permdock 0.4.0 → 0.6.0

package/dist/testing/index.js

@@ -1,24 +1,44 @@
-import { r as principal } from "../refs-f3imMjNW.js";
-import { n as role, r as allow, u as memoryLimitStore } from "../role-builder-B4GbKM-i.js";
-import { c as snapshotFor, g as memoryRoleSource, s as definePermissions } from "../src-Bb7no-hS.js";
+import { t as require__2020 } from "../2020-C9VN-x8c.js";
+import { r as isRecord } from "../compact-CAf557ZB.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { r as principal } from "../refs-K6eWUJ0H.js";
+import { n as role, r as allow } from "../role-builder-uWQZ4v84.js";
+import { E as memoryCustomRoleSource, _ as limits, s as snapshotFor, v as memoryLimitStore, x as approvalPoliciesFor } from "../src-Cu2m75uo.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { a as normalizeMemberships, d as scopeList } from "../scopes-tvpa34ep.js";
-import { _ as evaluateCondition, n as parseSnapshot } from "../snapshot-Dc9CHPME.js";
-import { _ as resource, c as listPermissions } from "../permission-registry-BsblpB-z.js";
-import { i as parsePolicyDocument, o as definePolicy, r as mergeHostedGrants } from "../hosted-CBHgkzDl.js";
-import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-L26udHSk.js";
+import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-pHneukrx.js";
+import { _ as resource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
+import { r as parseAutomation } from "../automation-DVjOckjV.js";
+import { a as normalizeMemberships, d as scopeList } from "../scopes-CUPSjo9q.js";
+import { u as evaluateCondition } from "../delegation-j6-rc37o.js";
+import { a as authenticated } from "../grantee-hxrUsbpM.js";
+import { n as definePolicy } from "../policy-DbM5YYtV.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { n as fromSnapshot } from "../from-snapshot-7REQZe0H.js";
-import { o as parseCredential } from "../credential-kue0qpbm.js";
-import { s as problemFromDecision } from "../problem-CnWraVhC.js";
-import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-ILkLUj_o.js";
-import { o as resolveApproval } from "../helpers-C9YmyBIa.js";
-import { a as parseApiKey } from "../server-ZYEHtNHS.js";
-import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-vFR1O5oG.js";
+import { a as mergeHostedGrants, o as parsePolicyDocument } from "../hosted-B46-5LYE.js";
+import { t as definePermissions } from "../permissions-B-wCP5ZC.js";
+import { C as validateCustomRole, y as membershipsClaim } from "../evaluate-CNClBvcj.js";
+import { n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
+import { n as fromSnapshot } from "../from-snapshot-CTCMsFZk.js";
+import { t as getPermDock } from "../permdock-BrAscV28.js";
+import { t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
+import { i as memoryApprovalStore } from "../store-BDutJkDL.js";
+import { t as catalogFingerprint } from "../catalog-fingerprint-CCP0-yQS.js";
+import { s as parseCredential } from "../credential-BcoiejpY.js";
+import { s as problemFromDecision } from "../problem-CTviyH5L.js";
+import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
+import { t as catalogSchema } from "../schema-B4v0Qrac.js";
+import { c as parseApiKey } from "../server-C3WXAHZj.js";
+import { n as discoverAuthorizationServer } from "../device-BARQ8eYG.js";
+import { T as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-ClHtpyV3.js";
+import { a as approverHeaders, r as cloudEndpoints, t as cloud } from "../create-CQWIpUG-.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as quoteSqlIdent, s as quoteSqlTable, t as SQL_IDENT } from "../sql-t8teWOfo.js";
-import { i as saasPermissions } from "../permissions-CCJ6lmxB.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DtaA4JuW.js";
+import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "../sql-B5T1IL83.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-C0kK_8V0.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
+import { i as saasPermissions } from "../permissions-BPxlwVhN.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-BCXRuXca.js";
+import { t as POLICY_NOT_PUBLISHED } from "../problem-types-CJ2325SZ.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
 function isOutcomeCell(value) {
@@ -51,7 +71,7 @@ function describePolicy(policy, config) {
 		const permissions = listPermissions(policy.permissions);
 		const permdocks = /* @__PURE__ */ new Map();
 		beforeAll(async () => {
-			for (const [name, user] of Object.entries(config.subjects)) permdocks.set(name, await createPermDock(policy, user, config.options));
+			for (const [name, user] of Object.entries(config.subjects)) permdocks.set(name, await getPermDock(policy, user, config.options));
 		});
 		it("covers every permission", () => {
 			if (config.exhaustive === false) return;
@@ -63,7 +83,7 @@ function describePolicy(policy, config) {
 			describe(permission.key, () => {
 				if (!Object.values(spec).some((value) => !isOutcomeCell(value))) {
 					for (const [subjectName, cell] of Object.entries(spec)) it(`${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await createPermDock(policy, config.subjects[subjectName], config.options);
+						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
 						const data = permission.kind === "instance" ? Object.values(config.fixtures ?? {})[0] : void 0;
 						assertCell(instance.decide(permission, data), cell);
 						assertDeniedBy(instance, permission, data, cell);
@@ -74,7 +94,7 @@ function describePolicy(policy, config) {
 				for (const [fixtureName, row] of Object.entries(spec)) {
 					if (isOutcomeCell(row)) continue;
 					for (const [subjectName, cell] of Object.entries(row)) it(`${fixtureName} / ${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await createPermDock(policy, config.subjects[subjectName], config.options);
+						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
 						const fixture = config.fixtures?.[fixtureName];
 						assertCell(instance.decide(permission, fixture), cell);
 						assertDeniedBy(instance, permission, fixture, cell);
@@ -145,14 +165,13 @@ function statementSql(action, table, keyOnly) {
 	const quoted = quoteSqlTable(table);
 	const id = quoteSqlIdent("id");
 	const back = keyOnly ? id : "*";
-	switch (action) {
-		case "read":
-		case "list":
-		case "get": return `select ${back} from ${quoted} where ${id} = $1`;
+	const command = defaultSqlCommand(action) ?? "select";
+	switch (command) {
+		case "select": return `select ${back} from ${quoted} where ${id} = $1`;
 		case "update": return `update ${quoted} set ${id} = ${id} where ${id} = $1 returning ${back}`;
-		case "create": return `insert into ${quoted} (${id}) values ($1) returning ${back}`;
+		case "insert": return `insert into ${quoted} (${id}) values ($1) returning ${back}`;
 		case "delete": return `delete from ${quoted} where ${id} = $1 returning ${back}`;
-		default: return `select ${back} from ${quoted} where ${id} = $1`;
+		default: return command;
 	}
 }
 function valued(row) {
@@ -177,7 +196,7 @@ function dbOutcome(result) {
 	if (result.code === "42501") return "rejected";
 	return (result.rowCount ?? result.rows.length) > 0 ? "allowed" : "filtered";
 }
-async function rlsParity(policy, options) {
+async function testRlsParity(policy, options) {
 	const dialect = options.dialect ?? "guc";
 	const gucPrefix = options.gucPrefix ?? "app";
 	const tenantClaim = options.tenantClaim ?? "tenant_id";
@@ -186,12 +205,12 @@ async function rlsParity(policy, options) {
 	const customRoles = options.customRoles ?? [];
 	const scopes = scopeList(policy.scopes);
 	async function runCase(fixture) {
-		const permdock = await createPermDock(policy, toSubject(fixture.subject), { customRoles: memoryRoleSource(customRoles) });
+		const permdock = await getPermDock(policy, toSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
 		const granted = fixture.permission.kind === "collection" ? permdock.can(fixture.permission, fixture.row) : permdock.can(fixture.permission, fixture.row);
 		let fromClient;
 		if (options.snapshot === true) {
 			const snapshot = permdock.snapshot();
-			if (typeof snapshot !== "object" || snapshot instanceof Promise) throw new TypeError("PermDock: rlsParity needs an unsigned snapshot");
+			if (typeof snapshot !== "object" || snapshot instanceof Promise) throw new TypeError("PermDock: testRlsParity needs an unsigned snapshot");
 			fromClient = fromSnapshot(parseSnapshot(JSON.stringify(snapshot))).can(fixture.permission, fixture.row);
 		}
 		await options.query("begin");
@@ -251,11 +270,11 @@ function subsetOf(small, large) {
 * A partial `where()` (a closure grant it cannot compile) may be refused or
 * return fewer rows, never more.
 */
-async function ormParity(policy, scenarios, options) {
+async function testOrmParity(policy, scenarios, options) {
 	const idField = options.id ?? "id";
 	async function runCase(scenario) {
-		const permdock = await createPermDock(policy, scenario.user, scenario.options);
-		if (scenario.options?.relations !== void 0) await permdock.loadRelations(scenario.permission, scenario.rows);
+		const permdock = await getPermDock(policy, scenario.user, scenario.options);
+		if (scenario.options?.relations !== void 0) await permdock.prefetchRelations(scenario.permission, scenario.rows);
 		const expected = sortedIds(permdock.filter(scenario.permission, scenario.rows).map((row) => row[idField]));
 		const where = permdock.where(scenario.permission);
 		try {
@@ -292,7 +311,7 @@ async function ormParity(policy, scenarios, options) {
 //#endregion
 //#region src/testing/client-parity.ts
 async function outcomes(policy, entry, options) {
-	const server = await createPermDock(policy, entry.user, {
+	const server = await getPermDock(policy, entry.user, {
 		...entry.tenant === void 0 ? {} : { tenant: entry.tenant },
 		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles }
 	});
@@ -317,6 +336,31 @@ function testClientParity(policy, cases, options = {}) {
 	});
 }
 //#endregion
+//#region src/testing/legacy-parity.ts
+/**
+* Asserts that the policy answers each case as the application's legacy
+* check does, or as the case's `expect` says where the difference is
+* intended. Run it before enforcing a permission with `shadowMode`.
+*/
+function testLegacyParity(policy, legacy, cases) {
+	for (const entry of cases) it(`legacy parity: ${entry.name}`, async () => {
+		const permdock = await getPermDock(policy, entry.user);
+		const ours = permdock.can(entry.permission, entry.row);
+		const theirs = legacy({
+			permission: entry.permission,
+			data: entry.row,
+			subject: permdock.subject
+		});
+		expect({
+			permission: entry.permission.key,
+			granted: ours
+		}).toEqual({
+			permission: entry.permission.key,
+			granted: entry.expect ?? theirs
+		});
+	});
+}
+//#endregion
 //#region src/testing/client-store.ts
 const p = saasPermissions;
 function snapshotOf(user, tenant, tenants) {
@@ -344,7 +388,7 @@ function leadSnapshot() {
 		]
 	});
 }
-function json(value, status = 200) {
+function json$1(value, status = 200) {
 	return new Response(JSON.stringify(value), {
 		status,
 		headers: { "content-type": "application/json" }
@@ -391,7 +435,7 @@ function stubVerifier(tokens) {
 			claims: { snapshot },
 			header: {
 				alg: "ES256",
-				typ: "permdock-snapshot+jwt"
+				typ: "vnd.permdock.snapshot+jwt"
 			}
 		});
 	} };
@@ -442,7 +486,7 @@ function testClientStore(name, createStore) {
 		});
 		it("fetches another tenant with one query string and commits it only on success", async () => {
 			let fail = true;
-			const net = recorder(() => fail ? json({ error: "down" }, 503) : json(snapshotOf("erin", "globex")));
+			const net = recorder(() => fail ? json$1({ error: "down" }, 503) : json$1(snapshotOf("erin", "globex")));
 			const store = createStore({
 				snapshot: snapshotOf("erin", "acme"),
 				snapshotUrl: "/api/snapshot?v=1",
@@ -471,7 +515,7 @@ function testClientStore(name, createStore) {
 			});
 			const pending = store.get().refresh();
 			expect(store.get().status()).toBe("pending");
-			gate.resolve(json(snapshotOf("erin", "acme")));
+			gate.resolve(json$1(snapshotOf("erin", "acme")));
 			await pending;
 			expect(store.get().status()).toBe("ready");
 		});
@@ -486,7 +530,7 @@ function testClientStore(name, createStore) {
 			});
 			const pending = store.get().refresh();
 			store.get().clear();
-			gate.resolve(json(snapshotOf("erin", "acme")));
+			gate.resolve(json$1(snapshotOf("erin", "acme")));
 			await pending;
 			await settle();
 			expect(store.get().subject.principal).toBeNull();
@@ -504,7 +548,7 @@ function testClientStore(name, createStore) {
 			});
 			const pending = store.get().refresh({ tenant: "globex" });
 			store.replace(snapshotOf("bob", "acme"));
-			gate.resolve(json(snapshotOf("erin", "globex")));
+			gate.resolve(json$1(snapshotOf("erin", "globex")));
 			await pending;
 			await settle();
 			expect(store.get().subject.principal?.id).toBe("bob");
@@ -516,7 +560,7 @@ function testClientStore(name, createStore) {
 			const store = createStore({
 				snapshot: {
 					...snapshotOf("erin", "acme"),
-					expiresAt: 1
+					expiresAt: "1970-01-01T00:00:01.000Z"
 				},
 				tenant: "acme",
 				fetch: net.fetch
@@ -557,7 +601,7 @@ function testClientStore(name, createStore) {
 				snapshot: seed,
 				snapshotUrl: "/api/snapshot",
 				tenant: "acme",
-				fetch: recorder(() => json(next)).fetch,
+				fetch: recorder(() => json$1(next)).fetch,
 				verifier: stubVerifier(/* @__PURE__ */ new Map([[seed, snapshotOf("erin", "acme")], [next, snapshotOf("erin", "globex")]]))
 			});
 			await settle();
@@ -569,7 +613,7 @@ function testClientStore(name, createStore) {
 		it("caches endpoint answers per tenant and settles the store status", async () => {
 			const net = recorder((call) => {
 				const body = call.body;
-				return json({ evaluations: body.evaluations.map(() => ({
+				return json$1({ evaluations: body.evaluations.map(() => ({
 					decision: false,
 					context: { permdock: denied() }
 				})) });
@@ -600,7 +644,7 @@ function testClientStore(name, createStore) {
 		it("forgets endpoint answers when a new snapshot arrives", async () => {
 			const net = recorder((call) => {
 				const body = call.body;
-				return json({ evaluations: body.evaluations.map(() => ({
+				return json$1({ evaluations: body.evaluations.map(() => ({
 					decision: false,
 					context: { permdock: denied() }
 				})) });
@@ -677,7 +721,7 @@ function testClientStore(name, createStore) {
 			}
 		});
 		it("does not notify subscribers synchronously from a status read", () => {
-			const net = recorder(() => json({ evaluations: [] }));
+			const net = recorder(() => json$1({ evaluations: [] }));
 			const store = createStore({
 				snapshot: snapshotOf("gina", "acme"),
 				endpoint: "/api/permdock",
@@ -696,7 +740,7 @@ function testClientStore(name, createStore) {
 //#endregion
 //#region src/testing/snapshot-fixture.ts
 async function snapshotFixture(policy, subject, options = {}) {
-	const instance = await createPermDock(policy, subject, options.tenant === void 0 ? {} : { tenant: options.tenant });
+	const instance = await getPermDock(policy, subject, options.tenant === void 0 ? {} : { tenant: options.tenant });
 	const target = options.simulated === true ? instance.simulate({}) : instance;
 	if (Array.isArray(target)) throw new Error("PermDock: snapshotFixture expected a PermDock instance");
 	const snapshot = options.include === void 0 && options.tenants === void 0 ? target.snapshot() : target.snapshot({
@@ -744,7 +788,7 @@ async function* ticks(org, signal) {
 function demotionKey(user, org) {
 	return JSON.stringify([user, org]);
 }
-function createDomain$1() {
+function createDomain$2() {
 	const demoted = /* @__PURE__ */ new Set();
 	const principalOf = (sub, path) => {
 		const principal = saasPrincipal(sub, orgOf(path));
@@ -777,14 +821,14 @@ function createDomain$1() {
 			};
 		},
 		org: orgOf,
-		customRoles: memoryRoleSource(saasCustomRoles),
+		customRoles: memoryCustomRoleSource(saasCustomRoles),
 		store: memoryApprovalStore(),
-		limits: memoryLimitStore(),
+		limits: limits(memoryLimitStore()),
 		project: (id) => id === void 0 ? null : saasSeed.projects.find((row) => row.id === id) ?? null
 	};
 }
 async function approverSubject(user, tenant) {
-	return (await createPermDock(saasPolicy, saasPrincipal(user, tenant), { tenant })).subject;
+	return (await getPermDock(saasPolicy, saasPrincipal(user, tenant), { tenant })).subject;
 }
 //#endregion
 //#region src/testing/http-adapter/wire.ts
@@ -991,7 +1035,7 @@ function testHttpAdapter(options) {
 		it.skipIf(reason !== void 0)(reason === void 0 ? title : `${title} (${reason})`, run, timeout);
 	};
 	describe(`${options.name}: real-life HTTP scenarios`, () => {
-		const domain = createDomain$1();
+		const domain = createDomain$2();
 		const tokens = /* @__PURE__ */ new Map();
 		let mounted;
 		beforeAll(async () => {
@@ -1168,7 +1212,7 @@ function testHttpAdapter(options) {
 			});
 			expect(denied.status).toBe(403);
 			expect(field(denied.body, "type")).toBe("https://permdock.com/problems/denied");
-			const bob = await createPermDock(saasPolicy, saasPrincipal("bob", "acme"), { tenant: "acme" });
+			const bob = await getPermDock(saasPolicy, saasPrincipal("bob", "acme"), { tenant: "acme" });
 			const permission = saasPolicy.permissions.project.delete;
 			const fromProtect = await readResult(problemFromDecision(bob.decide(permission, project$1("p2")), permission, bob.subject));
 			expect(denied.status).toBe(fromProtect.status);
@@ -1304,7 +1348,7 @@ function testHttpAdapter(options) {
 				});
 				const end = await untilEnd(stream);
 				expect(end.problem).toMatchObject({
-					type: "https://permdock.com/problems/unauthenticated",
+					type: "about:blank",
 					status: 401,
 					detail: "session-revoked"
 				});
@@ -1364,7 +1408,7 @@ function testHttpAdapter(options) {
 				expect((await stream.next())?.event).toBe("message");
 				const end = await untilEnd(stream);
 				expect(end.problem).toMatchObject({
-					type: "https://permdock.com/problems/unauthenticated",
+					type: "about:blank",
 					detail: "expired"
 				});
 				expect(end.ended).toBe(true);
@@ -1470,12 +1514,12 @@ const SCENARIOS = [
 		expected: "approval-required"
 	}
 ];
-function loadProject(args) {
+function loadProject$1(args) {
 	const id = typeof args === "object" && args !== null ? args.id : void 0;
 	if (id === "throws") throw new Error("project store unavailable");
 	return saasSeed.projects.find((row) => row.id === id) ?? null;
 }
-function createDomain() {
+function createDomain$1() {
 	return {
 		policy: saasPolicy,
 		subject: (user, org) => {
@@ -1485,11 +1529,11 @@ function createDomain() {
 		tools: {
 			project_read: {
 				permission: saasPermissions.project.read,
-				data: loadProject
+				data: loadProject$1
 			},
 			api_keys_revoke_all: { permission: saasPermissions.apiKey.revokeAll }
 		},
-		customRoles: memoryRoleSource(saasCustomRoles),
+		customRoles: memoryCustomRoleSource(saasCustomRoles),
 		store: memoryApprovalStore()
 	};
 }
@@ -1499,7 +1543,7 @@ function createDomain() {
 */
 function testAgentAdapter(options) {
 	describe(`${options.name}: agent adapter scenarios`, () => {
-		const domain = createDomain();
+		const domain = createDomain$1();
 		let mounted;
 		beforeAll(async () => {
 			mounted = await options.mount(domain);
@@ -1517,12 +1561,201 @@ function testAgentAdapter(options) {
 	});
 }
 //#endregion
+//#region src/testing/agent-runtime.ts
+const alice = {
+	user: "alice",
+	org: "acme"
+};
+const erin = {
+	user: "erin",
+	org: "globex"
+};
+const mallory = {
+	user: "mallory",
+	org: "acme"
+};
+const OPERATIONS = [
+	{
+		name: "granted",
+		title: "grants a member reading a project in their org",
+		context: alice,
+		operation: "project_read",
+		input: { id: "p1" },
+		expected: "granted"
+	},
+	{
+		name: "denied",
+		title: "denies a user with no membership",
+		context: mallory,
+		operation: "project_read",
+		input: { id: "p1" },
+		expected: "denied"
+	},
+	{
+		name: "cross-tenant",
+		title: "denies a row from another org",
+		context: alice,
+		operation: "project_read",
+		input: { id: "g1" },
+		expected: "denied"
+	},
+	{
+		name: "anonymous",
+		title: "denies a call with no user",
+		context: {
+			user: null,
+			org: "acme"
+		},
+		operation: "project_read",
+		input: { id: "p1" },
+		expected: "denied"
+	},
+	{
+		name: "subject-throws",
+		title: "denies when the subject resolver throws",
+		context: {
+			user: AGENT_THROWING_USER,
+			org: "acme"
+		},
+		operation: "project_read",
+		input: { id: "p1" },
+		expected: "denied"
+	},
+	{
+		name: "loader-throws",
+		title: "denies when the row loader throws",
+		context: alice,
+		operation: "project_read",
+		input: { id: AGENT_THROWING_ROW },
+		expected: "denied"
+	},
+	{
+		name: "missing-row",
+		title: "denies when the row does not exist",
+		context: alice,
+		operation: "project_read",
+		input: { id: "missing" },
+		expected: "denied"
+	},
+	{
+		name: "approval-required",
+		title: "asks for approval before revoking every API key",
+		context: alice,
+		operation: "api_keys_revoke_all",
+		input: {},
+		expected: "approval-required"
+	},
+	{
+		name: "unmapped-operation",
+		title: "denies an operation the map does not name",
+		context: alice,
+		operation: "drop_database",
+		input: {},
+		expected: "denied"
+	}
+];
+function loadProject(args) {
+	const id = typeof args === "object" && args !== null ? args.id : void 0;
+	if (id === "throws") throw new Error("project store unavailable");
+	return saasSeed.projects.find((row) => row.id === id) ?? null;
+}
+function createDomain() {
+	return {
+		policy: saasPolicy,
+		subject: (user, org) => {
+			if (user === "throws") throw new Error("session store unavailable");
+			return user === null ? null : saasPrincipal(user, org);
+		},
+		operations: {
+			project_read: {
+				permission: saasPermissions.project.read,
+				data: loadProject
+			},
+			project_search: {
+				permission: saasPermissions.project.list,
+				results: saasPermissions.project.read
+			},
+			api_keys_revoke_all: { permission: saasPermissions.apiKey.revokeAll }
+		},
+		models: {
+			standard: saasPermissions.integration.read,
+			frontier: saasPermissions.analytics.read
+		},
+		customRoles: memoryCustomRoleSource(saasCustomRoles),
+		store: memoryApprovalStore()
+	};
+}
+function projects(...ids) {
+	return ids.flatMap((id) => saasSeed.projects.filter((row) => row.id === id));
+}
+/**
+* Runs the `AgentPermDock` contract against a runtime: operations decided by
+* name, the listing hint, the model gate, the results filter and gateway
+* attribution. Every failure denies, and no method throws.
+*/
+function testAgentRuntime(options) {
+	describe(`${options.name}: agent runtime contract`, () => {
+		const domain = createDomain();
+		let mounted;
+		beforeAll(async () => {
+			mounted = await options.mount(domain);
+		});
+		afterAll(async () => {
+			await mounted.close?.();
+		});
+		const agent = () => mounted.agent;
+		const scenario = (name, title, run) => {
+			const reason = options.skip?.[name];
+			it.skipIf(reason !== void 0)(reason === void 0 ? title : `${title} (${reason})`, run);
+		};
+		for (const entry of OPERATIONS) scenario(entry.name, entry.title, async () => {
+			const verdict = await agent().decideOperation(entry.operation, entry.input, entry.context);
+			expect(verdict.outcome).toBe(entry.expected);
+		});
+		scenario("allowed-operations", "lists the operations a subject could be granted, and none for a stranger", async () => {
+			const listed = await agent().allowedOperations(alice);
+			expect(listed.has("project_read")).toBe(true);
+			expect(listed.has("drop_database")).toBe(false);
+			expect([...await agent().allowedOperations(mallory)]).toEqual([]);
+		});
+		scenario("model-gate", "grants a model by its permission and denies one the map does not name", async () => {
+			expect((await agent().decideModel("frontier", erin)).outcome).toBe("granted");
+			expect((await agent().decideModel("frontier", alice)).outcome).toBe("denied");
+			expect((await agent().decideModel("unlisted", erin)).outcome).toBe("denied");
+			expect((await agent().decideModel("standard", {
+				user: AGENT_THROWING_USER,
+				org: "acme"
+			})).outcome).toBe("denied");
+		});
+		scenario("permitted-models", "returns the granted models in declaration order", async () => {
+			expect(await agent().permittedModels(erin)).toEqual(["standard", "frontier"]);
+			expect(await agent().permittedModels(alice)).toEqual(["standard"]);
+			expect(await agent().permittedModels(mallory)).toEqual([]);
+		});
+		scenario("results-filter", "keeps the rows the results permission grants, and none for an unknown operation", async () => {
+			const rows = projects("p1", "g1", "p2");
+			expect((await agent().filterResults("project_search", rows, alice)).map((row) => row.id)).toEqual(["p1", "p2"]);
+			expect(await agent().filterResults("project_search", rows, mallory)).toEqual([]);
+			expect(await agent().filterResults("drop_database", rows, alice)).toEqual([]);
+		});
+		scenario("gateway-options", "attributes gateway usage to the principal, and to nobody for an anonymous call", async () => {
+			const attributed = await agent().gatewayOptions(alice);
+			expect(attributed.gateway.user).toBe("alice");
+			const anonymous = await agent().gatewayOptions({
+				user: null,
+				org: "acme"
+			});
+			expect(anonymous.gateway.user).toBeUndefined();
+		});
+	});
+}
+//#endregion
 //#region src/testing/authzen.ts
 function sortKey(value) {
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => byCodePoint(a, b))));
 }
 /** Runs AuthZEN 1.0 interop vectors against an Authorization API endpoint. */
-function testAuthZen(handle, options) {
+function testAuthzen(handle, options) {
 	const origin = options.origin ?? "https://pdp.example.com";
 	const post = async (path, body) => {
 		const response = await handle(new Request(`${origin}${path}`, {
@@ -1628,7 +1861,7 @@ const authzenTodoPolicy = definePolicy(authzenTodoPermissions, {
 		role("evil_genius", [...everyone, allow(todo.can_update_todo)]),
 		role("pep", [])
 	],
-	principal: (user) => {
+	subject: (user) => {
 		const id = user !== null && typeof user === "object" && "id" in user ? user.id : void 0;
 		if (id === "pep") return {
 			id: "pep",
@@ -1776,6 +2009,7 @@ function authzenTodoVectors() {
 function sampleApproval(token) {
 	return {
 		v: 1,
+		id: `apr_${token}`,
 		token,
 		permission: "post.delete",
 		scope: "post:delete",
@@ -1794,8 +2028,8 @@ function sampleApproval(token) {
 			}
 		},
 		detail: "post.delete requires human approval.",
-		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-		expiresAt: new Date(Date.now() + 36e5).toISOString(),
+		createdAt: isoNow(),
+		expiresAt: isoAt(nowMillis() + 36e5),
 		status: "pending"
 	};
 }
@@ -1813,7 +2047,7 @@ const secondApprover = {
 	},
 	context: {}
 };
-const admin = {
+const admin$2 = {
 	kind: "role",
 	role: "admin",
 	scope: "global"
@@ -1905,7 +2139,7 @@ function testApprovalStore(store, options = {}) {
 			by: approver
 		}))).rejects.toThrow(/not pending/);
 		await store.create(sampleApproval("stale-token"));
-		const expired = await store.expire(new Date(Date.now() + 72e5));
+		const expired = await store.expire({ epochMilliseconds: nowMillis() + 72e5 });
 		expect(expired).toBeGreaterThanOrEqual(1);
 	});
 	it("pages list results with limit and an opaque cursor", async () => {
@@ -1920,7 +2154,7 @@ function testApprovalStore(store, options = {}) {
 				id: "u_pager",
 				roles: ["member"]
 			} },
-			createdAt: new Date(base + index * 1e3).toISOString()
+			createdAt: isoAt(base + index * 1e3)
 		})));
 		const first = await store.list({
 			principalId: "u_pager",
@@ -1972,9 +2206,9 @@ function testApprovalStore(store, options = {}) {
 		};
 		const shapes = [
 			["self-human", void 0],
-			["self-by", { by: admin }],
+			["self-by", { by: admin$2 }],
 			["self-distinct", {
-				by: admin,
+				by: admin$2,
 				distinct: true
 			}]
 		];
@@ -1992,7 +2226,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("self-optout"),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				distinct: false
 			}
 		});
@@ -2006,7 +2240,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("quorum-token"),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				quorum: 2
 			}
 		});
@@ -2037,7 +2271,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("vouched-token"),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				quorum: 2
 			}
 		});
@@ -2075,7 +2309,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("veto-token"),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				quorum: 2
 			}
 		});
@@ -2095,7 +2329,7 @@ function testApprovalStore(store, options = {}) {
 			context: {}
 		};
 		const escalation = {
-			after: "1h",
+			after: 3600,
 			to: {
 				kind: "role",
 				role: "auditor",
@@ -2105,7 +2339,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("fresh-escalation"),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				escalation
 			}
 		});
@@ -2115,9 +2349,9 @@ function testApprovalStore(store, options = {}) {
 		}))).rejects.toThrow(/eligible/u);
 		await store.create({
 			...sampleApproval("waited-escalation"),
-			createdAt: (/* @__PURE__ */ new Date(Date.now() - 72e5)).toISOString(),
+			createdAt: isoAt(nowMillis() - 72e5),
 			approvers: {
-				by: admin,
+				by: admin$2,
 				escalation
 			}
 		});
@@ -2136,7 +2370,7 @@ function testApprovalStore(store, options = {}) {
 				stages: [{ by: {
 					kind: "user",
 					id: "u_10"
-				} }, { by: admin }]
+				} }, { by: admin$2 }]
 			}
 		});
 		await expect(Promise.resolve().then(() => store.resolve("stages-token", {
@@ -2206,49 +2440,2608 @@ function testApprovalPolicySource(source, options) {
 		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
 	});
 }
+const reviewItem = {
+	v: 1,
+	id: "rev:u_1:post.delete",
+	review: "rev",
+	principal: "u_1",
+	permission: "post.delete",
+	via: ["member"],
+	status: "pending"
+};
+/**
+* Checks an `AccessReviewStore`: create is kept, items page, a decision is
+* recorded once, only a revoked item can be marked applied, and close is once.
+*/
+function testAccessReviewStore(store) {
+	it("records a review, pages its items and stores one decision", async () => {
+		const review = {
+			v: 1,
+			id: "rev",
+			tenant: "o1",
+			permissions: ["post.delete"],
+			reviewers: {
+				kind: "user",
+				id: "u_9"
+			},
+			createdBy: "u_owner",
+			createdAt: "2026-10-13T12:00:00.000Z",
+			dueAt: "2026-12-31T00:00:00.000Z",
+			status: "open",
+			complete: true
+		};
+		await store.create(review, [reviewItem, {
+			...reviewItem,
+			id: "rev:u_2:post.delete",
+			principal: "u_2"
+		}]);
+		await store.create(review, []);
+		expect((await store.get("rev"))?.status).toBe("open");
+		const page = await store.items({
+			review: "rev",
+			limit: 1
+		});
+		expect(page.items).toHaveLength(1);
+		expect(page.next).toEqual(expect.any(String));
+		const kept = await store.decide("rev", reviewItem.id, {
+			status: "kept",
+			decidedBy: "u_9",
+			decidedAt: "2026-10-14T12:00:00.000Z"
+		});
+		expect(kept.status).toBe("kept");
+		await expect(Promise.resolve().then(() => store.decide("rev", reviewItem.id, {
+			status: "revoked",
+			decidedBy: "u_9",
+			decidedAt: "2026-10-14T12:00:00.000Z"
+		}))).rejects.toThrow(/decided/u);
+		const revoked = await store.decide("rev", "rev:u_2:post.delete", {
+			status: "revoked",
+			decidedBy: "u_9",
+			decidedAt: "2026-10-14T12:00:00.000Z"
+		});
+		expect(revoked.status).toBe("revoked");
+		await expect(Promise.resolve().then(() => store.markApplied("rev", reviewItem.id, "2026-10-15T00:00:00.000Z"))).rejects.toThrow(/revoked/u);
+		const applied = await store.markApplied("rev", "rev:u_2:post.delete", "2026-10-15T00:00:00.000Z");
+		expect(applied.appliedAt).toBe("2026-10-15T00:00:00.000Z");
+		expect((await store.close("rev")).status).toBe("closed");
+		await expect(Promise.resolve().then(() => store.close("rev"))).rejects.toThrow(/closed/u);
+	});
+}
+/**
+* Checks an `ApprovalDelegationSource`: entries are plain JSON, name the
+* delegate, and are active at `at`. A query for another delegate is empty.
+*/
+function testApprovalDelegationSource(source, options) {
+	it("answers with active plain delegations for the delegate", async () => {
+		const at = options.at ?? isoNow();
+		const entries = await source.delegationsFor({
+			delegate: options.delegate,
+			...options.tenant === void 0 ? {} : { tenant: options.tenant },
+			at
+		});
+		expect(Array.isArray(entries)).toBe(true);
+		expect(entries.some((entry) => entry.delegate === options.delegate && entry.delegator === options.delegator)).toBe(true);
+		const instant = Date.parse(at);
+		for (const entry of entries) {
+			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect(entry.delegate).toBe(options.delegate);
+			expect(Date.parse(entry.from)).toBeLessThanOrEqual(instant);
+			expect(Date.parse(entry.until)).toBeGreaterThan(instant);
+		}
+		expect(await source.delegationsFor({
+			delegate: "__permdock_unknown__",
+			...options.tenant === void 0 ? {} : { tenant: options.tenant },
+			at
+		})).toEqual([]);
+	});
+}
+/**
+* Checks an `IdempotencyStore`: a stored response comes back as written
+* until it expires, keys never share an entry, and a later `set` replaces an
+* earlier one.
+*/
+function testIdempotencyStore(store) {
+	it("replays a stored response per key and keeps keys apart", async () => {
+		const key = `u_1\n${crypto.randomUUID()}`;
+		const other = `u_2\n${crypto.randomUUID()}`;
+		const response = {
+			fingerprint: "approve apr_1 sha-256:abc",
+			status: 200,
+			headers: [["content-type", "application/json"]],
+			body: "{\"status\":\"approved\"}"
+		};
+		const later = nowMillis() + 36e5;
+		expect(await store.get(key)).toBeUndefined();
+		await store.set(key, response, later);
+		expect(await store.get(key)).toEqual(response);
+		expect(await store.get(other)).toBeUndefined();
+		const replaced = {
+			...response,
+			status: 201
+		};
+		await store.set(key, replaced, later);
+		expect(await store.get(key)).toEqual(replaced);
+	});
+}
 //#endregion
-//#region src/testing/conformance/where.ts
-const WHERE_ROWS = [
-	{
-		id: "r1",
-		authorId: "u1",
-		score: 5,
-		title: "Plan 100%",
-		archived: false,
-		note: null
-	},
-	{
-		id: "r2",
-		authorId: "u2",
-		score: 10,
-		title: "plan_b",
-		archived: true,
-		note: "kept"
+//#region src/testing/conformance/runtime-stores.ts
+function testLimitStore(store) {
+	it("counts down synchronously and fails closed when exhausted", async () => {
+		const input = {
+			key: "report.export",
+			subjectId: "u_1",
+			count: 2,
+			per: 3600,
+			now: { epochMilliseconds: 17e11 }
+		};
+		const first = await store.consume(input);
+		expect(first.remaining).toBeGreaterThanOrEqual(0);
+		const peeked = store.remaining(input);
+		if (peeked !== void 0) {
+			expect(typeof peeked.remaining).toBe("number");
+			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
+		}
+		await store.consume(input);
+		const exhausted = await store.consume(input);
+		expect(exhausted.remaining).toBeLessThan(0);
+	});
+}
+function testDecisionSink(sink) {
+	it("accepts batches and never propagates write errors", async () => {
+		await expect(Promise.resolve(sink.write([{
+			type: "membership",
+			at: isoNow(),
+			source: "app",
+			operation: "changed",
+			principal: { id: "u_1" },
+			roles: {
+				added: ["admin"],
+				removed: ["member"]
+			}
+		}]))).resolves.toBeUndefined();
+		await expect(Promise.resolve(sink.write([]))).resolves.toBeUndefined();
+		if (sink.flush !== void 0) {
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
+		}
+	});
+}
+function testSnapshotSource(source) {
+	it("round-trips a snapshot", async () => {
+		const snapshot = await source.get();
+		expect(snapshot === null || snapshot === void 0).toBe(false);
+		if (typeof snapshot === "object" && snapshot !== null && "v" in snapshot) expect(snapshot.v).toBe(1);
+		if (source.subscribe !== void 0) source.subscribe(() => void 0)();
+	});
+}
+function testPolicySource(source, options = {}) {
+	const readCurrent = () => {
+		const document = source.current();
+		expect(document !== null && typeof document === "object" && "then" in document && typeof document.then === "function").toBe(false);
+		return document;
+	};
+	it("returns null or a v1 policy document synchronously", () => {
+		const document = readCurrent();
+		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+	});
+	it("refreshes without rejecting and keeps current() synchronous", async () => {
+		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
+		const document = readCurrent();
+		if (document !== null) expect(document.v).toBe(1);
+	});
+	if (options.policy !== void 0) {
+		const policy = options.policy;
+		it("merges only grants on hostable permissions", () => {
+			const document = readCurrent();
+			const merged = mergeHostedGrants(policy, document);
+			for (const grant of merged.policy.grants) if (grant.hosted !== void 0) expect(policy.hostable).toContain(grant.permission.key);
+			for (const dropped of merged.dropped) expect(dropped.kind).toBe("hosted-grant-dropped");
+		});
+	}
+}
+//#endregion
+//#region src/testing/cloud-api/platform.ts
+const CATALOG = "https://permdock.com/schemas/catalog-v1.json";
+const MANIFEST = "https://permdock.com/schemas/supabase-manifest-v1.json";
+const PUSHED_POLICY = "https://permdock.com/schemas/pushed-policy-v1.json";
+const OAUTH_FORM$1 = "application/x-www-form-urlencoded";
+/** The scopes the platform issuer grants a person's login. */
+const PLATFORM_SCOPES = {
+	"projects:read": "List and read the projects the person belongs to",
+	"policy:read": "Read a project's pushed catalog, manifest and policy",
+	"catalog:write": "Push a catalog and policy with permdock cloud push"
+};
+const ref$1 = (name) => ({ $ref: `#/components/schemas/${name}` });
+const RATE_LIMIT_HEADERS = {
+	RateLimit: {
+		description: "Remaining quota per policy, draft-ietf-httpapi-ratelimit-headers-11 (`\"read\";r=59;t=30`)",
+		schema: { type: "string" }
 	},
-	{
-		id: "r3",
-		authorId: null,
-		score: null,
-		title: null,
-		archived: null,
-		note: null
+	"RateLimit-Policy": {
+		description: "The quota policy, draft-ietf-httpapi-ratelimit-headers-11 (`\"read\";q=60;w=60`)",
+		schema: { type: "string" }
 	}
-];
-const WHERE_CASES = [
-	["eq", {
-		op: "eq",
-		field: "authorId",
-		value: "u1"
-	}],
-	["ne", {
-		op: "ne",
-		field: "authorId",
-		value: "u1"
-	}],
-	["eq on a boolean", {
-		op: "eq",
-		field: "archived",
-		value: false
+};
+const limited = (description, schema) => ({
+	description,
+	headers: RATE_LIMIT_HEADERS,
+	content: { "application/json": { schema } }
+});
+const problem$1 = (description, headers) => ({
+	description,
+	...headers === void 0 ? {} : { headers },
+	content: { "application/problem+json": { schema: ref$1("Problem") } }
+});
+const oauthJson = (description, schema) => ({
+	description,
+	content: { "application/json": { schema } }
+});
+const TOO_MANY = problem$1("Rate limited; retry after Retry-After seconds", {
+	...RATE_LIMIT_HEADERS,
+	"Retry-After": {
+		description: "Seconds to wait (RFC 9110)",
+		schema: { type: "string" }
+	}
+});
+const READ_SECURITY = (scope) => [{ platform: [scope] }, { cloudToken: [] }];
+const read = (scope, summary, responses) => ({ get: {
+	security: READ_SECURITY(scope),
+	summary,
+	responses: {
+		...responses,
+		"401": problem$1("Missing, expired or revoked token"),
+		"403": problem$1("The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment"),
+		"429": TOO_MANY
+	}
+} });
+const PLATFORM_SCHEMAS = {
+	AuthorizationServerMetadata: {
+		type: "object",
+		description: "RFC 8414 metadata of the platform issuer",
+		required: [
+			"issuer",
+			"authorization_endpoint",
+			"token_endpoint",
+			"device_authorization_endpoint",
+			"revocation_endpoint",
+			"registration_endpoint",
+			"scopes_supported",
+			"code_challenge_methods_supported"
+		],
+		properties: {
+			issuer: { type: "string" },
+			authorization_endpoint: { type: "string" },
+			device_authorization_endpoint: { type: "string" },
+			token_endpoint: { type: "string" },
+			revocation_endpoint: { type: "string" },
+			registration_endpoint: { type: "string" },
+			scopes_supported: {
+				type: "array",
+				items: { type: "string" },
+				contains: { const: "policy:read" }
+			},
+			code_challenge_methods_supported: {
+				type: "array",
+				items: { const: "S256" },
+				minItems: 1
+			},
+			grant_types_supported: {
+				type: "array",
+				items: { type: "string" }
+			},
+			response_types_supported: {
+				type: "array",
+				items: { type: "string" }
+			},
+			token_endpoint_auth_methods_supported: {
+				type: "array",
+				items: { type: "string" }
+			}
+		}
+	},
+	ClientRegistration: {
+		type: "object",
+		description: "RFC 7591 client information response",
+		required: ["client_id", "redirect_uris"],
+		properties: {
+			client_id: {
+				type: "string",
+				minLength: 1
+			},
+			client_id_issued_at: { type: "integer" },
+			redirect_uris: {
+				type: "array",
+				items: { type: "string" }
+			},
+			token_endpoint_auth_method: { type: "string" },
+			grant_types: {
+				type: "array",
+				items: { type: "string" }
+			},
+			client_name: { type: "string" },
+			scope: { type: "string" }
+		}
+	},
+	Project: {
+		type: "object",
+		description: "A Cloud project. A project is one environment: `id` is the `{env}` of /v1/environments/{env}.",
+		required: [
+			"id",
+			"name",
+			"environment"
+		],
+		properties: {
+			id: {
+				type: "string",
+				minLength: 1
+			},
+			name: { type: "string" },
+			environment: {
+				type: "string",
+				minLength: 1
+			},
+			issuer: {
+				type: "string",
+				description: "The environment's own issuer for app tokens"
+			},
+			catalog: {
+				type: "object",
+				required: ["version", "fingerprint"],
+				properties: {
+					version: {
+						type: "integer",
+						minimum: 1
+					},
+					fingerprint: { type: "string" }
+				}
+			}
+		}
+	},
+	ProjectPolicy: {
+		type: "object",
+		description: "What the project's last cloud push sent, with JSON member order kept as pushed, so permdock cloud pull writes the bytes the offline commands write.",
+		required: [
+			"v",
+			"project",
+			"version",
+			"fingerprint",
+			"permdockVersion",
+			"catalog"
+		],
+		properties: {
+			v: { const: 1 },
+			project: {
+				type: "string",
+				minLength: 1
+			},
+			version: {
+				type: "integer",
+				minimum: 1
+			},
+			fingerprint: {
+				type: "string",
+				description: "catalogFingerprint(catalog); equals catalog.fingerprint"
+			},
+			permdockVersion: {
+				type: "string",
+				description: "The permdock version that pushed"
+			},
+			catalog: { $ref: CATALOG },
+			manifest: { $ref: MANIFEST },
+			policy: { $ref: PUSHED_POLICY }
+		}
+	}
+};
+const PROJECT_ID = {
+	name: "id",
+	in: "path",
+	required: true,
+	description: "The project id, the same id as its environment",
+	schema: {
+		type: "string",
+		minLength: 1
+	}
+};
+/** Routes of the platform issuer and its read API; they sit at the API root, outside /v1/environments/{env}. */
+const PLATFORM_PATHS = {
+	"/.well-known/oauth-authorization-server": { get: {
+		security: [],
+		summary: "RFC 8414 metadata of the platform issuer. For the issuer https://permdock.com/api it is served at https://permdock.com/.well-known/oauth-authorization-server/api (section 3.1) and here.",
+		responses: { "200": oauthJson("The metadata", ref$1("AuthorizationServerMetadata")) }
+	} },
+	"/oauth/authorize": { get: {
+		security: [],
+		summary: "Authorization code with PKCE S256 for public clients, including the RFC 8252 loopback redirect http://127.0.0.1:{port}/callback",
+		parameters: [
+			...[
+				"response_type",
+				"client_id",
+				"redirect_uri",
+				"code_challenge"
+			].map((name) => ({
+				name,
+				in: "query",
+				required: true,
+				schema: { type: "string" }
+			})),
+			{
+				name: "code_challenge_method",
+				in: "query",
+				required: true,
+				schema: { const: "S256" }
+			},
+			{
+				name: "state",
+				in: "query",
+				schema: { type: "string" }
+			},
+			{
+				name: "scope",
+				in: "query",
+				schema: { type: "string" }
+			}
+		],
+		responses: {
+			"302": { description: "Redirect to the client with a code" },
+			"400": oauthJson("invalid_request, including plain PKCE", ref$1("OAuthError"))
+		}
+	} },
+	"/oauth/device_authorization": { post: {
+		security: [{ publicClient: [] }],
+		summary: "RFC 8628 device authorization for permdock login",
+		requestBody: {
+			required: true,
+			content: { [OAUTH_FORM$1]: { schema: {
+				type: "object",
+				required: ["client_id"]
+			} } }
+		},
+		responses: {
+			"200": oauthJson("The codes", {
+				type: "object",
+				required: [
+					"device_code",
+					"user_code",
+					"verification_uri",
+					"expires_in"
+				],
+				properties: {
+					device_code: { type: "string" },
+					user_code: { type: "string" },
+					verification_uri: { type: "string" },
+					verification_uri_complete: { type: "string" },
+					expires_in: { type: "integer" },
+					interval: { type: "integer" }
+				}
+			}),
+			"400": oauthJson("invalid_request or invalid_client", ref$1("OAuthError"))
+		}
+	} },
+	"/oauth/token": { post: {
+		security: [{ publicClient: [] }],
+		summary: "authorization_code with code_verifier, device_code and refresh_token for public clients",
+		requestBody: {
+			required: true,
+			content: { [OAUTH_FORM$1]: { schema: {
+				type: "object",
+				required: ["grant_type"],
+				properties: { grant_type: { enum: [
+					"authorization_code",
+					"urn:ietf:params:oauth:grant-type:device_code",
+					"refresh_token"
+				] } }
+			} } }
+		},
+		responses: {
+			"200": oauthJson("The tokens", ref$1("TokenResponse")),
+			"400": oauthJson("An RFC 6749 or RFC 8628 error", ref$1("OAuthError"))
+		}
+	} },
+	"/oauth/revoke": { post: {
+		security: [{ publicClient: [] }],
+		summary: "RFC 7009 revocation; permdock logout sends the refresh token. An unknown token also answers 200.",
+		requestBody: {
+			required: true,
+			content: { [OAUTH_FORM$1]: { schema: {
+				type: "object",
+				required: ["token"],
+				properties: {
+					token: { type: "string" },
+					token_type_hint: { enum: ["access_token", "refresh_token"] }
+				}
+			} } }
+		},
+		responses: {
+			"200": { description: "Revoked, or the token was not known" },
+			"400": oauthJson("invalid_request", ref$1("OAuthError"))
+		}
+	} },
+	"/oauth/register": { post: {
+		security: [],
+		summary: "RFC 7591 dynamic client registration for MCP clients of https://permdock.com/mcp: public clients with loopback or https redirect URIs",
+		requestBody: {
+			required: true,
+			content: { "application/json": { schema: {
+				type: "object",
+				required: ["redirect_uris"],
+				properties: {
+					redirect_uris: {
+						type: "array",
+						items: { type: "string" },
+						minItems: 1
+					},
+					token_endpoint_auth_method: { const: "none" },
+					client_name: { type: "string" },
+					scope: { type: "string" }
+				}
+			} } }
+		},
+		responses: {
+			"201": oauthJson("The registered client", ref$1("ClientRegistration")),
+			"400": oauthJson("invalid_redirect_uri or invalid_client_metadata", ref$1("OAuthError"))
+		}
+	} },
+	"/v1/projects": read("projects:read", "The projects the token reads", { "200": limited("The projects", {
+		type: "object",
+		required: ["items"],
+		properties: {
+			items: {
+				type: "array",
+				items: ref$1("Project")
+			},
+			next: { type: "string" }
+		}
+	}) }),
+	"/v1/projects/{id}": {
+		parameters: [PROJECT_ID],
+		...read("projects:read", "One project", {
+			"200": limited("The project", ref$1("Project")),
+			"404": problem$1("No such project")
+		})
+	},
+	"/v1/projects/{id}/policy": {
+		parameters: [PROJECT_ID],
+		...read("policy:read", "The pushed catalog, manifest and policy, for permdock cloud pull and rls generate --project", {
+			"200": limited("The pushed policy", ref$1("ProjectPolicy")),
+			"404": problem$1(`No such project, or \`type\` ${POLICY_NOT_PUBLISHED}: nothing pushed yet`)
+		})
+	}
+};
+const PLATFORM_SECURITY_SCHEMES = {
+	platform: {
+		type: "oauth2",
+		description: "A person's login at the platform issuer https://permdock.com/api: permdock login (device flow, RFC 8628, or the RFC 8252 loopback with PKCE) or an MCP client registered with RFC 7591.",
+		flows: { authorizationCode: {
+			authorizationUrl: "https://permdock.com/api/oauth/authorize",
+			tokenUrl: "https://permdock.com/api/oauth/token",
+			refreshUrl: "https://permdock.com/api/oauth/token",
+			scopes: PLATFORM_SCOPES
+		} }
+	},
+	cloudToken: {
+		type: "http",
+		scheme: "bearer",
+		description: "PERMDOCK_CLOUD_TOKEN: a read-only Cloud key pinned to one environment, for CI. It reads that project and its policy, and nothing else."
+	}
+};
+//#endregion
+//#region src/testing/cloud-api/platform-checks.ts
+const ITEM = /^"[^"]+"(?:;[a-z]+=-?\d+)+$/u;
+/** Whether a RateLimit or RateLimit-Policy field value lists items with the parameters `keys` (draft-ietf-httpapi-ratelimit-headers-11). */
+function rateLimitField(value, keys) {
+	if (value === null || value.trim() === "") return false;
+	return value.split(",").every((raw) => {
+		const item = raw.trim();
+		return ITEM.test(item) && keys.every((key) => item.includes(`;${key}=`));
+	});
+}
+function rateLimited(response) {
+	return rateLimitField(response.headers.get("ratelimit"), ["r", "t"]) && rateLimitField(response.headers.get("ratelimit-policy"), ["q", "w"]);
+}
+function problemType(response, body) {
+	return (response.headers.get("content-type") ?? "").startsWith("application/problem+json") && isRecord(body) ? body["type"] : void 0;
+}
+/** The platform issuer and project read API checks of `testCloudApi`. */
+function testCloudPlatform(url, environment, options, fetchFn) {
+	const project = options.project ?? environment;
+	const read = (path, token) => fetchFn(`${url}${path}`, token === null ? {} : { headers: { authorization: `Bearer ${token}` } });
+	const form = (path, fields) => fetchFn(`${url}${path}`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(fields).toString()
+	});
+	it("publishes RFC 8414 metadata for the platform issuer", async () => {
+		const metadata = await discoverAuthorizationServer(url, { fetch: (input, init) => fetchFn(String(input), init) });
+		expect(metadata).not.toBeNull();
+		expect(metadata).toMatchObject({
+			issuer: url,
+			code_challenge_methods_supported: ["S256"]
+		});
+		const scopes = metadata?.["scopes_supported"];
+		expect(scopes).toEqual(expect.arrayContaining(Object.keys(PLATFORM_SCOPES)));
+	});
+	it("lists and reads the project and its policy with RateLimit fields", async () => {
+		const list = await read("/v1/projects", options.token);
+		expect(list.status).toBe(200);
+		expect(rateLimited(list)).toBe(true);
+		const listed = await list.json();
+		const items = isRecord(listed) && Array.isArray(listed["items"]) ? listed["items"] : [];
+		expect(items).toContainEqual(expect.objectContaining({ id: project }));
+		const one = await read(`/v1/projects/${encodeURIComponent(project)}`, options.token);
+		expect(one.status).toBe(200);
+		expect(rateLimited(one)).toBe(true);
+		expect(await one.json()).toMatchObject({
+			id: project,
+			environment: project
+		});
+		const policy = await read(`/v1/projects/${encodeURIComponent(project)}/policy`, options.token);
+		const body = await policy.json();
+		if (policy.status === 404) {
+			expect(problemType(policy, body)).toBe(POLICY_NOT_PUBLISHED);
+			return;
+		}
+		expect(policy.status).toBe(200);
+		expect(rateLimited(policy)).toBe(true);
+		expect(isRecord(body)).toBe(true);
+		const catalog = isRecord(body) ? body["catalog"] : void 0;
+		expect(isRecord(catalog)).toBe(true);
+		const fingerprint = isRecord(catalog) ? catalogFingerprint(catalog) : "";
+		expect(body).toMatchObject({
+			v: 1,
+			project,
+			fingerprint
+		});
+	});
+	it("answers policy-not-published as Problem Details before the first push", async (context) => {
+		if (options.unpublished === void 0) {
+			context.skip();
+			return;
+		}
+		const response = await read(`/v1/projects/${encodeURIComponent(options.unpublished.project)}/policy`, options.unpublished.token);
+		expect(response.status).toBe(404);
+		expect(problemType(response, await response.json())).toBe(POLICY_NOT_PUBLISHED);
+	});
+	it("answers 401 Problem Details to the read API without a token", async () => {
+		const response = await read(`/v1/projects/${encodeURIComponent(project)}`, null);
+		expect(response.status).toBe(401);
+		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
+	});
+	it("refuses a catalog push with the read-only token", async () => {
+		const response = await fetchFn(`${url}/v1/environments/${encodeURIComponent(project)}/catalog`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${options.token}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				fingerprint: "x",
+				catalog: {}
+			})
+		});
+		expect([401, 403]).toContain(response.status);
+	});
+	it("answers RFC 7009 revocation of an unknown token with 200", async () => {
+		const response = await form("/oauth/revoke", {
+			token: `unknown-${globalThis.crypto.randomUUID()}`,
+			token_type_hint: "refresh_token",
+			client_id: "permdock-cli"
+		});
+		expect(response.status).toBe(200);
+	});
+	it("registers an MCP client with a loopback redirect and refuses a plain http one", async (context) => {
+		if (options.registration !== true) {
+			context.skip();
+			return;
+		}
+		const register = (redirect) => fetchFn(`${url}/oauth/register`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				redirect_uris: [redirect],
+				token_endpoint_auth_method: "none",
+				client_name: "PermDock contract test"
+			})
+		});
+		const loopback = await register("http://127.0.0.1:33418/callback");
+		expect(loopback.status).toBe(201);
+		expect(await loopback.json()).toMatchObject({ client_id: expect.any(String) });
+		expect((await register("http://mcp.example.invalid/callback")).status).toBe(400);
+	});
+}
+//#endregion
+//#region src/testing/cloud-api/connector-schema.ts
+var import__2020 = require__2020();
+/**
+* `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
+* `oneOf` branch per kind with a closed `config`. No branch holds a secret.
+*/
+const CONNECTOR_SCHEMA = freezeDeep({
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/connector-v1.json",
+	title: "PermDock Cloud connector",
+	description: "A connector on PermDock Cloud's /connectors route, wire format v1: the closed list of kinds, one branch per kind. Trusted issuers have their own route (/trusted-issuers).",
+	oneOf: [
+		{
+			description: "CloudEvents batches signed with Standard Webhooks.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "webhook" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["url"],
+					properties: {
+						url: {
+							type: "string",
+							pattern: "^https://"
+						},
+						types: {
+							type: "array",
+							items: {
+								type: "string",
+								minLength: 1
+							},
+							uniqueItems: true,
+							description: "CloudEvents types to deliver; all when absent."
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "OTLP/HTTP log records and spans with the permdock.* attributes.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "otlp" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["endpoint"],
+					properties: {
+						endpoint: {
+							type: "string",
+							pattern: "^https://"
+						},
+						headers: {
+							type: "object",
+							additionalProperties: { type: "string" }
+						},
+						signals: {
+							type: "array",
+							items: { enum: ["logs", "traces"] },
+							minItems: 1,
+							uniqueItems: true
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "The OCSF projection posted to a SIEM ingest API.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "siem" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["destination", "endpoint"],
+					properties: {
+						destination: { enum: [
+							"splunk-hec",
+							"sentinel",
+							"security-lake",
+							"google-secops",
+							"elastic",
+							"datadog"
+						] },
+						endpoint: {
+							type: "string",
+							pattern: "^https://"
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "A scheduled decision-log export.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "evidence" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["format", "destination"],
+					properties: {
+						format: { enum: [
+							"jws",
+							"ocsf",
+							"csv"
+						] },
+						destination: {
+							type: "string",
+							pattern: "^https://"
+						},
+						schedule: { enum: ["hourly", "daily"] }
+					}
+				}
+			}
+		},
+		{
+			description: "A hosted SCIM 2.0 relay for one tenant, replayed to the application's scimHandler.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "scim" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["tenant", "target"],
+					properties: {
+						tenant: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						target: {
+							type: "string",
+							pattern: "^https://"
+						},
+						groupRoles: {
+							type: "object",
+							description: "Group id to declared assignable role.",
+							additionalProperties: {
+								type: "string",
+								minLength: 1,
+								maxLength: 256
+							}
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "An SSF transmitter whose SETs the Cloud receives (POST /ssf/receive/:connector, or poll).",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "caep-transmitter" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["issuer", "delivery"],
+					properties: {
+						issuer: {
+							type: "string",
+							pattern: "^https://"
+						},
+						jwks_uri: {
+							type: "string",
+							pattern: "^https://"
+						},
+						delivery: { enum: ["push", "poll"] },
+						poll_endpoint: {
+							type: "string",
+							pattern: "^https://"
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "An OIDC upstream the Cloud issuer federates to with authorization code plus PKCE.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "federated-upstream" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["discovery", "client_id"],
+					properties: {
+						discovery: {
+							type: "string",
+							pattern: "^https://"
+						},
+						client_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						scopes: {
+							type: "array",
+							items: {
+								type: "string",
+								minLength: 1
+							},
+							uniqueItems: true
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "Approval cards through the Vercel Chat SDK.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "chat" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["platform", "workspace"],
+					properties: {
+						platform: { enum: ["slack", "teams"] },
+						workspace: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "The Cloud's hosted email sender for approval and delivery messages.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "email" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["from"],
+					properties: { from: {
+						type: "string",
+						pattern: "^[^@\\s]+@[^@\\s]+$"
+					} }
+				}
+			}
+		},
+		{
+			description: "Vercel OIDC federation tokens accepted as hosted ADS callers.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "vercel-oidc" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["team_id"],
+					properties: {
+						team_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						project_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						environment: { enum: [
+							"production",
+							"preview",
+							"development"
+						] }
+					}
+				}
+			}
+		}
+	]
+});
+//#endregion
+//#region src/testing/cloud-api/document.ts
+const ENV = "/v1/environments/{env}";
+const COMPACT_JWS = String.raw`^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+$`;
+const APPROVAL_REQUEST = "https://permdock.com/schemas/approval-request-v1.json";
+const CONNECTOR = "https://permdock.com/schemas/connector-v1.json";
+const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+const problem = (description) => ({
+	description,
+	content: { "application/problem+json": { schema: ref("Problem") } }
+});
+const json = (description, schema) => ({
+	description,
+	content: { "application/json": { schema } }
+});
+const jwt = (description) => ({
+	description,
+	content: { "application/jwt": { schema: ref("CompactJws") } }
+});
+const empty = (description) => ({ description });
+const body = (schema, type = "application/json") => ({
+	required: true,
+	content: { [type]: { schema } }
+});
+const UNAUTHORISED = problem("Missing or unknown key");
+const FORBIDDEN = problem("A key of another kind");
+const keyed = (scheme) => (operation) => ({
+	security: [{ [scheme]: [] }],
+	...operation,
+	responses: {
+		...operation.responses,
+		"401": UNAUTHORISED,
+		"403": FORBIDDEN
+	}
+});
+const client = keyed("client");
+const admin$1 = keyed("admin");
+const open = (operation) => ({
+	security: [],
+	...operation
+});
+const header = (name, description) => ({
+	name,
+	in: "header",
+	required: true,
+	description,
+	schema: {
+		type: "string",
+		minLength: 1
+	}
+});
+const APPROVAL_TOKEN = header("PermDock-Approval", "The approval token; never in the URL");
+const ID = { $ref: "#/components/parameters/id" };
+const items = (schema) => ({
+	type: "object",
+	required: ["items"],
+	properties: {
+		items: {
+			type: "array",
+			items: schema
+		},
+		next: { type: "string" }
+	}
+});
+function crud(name, schema, input) {
+	return {
+		[`${ENV}/${name}`]: {
+			get: admin$1({
+				summary: `List ${name}`,
+				responses: { "200": json("The list", items(schema)) }
+			}),
+			post: admin$1({
+				summary: `Create one of ${name}`,
+				requestBody: body(input),
+				responses: {
+					"201": json("Stored", schema),
+					"400": problem("Not a valid body")
+				}
+			})
+		},
+		[`${ENV}/${name}/{id}`]: {
+			parameters: [ID],
+			get: admin$1({
+				summary: `Read one of ${name}`,
+				responses: {
+					"200": json("The item", schema),
+					"404": problem("Unknown id")
+				}
+			}),
+			delete: admin$1({
+				summary: `Remove one of ${name}`,
+				responses: {
+					"204": empty("Removed"),
+					"404": problem("Unknown id")
+				}
+			})
+		}
+	};
+}
+const withId = (schema) => ({ allOf: [schema, {
+	type: "object",
+	required: ["id"],
+	properties: { id: { type: "string" } }
+}] });
+const SCHEMAS = {
+	Problem: {
+		type: "object",
+		description: "RFC 9457 Problem Details",
+		required: [
+			"type",
+			"title",
+			"status"
+		],
+		properties: {
+			type: { type: "string" },
+			title: { type: "string" },
+			status: {
+				type: "integer",
+				minimum: 400,
+				maximum: 599
+			},
+			detail: { type: "string" },
+			instance: { type: "string" },
+			code: { type: "string" },
+			reason: { type: "string" }
+		}
+	},
+	CompactJws: {
+		type: "string",
+		pattern: COMPACT_JWS
+	},
+	ApprovalRequest: { $ref: APPROVAL_REQUEST },
+	ApprovalPage: items({ $ref: APPROVAL_REQUEST }),
+	Verdict: {
+		type: "object",
+		required: ["status", "by"],
+		properties: {
+			status: { enum: ["approved", "rejected"] },
+			by: { type: "object" },
+			note: { type: "string" }
+		}
+	},
+	CatalogPush: { oneOf: [{
+		type: "object",
+		required: [
+			"version",
+			"fingerprint",
+			"findings"
+		],
+		properties: {
+			version: {
+				type: "integer",
+				minimum: 1
+			},
+			fingerprint: {
+				type: "string",
+				minLength: 1
+			},
+			findings: {
+				type: "array",
+				items: { type: "object" }
+			}
+		}
+	}, {
+		type: "object",
+		required: [
+			"version",
+			"fingerprint",
+			"unchanged"
+		],
+		properties: {
+			version: {
+				type: "integer",
+				minimum: 1
+			},
+			fingerprint: {
+				type: "string",
+				minLength: 1
+			},
+			unchanged: { const: true }
+		}
+	}] },
+	HostedGrant: {
+		type: "object",
+		required: ["permission", "to"],
+		properties: {
+			id: { type: "string" },
+			permission: {
+				type: "string",
+				minLength: 1
+			},
+			to: { type: "object" }
+		}
+	},
+	Connector: { $ref: CONNECTOR },
+	TrustedIssuer: {
+		type: "object",
+		required: [
+			"issuer",
+			"audiences",
+			"purposes"
+		],
+		properties: {
+			id: { type: "string" },
+			issuer: {
+				type: "string",
+				pattern: "^https://"
+			},
+			jwks_uri: {
+				type: "string",
+				pattern: "^https://"
+			},
+			discovery: {
+				type: "string",
+				pattern: "^https://"
+			},
+			audiences: {
+				type: "array",
+				minItems: 1,
+				items: { type: "string" }
+			},
+			purposes: {
+				type: "array",
+				minItems: 1,
+				uniqueItems: true,
+				items: { enum: [
+					"approver",
+					"subject",
+					"token-exchange"
+				] }
+			}
+		},
+		oneOf: [{
+			required: ["jwks_uri"],
+			properties: { jwks_uri: true }
+		}, {
+			required: ["discovery"],
+			properties: { discovery: true }
+		}]
+	},
+	TrustedPep: {
+		type: "object",
+		properties: {
+			id: { type: "string" },
+			vercel: {
+				type: "object",
+				required: ["team_id"],
+				additionalProperties: false,
+				properties: {
+					team_id: {
+						type: "string",
+						minLength: 1
+					},
+					project_id: {
+						type: "string",
+						minLength: 1
+					},
+					environment: { enum: [
+						"production",
+						"preview",
+						"development"
+					] }
+				}
+			},
+			client_id: {
+				type: "string",
+				minLength: 1
+			}
+		},
+		oneOf: [{
+			required: ["vercel"],
+			properties: { vercel: true }
+		}, {
+			required: ["client_id"],
+			properties: { client_id: true }
+		}]
+	},
+	ApproverGroup: {
+		type: "object",
+		required: ["name", "members"],
+		properties: {
+			id: { type: "string" },
+			name: {
+				type: "string",
+				minLength: 1
+			},
+			members: {
+				type: "array",
+				items: {
+					type: "string",
+					minLength: 1
+				}
+			}
+		}
+	},
+	Assignment: {
+		type: "object",
+		required: ["tenant", "role"],
+		properties: {
+			id: { type: "string" },
+			principal: { type: "string" },
+			group: { type: "string" },
+			tenant: { type: "string" },
+			team: { type: "string" },
+			role: {
+				type: "string",
+				minLength: 1
+			}
+		},
+		oneOf: [{
+			required: ["principal"],
+			properties: { principal: true }
+		}, {
+			required: ["group"],
+			properties: { group: true }
+		}]
+	},
+	Created: {
+		type: "object",
+		required: ["id"],
+		properties: { id: {
+			type: "string",
+			minLength: 1
+		} }
+	},
+	Jwks: {
+		type: "object",
+		required: ["keys"],
+		properties: { keys: {
+			type: "array",
+			items: { type: "object" }
+		} }
+	},
+	Metadata: {
+		type: "object",
+		additionalProperties: true
+	},
+	TokenResponse: {
+		type: "object",
+		required: [
+			"access_token",
+			"token_type",
+			"expires_in"
+		],
+		properties: {
+			access_token: { type: "string" },
+			issued_token_type: { type: "string" },
+			token_type: { const: "Bearer" },
+			expires_in: {
+				type: "integer",
+				minimum: 1
+			},
+			refresh_token: { type: "string" },
+			scope: { type: "string" }
+		}
+	},
+	OAuthError: {
+		type: "object",
+		required: ["error"],
+		properties: {
+			error: { type: "string" },
+			error_description: { type: "string" }
+		}
+	},
+	SsfStream: {
+		type: "object",
+		required: ["stream_id"],
+		properties: { stream_id: { type: "string" } }
+	},
+	SetPoll: {
+		type: "object",
+		required: ["sets"],
+		properties: {
+			sets: {
+				type: "object",
+				additionalProperties: ref("CompactJws")
+			},
+			moreAvailable: { type: "boolean" }
+		}
+	}
+};
+const APPROVALS = {
+	[`${ENV}/approvals`]: {
+		post: client({
+			summary: "approvals.create",
+			requestBody: body(ref("ApprovalRequest")),
+			responses: {
+				"200": json("The record already stored for this token", ref("ApprovalRequest")),
+				"201": json("Stored", ref("ApprovalRequest")),
+				"400": problem("Not a v1 approval request")
+			}
+		}),
+		get: client({
+			summary: "approvals.list",
+			parameters: [...[
+				"status",
+				"principalId",
+				"actorId",
+				"tenant",
+				"session",
+				"cursor"
+			].map((name) => ({
+				name,
+				in: "query",
+				schema: { type: "string" }
+			})), {
+				name: "limit",
+				in: "query",
+				schema: {
+					type: "integer",
+					minimum: 1
+				}
+			}],
+			responses: { "200": json("One page", ref("ApprovalPage")) }
+		})
+	},
+	[`${ENV}/approvals/by-token`]: { get: client({
+		summary: "approvals.get",
+		parameters: [APPROVAL_TOKEN],
+		responses: {
+			"200": json("The record", ref("ApprovalRequest")),
+			"404": problem("Unknown token")
+		}
+	}) },
+	[`${ENV}/approvals/{id}`]: {
+		parameters: [ID],
+		get: client({
+			summary: "approvals.getById",
+			responses: {
+				"200": json("The record", ref("ApprovalRequest")),
+				"404": problem("Unknown id")
+			}
+		})
+	},
+	[`${ENV}/approvals/by-token/resolve`]: { post: client({
+		summary: "approvals.resolve",
+		parameters: [
+			APPROVAL_TOKEN,
+			{
+				...header("PermDock-Approver", "The approver at+jwt; absent only for a system rejection"),
+				required: false
+			},
+			{
+				name: "If-Match",
+				in: "header",
+				schema: { type: "string" }
+			}
+		],
+		requestBody: body(ref("Verdict")),
+		responses: {
+			"200": json("The resolved record", ref("ApprovalRequest")),
+			"404": problem("approval-not-found"),
+			"409": problem("Not pending, or a stale ETag"),
+			"410": problem("Expired")
+		}
+	}) },
+	[`${ENV}/approvals/by-token/consume`]: { post: client({
+		summary: "approvals.consume",
+		parameters: [APPROVAL_TOKEN],
+		responses: {
+			"200": json("The approved record with consumedAt", ref("ApprovalRequest")),
+			"409": problem("Not approved, already consumed or expired")
+		}
+	}) },
+	[`${ENV}/approvals/expire`]: { post: client({
+		summary: "approvals.expire",
+		responses: { "200": json("Requests expired", {
+			type: "object",
+			required: ["expired"],
+			properties: { expired: {
+				type: "integer",
+				minimum: 0
+			} }
+		}) }
+	}) },
+	[`${ENV}/approvals/cancel`]: { post: client({
+		summary: "approvals.cancel",
+		requestBody: body({
+			type: "object",
+			required: ["filter", "by"],
+			properties: {
+				filter: { type: "object" },
+				by: {
+					type: "string",
+					minLength: 1
+				},
+				note: { type: "string" }
+			}
+		}),
+		responses: { "200": json("Requests cancelled", {
+			type: "object",
+			required: ["cancelled"],
+			properties: { cancelled: {
+				type: "integer",
+				minimum: 0
+			} }
+		}) }
+	}) }
+};
+const RUNTIME = {
+	[`${ENV}/decisions`]: { post: client({
+		summary: "sink.write and sink.flush",
+		requestBody: body({
+			type: "array",
+			items: { type: "object" }
+		}, "application/cloudevents-batch+json"),
+		responses: {
+			"202": empty("Accepted"),
+			"400": problem("Not a CloudEvents batch")
+		}
+	}) },
+	[`${ENV}/snapshot`]: { get: client({
+		summary: "snapshotsFor(token).get",
+		parameters: [header("PermDock-Subject", "An at+jwt naming the subject, exp at most five minutes after iat")],
+		responses: { "200": jwt("A vnd.permdock.snapshot+jwt") }
+	}) },
+	[`${ENV}/catalog`]: {
+		post: {
+			...client({
+				summary: "catalog.push and permdock cloud push",
+				requestBody: body({
+					type: "object",
+					required: ["fingerprint", "catalog"],
+					properties: {
+						fingerprint: {
+							type: "string",
+							minLength: 1
+						},
+						catalog: { type: "object" },
+						policy: { $ref: PUSHED_POLICY },
+						manifest: { $ref: "https://permdock.com/schemas/supabase-manifest-v1.json" },
+						permdockVersion: {
+							type: "string",
+							description: "The permdock version that pushed"
+						}
+					}
+				}),
+				responses: {
+					"200": json("The fingerprint is already published", ref("CatalogPush")),
+					"201": json("A new version and its drift findings", ref("CatalogPush")),
+					"400": problem("Not a catalog, or a fingerprint that does not match it")
+				}
+			}),
+			security: [{ client: [] }, { platform: ["catalog:write"] }]
+		},
+		get: client({
+			summary: "The latest catalog",
+			responses: {
+				"200": json("The catalog", { type: "object" }),
+				"404": problem("Nothing pushed yet")
+			}
+		})
+	},
+	[`${ENV}/catalog/versions`]: { get: client({
+		summary: "Catalog versions",
+		responses: { "200": json("Versions, newest first", items({
+			type: "object",
+			required: ["version", "fingerprint"],
+			properties: {
+				version: {
+					type: "integer",
+					minimum: 1
+				},
+				fingerprint: { type: "string" }
+			}
+		})) }
+	}) },
+	[`${ENV}/deliveries`]: { post: client({
+		summary: "cloudDeliveryTransport",
+		parameters: [header("Idempotency-Key", "The router's per-recipient key")],
+		requestBody: body({
+			type: "object",
+			required: [
+				"channel",
+				"delivery",
+				"target",
+				"message"
+			],
+			properties: {
+				channel: { type: "string" },
+				delivery: { type: "string" },
+				target: {
+					type: "object",
+					required: ["address", "permission"]
+				},
+				message: { type: "object" }
+			}
+		}),
+		responses: {
+			"202": json("Accepted", ref("Created")),
+			"400": problem("invalid-message"),
+			"409": problem("A delivery with this key is in flight"),
+			"422": problem("invalid-message"),
+			"429": problem("rate-limited")
+		}
+	}) },
+	[`${ENV}/sign`]: { post: client({
+		summary: "cloudSigner",
+		requestBody: body({
+			type: "object",
+			required: [
+				"typ",
+				"claims",
+				"aud"
+			],
+			properties: {
+				typ: { type: "string" },
+				claims: { type: "object" },
+				aud: { anyOf: [{ type: "string" }, {
+					type: "array",
+					items: { type: "string" }
+				}] },
+				exp: { type: "integer" },
+				iat: { type: "integer" },
+				jti: { type: "string" }
+			}
+		}),
+		responses: {
+			"200": jwt("The compact JWS of the requested typ"),
+			"400": problem("Missing audience or claims"),
+			"422": problem("A typ the client key may not sign")
+		}
+	}) },
+	[`${ENV}/policy`]: { get: client({
+		summary: "policies.refresh",
+		responses: {
+			"200": jwt("A vnd.permdock.policy+jwt"),
+			"404": problem("No hosted grants")
+		}
+	}) }
+};
+const AUTHORING = {
+	[`${ENV}/hosted-grants`]: {
+		get: admin$1({
+			summary: "List hosted grants",
+			responses: { "200": json("The grants", items(ref("HostedGrant"))) }
+		}),
+		post: admin$1({
+			summary: "Author a hosted grant",
+			requestBody: body(ref("HostedGrant")),
+			responses: {
+				"201": json("The stored grant", withId(ref("HostedGrant"))),
+				"422": problem("A grant mergeHostedGrants would drop; reason names why")
+			}
+		})
+	},
+	[`${ENV}/hosted-grants/{id}`]: {
+		parameters: [ID],
+		delete: admin$1({
+			summary: "Remove a hosted grant",
+			responses: {
+				"204": empty("Removed"),
+				"404": problem("Unknown id")
+			}
+		})
+	},
+	[`${ENV}/directory/principals`]: {
+		get: admin$1({
+			summary: "List principals",
+			responses: { "200": json("The list", items({ type: "object" })) }
+		}),
+		post: admin$1({
+			summary: "Create a principal",
+			requestBody: body({
+				type: "object",
+				required: ["subject"]
+			}),
+			responses: { "201": json("Created", ref("Created")) }
+		})
+	},
+	[`${ENV}/directory/groups`]: {
+		get: admin$1({
+			summary: "List groups",
+			responses: { "200": json("The list", items({ type: "object" })) }
+		}),
+		post: admin$1({
+			summary: "Create a group",
+			requestBody: body({
+				type: "object",
+				required: ["name"]
+			}),
+			responses: { "201": json("Created", ref("Created")) }
+		})
+	},
+	...crud("directory/assignments", ref("Assignment"), ref("Assignment")),
+	...crud("connectors", withId(ref("Connector")), ref("Connector")),
+	...crud("trusted-issuers", withId(ref("TrustedIssuer")), ref("TrustedIssuer")),
+	...crud("trusted-peps", withId(ref("TrustedPep")), ref("TrustedPep")),
+	...crud("approver-groups", withId(ref("ApproverGroup")), ref("ApproverGroup")),
+	[`${ENV}/snapshots/invalidate`]: { post: admin$1({
+		summary: "Invalidate edge snapshots and send CAEP session-revoked",
+		requestBody: body({
+			type: "object",
+			required: ["reason"],
+			properties: {
+				principal: { type: "string" },
+				session: { type: "string" },
+				tenant: { type: "string" },
+				reason: {
+					type: "string",
+					minLength: 1
+				}
+			}
+		}),
+		responses: { "202": empty("Accepted") }
+	}) },
+	[`${ENV}/export`]: { get: keyed("export")({
+		summary: "The decision log",
+		parameters: [{
+			name: "format",
+			in: "query",
+			required: true,
+			schema: { enum: [
+				"jws",
+				"ocsf",
+				"csv",
+				"otlp"
+			] }
+		}],
+		responses: { "200": {
+			description: "The export",
+			content: {
+				"application/jwt": { schema: ref("CompactJws") },
+				"application/json": { schema: { type: "array" } },
+				"text/csv": { schema: { type: "string" } }
+			}
+		} }
+	}) }
+};
+const OAUTH_FORM = "application/x-www-form-urlencoded";
+const IDENTITY = {
+	[`${ENV}/oauth/authorize`]: { get: open({
+		summary: "Authorization code with PKCE; S256 only",
+		parameters: [
+			...[
+				"response_type",
+				"client_id",
+				"redirect_uri",
+				"code_challenge"
+			].map((name) => ({
+				name,
+				in: "query",
+				required: true,
+				schema: { type: "string" }
+			})),
+			{
+				name: "code_challenge_method",
+				in: "query",
+				required: true,
+				schema: { const: "S256" }
+			},
+			{
+				name: "state",
+				in: "query",
+				schema: { type: "string" }
+			},
+			{
+				name: "scope",
+				in: "query",
+				schema: { type: "string" }
+			}
+		],
+		responses: {
+			"302": empty("Redirect to the client with a code"),
+			"400": json("invalid_request, including plain PKCE", ref("OAuthError"))
+		}
+	}) },
+	[`${ENV}/oauth/device_authorization`]: { post: {
+		security: [{ oauthClient: [] }, { publicClient: [] }],
+		summary: "RFC 8628 device authorization",
+		requestBody: body({
+			type: "object",
+			required: ["client_id"]
+		}, OAUTH_FORM),
+		responses: {
+			"200": json("The codes", {
+				type: "object",
+				required: [
+					"device_code",
+					"user_code",
+					"verification_uri",
+					"expires_in"
+				],
+				properties: {
+					device_code: { type: "string" },
+					user_code: { type: "string" },
+					verification_uri: { type: "string" },
+					verification_uri_complete: { type: "string" },
+					expires_in: { type: "integer" },
+					interval: { type: "integer" }
+				}
+			}),
+			"400": json("invalid_request or invalid_client", ref("OAuthError"))
+		}
+	} },
+	[`${ENV}/oauth/token`]: { post: {
+		security: [{ oauthClient: [] }, { publicClient: [] }],
+		summary: "authorization_code, device_code, client_credentials and token exchange (confidential only), refresh_token",
+		requestBody: body({
+			type: "object",
+			required: ["grant_type"],
+			properties: { grant_type: { enum: [
+				"authorization_code",
+				"urn:ietf:params:oauth:grant-type:device_code",
+				"client_credentials",
+				"urn:ietf:params:oauth:grant-type:token-exchange",
+				"refresh_token"
+			] } }
+		}, OAUTH_FORM),
+		responses: {
+			"200": json("The tokens", ref("TokenResponse")),
+			"400": json("An RFC 6749 or RFC 8628 error", ref("OAuthError")),
+			"401": json("invalid_client", ref("OAuthError"))
+		}
+	} },
+	[`${ENV}/.well-known/openid-configuration`]: { get: open({
+		summary: "Issuer metadata",
+		responses: { "200": json("The metadata", ref("Metadata")) }
+	}) },
+	[`${ENV}/.well-known/jwks.json`]: { get: open({
+		summary: "The environment's JWK Set",
+		responses: { "200": json("The JWK Set", ref("Jwks")) }
+	}) }
+};
+const ads = (summary) => ({ post: {
+	security: [{ adsCaller: [] }],
+	summary,
+	requestBody: body({ type: "object" }),
+	responses: {
+		"200": json("The AuthZEN response", { type: "object" }),
+		"400": problem("Not an AuthZEN request"),
+		"401": problem("No verified caller")
+	}
+} });
+const ADS = {
+	[`${ENV}/access/v1/evaluation`]: ads("AuthZEN evaluation"),
+	[`${ENV}/access/v1/evaluations`]: ads("AuthZEN evaluations"),
+	[`${ENV}/access/v1/search/subject`]: ads("AuthZEN subject search"),
+	[`${ENV}/access/v1/search/resource`]: ads("AuthZEN resource search"),
+	[`${ENV}/access/v1/search/action`]: ads("AuthZEN action search"),
+	[`${ENV}/.well-known/authzen-configuration`]: { get: open({
+		summary: "AuthZEN metadata",
+		responses: { "200": json("The metadata", ref("Metadata")) }
+	}) }
+};
+const ssf = (operation) => ({
+	security: [{ ssfReceiver: [] }],
+	...operation
+});
+const STREAM_ID = {
+	name: "stream_id",
+	in: "query",
+	schema: { type: "string" }
+};
+const SSF = {
+	[`${ENV}/ssf/receive/{connector}`]: {
+		parameters: [{
+			name: "connector",
+			in: "path",
+			required: true,
+			schema: { type: "string" }
+		}],
+		post: {
+			security: [{ connectorStream: [] }],
+			summary: "RFC 8935 push into the Cloud's SSF receiver",
+			requestBody: body(ref("CompactJws"), "application/secevent+jwt"),
+			responses: {
+				"202": empty("Accepted"),
+				"400": json("An RFC 8935 error", {
+					type: "object",
+					required: ["err"]
+				}),
+				"401": empty("Unknown stream credential")
+			}
+		}
+	},
+	[`${ENV}/.well-known/ssf-configuration`]: { get: open({
+		summary: "SSF transmitter metadata",
+		responses: { "200": json("The metadata", ref("Metadata")) }
+	}) },
+	[`${ENV}/ssf/streams`]: {
+		get: ssf({
+			summary: "Read streams",
+			parameters: [STREAM_ID],
+			responses: { "200": json("The stream", ref("SsfStream")) }
+		}),
+		post: ssf({
+			summary: "Create a stream",
+			requestBody: body({ type: "object" }),
+			responses: { "201": json("The stream", ref("SsfStream")) }
+		}),
+		patch: ssf({
+			summary: "Update a stream",
+			requestBody: body(ref("SsfStream")),
+			responses: { "200": json("The stream", ref("SsfStream")) }
+		}),
+		delete: ssf({
+			summary: "Delete a stream",
+			parameters: [STREAM_ID],
+			responses: { "204": empty("Deleted") }
+		})
+	},
+	[`${ENV}/ssf/status`]: {
+		get: ssf({
+			summary: "A stream's status",
+			parameters: [STREAM_ID],
+			responses: { "200": json("The status", {
+				type: "object",
+				required: ["status"]
+			}) }
+		}),
+		post: ssf({
+			summary: "Set a stream's status",
+			requestBody: body({
+				type: "object",
+				required: ["stream_id", "status"]
+			}),
+			responses: { "200": json("The status", {
+				type: "object",
+				required: ["status"]
+			}) }
+		})
+	},
+	[`${ENV}/ssf/verify`]: { post: ssf({
+		summary: "Send a verification event",
+		requestBody: body({
+			type: "object",
+			required: ["stream_id"]
+		}),
+		responses: { "204": empty("Queued") }
+	}) },
+	[`${ENV}/ssf/poll`]: { post: ssf({
+		summary: "RFC 8936 poll",
+		requestBody: body({ type: "object" }),
+		responses: {
+			"200": json("Pending SETs", ref("SetPoll")),
+			"400": json("invalid_request", {
+				type: "object",
+				required: ["err"]
+			})
+		}
+	}) }
+};
+const scim = (summary) => ({
+	security: [{ scimBearer: [] }],
+	summary,
+	responses: {
+		"200": {
+			description: "The SCIM response",
+			content: { "application/scim+json": { schema: { type: "object" } } }
+		},
+		"401": empty("Not the connection's bearer")
+	}
+});
+const SCIM = { "/scim/v2/{connection}/{resource}": {
+	parameters: [{
+		name: "connection",
+		in: "path",
+		required: true,
+		schema: { type: "string" }
+	}, {
+		name: "resource",
+		in: "path",
+		required: true,
+		description: "The SCIM path below the connection",
+		schema: { type: "string" }
+	}],
+	get: scim("SCIM read"),
+	post: scim("SCIM create"),
+	put: scim("SCIM replace"),
+	patch: scim("SCIM patch"),
+	delete: scim("SCIM delete")
+} };
+function withEnv(paths) {
+	return Object.fromEntries(Object.entries(paths).map(([path, item]) => {
+		if (!path.startsWith(ENV)) return [path, item];
+		const parameters = Array.isArray(item["parameters"]) ? item["parameters"] : [];
+		return [path, {
+			...item,
+			parameters: [{ $ref: "#/components/parameters/env" }, ...parameters]
+		}];
+	}));
+}
+const bearer = (description) => ({
+	type: "http",
+	scheme: "bearer",
+	description
+});
+/**
+* `schemas/cloud-api-v1.json`: the PermDock Cloud HTTP API as an OpenAPI 3.1
+* document. The route tables in `adapters/cloud.mdx` and `docs:drift` keep it whole.
+*/
+const CLOUD_API_DOCUMENT = freezeDeep({
+	openapi: "3.1.1",
+	info: {
+		title: "PermDock Cloud API",
+		version: "1.0.0",
+		description: "The platform issuer and project read API the permdock CLI calls, the routes permdock/cloud calls, and the authoring, identity, ADS, SSF and SCIM routes a Cloud implementation serves. Errors are RFC 9457 Problem Details unless the route's own standard says otherwise."
+	},
+	jsonSchemaDialect: "https://spec.openapis.org/oas/3.1/dialect/base",
+	servers: [{ url: "https://permdock.com/api" }],
+	paths: withEnv({
+		...PLATFORM_PATHS,
+		...APPROVALS,
+		...RUNTIME,
+		...AUTHORING,
+		...IDENTITY,
+		...ADS,
+		...SSF,
+		...SCIM
+	}),
+	components: {
+		parameters: {
+			env: {
+				name: "env",
+				in: "path",
+				required: true,
+				schema: {
+					type: "string",
+					minLength: 1
+				}
+			},
+			id: {
+				name: "id",
+				in: "path",
+				required: true,
+				schema: {
+					type: "string",
+					minLength: 1
+				}
+			}
+		},
+		schemas: {
+			...SCHEMAS,
+			...PLATFORM_SCHEMAS
+		},
+		securitySchemes: {
+			client: bearer("The client key (PERMDOCK_CLOUD_KEY)"),
+			admin: bearer("The admin key (PERMDOCK_CLOUD_ADMIN_KEY)"),
+			export: bearer("An export key"),
+			oauthClient: {
+				type: "http",
+				scheme: "basic",
+				description: "A confidential OAuth client, client_secret_basic"
+			},
+			publicClient: {
+				type: "apiKey",
+				in: "query",
+				name: "client_id",
+				description: "A public OAuth client; token exchange refuses it"
+			},
+			adsCaller: bearer("A Vercel OIDC or client-credentials token for the environment"),
+			ssfReceiver: bearer("A receiver's token for its stream"),
+			connectorStream: bearer("The caep-transmitter connector's stream credential"),
+			scimBearer: bearer("The SCIM connection's bearer"),
+			...PLATFORM_SECURITY_SCHEMES
+		}
+	}
+});
+//#endregion
+//#region src/testing/cloud-api/validate.ts
+const DOCUMENT_ID = "https://permdock.com/schemas/cloud-api-v1.json";
+const METHODS = [
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete"
+];
+function patternOf(template) {
+	const source = template.split(/(\{[^}]+\})/u).map((part) => {
+		if (part === "{resource}") return ".+";
+		if (part.startsWith("{")) return "[^/]+";
+		return part.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+	}).join("");
+	return new RegExp(`^${source}$`, "u");
+}
+function routesOf(paths) {
+	const routes = [];
+	for (const [template, item] of Object.entries(paths)) for (const method of METHODS) {
+		const responses = item[method]?.responses;
+		if (isRecord(responses)) routes.push({
+			method: method.toUpperCase(),
+			template,
+			pattern: patternOf(template),
+			responses
+		});
+	}
+	return routes.toSorted((a, b) => a.template.split("{").length - b.template.split("{").length);
+}
+function pointer(parts) {
+	return parts.map((part) => part.replaceAll("~", "~0").replaceAll("/", "~1")).join("/");
+}
+/** A checker for responses of the PermDock Cloud API, compiled once from `CLOUD_API_DOCUMENT`. */
+function cloudApiValidator() {
+	const ajv = new import__2020.Ajv2020({
+		strict: false,
+		allErrors: false,
+		validateFormats: false
+	});
+	ajv.addSchema(APPROVAL_REQUEST_SCHEMA);
+	ajv.addSchema(CONNECTOR_SCHEMA);
+	ajv.addSchema(catalogSchema);
+	ajv.addSchema(PUSHED_POLICY_SCHEMA);
+	ajv.addSchema(supabaseManifestSchema);
+	ajv.addSchema({
+		...CLOUD_API_DOCUMENT,
+		$id: DOCUMENT_ID
+	});
+	const routes = routesOf(CLOUD_API_DOCUMENT["paths"]);
+	const validators = /* @__PURE__ */ new Map();
+	const validatorFor = (parts) => {
+		const key = pointer(parts);
+		if (!validators.has(key)) validators.set(key, ajv.getSchema(`${DOCUMENT_ID}#/${key}`));
+		return validators.get(key);
+	};
+	return async (method, path, response) => {
+		const name = `${method} ${path} ${String(response.status)}`;
+		const route = routes.find((item) => item.method === method && item.pattern.test(path));
+		if (route === void 0) return [`${method} ${path} is not in cloud-api-v1.json`];
+		const spec = route.responses[String(response.status)];
+		if (!isRecord(spec)) return [`${name}: cloud-api-v1.json documents no ${String(response.status)} for ${route.template}`];
+		const content = spec["content"];
+		if (!isRecord(content)) return [];
+		const [type = ""] = (response.headers.get("content-type") ?? "").toLowerCase().split(";").map((part) => part.trim());
+		if (!(type in content)) return [`${name}: content type "${type}", documented ${Object.keys(content).join(", ")}`];
+		const text = await response.text();
+		let body = text;
+		if (type.endsWith("json")) try {
+			body = JSON.parse(text);
+		} catch {
+			return [`${name}: the ${type} body is not JSON`];
+		}
+		const validate = validatorFor([
+			"paths",
+			route.template,
+			method.toLowerCase(),
+			"responses",
+			String(response.status),
+			"content",
+			type,
+			"schema"
+		]);
+		if (validate === void 0 || validate(body)) return [];
+		return [`${name}: ${ajv.errorsText(validate.errors)}`];
+	};
+}
+//#endregion
+//#region src/testing/cloud-api/index.ts
+const REFUSED_TYPES = [
+	"vnd.permdock.policy+jwt",
+	"vnd.permdock.snapshot+jwt",
+	"vnd.permdock.evidence+jwt",
+	"at+jwt"
+];
+const admin = {
+	principal: {
+		id: "u_9",
+		roles: ["admin"]
+	},
+	context: {}
+};
+const member = {
+	principal: {
+		id: "u_2",
+		roles: ["member"]
+	},
+	context: {}
+};
+function sample(token, overrides = {}) {
+	return {
+		v: 1,
+		id: `apr_${token}`,
+		token,
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: {
+			type: "post",
+			id: "42"
+		},
+		subject: { principal: {
+			id: "u_1",
+			roles: ["member"]
+		} },
+		detail: "post.delete requires human approval.",
+		createdAt: isoAt(nowMillis()),
+		expiresAt: isoAt(nowMillis() + 36e5),
+		status: "pending",
+		...overrides
+	};
+}
+const METADATA = "/.well-known/oauth-authorization-server";
+function trimSlash(value) {
+	return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+async function problemCode(response) {
+	const body = await response.json();
+	return isRecord(body) ? body["code"] : void 0;
+}
+/**
+* Runs the conformance runners and the HTTP contract checks against one
+* PermDock Cloud environment, and validates every response body against
+* `cloud-api-v1.json`. Point it at a test environment: it creates approvals,
+* sends decision events and deliveries to `.invalid` addresses, and pushes
+* the catalog the environment already holds.
+*/
+function testCloudApi(baseUrl, keys, options) {
+	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+	const url = trimSlash(baseUrl);
+	const prefix = trimSlash(new URL(url).pathname);
+	const { issuer } = cloudEndpoints({
+		url,
+		...options.environment === void 0 ? {} : { environment: options.environment }
+	});
+	const check = cloudApiValidator();
+	const problems = [];
+	const checks = [];
+	const recording = async (input, init) => {
+		const request = new Request(input, init);
+		const response = await fetchFn(request);
+		const { pathname } = new URL(request.url);
+		const path = pathname === `${METADATA}${prefix}` ? METADATA : pathname.slice(prefix.length);
+		checks.push(check(request.method, path, response.clone()).then((found) => {
+			problems.push(...found);
+		}));
+		return response;
+	};
+	const client = cloud({
+		url,
+		key: keys.client,
+		fetch: recording,
+		approver: options.approver,
+		...options.environment === void 0 ? {} : { environment: options.environment },
+		...options.verifier === void 0 ? {} : { verifier: options.verifier }
+	});
+	const call = (path, key, init = {}) => {
+		const headers = new Headers(init.headers);
+		if (key !== null) headers.set("authorization", `Bearer ${key}`);
+		if (init.body !== void 0 && !headers.has("content-type")) headers.set("content-type", "application/json");
+		return recording(`${issuer}${path}`, {
+			...init,
+			headers
+		});
+	};
+	const tag = () => `cloud-api-${globalThis.crypto.randomUUID()}`;
+	const resolveRaw = async (token, verdict, target) => {
+		const approver = await approverHeaders(verdict, options.approver, issuer, target);
+		return call("/approvals/by-token/resolve", keys.client, {
+			method: "POST",
+			headers: {
+				[APPROVAL_HEADER]: token,
+				...approver
+			},
+			body: JSON.stringify(verdict)
+		});
+	};
+	const current = async (token) => {
+		const response = await call("/approvals/by-token", keys.client, { headers: { [APPROVAL_HEADER]: token } });
+		expect(response.status).toBe(200);
+		const request = await response.json();
+		const etag = response.headers.get("etag");
+		return etag === null ? { request } : {
+			request,
+			etag
+		};
+	};
+	testApprovalStore(client.approvals);
+	testDecisionSink(client.sink);
+	testPolicySource(client.policies);
+	if (options.subject !== void 0) {
+		const subject = options.subject;
+		testSnapshotSource({ get: async () => client.snapshotsFor(await subject()).get() });
+	}
+	if (options.authzen !== void 0) testAuthzen(async (request) => recording(request), {
+		vectors: options.authzen.vectors,
+		origin: issuer,
+		...options.authzen.headers === void 0 ? {} : { headers: options.authzen.headers }
+	});
+	if (options.platform !== void 0) testCloudPlatform(url, options.environment ?? "production", options.platform, recording);
+	it("answers 401 Problem Details without a key", async () => {
+		const response = await call("/approvals", null);
+		expect(response.status).toBe(401);
+		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
+	});
+	it("answers 403 to a key of another kind", async () => {
+		expect((await call("/hosted-grants", keys.client)).status).toBe(403);
+		if (keys.export !== void 0) expect((await call("/approvals", keys.export)).status).toBe(403);
+	});
+	it("sends an ETag on the approval read and refuses an approver token with a stale one", async () => {
+		const token = tag();
+		await client.approvals.create(sample(token));
+		const { request, etag } = await current(token);
+		expect(etag).toEqual(expect.any(String));
+		const stale = await resolveRaw(token, {
+			status: "approved",
+			by: admin
+		}, async () => ({
+			request,
+			etag: "\"stale\""
+		}));
+		expect(stale.status).toBe(409);
+		expect((await client.approvals.get(token))?.status).toBe("pending");
+	});
+	it("answers the documented resolve statuses", async () => {
+		const verdict = {
+			status: "approved",
+			by: admin
+		};
+		const unsigned = tag();
+		await client.approvals.create(sample(unsigned));
+		const missingApprover = await call("/approvals/by-token/resolve", keys.client, {
+			method: "POST",
+			headers: { [APPROVAL_HEADER]: unsigned },
+			body: JSON.stringify(verdict)
+		});
+		expect(missingApprover.status).toBe(401);
+		expect(await problemCode(missingApprover)).toBe("approver-unauthenticated");
+		const gated = tag();
+		await client.approvals.create(sample(gated, { approvers: { by: {
+			kind: "role",
+			role: "admin",
+			scope: "global"
+		} } }));
+		const ineligible = await resolveRaw(gated, {
+			status: "approved",
+			by: member
+		}, async () => current(gated));
+		expect(ineligible.status).toBe(403);
+		const once = tag();
+		await client.approvals.create(sample(once));
+		expect((await resolveRaw(once, verdict, async () => current(once))).status).toBe(200);
+		expect((await resolveRaw(once, verdict, async () => current(once))).status).toBe(409);
+		const expired = tag();
+		await client.approvals.create(sample(expired, {
+			createdAt: isoAt(nowMillis() - 72e5),
+			expiresAt: isoAt(nowMillis() - 6e4)
+		}));
+		expect((await resolveRaw(expired, verdict, async () => current(expired))).status).toBe(410);
+		const missing = tag();
+		const notFound = await resolveRaw(missing, verdict, async () => ({ request: sample(missing) }));
+		expect(notFound.status).toBe(404);
+	});
+	it("refuses to sign the Cloud's own token types and approver tokens", async () => {
+		for (const typ of REFUSED_TYPES) {
+			const response = await call("/sign", keys.client, {
+				method: "POST",
+				headers: { accept: "application/jwt" },
+				body: JSON.stringify({
+					typ,
+					claims: { sub: "u_1" },
+					aud: issuer
+				})
+			});
+			expect([typ, response.status]).toEqual([typ, 422]);
+		}
+	});
+	it("repeats a delivery for a repeated Idempotency-Key and requires one", async () => {
+		const delivery = tag();
+		const message = {
+			channel: "email",
+			delivery,
+			target: {
+				address: `${delivery}@example.invalid`,
+				principal: "u_1",
+				permission: "post.delete"
+			},
+			message: {
+				subject: "PermDock contract test",
+				text: "Ignore."
+			}
+		};
+		const send = (headers) => call("/deliveries", keys.client, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(message)
+		});
+		const first = await send({ "idempotency-key": delivery });
+		const second = await send({ "idempotency-key": delivery });
+		expect(first.ok && second.ok).toBe(true);
+		const [a, b] = await Promise.all([first.json(), second.json()]);
+		expect(isRecord(a) && isRecord(b) && a["id"] === b["id"]).toBe(true);
+		expect((await send({})).status).toBe(400);
+	});
+	it("answers unchanged for the catalog it already holds", async (context) => {
+		const response = await call("/catalog", keys.client);
+		if (response.status === 404) context.skip();
+		expect(response.status).toBe(200);
+		const catalog = await response.json();
+		expect(isRecord(catalog)).toBe(true);
+		const pushed = await client.catalog.push(catalog);
+		expect(pushed).toMatchObject({ unchanged: true });
+	});
+	it("answers 422 with a reason for a hosted grant the engine would drop", async (context) => {
+		if (keys.admin === void 0) context.skip();
+		const response = await call("/hosted-grants", keys.admin ?? "", {
+			method: "POST",
+			body: JSON.stringify({
+				permission: "permdock.cloud-api-test.missing",
+				to: { kind: "authenticated" }
+			})
+		});
+		expect(response.status).toBe(422);
+		const body = await response.json();
+		expect(isRecord(body) && body["reason"]).toBe("unknown-permission");
+	});
+	it("serves the snapshot as application/jwt only to a fresh subject token", async (context) => {
+		if (options.subject === void 0) {
+			context.skip();
+			return;
+		}
+		const token = await options.subject();
+		const get = (headers) => call("/snapshot", keys.client, { headers: {
+			accept: "application/jwt",
+			...headers
+		} });
+		const first = await get({ "permdock-subject": token });
+		expect(first.status).toBe(200);
+		expect(first.headers.get("content-type")).toMatch(/^application\/jwt/u);
+		expect((await get({ "permdock-subject": token })).status).toBe(401);
+		expect((await get({})).status).toBe(401);
+	});
+	it("answers every request in the shapes cloud-api-v1.json documents", async () => {
+		await Promise.all(checks);
+		expect(problems).toEqual([]);
+	});
+}
+//#endregion
+//#region src/testing/conformance/where.ts
+const WHERE_ROWS = [
+	{
+		id: "r1",
+		authorId: "u1",
+		score: 5,
+		title: "Plan 100%",
+		archived: false,
+		note: null
+	},
+	{
+		id: "r2",
+		authorId: "u2",
+		score: 10,
+		title: "plan_b",
+		archived: true,
+		note: "kept"
+	},
+	{
+		id: "r3",
+		authorId: null,
+		score: null,
+		title: null,
+		archived: null,
+		note: null
+	}
+];
+const WHERE_CASES = [
+	["eq", {
+		op: "eq",
+		field: "authorId",
+		value: "u1"
+	}],
+	["ne", {
+		op: "ne",
+		field: "authorId",
+		value: "u1"
+	}],
+	["eq on a boolean", {
+		op: "eq",
+		field: "archived",
+		value: false
 	}],
 	["gt", {
 		op: "gt",
@@ -2419,9 +5212,9 @@ const jwtFixtureTokens = {
 	wrongIss: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2V2aWwuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwfQ.tIcLHLa9JLtKz1gqjRGdr5DFbUzRDs5KsoPsJCxspvbBcsFfRFG2G0XJnd1h4QHyZ_5B4OhY3W_jIIsnOPD9Bg",
 	unknownKid: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoibm9wZSIsInR5cCI6ImF0K2p3dCJ9.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MjAwMDAwMDAwMH0.walgG5GvpCVBnkMtkdw-epi5c93JqfvAM_N4EWR9Tqhiw_cnzITnlQyoVfihECmV1fqtFrhwM1RCIRJvd38zAQ",
 	none: "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ1XzEiLCJpc3MiOiJodHRwczovL2xvZ2luLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJleHAiOjIwMDAwMDAwMDAsImlhdCI6MTcwMDAwMDAwMH0.",
-	snapshot: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLXNuYXBzaG90K2p3dCJ9.eyJzbmFwc2hvdCI6eyJ2IjoyLCJpc3N1ZWRBdCI6MTcwMDAwMDAwMCwic3ViamVjdCI6eyJwcmluY2lwYWwiOnsiaWQiOiJ1XzEiLCJyb2xlcyI6WyJtZW1iZXIiXX0sImNvbnRleHQiOnt9fSwicm9sZXMiOlsibWVtYmVyIl0sImdyYW50cyI6W10sInRlbmFudHMiOltdfSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJzbmFwX2ZpeHR1cmUifQ.4itaYctluoCwU-syytUxArtS_FRyNAti2SZxuSH-nKIMr7-Sb3h1Q3xugn_vPR1eupV4fVNIe6dH27_EiyDvCA",
-	approval: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWFwcHJvdmFsK2p3dCJ9.eyJhcHByb3ZhbCI6eyJ0b2tlbiI6InBkMS5hYmMiLCJwZXJtaXNzaW9uIjoicG9zdC5kZWxldGUiLCJyZXNvdXJjZSI6eyJ0eXBlIjoicG9zdCIsImlkIjoiNDIifSwic3RhdHVzIjoiYXBwcm92ZWQifSwic3ViIjoidV8xIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJhcHJfZml4dHVyZSJ9.UHsoSzQCo68G7ee-EFqdzMLvmqaKlFIMdQKFuqZEM4yUQnJsJJTXbld_aCXcyfN-IdjF9cj2F5EHzsV4nLKbBg",
-	decisions: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InBlcm1kb2NrLWRlY2lzaW9ucytqd3QifQ.eyJldmVudHMiOltdLCJpc3MiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoyMDAwMDAwMDAwLCJqdGkiOiJkZWNfZml4dHVyZSJ9.UZhJd72yFGxHOdjYbzcGYUPgYjvLwOPCtHKxEbLu56SdKSKUDCREXmEBI9WaCPKWjlTBnnIKMYwjG8I8RATJCg"
+	snapshot: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InZuZC5wZXJtZG9jay5zbmFwc2hvdCtqd3QifQ.eyJzbmFwc2hvdCI6eyJ2IjoxLCJzdWJqZWN0Ijp7InByaW5jaXBhbCI6eyJpZCI6InVfMSIsInJvbGVzIjpbIm1lbWJlciJdfSwiY29udGV4dCI6e319LCJyb2xlcyI6WyJtZW1iZXIiXSwiZ3JhbnRzIjpbXSwidGVuYW50cyI6W119LCJzdWIiOiJ1XzEiLCJpYXQiOjE3MDAwMDAwMDAsImp0aSI6InNuYXBfZml4dHVyZSIsImlzcyI6Imh0dHBzOi8vYXBwLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJleHAiOjIwMDAwMDAwMDB9.41KijBuOn1Ehodp60-Pn6qx_WrHQ-BiVUmYy2vjcHjO3o1dopXxjnHJP7P1c-6ghYgrvucPu7hZrDjTtPhxWBw",
+	approval: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InZuZC5wZXJtZG9jay5hcHByb3ZhbCtqd3QifQ.eyJzdWIiOiJ1XzEiLCJ0b2tlbiI6InNoYS0yNTY6NDdERVFwajhIQlNhLV9USW1XLTVKQ2V1UWVSa201Tk1wSldaRzNoU3VGVSIsInJlc29sdmVkX2J5IjoidV8yIiwiYXBwcm92YWxzIjpbeyJieSI6InVfMiIsImF0IjoiMjAyMy0xMS0xNFQyMjoxMzoyMFoifV0sImF1dGhvcml6YXRpb25fZGV0YWlscyI6W3sidHlwZSI6InBvc3QiLCJhY3Rpb25zIjpbImRlbGV0ZSJdLCJpZGVudGlmaWVyIjoiNDIifV0sImlhdCI6MTcwMDAwMDAwMCwianRpIjoiYXByX2ZpeHR1cmUiLCJpc3MiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImF1ZCI6Imh0dHBzOi8vYXBwLmV4YW1wbGUuY29tIiwiZXhwIjoyMDAwMDAwMDAwfQ.Q76F3tDT2FrEnxD9TjdLfEayJEyyGUWHu6bTCCl5Flegcl9-o370agNVhcV03Khfidm-lK7gPg05ZiYcpCfyBQ",
+	decisions: "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMjAyNi0wOSIsInR5cCI6InZuZC5wZXJtZG9jay5ldmlkZW5jZStqd3QifQ.eyJldmVudHMiOltdLCJpYXQiOjE3MDAwMDAwMDAsImp0aSI6ImRlY19maXh0dXJlIiwiaXNzIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20iLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbSIsImV4cCI6MjAwMDAwMDAwMH0.oGiFmCEFWUAEBtLO3F_rnGMSKBhb9rIxng4YLwRbBTA3fudrbJMcJD2BhNH99cjcBa1xCmADfdOnTc-Ltq-kAA"
 };
 //#endregion
 //#region src/testing/conformance/credentials.ts
@@ -2434,7 +5227,7 @@ function testReplayStore(store) {
 		expect(await store.seen("jti-2")).toBe(false);
 	});
 	it("forgets a jti whose expiresAt has passed", async () => {
-		await store.remember("ttl-jti", Math.floor(Date.now() / 1e3) - 1);
+		await store.remember("ttl-jti", nowSeconds() - 1);
 		expect(await store.seen("ttl-jti")).toBe(false);
 	});
 	it("claims a key once under concurrency and releases it for a retry", async (context) => {
@@ -2442,7 +5235,7 @@ function testReplayStore(store) {
 			context.skip();
 			return;
 		}
-		const expiresAt = Math.floor(Date.now() / 1e3) + 60;
+		const expiresAt = nowSeconds() + 60;
 		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
 		expect(results.toSorted()).toEqual([false, true]);
 		expect(await store.seen("claim-key")).toBe(true);
@@ -2450,6 +5243,43 @@ function testReplayStore(store) {
 		expect(await store.claim("claim-key", expiresAt)).toBe(true);
 	});
 }
+function testSetQueue(queue) {
+	it("returns pending SETs oldest first, at most max, per stream", async () => {
+		await queue.enqueue("stream-a", "a1", "set-a1");
+		await queue.enqueue("stream-a", "a2", "set-a2");
+		await queue.enqueue("stream-b", "b1", "set-b1");
+		expect(await queue.pending("stream-a", 10)).toEqual([{
+			jti: "a1",
+			set: "set-a1"
+		}, {
+			jti: "a2",
+			set: "set-a2"
+		}]);
+		expect(await queue.pending("stream-a", 1)).toEqual([{
+			jti: "a1",
+			set: "set-a1"
+		}]);
+		expect(await queue.pending("stream-b", 10)).toEqual([{
+			jti: "b1",
+			set: "set-b1"
+		}]);
+	});
+	it("keeps a SET pending until it is acknowledged or reported failed", async () => {
+		await queue.enqueue("stream-c", "c1", "set-c1");
+		await queue.enqueue("stream-c", "c2", "set-c2");
+		await queue.enqueue("stream-c", "c3", "set-c3");
+		await queue.ack("stream-c", "c1");
+		await queue.fail("stream-c", "c2", {
+			err: "invalid_key",
+			description: "unknown kid"
+		});
+		await queue.ack("stream-other", "c3");
+		expect(await queue.pending("stream-c", 10)).toEqual([{
+			jti: "c3",
+			set: "set-c3"
+		}]);
+	});
+}
 function testRevocationFeed(feed) {
 	it("delivers each event to every subscriber until it unsubscribes", async () => {
 		const first = [];
@@ -2636,8 +5466,8 @@ function testCredentialVerifier(verifier, options) {
 		const key = await live();
 		const before = parseCredential(await verifier.verify(key));
 		const id = parseApiKey(key)?.id ?? "";
-		await verifier.touch?.(id, Math.floor(Date.now() / 1e3));
-		await verifier.touch?.("unknown-id", Math.floor(Date.now() / 1e3));
+		await verifier.touch?.(id, { epochMilliseconds: nowMillis() });
+		await verifier.touch?.("unknown-id", { epochMilliseconds: nowMillis() });
 		expect(parseCredential(await verifier.verify(key))).toEqual(before);
 	});
 	if (options.revoke !== void 0) {
@@ -2655,7 +5485,7 @@ function testTokenSigner(signer, options) {
 			snapshot: { v: 1 },
 			sub: "u_1"
 		}, {
-			typ: "permdock-snapshot+jwt",
+			typ: "vnd.permdock.snapshot+jwt",
 			audience: "https://app.example.com"
 		});
 		const header = decodeHeader(token);
@@ -2664,10 +5494,10 @@ function testTokenSigner(signer, options) {
 			"kid",
 			"typ"
 		]);
-		expect(header["typ"]).toBe("permdock-snapshot+jwt");
+		expect(header["typ"]).toBe("vnd.permdock.snapshot+jwt");
 		expect(header["alg"]).not.toBe("none");
 		const verified = await options.verifier.verify(token, {
-			typ: "permdock-snapshot+jwt",
+			typ: "vnd.permdock.snapshot+jwt",
 			audience: "https://app.example.com"
 		});
 		expect(verified.ok).toBe(true);
@@ -2679,80 +5509,82 @@ function testTokenSigner(signer, options) {
 	});
 }
 //#endregion
-//#region src/testing/conformance/runtime-stores.ts
-function testLimitStore(store) {
-	it("counts down synchronously and fails closed when exhausted", async () => {
-		const input = {
-			key: "report.export",
-			subjectId: "u_1",
-			count: 2,
-			per: "hour",
-			now: 17e8
-		};
-		const first = await store.consume(input);
-		expect(first.remaining).toBeGreaterThanOrEqual(0);
-		const peeked = store.remaining(input);
-		if (peeked !== void 0) {
-			expect(typeof peeked.remaining).toBe("number");
-			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
-		}
-		await store.consume(input);
-		const exhausted = await store.consume(input);
-		expect(exhausted.remaining).toBeLessThan(0);
-	});
+//#region src/testing/conformance/providers.ts
+const OUTCOMES = [
+	"granted",
+	"denied",
+	"approval-required"
+];
+const LOCAL = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "no-grant"
+	})]),
+	alternatives: Object.freeze([])
+});
+function expectDecision(decision) {
+	expect(OUTCOMES).toContain(decision.outcome);
+	if (decision.outcome === "denied") expect(decision.denials.length).toBeGreaterThan(0);
 }
-function testDecisionSink(sink) {
-	it("accepts batches and never propagates write errors", async () => {
-		await expect(Promise.resolve(sink.write([{
-			type: "membership",
-			at: (/* @__PURE__ */ new Date()).toISOString(),
-			source: "app",
-			operation: "changed",
-			principal: { id: "u_1" },
-			roles: {
-				added: ["admin"],
-				removed: ["member"]
-			}
-		}]))).resolves.toBeUndefined();
-		await expect(Promise.resolve(sink.write([]))).resolves.toBeUndefined();
-		if (sink.flush !== void 0) {
-			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
-			await expect(Promise.resolve(sink.flush())).resolves.toBeUndefined();
-		}
+function testDecisionProvider(provider, options) {
+	const request = Object.freeze({
+		permission: options.permission,
+		data: options.data,
+		subject: options.subject,
+		local: LOCAL
 	});
-}
-function testSnapshotSource(source) {
-	it("round-trips a snapshot", async () => {
-		const snapshot = await source.get();
-		expect(snapshot === null || snapshot === void 0).toBe(false);
-		if (typeof snapshot === "object" && snapshot !== null && "v" in snapshot) expect(snapshot.v).toBe(1);
-		if (source.subscribe !== void 0) source.subscribe(() => void 0)();
+	it("names itself and claims the permission synchronously", () => {
+		expect(typeof provider.name).toBe("string");
+		expect(provider.name.length).toBeGreaterThan(0);
+		expect(provider.handles(options.permission)).toBe(true);
 	});
-}
-function testPolicySource(source, options = {}) {
-	const readCurrent = () => {
-		const document = source.current();
-		expect(document !== null && typeof document === "object" && "then" in document && typeof document.then === "function").toBe(false);
-		return document;
-	};
-	it("returns null or a v1 policy document synchronously", () => {
-		const document = readCurrent();
-		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+	it("answers decide with one of the three outcomes", async () => {
+		expectDecision(await provider.decide(request));
 	});
-	it("refreshes without rejecting and keeps current() synchronous", async () => {
-		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
-		const document = readCurrent();
-		if (document !== null) expect(document.v).toBe(1);
+	it("lists permitted ids as non-empty strings, or null or undefined", async () => {
+		const ids = provider.permitted === void 0 ? void 0 : await provider.permitted({
+			permission: options.permission,
+			subject: options.subject
+		});
+		expect(ids === null || ids === void 0 || ids.every((id) => typeof id === "string" && id.length > 0)).toBe(true);
 	});
-	if (options.policy !== void 0) {
-		const policy = options.policy;
-		it("merges only grants on hostable permissions", () => {
-			const document = readCurrent();
-			const merged = mergeHostedGrants(policy, document);
-			for (const grant of merged.policy.grants) if (grant.hosted !== void 0) expect(policy.hostable).toContain(grant.permission.key);
-			for (const dropped of merged.dropped) expect(dropped.kind).toBe("hosted-grant-dropped");
+	it("denies without throwing when its transport fails", async () => {
+		const unavailable = options.unavailable;
+		const decision = unavailable === void 0 ? void 0 : await unavailable.decide(request).catch(() => void 0);
+		expect(unavailable === void 0 || decision?.outcome === "denied").toBe(true);
+	});
+}
+function testSnapshotStorage(storage) {
+	const key = `permdock.conformance.${globalThis.crypto.randomUUID()}`;
+	const other = `${key}.other`;
+	it("reads back what it stores, verbatim", async () => {
+		const value = JSON.stringify({
+			v: 1,
+			note: "ünïcødé \u2028 line"
 		});
-	}
+		await storage.setItem(key, value);
+		expect(await storage.getItem(key)).toBe(value);
+		await storage.setItem(key, "replaced");
+		expect(await storage.getItem(key)).toBe("replaced");
+		await storage.removeItem(key);
+	});
+	it("answers null for a key it never stored or removed", async () => {
+		expect(await storage.getItem(other)).toBeNull();
+		await storage.setItem(key, "kept");
+		await storage.removeItem(key);
+		expect(await storage.getItem(key)).toBeNull();
+		await storage.removeItem(other);
+	});
+	it("keeps keys apart", async () => {
+		await storage.setItem(key, "a");
+		await storage.setItem(other, "b");
+		expect(await storage.getItem(key)).toBe("a");
+		expect(await storage.getItem(other)).toBe("b");
+		await storage.removeItem(key);
+		expect(await storage.getItem(other)).toBe("b");
+		await storage.removeItem(other);
+	});
 }
 //#endregion
 //#region src/testing/conformance/relations.ts
@@ -2878,6 +5710,302 @@ function testRelationSource(source, options) {
 	});
 }
 //#endregion
+//#region src/testing/conformance/principals.ts
+function isFrozenDeep(value) {
+	if (value === null || typeof value !== "object") return true;
+	return Object.isFrozen(value) && Object.values(value).every((item) => isFrozenDeep(item));
+}
+/**
+* Checks a `PrincipalSource`: `principal` answers each listed id with the
+* expected principal or `null`, never another id; `principalByIdentity`
+* resolves each listed identity to the expected principal id or `null`, and
+* an email matches trimmed and in any case.
+*/
+function testPrincipalSource(source, options) {
+	it("returns the principal with the asked id, or null", async () => {
+		for (const entry of options.principals) {
+			let found;
+			try {
+				found = await source.principal(entry.id, entry.tenant === void 0 ? {} : { tenant: entry.tenant });
+			} catch {
+				found = null;
+			}
+			expect(found === null || typeof found === "object").toBe(true);
+			if (found !== null) expect(await loadPrincipal(source, entry.id, entry.tenant)).toEqual(found);
+			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+		}
+	});
+	it("returns principals a caller cannot change", async () => {
+		for (const entry of options.principals) {
+			const found = await loadPrincipal(source, entry.id, entry.tenant);
+			if (found !== null) expect(isFrozenDeep(found)).toBe(true);
+		}
+	});
+	it("answers an empty or unknown id with null", async () => {
+		expect(await loadPrincipal(source, "")).toBeNull();
+		expect(await loadPrincipal(source, "permdock-conformance-unknown-principal")).toBeNull();
+	});
+	if (options.identities !== void 0 && options.identities.length > 0) {
+		const identities = options.identities;
+		it("resolves linked identities and nothing else", async () => {
+			for (const entry of identities) {
+				const found = await loadPrincipalByIdentity(source, entry.identity);
+				expect(found?.id ?? null).toBe(entry.expect);
+			}
+		});
+		it("matches an email trimmed and in any case", async () => {
+			for (const entry of identities) {
+				if (entry.identity.kind !== "email" || entry.expect === null) continue;
+				const shouted = await loadPrincipalByIdentity(source, {
+					kind: "email",
+					value: `  ${entry.identity.value.toUpperCase()}  `
+				});
+				expect(shouted?.id ?? null).toBe(entry.expect);
+			}
+		});
+	}
+}
+//#endregion
+//#region src/testing/conformance/automations.ts
+async function automationOf(source, id, tenant) {
+	try {
+		return await source.automation(id, tenant === void 0 ? {} : { tenant });
+	} catch {
+		return null;
+	}
+}
+/**
+* Checks an `AutomationSource`: `automation(id)` answers each listed id
+* with a valid Automation v1 record of that id or `null`, never another id;
+* a record held to one tenant is `null` when asked for another; an empty or
+* unknown id is `null`.
+*/
+function testAutomationSource(source, options) {
+	it("returns a valid v1 record with the asked id, or null", async () => {
+		for (const entry of options.automations) {
+			const found = await automationOf(source, entry.id, entry.tenant);
+			if (found !== null) {
+				const parsed = parseAutomation(found);
+				expect(parsed).toEqual(found);
+				expect(parsed?.id).toBe(entry.id);
+			}
+			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+		}
+	});
+	it("refuses a record held to another tenant", async () => {
+		for (const entry of options.automations) {
+			const found = parseAutomation(await automationOf(source, entry.id));
+			if (found?.tenant === void 0) continue;
+			expect(await automationOf(source, entry.id, `${found.tenant}-permdock-conformance-other`)).toBeNull();
+		}
+	});
+	it("answers an empty or unknown id with null", async () => {
+		expect(await automationOf(source, "")).toBeNull();
+		expect(await automationOf(source, "permdock-conformance-unknown-automation")).toBeNull();
+	});
+}
+async function sessionOf(source, id) {
+	try {
+		return await source.session(id);
+	} catch {
+		return null;
+	}
+}
+/**
+* Checks a `SupportSessionSource`: `session(id)` answers each listed id
+* with a record of that id or `null`, never another id; `ended` is a
+* boolean when present; an empty or unknown id is `null`.
+*/
+function testSupportSessionSource(source, options) {
+	it("returns the session with the asked id, or null", async () => {
+		for (const entry of options.sessions) {
+			const found = await sessionOf(source, entry.id);
+			expect(found === null || typeof found === "object").toBe(true);
+			if (found !== null && typeof found === "object") {
+				expect(Reflect.get(found, "id")).toBe(entry.id);
+				const ended = Reflect.get(found, "ended");
+				expect(ended === void 0 || typeof ended === "boolean").toBe(true);
+			}
+			if (entry.ended === null) expect(found).toBeNull();
+			else if (entry.ended !== void 0) {
+				expect(found).not.toBeNull();
+				expect(found !== null && typeof found === "object" && Reflect.get(found, "ended") === true).toBe(entry.ended);
+			}
+		}
+	});
+	it("answers an empty or unknown id with null", async () => {
+		expect(await sessionOf(source, "")).toBeNull();
+		expect(await sessionOf(source, "permdock-conformance-unknown-session")).toBeNull();
+	});
+}
+const SETTLED = Symbol("settled");
+/** Whether `promise` settles within `ms` milliseconds; a rejection counts as settled. */
+async function settlesWithin(promise, ms) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			resolve(false);
+		}, ms);
+	});
+	try {
+		return await Promise.race([promise.then(() => SETTLED, () => SETTLED), timeout]).then((result) => result === SETTLED);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* Checks an `ApprovalWaiter`: a wait ends when its token is woken and not
+* when another token is; waking a token nobody waits on resolves; a wait
+* whose `expiresAt` has passed ends; an aborted `signal` rejects the wait with its reason.
+* Pass `expiry: false` or `abort: false` for a waiter whose runner offers no
+* timer or no cancellation, `pending` when the waiter reads a store, and
+* `parked` when a wait parks asynchronously.
+*/
+function testApprovalWaiter(waiter, options = {}) {
+	const timeout = options.timeout ?? 1e3;
+	const pending = async (label) => {
+		return options.pending === void 0 ? `permdock-conformance-${label}` : await options.pending(label);
+	};
+	const parked = options.parked ?? (() => new Promise((resolve) => {
+		setTimeout(resolve, 0);
+	}));
+	it("ends a wait when its token is woken, and only then", async () => {
+		const woken = await pending("woken");
+		const still = await pending("other");
+		const waiting = waiter.wait(woken);
+		const other = waiter.wait(still);
+		await parked(woken);
+		await parked(still);
+		await waiter.wake(woken);
+		expect(await settlesWithin(waiting, timeout)).toBe(true);
+		await expect(waiting).resolves.toBeUndefined();
+		expect(await settlesWithin(other, 20)).toBe(false);
+		await waiter.wake(still);
+		await expect(other).resolves.toBeUndefined();
+	});
+	it("resolves a wake for a token nobody waits on", async () => {
+		await expect(Promise.resolve(waiter.wake("permdock-conformance-nobody"))).resolves.toBeUndefined();
+	});
+	if (options.expiry !== false) it("ends a wait whose expiresAt has passed", async () => {
+		const waiting = waiter.wait(await pending("expired"), { expiresAt: { epochMilliseconds: nowMillis() - 1e3 } });
+		expect(await settlesWithin(waiting, timeout)).toBe(true);
+		await expect(waiting).resolves.toBeUndefined();
+	});
+	if (options.abort !== false) it("rejects a wait when its signal aborts", async () => {
+		const token = await pending("aborted");
+		const controller = new AbortController();
+		const waiting = waiter.wait(token, { signal: controller.signal });
+		await parked(token);
+		const reason = /* @__PURE__ */ new Error("permdock-conformance-abort");
+		controller.abort(reason);
+		await expect(waiting).rejects.toBe(reason);
+	});
+}
+//#endregion
+//#region src/testing/delivery-transport.ts
+const permissions = definePermissions({ notice: resource({ actions: ["read"] }) });
+const policy = definePolicy(permissions, {
+	grants: [allow(permissions.notice.read, { to: authenticated() })],
+	subject: (user) => user
+});
+async function grantedDecision() {
+	const decision = (await getPermDock(policy, { id: "u_runner" })).decide(permissions.notice.read, { id: "n_runner" }, { trusted: true });
+	if (decision.outcome !== "granted") throw new Error("testDeliveryTransport: the runner policy did not grant");
+	return decision;
+}
+function key(suffix) {
+	return {
+		idempotencyKey: `pdd_runner_${suffix}`,
+		delivery: "dlv_runner"
+	};
+}
+/**
+* Conformance for a `DeliveryTransport`: it sends a checked target with its
+* idempotency key, keeps the key on a retry, refuses a target without a
+* granted decision before calling the provider, and maps provider errors to
+* retryable or final failures without rejecting.
+*/
+function testDeliveryTransport(name, options) {
+	const targetWith = async (decision) => ({
+		channel: options.channel,
+		address: options.address,
+		principal: "u_runner",
+		decision
+	});
+	const send = async (harness, target, suffix) => harness.transport.deliver(target, options.message, key(suffix));
+	describe(`${name} (delivery transport)`, () => {
+		it("names its channel and provider", () => {
+			const { transport } = options.create();
+			expect(transport.channel).toBe(options.channel);
+			expect(typeof transport.name).toBe("string");
+			expect(transport.name).not.toBe("");
+		});
+		it("sends a checked target with its idempotency key", async () => {
+			const harness = options.create();
+			const result = await send(harness, await targetWith(await grantedDecision()), "a");
+			expect(result.status).toBe("sent");
+			expect(await harness.received()).toEqual([{ idempotencyKey: "pdd_runner_a" }]);
+		});
+		it("passes the same key on a retry of the same delivery", async () => {
+			const harness = options.create();
+			const target = await targetWith(await grantedDecision());
+			await send(harness, target, "b");
+			await send(harness, target, "b");
+			const received = await harness.received();
+			expect(received.length).toBeGreaterThan(0);
+			expect(received.every((entry) => entry.idempotencyKey === "pdd_runner_b")).toBe(true);
+		});
+		it("refuses a target without a granted decision and never calls the provider", async () => {
+			const harness = options.create();
+			for (const decision of [
+				void 0,
+				{
+					outcome: "denied",
+					denials: [],
+					alternatives: []
+				},
+				{ outcome: "approval-required" }
+			]) expect(await send(harness, await targetWith(decision), "c")).toMatchObject({
+				status: "failed",
+				cause: "invalid-recipient",
+				retryable: false
+			});
+			expect(await harness.received()).toEqual([]);
+		});
+		it("maps a retryable provider error to a retryable failure", async () => {
+			const harness = options.create();
+			harness.fail("retryable");
+			expect(await send(harness, await targetWith(await grantedDecision()), "d")).toMatchObject({
+				status: "failed",
+				retryable: true
+			});
+		});
+		it("maps a final provider error to a final failure", async () => {
+			const harness = options.create();
+			harness.fail("final");
+			expect(await send(harness, await targetWith(await grantedDecision()), "e")).toMatchObject({
+				status: "failed",
+				retryable: false
+			});
+		});
+		it("resolves a provider throw as a retryable failure or rejects for the router to catch", async () => {
+			const harness = options.create();
+			harness.fail("throw");
+			let result;
+			try {
+				result = await send(harness, await targetWith(await grantedDecision()), "f");
+			} catch {
+				result = void 0;
+			}
+			if (result !== void 0) expect(result).toMatchObject({
+				status: "failed",
+				retryable: true
+			});
+			expect(await harness.received()).toEqual([]);
+		});
+	});
+}
+//#endregion
 //#region src/testing/conformance/identity.ts
 function testSubjectResolver(resolver, options) {
 	it("never throws and fails closed to anonymous", async () => {
@@ -2948,7 +6076,7 @@ function testEntitlementSource(source, options) {
 		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
 	});
 }
-function testRoleSource(source, options) {
+function testCustomRoleSource(source, options) {
 	it("only resolves declared role names", async () => {
 		const declared = options.declared.map((item) => typeof item === "string" ? item : item.key);
 		const roles = await source.rolesFor(options.tenant);
@@ -3046,7 +6174,7 @@ function testDirectoryStore(store, options) {
 		const kinds = [];
 		const token = "conformance-scim-token";
 		const handle = scimHandler({
-			store,
+			directory: store,
 			tenant: home,
 			token: {
 				hash: "sha256",
@@ -3100,7 +6228,7 @@ function testSettingsSource(source, options) {
 			const credentials = settings.credentials;
 			if (credentials !== void 0) {
 				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
-				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service")).toBe(true);
+				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service" || kind === "feed")).toBe(true);
 			}
 			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
 		}
@@ -3137,6 +6265,17 @@ const ownerMembership = {
 	managedBy: "idp",
 	entitlements: ["seat:pro"]
 };
+const ownerMembershipClaim = {
+	scope: ownerMembership.scope,
+	id: ownerMembership.id,
+	roles: ownerMembership.roles,
+	via: ownerMembership.via,
+	expires_at: ownerMembership.expiresAt,
+	granted_by: ownerMembership.grantedBy,
+	reason: ownerMembership.reason,
+	managed_by: ownerMembership.managedBy,
+	entitlements: ownerMembership.entitlements
+};
 const projectMembership = {
 	scope: "project",
 	id: project,
@@ -3290,7 +6429,7 @@ const supabaseClaimFixtures = {
 			},
 			authz_ver: 3
 		},
-		options: { plans: "features" },
+		options: { claims: { plans: "features" } },
 		expect: {
 			id,
 			roles: [],
@@ -3315,7 +6454,7 @@ const supabaseClaimFixtures = {
 			tenant_id: org,
 			memberships: [
 				{
-					...ownerMembership,
+					...ownerMembershipClaim,
 					grants: { analyst: ["post.read", "-post.delete"] }
 				},
 				projectMembership,
@@ -3683,4 +6822,139 @@ const supabaseHookManifestFixture = {
 	}
 };
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, ormParity, rlsParity, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAgentAdapter, testApprovalPolicySource, testApprovalStore, testAuthZen, testClientParity, testClientStore, testCredentialVerifier, testDecisionSink, testDirectoryStore, testEntitlementSource, testHttpAdapter, testLimitStore, testMembershipSource, testPolicySource, testRelationSource, testReplayStore, testRevocationFeed, testRoleSource, testSettingsSource, testSnapshotSource, testSubjectResolver, testTokenSigner, testTokenVerifier, testWhereCompiler };
+//#region src/testing/problem-examples.ts
+/**
+* One RFC 9457 body per PermDock problem type, exactly as the HTTP adapters
+* write it for a `post.delete` request by subject `u_123`. A client tests its
+* error handling against these; `tests/standards/problem-details.test.ts`
+* rebuilds each from the code that emits it, and the docs show the same JSON.
+*/
+const PROBLEM_EXAMPLES = Object.freeze({
+	denied: {
+		type: "https://permdock.com/problems/denied",
+		title: "Permission denied",
+		status: 403,
+		detail: "post.delete denied for subject u_123: member (condition). Alternatives: post.read, post.update.",
+		instance: "/posts/p_42",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		denials: [{
+			role: "member",
+			reason: "condition"
+		}],
+		alternatives: ["post.read", "post.update"]
+	},
+	"approval-required": {
+		type: "https://permdock.com/problems/approval-required",
+		title: "Approval required",
+		status: 403,
+		detail: "post.delete requires human approval (human). Token: pd1.eyJhbGciOiJFZERTQSJ9.",
+		instance: "/posts/p_42",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		reason: "human",
+		token: "pd1.eyJhbGciOiJFZERTQSJ9",
+		approval: { at: "https://app.example/approvals" }
+	},
+	validation: {
+		type: "https://permdock.com/problems/validation",
+		title: "Invalid resource data",
+		status: 400,
+		detail: "invalid post",
+		permission: "post.delete",
+		issues: [{
+			message: "title is required",
+			path: ["title"]
+		}]
+	},
+	"step-up-required": {
+		type: "https://permdock.com/problems/step-up-required",
+		title: "Step-up required",
+		status: 401,
+		detail: "post.delete denied for subject u_123: member (insufficient-user-authentication). Alternatives: post.read, post.update.",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		denials: [{
+			role: "member",
+			reason: "insufficient-user-authentication",
+			to: {
+				kind: "assurance",
+				acr: ["urn:mfa"],
+				maxAge: 600
+			}
+		}],
+		alternatives: ["post.read", "post.update"],
+		acrValues: ["urn:mfa"],
+		maxAge: 600
+	},
+	"not-entitled": {
+		type: "https://permdock.com/problems/not-entitled",
+		title: "Plan upgrade required",
+		status: 403,
+		detail: "post.delete denied for subject u_123: admin (not-entitled). Alternatives: post.read, post.update.",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		denials: [{
+			role: "admin",
+			reason: "not-entitled",
+			to: {
+				kind: "plan",
+				plan: "pro"
+			}
+		}],
+		alternatives: ["post.read", "post.update"],
+		plans: ["pro"]
+	},
+	"rate-limited": {
+		type: "https://permdock.com/problems/rate-limited",
+		title: "Rate limit exceeded",
+		status: 429,
+		detail: "post.delete denied for subject u_123: member (limit). Alternatives: post.read, post.update.",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		denials: [{
+			role: "member",
+			reason: "limit",
+			detail: {
+				count: 10,
+				per: 60,
+				resetsAt: "2030-03-17T17:46:40.000Z"
+			}
+		}],
+		alternatives: ["post.read", "post.update"]
+	},
+	"limit-unavailable": {
+		type: "https://permdock.com/problems/limit-unavailable",
+		title: "Rate limit unavailable",
+		status: 503,
+		detail: "post.delete denied for subject u_123: member (limit-unavailable). Alternatives: post.read, post.update.",
+		permission: "post.delete",
+		scope: "post:delete",
+		resource: { type: "post" },
+		denials: [{
+			role: "member",
+			reason: "limit-unavailable"
+		}],
+		alternatives: ["post.read", "post.update"]
+	},
+	"invalid-signature": {
+		type: "https://permdock.com/problems/invalid-signature",
+		title: "Invalid signature",
+		status: 403,
+		detail: "HTTP Message Signature did not verify"
+	},
+	"approver-not-eligible": {
+		type: "https://permdock.com/problems/approver-not-eligible",
+		title: "Approver not eligible",
+		status: 403,
+		detail: "approver is the principal of this request",
+		reason: "approver-is-principal"
+	}
+});
+//#endregion
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };