permdock 0.5.0 → 0.7.0

package/dist/testing/index.d.ts

@@ -1,179 +1,34 @@
-import { J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, Vt as Snapshot, W as CustomRoleSource, Zn as CustomRole, Zt as DeliveryChannel, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, ir as Subject, it as RelationSource, mt as WhereCompiler, nr as Membership, ot as SnapshotSource, q as DecisionSink, rr as Principal, st as SubjectResolver, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
-import { C as InferPermissionTree, k as ResourceInit, r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { Q as LegacyCheck } from "../index-DOVf7RJv.js";
-import { S as ApprovalPolicySource, c as WhereResult, d as PrincipalIdentity, g as Limits, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-D7eeLJER.js";
-import { o as PolicySource } from "../hosted-DBDX0M-P.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { a as ProblemDetails } from "../errors-C2PXIv4c.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BDS7wc3y.js";
-import { c as AccessReviewStore } from "../types-_sHy8BQf.js";
-import { F as IdempotencyStore } from "../index-CxGUswIC.js";
+import { Gt as Snapshot, J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, W as CustomRoleSource, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, lr as Subject, mt as WhereCompiler, or as Membership, ot as SnapshotSource, q as DecisionSink, sr as Principal, st as SubjectResolver, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
+import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-DhNEmoRG.js";
+import { r as Role } from "../vocabulary-Bg3eeT2H.js";
+import { st as LegacyCheck } from "../index-BTkwrK7v.js";
+import { T as ApprovalPolicySource, a as PermDock, h as PrincipalSource, p as PrincipalIdentity, v as Limits } from "../permdock-Dco6dyCK.js";
+import { s as PolicySource } from "../hosted-BmjzxQhp.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DC44-hqb.js";
+import { a as ProblemDetails } from "../errors-B_Qg9D3e.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-UTnUVETj.js";
+import { c as AccessReviewStore } from "../types-CfiKC5aN.js";
+import { R as IdempotencyStore } from "../index-BE8y3moU.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { s as SupportSessionSource } from "../index-Chrs5fQ-.js";
-import { a as AutomationSource, t as Automation } from "../automation-BMZPIVUM.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-DX0LaKTb.js";
-import { n as SupabaseHookManifest } from "../manifest-mx5ghSFM.js";
+import { s as SupportSessionSource } from "../index-BSfRl0hZ.js";
+import { a as AutomationSource, t as Automation } from "../automation-DOtAFWdy.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-g7Oy6Zg4.js";
+import { r as SupabaseHookManifest } from "../manifest-BVhExYhw.js";
 import { t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
-import { t as CloudApproverOptions } from "../types-C8-KNsFf.js";
-import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DiQjupG2.js";
-import { r as SnapshotStorage } from "../types-BjV-fqcA.js";
-import { y as DirectoryStore } from "../index-SGdIQyzc.js";
-import { a as SaasProject } from "../permissions-oEWfl-kl.js";
-import { n as saasPolicy } from "../policy-Czo4n3Hs.js";
+import { t as CloudApproverOptions } from "../types-DBHftjgS.js";
+import { n as ApprovalWaiter } from "../waiter-DwEyouan.js";
+import { g as SetQueue, l as ReplayStore } from "../types-cTos-H7p.js";
+import { r as SnapshotStorage } from "../types-CeIscIKp.js";
+import { x as DirectoryStore } from "../index-DH9DUDEM.js";
+import { S as SsfStreamStore } from "../index-CMiPH2Tv.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CQkE8Esr.js";
+import { a as SaasProject } from "../permissions-CoqCOfJ3.js";
+import { n as saasPolicy } from "../policy-B7dg_yzu.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
-type MatrixOutcome = "granted" | "denied" | "approval-required";
-type MatrixCell = MatrixOutcome | {
-  readonly outcome?: MatrixOutcome;
-  readonly denials?: readonly {
-    readonly role?: string | null;
-    readonly reason: string;
-  }[];
-  readonly alternatives?: readonly string[];
-  /** Obligation kinds a granted decision carries, in order; `[]` asserts none. */
-  readonly obligations?: readonly string[];
-  /** The `name` of the deny grant `explain` reports as the one that won. */
-  readonly deniedBy?: string;
-};
-type DescribePolicyConfig<TSubject> = {
-  readonly subjects: Record<string, TSubject>;
-  readonly fixtures?: Record<string, unknown>;
-  readonly matrix: Record<string, Record<string, MatrixCell | Record<string, MatrixCell>>>;
-  readonly exhaustive?: boolean;
-  readonly options?: PermDockOptions;
-  /**
-   * Also assert every granted or denied cell against `fromSnapshot(permdock.snapshot())`,
-   * the client a Server Component hands down. Closures cannot cross a snapshot and deny on the client.
-   */
-  readonly snapshot?: boolean;
-};
+/** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
 export declare function describePolicy<TSubject>(policy: Policy, config: DescribePolicyConfig<TSubject>): void;
 //#endregion
-//#region src/testing/rls-parity.d.ts
-type RlsDbOutcome = "allowed" | "filtered" | "rejected";
-type RlsParitySubject = {
-  readonly id: string;
-  readonly roles?: readonly string[];
-  readonly tenant?: string;
-  readonly memberships?: readonly Membership[];
-  /**
-   * Extra token claims, read in memory as `principal.claims.*`. They join the
-   * JWT claims (`supabase`, `neon`); under `guc` each top-level claim is its
-   * own `<prefix>.<name>` setting, strings as is and anything else as JSON.
-   */
-  readonly claims?: Readonly<Record<string, unknown>>;
-};
-type RlsParityFixture = {
-  readonly name: string;
-  readonly subject: RlsParitySubject;
-  readonly permission: Permission;
-  readonly row: Readonly<Record<string, unknown>>;
-  readonly table: string;
-};
-type RlsQueryResult = {
-  readonly rows: readonly Record<string, unknown>[];
-  readonly rowCount?: number;
-  readonly code?: string;
-};
-type RlsQueryFn = (sql: string, values?: readonly unknown[]) => Promise<RlsQueryResult>;
-type RlsParityOptions = {
-  readonly query: RlsQueryFn;
-  readonly fixtures: readonly RlsParityFixture[];
-  /**
-   * `supabase` and `neon` set `request.jwt.claims`; a test database stubs
-   * `auth.jwt()` / `auth.uid()` or `auth.session()` / `auth.user_id()` over it.
-   */
-  readonly dialect?: "supabase" | "neon" | "guc";
-  readonly gucPrefix?: string;
-  readonly tenantClaim?: string;
-  /** Claim (or `guc` setting) the RLS helpers read global roles from. Default `user_role`. */
-  readonly roleClaim?: string;
-  readonly role?: "authenticated" | "anon";
-  /**
-   * Tenant-defined roles the subjects' memberships may hold. `decide` resolves them through a
-   * `CustomRoleSource`; each membership's claim carries them as the compact `grants` map, which the
-   * helpers read in `jwt` mode. Seeding the `database`-mode tables is the caller's job.
-   */
-  readonly customRoles?: readonly CustomRole[];
-  /** Also decide each case from the subject's serialized snapshot (`fromSnapshot`); it must agree. */
-  readonly snapshot?: boolean;
-  /**
-   * With `rls generate --fields views`: for each instance read, the row of
-   * `<table>_visible` must hold exactly the columns `pick` keeps (plus the key,
-   * which always passes through). A table with no view is read directly.
-   */
-  readonly fieldViews?: boolean;
-};
-/** Columns with a value in the view's row and in `pick`'s result, sorted. */
-type RlsFieldsOutcome = {
-  readonly app: readonly string[];
-  readonly database: readonly string[] | string;
-};
-type RlsParityCase = {
-  readonly name: string;
-  readonly granted: boolean;
-  readonly database: RlsDbOutcome;
-  /** The snapshot's decision, with `snapshot: true`. */
-  readonly snapshot?: boolean;
-  /** The field view check, with `fieldViews: true`; `database` is an error code when the read failed. */
-  readonly fields?: RlsFieldsOutcome;
-  readonly ok: boolean;
-};
-type RlsParityReport = {
-  readonly ok: boolean;
-  readonly results: readonly RlsParityCase[];
-};
-export declare function testRlsParity<TUser>(policy: Policy<TUser>, options: RlsParityOptions): Promise<RlsParityReport>;
-//#endregion
-//#region src/testing/orm-parity.d.ts
-type OrmParityScenario<TUser = unknown> = {
-  readonly name: string;
-  /** What the policy's `subject` mapper receives, as in `createPermDock(policy, user)`. */
-  readonly user: TUser;
-  /** The active tenant and role sources, as in `createPermDock(policy, user, options)`. */
-  readonly options?: PermDockOptions;
-  /** An instance permission; its `where()` filters the table. */
-  readonly permission: Permission<string, unknown, "instance">;
-  /** Every row of the table, exactly as the database holds them. */
-  readonly rows: readonly Readonly<Record<string, unknown>>[];
-};
-type OrmParityRunInput<TUser = unknown> = {
-  readonly scenario: OrmParityScenario<TUser>;
-  readonly where: WhereResult;
-};
-type OrmParityOptions<TUser = unknown> = {
-  /** Runs `toWhere(where)` against the database and returns the matching row ids. */
-  readonly run: (input: OrmParityRunInput<TUser>) => Promise<readonly unknown[]>;
-  /** The row id field; default `id`. */
-  readonly id?: string;
-};
-type OrmParityCase = {
-  readonly name: string;
-  readonly expected: readonly string[];
-  readonly actual: readonly string[];
-  /**
-   * `where()` left out a non-portable grant. `toWhere` refusing it is
-   * fail-closed and passes; rows it does return must be a subset.
-   */
-  readonly partial: boolean;
-  readonly error?: string;
-  readonly ok: boolean;
-};
-type OrmParityReport = {
-  readonly ok: boolean;
-  readonly results: readonly OrmParityCase[];
-};
-/**
- * ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
- * must be exactly the rows the database returns for `toWhere(permdock.where())`.
- * With a `relations` option, the graph is loaded for the rows first, so the
- * in-memory side walks the same graph the database query does.
- * A partial `where()` (a closure grant it cannot compile) may be refused or
- * return fewer rows, never more.
- */
-export declare function testOrmParity<TUser>(policy: Policy<TUser>, scenarios: readonly OrmParityScenario<TUser>[], options: OrmParityOptions<TUser>): Promise<OrmParityReport>;
-//#endregion
 //#region src/testing/client-parity.d.ts
 type ClientParityCase = {
   readonly name: string;
@@ -597,6 +452,8 @@ type TestCloudPlatformOptions = {
     readonly project: string;
     readonly token: string;
   };
+  /** A login token with `projects:read` and without `policy:read`; the `insufficient_scope` check is skipped without it. */
+  readonly projectsOnly?: string;
   /** Registers a test MCP client with RFC 7591; skipped unless true. */
   readonly registration?: boolean;
 };
@@ -639,11 +496,20 @@ export declare function testCloudApi(baseUrl: string, keys: CloudApiKeys, option
 //#region src/testing/conformance/approvals.d.ts
 type ApprovalStoreOptions = {
   /**
-   * Opens a second store over the same backing storage, as a restarted process
-   * would. Omit it for stores that do not persist (the resume-after-restart
-   * case is then skipped).
+   * Opens a second client over the same backing storage, as a restarted
+   * process would: for a hosted store, `() => cloud(...).approvals`. Omit it
+   * for stores that do not persist (the resume-after-restart case is then
+   * skipped).
    */
   readonly reopen?: () => ApprovalStore | Promise<ApprovalStore>;
+  readonly capabilities?: {
+    /**
+     * Marks the record for `token` expired, or moves its `expiresAt` into the
+     * past, in the backing storage. Without it the replace-on-expiry case is
+     * skipped.
+     */
+    readonly expire?: (token: string) => Promise<void> | void;
+  };
 };
 export declare function testApprovalStore(store: ApprovalStore, options?: ApprovalStoreOptions): void;
 /**
@@ -695,6 +561,7 @@ export declare function testWhereCompiler<TTarget>(compiler: WhereCompiler<TTarg
 //#region src/testing/conformance/credentials.d.ts
 export declare function testReplayStore(store: ReplayStore): void;
 export declare function testSetQueue(queue: SetQueue): void;
+export declare function testSsfStreamStore(store: SsfStreamStore): void;
 export declare function testRevocationFeed(feed: RevocationFeed): void;
 export declare function testTokenVerifier(verifier: TokenVerifier, options?: {
   readonly audience?: string;
@@ -1027,4 +894,4 @@ type ProblemType = (typeof PROBLEM_TYPES)[number];
  */
 export declare const PROBLEM_EXAMPLES: Readonly<Record<ProblemType, ProblemDetails>>;
 //#endregion
-export { type AgentAdapterOptions, type AgentCall, type AgentMounted, type AgentOutcome, type AgentRuntimeContext, type AgentRuntimeDomain, type AgentRuntimeModel, type AgentRuntimeMounted, type AgentRuntimeOperation, type AgentRuntimeOptions, type AgentRuntimeScenarioName, type AgentScenarioDomain, type AgentScenarioName, type AgentToolName, type ApprovalStoreOptions, type AuthzenEvaluationVector, type AuthzenEvaluationsVector, type AuthzenSearchVector, type AuthzenVectors, type ClientParityCase, type ClientParityOptions, type ClientStoreFactory, type ClientStoreFactoryOptions, type ClientStoreHandle, type ClientStorePermDock, type ClientStoreStatus, type CloudApiKeys, type DecisionProviderRunnerOptions, type DeliveryFailureKind, type DeliveryTransportHarness, type DeliveryTransportOptions, type DescribePolicyConfig, type HttpAdapterOptions, type HttpCall, type HttpMounted, type HttpOp, type HttpResult, type HttpScenarioDomain, type HttpScenarioName, type LegacyParityCase, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, type SupabaseClaimFixture, type SupabaseClaimFixtureName, type SupabaseClaimVectors, type TestAuthzenOptions, type TestCloudApiOptions, type TestCloudPlatformOptions, expectTypeOf, supabaseMembershipsBudget };
+export { type AgentAdapterOptions, type AgentCall, type AgentMounted, type AgentOutcome, type AgentRuntimeContext, type AgentRuntimeDomain, type AgentRuntimeModel, type AgentRuntimeMounted, type AgentRuntimeOperation, type AgentRuntimeOptions, type AgentRuntimeScenarioName, type AgentScenarioDomain, type AgentScenarioName, type AgentToolName, type ApprovalStoreOptions, type AuthzenEvaluationVector, type AuthzenEvaluationsVector, type AuthzenSearchVector, type AuthzenVectors, type ClientParityCase, type ClientParityOptions, type ClientStoreFactory, type ClientStoreFactoryOptions, type ClientStoreHandle, type ClientStorePermDock, type ClientStoreStatus, type CloudApiKeys, type DecisionProviderRunnerOptions, type DeliveryFailureKind, type DeliveryTransportHarness, type DeliveryTransportOptions, type DescribePolicyConfig, type HttpAdapterOptions, type HttpCall, type HttpMounted, type HttpOp, type HttpResult, type HttpScenarioDomain, type HttpScenarioName, type LegacyParityCase, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, type SupabaseClaimFixture, type SupabaseClaimFixtureName, type SupabaseClaimVectors, type TestAuthzenOptions, type TestCloudApiOptions, type TestCloudPlatformOptions, expectTypeOf, policyMatrix, supabaseMembershipsBudget, testOrmParity, testRlsParity };