true);
+			for (const holder of holders) {
+				if ("group" in holder) for (const part of [
+					holder.group.resource,
+					holder.group.id,
+					holder.group.relation
+				]) {
+					expect(typeof part).toBe("string");
+					expect(part).not.toBe("");
+				}
+				else expect(typeof holder.principal.id).toBe("string");
+				for (const instant of [holder.startsAt, holder.expiresAt]) expect(instant === void 0 || typeof instant === "number" && Number.isFinite(instant)).toBe(true);
 			}
+			const expected = options.expect?.holders?.[`${object.resource}:${object.id}#${object.relation}`];
+			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toEqual([...expected].toSorted());
+		}
+	});
+	it("follows each link to exactly one instance", async () => {
+		for (const [key, id] of Object.entries(options.expect?.links ?? {})) {
+			const [object, through] = key.split(">");
+			const [resource, objectId] = (object ?? "").split(":");
+			if (resource === void 0 || objectId === void 0 || through === void 0) throw new Error(`expect.links key "${key}" is not resource:id>link.`);
+			const linked = await source.ancestors({
+				resource,
+				id: objectId,
+				through,
+				depth: 1
+			});
+			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
+		}
+	});
+	it("reads each object's row as an object, or null when there is none", async () => {
+		if (source.row === void 0) return;
+		const read = (query) => source.row?.(query);
+		for (const object of options.objects) {
+			const row = await read({
+				resource: object.resource,
+				id: object.id
+			});
+			expect(row === null || row === void 0 || typeof row === "object" && !Array.isArray(row)).toBe(true);
+		}
+		const missing = await read({
+			resource: options.objects[0]?.resource ?? "",
+			id: "permdock-missing-object"
 		});
-		await expect(Promise.resolve().then(() => store.resolve("stages-token", {
-			status: "approved",
-			by: approver
-		}))).rejects.toThrow(/eligible/u);
-		const first = await store.resolve("stages-token", {
-			status: "approved",
-			by: secondApprover
-		});
-		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
-			by: "u_10",
-			at: expect.any(String),
-			stage: 0
-		}]);
-		const second = await store.resolve("stages-token", {
-			status: "approved",
-			by: approver
-		});
-		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.stage)).toEqual([0, 1]);
+		expect(missing ?? null).toBeNull();
 	});
-	it("matches a relation approver only through the verdict's relations", async () => {
-		const manager = {
-			kind: "relation",
-			resource: "post",
-			relation: "manager"
+	it("answers an unknown object with nothing instead of throwing", async () => {
+		const first = options.objects[0];
+		if (first === void 0) return;
+		const missing = {
+			resource: first.resource,
+			id: "permdock-missing-object"
 		};
-		await store.create({
-			...sampleApproval("relation-token"),
-			approvers: { by: manager }
-		});
-		await expect(Promise.resolve().then(() => store.resolve("relation-token", {
-			status: "approved",
-			by: approver
-		}))).rejects.toThrow(/eligible/u);
-		const resolved = await store.resolve("relation-token", {
-			status: "approved",
-			by: approver,
-			relations: [JSON.stringify([
-				"post",
-				"manager",
-				null,
-				null
-			])]
-		});
-		expect(resolved.status).toBe("approved");
+		expect((await source.ancestors({
+			...missing,
+			through: "parent",
+			depth: 16
+		})).ancestors).toEqual([]);
+		if (first.relation !== void 0) expect(await source.related({
+			...missing,
+			relation: first.relation
+		})).toEqual([]);
 	});
 }
-function decodeHeader(token) {
-	const [encoded] = token.split(".");
-	if (encoded === void 0) return {};
-	const padded = encoded.replaceAll("-", "+").replaceAll("_", "/");
-	const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
-	return JSON.parse(atob(`${padded}${pad}`));
-}
-function testTokenVerifier(verifier, options) {
-	const audience = options?.audience ?? "https://api.example.com";
-	const issuer = options?.issuer ?? "https://login.example.com";
-	it("never throws and maps the JWT behaviour table", async () => {
-		const valid = await verifier.verify(jwtFixtureTokens.valid, {
-			audience,
-			issuer
-		});
-		expect(valid.ok).toBe(true);
-		if (valid.ok) {
-			expect(valid.claims.sub).toBe("u_1");
-			expect(valid.header.alg).toBe("Ed25519");
-		}
-		const rows = [
-			{
-				token: jwtFixtureTokens.none,
-				cause: "alg-none"
-			},
-			{
-				token: jwtFixtureTokens.expired,
-				cause: "expired"
-			},
-			{
-				token: jwtFixtureTokens.wrongAud,
-				cause: "wrong-audience"
-			},
-			{
-				token: jwtFixtureTokens.wrongIss,
-				cause: "wrong-issuer"
-			},
-			{
-				token: jwtFixtureTokens.unknownKid,
-				cause: "unknown-kid"
-			},
-			{
-				token: "not-a-jwt",
-				cause: "malformed"
-			},
-			{
-				token: "a.b.c.d.e",
-				cause: "encrypted-token"
-			}
-		];
-		for (const row of rows) {
-			let result;
+//#endregion
+//#region src/testing/conformance/identity.ts
+function testSubjectResolver(resolver, options) {
+	it("never throws and fails closed to anonymous", async () => {
+		let result;
+		try {
+			result = await resolver(options.invalid);
+		} catch {
+			throw new Error("SubjectResolver must not throw");
+		}
+		expect(result.principal).toBeNull();
+	});
+}
+function testMembershipSource(source, options) {
+	const query = options.tenant === void 0 ? {} : { tenant: options.tenant };
+	it("returns well-formed memberships and fails closed on throw", async () => {
+		for (const principal of options.principals) {
+			let memberships = [];
 			try {
-				result = await verifier.verify(row.token, {
-					audience,
-					issuer
-				});
+				memberships = await source.membershipsFor(principal, query);
 			} catch {
-				throw new Error("TokenVerifier must not throw");
+				memberships = [];
 			}
-			expect(result.ok).toBe(false);
-			if (!result.ok) expect(result.cause).toBe(row.cause);
+			for (const membership of memberships) {
+				const shapes = [
+					membership.scope !== void 0,
+					membership.tenant !== void 0 || membership.team !== void 0,
+					membership.on !== void 0
+				].filter(Boolean);
+				expect(shapes.length).toBe(1);
+				expect(Array.isArray(membership.roles)).toBe(true);
+				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
+			}
+			const expected = options.expect?.[principal.id];
+			if (expected !== void 0) expect(memberships).toEqual(expected);
 		}
 	});
-}
-/** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
-function testSettingsSource(source, options) {
-	it("answers per tenant with plain settings and nothing for an unknown tenant", async () => {
-		const settings = await source.settingsFor(options.tenant);
-		if (settings !== void 0) {
-			expect(typeof settings).toBe("object");
-			const credentials = settings.credentials;
-			if (credentials !== void 0) {
-				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
-				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service")).toBe(true);
+	if (source.list !== void 0) it("lists every member of an instance it returns a membership for", async () => {
+		for (const principal of options.principals) {
+			let memberships = [];
+			try {
+				memberships = await source.membershipsFor(principal, query);
+			} catch {
+				continue;
+			}
+			for (const membership of memberships) {
+				if (membership.scope === void 0 || membership.id === void 0) continue;
+				const members = await source.list?.({
+					scope: membership.scope,
+					id: membership.id
+				}) ?? [];
+				expect(members.some((entry) => entry.principal.id === principal.id && entry.membership.scope === membership.scope && entry.membership.id === membership.id)).toBe(true);
 			}
-			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
 		}
-		expect(await source.settingsFor(options.unknown ?? "__permdock_unknown__")).toBeUndefined();
 	});
-}
-/**
-* Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
-* queried tenant or to none, and every entry loads against `policy` (an
-* entry that does not would deny every call).
-*/
-function testApprovalPolicySource(source, options) {
-	it("answers per tenant with plain entries that load against the policy", async () => {
-		const entries = await source.approvalPoliciesFor({ tenants: [options.tenant] });
-		expect(Array.isArray(entries)).toBe(true);
-		for (const entry of entries) {
-			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
-			expect([void 0, options.tenant]).toContain(entry.tenant);
+	if (source.version !== void 0) it("reports a finite version or none", async () => {
+		for (const principal of options.principals) {
+			const version = await source.version?.({ id: principal.id });
+			expect(version === void 0 || typeof version === "number" && Number.isFinite(version)).toBe(true);
 		}
-		const loaded = await approvalPoliciesFor(options.policy, source, [options.tenant], []);
-		expect(loaded).not.toBe("failed");
-		const other = await source.approvalPoliciesFor({ tenants: [options.unknown ?? "__permdock_unknown__"] });
-		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
 	});
 }
-function flipLast(value) {
-	const last = value.at(-1);
-	return `${value.slice(0, -1)}${last === "A" ? "B" : "A"}`;
-}
-/**
-* `key` is a live key the verifier knows, or a function issuing one (called
-* once). `revoke`, when given, revokes it; the runner then expects the key
-* to stop verifying.
-*/
-function testCredentialVerifier(verifier, options) {
-	let issued;
-	const live = () => {
-		const source = options.key;
-		issued ??= Promise.resolve(typeof source === "string" ? source : source());
-		return issued;
-	};
-	it("verifies the live key to a v1 credential with the key id", async () => {
-		const key = await live();
-		const parts = parseApiKey(key);
-		expect(parts).toBeDefined();
-		const credential = parseCredential(await verifier.verify(key));
-		expect(credential).toBeDefined();
-		expect(credential?.id).toBe(parts?.id);
-		expect(parseCredential(await verifier.verify(key))).toEqual(credential);
+function testEntitlementSource(source, options) {
+	it("returns plan names for a tenant and none without one", async () => {
+		const found = await source.entitlementsFor(options.principal, { tenant: options.tenant });
+		expect(Array.isArray(found)).toBe(true);
+		for (const name of found) expect(typeof name).toBe("string");
+		if (options.expect !== void 0) expect([...found].toSorted()).toEqual([...options.expect].toSorted());
+		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
 	});
-	it("never throws and answers null for every other key", async () => {
-		const key = await live();
-		const parts = parseApiKey(key);
-		const others = [
-			"",
-			"garbage",
-			"pdk_",
-			`${key}x`,
-			flipLast(key),
-			`pdk_${parts?.id ?? "x"}-other_${parts?.secret ?? ""}`,
-			key.replace(/^pdk_/u, "sk_")
-		];
-		for (const other of others) {
-			let result;
-			try {
-				result = await verifier.verify(other);
-			} catch {
-				throw new Error("CredentialVerifier must not throw");
-			}
-			expect(result).toBeNull();
+}
+function testRoleSource(source, options) {
+	it("only resolves declared role names", async () => {
+		const declared = options.declared.map((item) => typeof item === "string" ? item : item.key);
+		const roles = await source.rolesFor(options.tenant);
+		for (const role of roles) {
+			expect(role.tenant).toBe(options.tenant);
+			for (const included of role.includes ?? []) expect(declared).toContain(included);
+			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toEqual([]);
+		}
+		if (source.assignable !== void 0) {
+			const assignable = await source.assignable(options.tenant);
+			for (const name of assignable) expect(declared).toContain(name);
 		}
 	});
-	if (verifier.touch !== void 0) it("accepts a touch without changing what the key verifies to", async () => {
-		const key = await live();
-		const before = parseCredential(await verifier.verify(key));
-		const id = parseApiKey(key)?.id ?? "";
-		await verifier.touch?.(id, Math.floor(Date.now() / 1e3));
-		await verifier.touch?.("unknown-id", Math.floor(Date.now() / 1e3));
-		expect(parseCredential(await verifier.verify(key))).toEqual(before);
+	const every = options.every;
+	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
+		const roles = await source.rolesFor(options.tenant, { held: [] });
+		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
 	});
-	if (options.revoke !== void 0) {
-		const revoke = options.revoke;
-		it("stops verifying a revoked key", async () => {
-			const key = await live();
-			await revoke();
-			expect(await verifier.verify(key)).toBeNull();
+}
+function testDirectoryStore(store, options) {
+	const [home, other] = options.tenants;
+	it("round-trips users and groups, isolates tenants, and drops inactive memberships", async () => {
+		const created = await store.putUser(home, {
+			id: "",
+			userName: "ada",
+			externalId: "00u1",
+			active: true,
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		});
+		expect(created.id).not.toBe("");
+		expect(await store.getUser(home, created.id)).toMatchObject({
+			userName: "ada",
+			externalId: "00u1"
+		});
+		expect(await store.getUser(other, created.id)).toBeNull();
+		await expect(store.putUser(home, {
+			id: "",
+			userName: "ada",
+			active: true,
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		})).rejects.toThrow(/userName/);
+		const group = await store.putGroup(home, {
+			id: "g_editors",
+			displayName: "Editors",
+			members: [{ value: created.id }],
+			roles: ["editor"],
+			meta: {
+				created: "",
+				lastModified: ""
+			}
+		});
+		expect(await store.groupsFor(home, created.id)).toEqual([expect.objectContaining({
+			id: group.id,
+			displayName: "Editors"
+		})]);
+		expect(await store.groupsFor(other, created.id)).toEqual([]);
+		const patched = await store.patchUser(home, created.id, [{
+			op: "replace",
+			path: "active",
+			value: false
+		}]);
+		expect(patched.active).toBe(false);
+		const source = directoryMembershipSource(store, { assignable: ["editor"] });
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([]);
+		await store.patchUser(home, created.id, [{
+			op: "replace",
+			path: "active",
+			value: true
+		}]);
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([{
+			tenant: home,
+			roles: ["editor"],
+			via: `group:${group.id}`,
+			managedBy: "idp"
+		}]);
+		await store.patchGroup(home, group.id, [{
+			op: "remove",
+			path: "members",
+			value: [{ value: created.id }]
+		}]);
+		expect(await store.groupsFor(home, created.id)).toEqual([]);
+	});
+	it("ends sessions when scimHandler deactivates a user in this store", async () => {
+		const feed = memoryRevocationFeed();
+		const seen = [];
+		feed.subscribe((event) => {
+			seen.push(event);
+		});
+		const kinds = [];
+		const token = "conformance-scim-token";
+		const handle = scimHandler({
+			store,
+			tenant: home,
+			token: {
+				hash: "sha256",
+				lookup: () => sha256Hex(token)
+			},
+			revocations: feed,
+			onChange: (change) => {
+				kinds.push(change.kind);
+			}
+		});
+		const call = (path, method, body) => handle(new Request(`https://app.example.com/scim/v2${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/scim+json"
+			},
+			body: JSON.stringify(body)
+		}));
+		const created = await call("/Users", "POST", {
+			schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
+			userName: "grace",
+			active: true
 		});
-	}
-}
-function testTokenSigner(signer, options) {
-	it("emits compact JWS with only alg, kid and typ", async () => {
-		const token = await signer.sign({
-			snapshot: { v: 1 },
-			sub: "u_1"
-		}, {
-			typ: "permdock-snapshot+jwt",
-			audience: "https://app.example.com"
+		expect(created.status).toBe(201);
+		const id = String((await created.json()).id);
+		seen.length = 0;
+		const patched = await call(`/Users/${id}`, "PATCH", {
+			schemas: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+			Operations: [{
+				op: "replace",
+				path: "active",
+				value: false
+			}]
 		});
-		const header = decodeHeader(token);
-		expect(Object.keys(header).toSorted()).toEqual([
-			"alg",
-			"kid",
-			"typ"
-		]);
-		expect(header["typ"]).toBe("permdock-snapshot+jwt");
-		expect(header["alg"]).not.toBe("none");
-		const verified = await options.verifier.verify(token, {
-			typ: "permdock-snapshot+jwt",
-			audience: "https://app.example.com"
+		expect(patched.status).toBe(200);
+		expect(seen).toContainEqual({
+			principal: "grace",
+			tenant: home,
+			kind: "session-revoked"
 		});
-		expect(verified.ok).toBe(true);
-		if (signer.jwks !== void 0) {
-			const jwks = await signer.jwks();
-			expect(jwks.keys.length).toBeGreaterThan(0);
-			expect(jwks.keys[0]).not.toHaveProperty("d");
-		}
+		expect(seen.every((event) => event.kind === "session-revoked")).toBe(true);
+		expect(kinds).toEqual(["changed", "session-revoked"]);
 	});
 }
-const WHERE_ROWS = [
-	{
-		id: "r1",
-		authorId: "u1",
-		score: 5,
-		title: "Plan 100%",
-		archived: false,
-		note: null
-	},
-	{
-		id: "r2",
-		authorId: "u2",
-		score: 10,
-		title: "plan_b",
-		archived: true,
-		note: "kept"
-	},
-	{
-		id: "r3",
-		authorId: null,
-		score: null,
-		title: null,
-		archived: null,
-		note: null
-	}
-];
-const WHERE_CASES = [
-	["eq", {
-		op: "eq",
-		field: "authorId",
-		value: "u1"
-	}],
-	["ne", {
-		op: "ne",
-		field: "authorId",
-		value: "u1"
-	}],
-	["eq on a boolean", {
-		op: "eq",
-		field: "archived",
-		value: false
-	}],
-	["gt", {
-		op: "gt",
-		field: "score",
-		value: 5
-	}],
-	["gte", {
-		op: "gte",
-		field: "score",
-		value: 5
-	}],
-	["lt", {
-		op: "lt",
-		field: "score",
-		value: 10
-	}],
-	["lte", {
-		op: "lte",
-		field: "score",
-		value: 10
-	}],
-	["contains a literal %", {
-		op: "contains",
-		field: "title",
-		value: "100%"
-	}],
-	["contains a literal _", {
-		op: "contains",
-		field: "title",
-		value: "n_b"
-	}],
-	["in", {
-		op: "in",
-		field: "authorId",
-		value: ["u1", "u2"]
-	}],
-	["notIn", {
-		op: "notIn",
-		field: "authorId",
-		value: ["u1"]
-	}],
-	["isNull", {
-		op: "isNull",
-		field: "note",
-		value: true
-	}],
-	["is not null", {
-		op: "isNull",
-		field: "note",
-		value: false
-	}],
-	["and", {
-		op: "and",
-		conditions: [{
-			op: "eq",
-			field: "authorId",
-			value: "u1"
-		}, {
-			op: "lt",
-			field: "score",
-			value: 10
-		}]
-	}],
-	["or", {
-		op: "or",
-		conditions: [{
-			op: "eq",
-			field: "authorId",
-			value: "u1"
-		}, {
-			op: "eq",
-			field: "archived",
-			value: true
-		}]
-	}],
-	["not over a NULL field", {
-		op: "not",
-		condition: {
-			op: "eq",
-			field: "authorId",
-			value: "u1"
-		}
-	}],
-	["not over and", {
-		op: "not",
-		condition: {
-			op: "and",
-			conditions: [{
-				op: "eq",
-				field: "authorId",
-				value: "u2"
-			}, {
-				op: "gt",
-				field: "score",
-				value: 5
-			}]
-		}
-	}],
-	["and of nothing", {
-		op: "and",
-		conditions: []
-	}],
-	["not of the empty allow set", {
-		op: "not",
-		condition: {
-			op: "or",
-			conditions: []
+/** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
+function testSettingsSource(source, options) {
+	it("answers per tenant with plain settings and nothing for an unknown tenant", async () => {
+		const settings = await source.settingsFor(options.tenant);
+		if (settings !== void 0) {
+			expect(typeof settings).toBe("object");
+			const credentials = settings.credentials;
+			if (credentials !== void 0) {
+				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
+				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service")).toBe(true);
+			}
+			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
 		}
-	}]
-];
-const WHERE_SUBJECT = {
-	principal: null,
-	context: {}
-};
-/**
-* `matches` answers whether the compiled output selects `row`, for example
-* by running it against a table holding only that row. With it, every case
-* must select the rows the in-memory evaluator keeps, including rows whose
-* fields are NULL.
-*/
-function testWhereCompiler(compiler, options) {
-	const { matches } = options;
-	it.skipIf(matches === void 0).each(WHERE_CASES)("selects the rows the evaluator keeps: %s", async (_name, condition) => {
-		if (matches === void 0) return;
-		const compiled = compiler(condition, options.target);
-		const selected = [];
-		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
-		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
-	});
-	it("fails closed on an empty allow set", () => {
-		const compiled = compiler({
-			op: "or",
-			conditions: []
-		}, options.target);
-		const closed = options.isFailClosed === void 0 ? compiled === false || compiled === void 0 || compiled === null : options.isFailClosed(compiled);
-		expect(closed).toBe(true);
-	});
-	it("compiles a sqlFunction through its twin", () => {
-		const twin = {
-			op: "eq",
-			field: "authorId",
-			value: "u1"
-		};
-		expect(() => compiler({
-			op: "sqlFunction",
-			name: "job_permitted",
-			args: [{ field: "id" }],
-			twin
-		}, options.target)).not.toThrow();
+		expect(await source.settingsFor(options.unknown ?? "__permdock_unknown__")).toBeUndefined();
 	});
 }
 //#endregion