permdock 0.5.0 → 0.7.0

package/dist/testing/index.js

@@ -1,312 +1,69 @@
-import { t as require__2020 } from "../2020-C9VN-x8c.js";
 import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as principal } from "../refs-K6eWUJ0H.js";
-import { n as role, r as allow } from "../role-builder-CXbis5-X.js";
-import { E as memoryCustomRoleSource, _ as limits, s as snapshotFor, v as memoryLimitStore, x as approvalPoliciesFor } from "../src-DLfUWFAI.js";
+import { i as principal } from "../refs-CNJBiTFo.js";
+import { n as role, r as allow } from "../role-builder-C1VJzvcr.js";
+import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DLFrtrrC.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-pHneukrx.js";
-import { _ as resource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { v as resource } from "../permission-registry-DpPtSKNZ.js";
 import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
-import { r as parseAutomation } from "../automation-DVjOckjV.js";
-import { a as normalizeMemberships, d as scopeList } from "../scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "../delegation-DaXVdDhM.js";
-import { a as authenticated } from "../grantee-Cn1HyUsI.js";
-import { n as definePolicy } from "../policy-DLZJ5gAp.js";
+import { r as parseAutomation } from "../automation-ySsxp_Yp.js";
+import { f as scopeList, o as normalizeMemberships } from "../scopes-BHsc-wp-.js";
+import { u as evaluateCondition } from "../delegation-C5rOdTp5.js";
+import { a as authenticated } from "../grantee-BrRANrpT.js";
+import { n as definePolicy } from "../policy-DaJy4nK4.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { a as mergeHostedGrants, o as parsePolicyDocument } from "../hosted-BZIAYvon.js";
-import { t as definePermissions } from "../permissions-B-wCP5ZC.js";
-import { _ as membershipsClaim, x as validateCustomRole } from "../evaluate-_R8QkWaf.js";
-import { n as parseSnapshot } from "../snapshot-CXUWfsNy.js";
-import { n as fromSnapshot } from "../from-snapshot-D2lZt4Dd.js";
-import { t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-XBgU6RGT.js";
+import { t as definePermissions } from "../permissions-CyH2MV_B.js";
+import { T as validateCustomRole } from "../evaluate-B_oqFbWC.js";
+import { n as parseSnapshot } from "../snapshot-CbGmYiJx.js";
+import { n as fromSnapshot } from "../from-snapshot-Bz469dIh.js";
+import { t as getPermDock } from "../permdock-BfWEeMqk.js";
 import { t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { i as memoryApprovalStore } from "../store-4u_hxjWa.js";
-import { t as catalogFingerprint } from "../catalog-fingerprint-CCP0-yQS.js";
-import { s as parseCredential } from "../credential-DM2um3ha.js";
+import { i as memoryApprovalStore } from "../store-DSP9oGvh.js";
+import { t as catalogFingerprint } from "../catalog-fingerprint-C144oW4M.js";
+import { s as parseCredential } from "../credential-CIM7wHwA.js";
 import { s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { o as resolveApproval } from "../helpers-DTcZOzhF.js";
+import { o as resolveApproval } from "../helpers-DY3vXuGs.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
 import { t as catalogSchema } from "../schema-B4v0Qrac.js";
-import { c as parseApiKey } from "../server-DqCT4CgZ.js";
+import { c as parseApiKey } from "../server-Bnga6I50.js";
 import { n as discoverAuthorizationServer } from "../device-BARQ8eYG.js";
-import { T as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-ClHtpyV3.js";
-import { a as approverHeaders, r as cloudEndpoints, t as cloud } from "../create-BWRSXgOF.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-_VCSsdtD.js";
+import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-YNieBO1U.js";
+import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-nGWma08S.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "../sql-B5T1IL83.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-C0kK_8V0.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DobP7AHI.js";
-import { i as saasPermissions } from "../permissions-CZKiUfFM.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-FO-Q8oj0.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-Cv492Qev.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-B5-w6Kw9.js";
+import { i as saasPermissions } from "../permissions-DArULThq.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-Az_Kz-4D.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-CJ2325SZ.js";
+import { t as require__2020 } from "../2020-CJbO8Bvz.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
-function isOutcomeCell(value) {
-	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);
-}
-/** Asserts `deniedBy` against the trace of a fresh `explain` call for the same arguments. */
-function assertDeniedBy(instance, permission, data, cell) {
-	if (typeof cell !== "object" || cell.deniedBy === void 0) return;
-	const explained = instance.explain(permission, data);
-	expect(explained.outcome).toBe("denied");
-	expect(explained.trace.denies[0]?.name).toBe(cell.deniedBy);
-}
-function expectedOutcome(cell) {
-	return typeof cell === "string" ? cell : cell.outcome ?? "denied";
-}
-function assertCell(decision, cell) {
-	expect(decision.outcome).toBe(expectedOutcome(cell));
-	if (typeof cell === "object" && cell.denials !== void 0 && decision.outcome === "denied") for (const denial of cell.denials) expect(decision.denials.some((item) => item.reason === denial.reason && (denial.role === void 0 || item.role === denial.role))).toBe(true);
-	if (typeof cell === "object" && cell.alternatives !== void 0 && decision.outcome === "denied") expect(decision.alternatives.map((leaf) => leaf.key)).toEqual(cell.alternatives);
-	if (typeof cell === "object" && cell.obligations !== void 0 && decision.outcome === "granted") expect((decision.obligations ?? []).map((item) => item.kind)).toEqual(cell.obligations);
-}
-function assertSnapshotCell(instance, permission, data, cell) {
-	const outcome = expectedOutcome(cell);
-	if (outcome === "approval-required") return;
-	const client = fromSnapshot(JSON.parse(JSON.stringify(instance.snapshot())));
-	expect(client.can(permission, data), "snapshot client disagrees with the server").toBe(outcome === "granted");
-}
+/** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
 function describePolicy(policy, config) {
 	describe("policy matrix", () => {
-		const permissions = listPermissions(policy.permissions);
-		const permdocks = /* @__PURE__ */ new Map();
+		const state = {};
 		beforeAll(async () => {
-			for (const [name, user] of Object.entries(config.subjects)) permdocks.set(name, await getPermDock(policy, user, config.options));
+			state.report = await policyMatrix(policy, config);
 		});
 		it("covers every permission", () => {
-			if (config.exhaustive === false) return;
-			for (const permission of permissions) expect(config.matrix[permission.key], `missing matrix for ${permission.key}`).toBeDefined();
-		});
-		for (const permission of permissions) {
-			const spec = config.matrix[permission.key];
-			if (spec === void 0) continue;
-			describe(permission.key, () => {
-				if (!Object.values(spec).some((value) => !isOutcomeCell(value))) {
-					for (const [subjectName, cell] of Object.entries(spec)) it(`${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
-						const data = permission.kind === "instance" ? Object.values(config.fixtures ?? {})[0] : void 0;
-						assertCell(instance.decide(permission, data), cell);
-						assertDeniedBy(instance, permission, data, cell);
-						if (config.snapshot === true) assertSnapshotCell(instance, permission, data, cell);
-					});
-					return;
-				}
-				for (const [fixtureName, row] of Object.entries(spec)) {
-					if (isOutcomeCell(row)) continue;
-					for (const [subjectName, cell] of Object.entries(row)) it(`${fixtureName} / ${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
-						const fixture = config.fixtures?.[fixtureName];
-						assertCell(instance.decide(permission, fixture), cell);
-						assertDeniedBy(instance, permission, fixture, cell);
-						if (config.snapshot === true) assertSnapshotCell(instance, permission, fixture, cell);
-					});
-				}
-			});
-		}
-	});
-}
-//#endregion
-//#region src/testing/rls-parity.ts
-function toSubject(input) {
-	return {
-		principal: {
-			id: input.id,
-			roles: input.roles ?? [],
-			...input.tenant === void 0 ? {} : { tenant: input.tenant },
-			memberships: input.memberships ?? [],
-			...input.claims === void 0 ? {} : { claims: input.claims }
-		},
-		context: {}
-	};
-}
-function rowId(row) {
-	return row["id"];
-}
-function setting(name, value) {
-	return {
-		sql: "select set_config($1, $2, true)",
-		values: [name, value]
-	};
-}
-/**
-* The session state the generated helpers read: JWT claims for `supabase`,
-* GUCs for `guc` (roles as a comma list, memberships as JSON).
-*/
-function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes) {
-	const roles = subject.roles ?? [];
-	const memberships = membershipsClaim(subject.memberships ?? [], customRoles, scopes);
-	if (dialect === "supabase" || dialect === "neon") {
-		const claims = {
-			...subject.claims,
-			sub: subject.id,
-			role: "authenticated",
-			[roleClaim]: roles.length === 1 ? roles[0] : roles,
-			[tenantClaim]: subject.tenant,
-			memberships
-		};
-		return [setting("request.jwt.claims", JSON.stringify(claims))];
-	}
-	const settings = [
-		...Object.entries(subject.claims ?? {}).map(([name, value]) => {
-			if (!SQL_IDENT.test(name)) throw new Error(`PermDock: unsafe claim name '${name}'`);
-			return setting(`${gucPrefix}.${name}`, typeof value === "string" ? value : JSON.stringify(value));
-		}),
-		setting(`${gucPrefix}.user_id`, subject.id),
-		setting(`${gucPrefix}.${roleClaim}`, roles.join(",")),
-		setting(`${gucPrefix}.memberships`, JSON.stringify(memberships))
-	];
-	return subject.tenant === void 0 ? settings : [...settings, setting(`${gucPrefix}.${tenantClaim}`, subject.tenant)];
-}
-/**
-* The statement a case runs. With field views it reads back only the key, so
-* a base table whose restricted columns are revoked does not reject it.
-*/
-function statementSql(action, table, keyOnly) {
-	const quoted = quoteSqlTable(table);
-	const id = quoteSqlIdent("id");
-	const back = keyOnly ? id : "*";
-	const command = defaultSqlCommand(action) ?? "select";
-	switch (command) {
-		case "select": return `select ${back} from ${quoted} where ${id} = $1`;
-		case "update": return `update ${quoted} set ${id} = ${id} where ${id} = $1 returning ${back}`;
-		case "insert": return `insert into ${quoted} (${id}) values ($1) returning ${back}`;
-		case "delete": return `delete from ${quoted} where ${id} = $1 returning ${back}`;
-		default: return command;
-	}
-}
-function valued(row) {
-	if (row === null || typeof row !== "object") return [];
-	const record = row;
-	return Object.keys(record).filter((name) => record[name] !== null && record[name] !== void 0).toSorted();
-}
-function isRead(action) {
-	return action === "read" || action === "get" || action === "list";
-}
-async function viewColumns(query, table, key) {
-	const id = quoteSqlIdent("id");
-	await query("savepoint permdock_fields");
-	const view = await query(`select * from ${quoteSqlTable(`${table}_visible`)} where ${id} = $1`, [key]);
-	if (view.code === void 0) return valued(view.rows[0]);
-	await query("rollback to savepoint permdock_fields");
-	if (view.code !== "42P01") return view.code;
-	const base = await query(`select * from ${quoteSqlTable(table)} where ${id} = $1`, [key]);
-	return base.code ?? valued(base.rows[0]);
-}
-function dbOutcome(result) {
-	if (result.code === "42501") return "rejected";
-	return (result.rowCount ?? result.rows.length) > 0 ? "allowed" : "filtered";
-}
-async function testRlsParity(policy, options) {
-	const dialect = options.dialect ?? "guc";
-	const gucPrefix = options.gucPrefix ?? "app";
-	const tenantClaim = options.tenantClaim ?? "tenant_id";
-	const roleClaim = options.roleClaim ?? "user_role";
-	const role = options.role ?? "authenticated";
-	const customRoles = options.customRoles ?? [];
-	const scopes = scopeList(policy.scopes);
-	async function runCase(fixture) {
-		const permdock = await getPermDock(policy, toSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
-		const granted = fixture.permission.kind === "collection" ? permdock.can(fixture.permission, fixture.row) : permdock.can(fixture.permission, fixture.row);
-		let fromClient;
-		if (options.snapshot === true) {
-			const snapshot = permdock.snapshot();
-			if (typeof snapshot !== "object" || snapshot instanceof Promise) throw new TypeError("PermDock: testRlsParity needs an unsigned snapshot");
-			fromClient = fromSnapshot(parseSnapshot(JSON.stringify(snapshot))).can(fixture.permission, fixture.row);
-		}
-		await options.query("begin");
-		try {
-			await options.query(`set local role ${quoteSqlIdent(role === "anon" && dialect === "neon" ? "anonymous" : role)}`);
-			for (const item of subjectSettings(dialect, fixture.subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes)) await options.query(item.sql, item.values);
-			const database = dbOutcome(await options.query(statementSql(fixture.permission.action, fixture.table, options.fieldViews === true), [rowId(fixture.row)]));
-			const agrees = granted ? database === "allowed" : database === "filtered" || database === "rejected";
-			let fields;
-			if (options.fieldViews === true && fixture.permission.kind === "instance" && isRead(fixture.permission.action)) {
-				const key = policy.resources.get(fixture.permission.resource)?.id ?? "id";
-				const kept = new Set(granted ? valued(permdock.pick(fixture.permission, fixture.row)) : []);
-				if (granted && fixture.row[key] !== null && fixture.row[key] !== void 0) kept.add(key);
-				fields = {
-					app: [...kept].toSorted(),
-					database: await viewColumns(options.query, fixture.table, rowId(fixture.row))
-				};
+			for (const key of state.report?.missing ?? []) expect.fail(`missing matrix for ${key}`);
+		});
+		const layout = policyMatrixLayout(policy, config);
+		for (const permission of new Set(layout.map((cell) => cell.permission))) describe(permission, () => {
+			for (const cell of layout.filter((item) => item.permission === permission)) {
+				const title = cell.fixture === void 0 ? cell.subject : `${cell.fixture} / ${cell.subject}`;
+				it(title, () => {
+					const decided = state.report?.cells.find((item) => item.name === cell.name);
+					expect(decided, `cell ${cell.name} was not decided`).toBeDefined();
+					expect(decided?.failures).toEqual([]);
+				});
 			}
-			const fieldsOk = fields === void 0 || typeof fields.database !== "string" && fields.database.join("\0") === fields.app.join("\0");
-			const ok = agrees && fieldsOk && (fromClient === void 0 || fromClient === granted);
-			return {
-				name: fixture.name,
-				granted,
-				database,
-				...fromClient === void 0 ? {} : { snapshot: fromClient },
-				...fields === void 0 ? {} : { fields },
-				ok
-			};
-		} finally {
-			await options.query("rollback");
-		}
-	}
-	async function runAll(remaining, acc) {
-		const [head, ...tail] = remaining;
-		if (head === void 0) return acc;
-		return runAll(tail, [...acc, await runCase(head)]);
-	}
-	const results = await runAll(options.fixtures, []);
-	return {
-		ok: results.every((item) => item.ok),
-		results
-	};
-}
-//#endregion
-//#region src/testing/orm-parity.ts
-function sortedIds(values) {
-	return values.map(String).toSorted();
-}
-function subsetOf(small, large) {
-	return small.every((value) => large.includes(value));
-}
-/**
-* ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
-* must be exactly the rows the database returns for `toWhere(permdock.where())`.
-* With a `relations` option, the graph is loaded for the rows first, so the
-* in-memory side walks the same graph the database query does.
-* A partial `where()` (a closure grant it cannot compile) may be refused or
-* return fewer rows, never more.
-*/
-async function testOrmParity(policy, scenarios, options) {
-	const idField = options.id ?? "id";
-	async function runCase(scenario) {
-		const permdock = await getPermDock(policy, scenario.user, scenario.options);
-		if (scenario.options?.relations !== void 0) await permdock.prefetchRelations(scenario.permission, scenario.rows);
-		const expected = sortedIds(permdock.filter(scenario.permission, scenario.rows).map((row) => row[idField]));
-		const where = permdock.where(scenario.permission);
-		try {
-			const actual = sortedIds(await options.run({
-				scenario,
-				where
-			}));
-			const ok = where.partial ? subsetOf(actual, expected) : actual.length === expected.length && subsetOf(actual, expected);
-			return {
-				name: scenario.name,
-				expected,
-				actual,
-				partial: where.partial,
-				ok
-			};
-		} catch (error) {
-			return {
-				name: scenario.name,
-				expected,
-				actual: [],
-				partial: where.partial,
-				error: error instanceof Error ? error.message : String(error),
-				ok: where.partial
-			};
-		}
-	}
-	const results = [];
-	for (const scenario of scenarios) results.push(await runCase(scenario));
-	return {
-		ok: results.every((item) => item.ok),
-		results
-	};
+		});
+	});
 }
 //#endregion
 //#region src/testing/client-parity.ts
@@ -2121,6 +1878,18 @@ function testApprovalStore(store, options = {}) {
 		expect(await reopened.consume("restart-token")).not.toBeNull();
 		expect(await store.consume("restart-token")).toBeNull();
 	});
+	it.skipIf(options.capabilities?.expire === void 0)("replaces an expired request on a new ask", async () => {
+		await store.create(sampleApproval("renew-token"));
+		await options.capabilities.expire("renew-token");
+		const renewed = {
+			...sampleApproval("renew-token"),
+			id: "apr_renewed"
+		};
+		await store.create(renewed);
+		const loaded = await store.get("renew-token");
+		expect(loaded?.id).toBe("apr_renewed");
+		expect(loaded?.status).toBe("pending");
+	});
 	it("creates, gets, lists, resolves and expires", async () => {
 		const request = sampleApproval("opaque-token");
 		await store.create(request);
@@ -2649,7 +2418,9 @@ const OAUTH_FORM$1 = "application/x-www-form-urlencoded";
 const PLATFORM_SCOPES = {
 	"projects:read": "List and read the projects the person belongs to",
 	"policy:read": "Read a project's pushed catalog, manifest and policy",
-	"catalog:write": "Push a catalog and policy with permdock cloud push"
+	"catalog:write": "Push a catalog and policy with permdock cloud push",
+	"evidence:read": "Read a project's decision log and exports, the evidence an access review uses",
+	"approvals:read": "Read a project's approval requests and their verdicts"
 };
 const ref$1 = (name) => ({ $ref: `#/components/schemas/${name}` });
 const RATE_LIMIT_HEADERS = {
@@ -2683,14 +2454,19 @@ const TOO_MANY = problem$1("Rate limited; retry after Retry-After seconds", {
 		schema: { type: "string" }
 	}
 });
+/** The RFC 6750 section 3 challenge a refused read carries, so a client tells a dead token from a missing scope. */
+const challenge = (example) => ({ "WWW-Authenticate": {
+	description: `RFC 6750 Bearer challenge (\`${example}\`)`,
+	schema: { type: "string" }
+} });
 const READ_SECURITY = (scope) => [{ platform: [scope] }, { cloudToken: [] }];
 const read = (scope, summary, responses) => ({ get: {
 	security: READ_SECURITY(scope),
 	summary,
 	responses: {
 		...responses,
-		"401": problem$1("Missing, expired or revoked token"),
-		"403": problem$1("The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment"),
+		"401": problem$1("Missing, expired or revoked token; a refused token carries `error=\"invalid_token\"`", challenge("Bearer realm=\"permdock\", error=\"invalid_token\"")),
+		"403": problem$1(`The token lacks ${scope} (\`error="insufficient_scope"\` with \`scope\`), or may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment`, challenge(`Bearer realm="permdock", error="insufficient_scope", scope="${scope}"`)),
 		"429": TOO_MANY
 	}
 } });
@@ -2776,6 +2552,10 @@ const PLATFORM_SCHEMAS = {
 				minLength: 1
 			},
 			name: { type: "string" },
+			slug: {
+				type: "string",
+				description: "The project's URL-safe name, unique in its organization"
+			},
 			environment: {
 				type: "string",
 				minLength: 1
@@ -2794,6 +2574,11 @@ const PLATFORM_SCHEMAS = {
 					},
 					fingerprint: { type: "string" }
 				}
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time",
+				description: "When the project last changed, RFC 3339"
 			}
 		}
 	},
@@ -2849,6 +2634,14 @@ const PLATFORM_PATHS = {
 		summary: "RFC 8414 metadata of the platform issuer. For the issuer https://permdock.com/api it is served at https://permdock.com/.well-known/oauth-authorization-server/api (section 3.1) and here.",
 		responses: { "200": oauthJson("The metadata", ref$1("AuthorizationServerMetadata")) }
 	} },
+	"/openapi.json": { get: {
+		security: [],
+		summary: "This document, the contract of https://permdock.com/api. permdock/schemas/cloud-api-v1.json ships the same document in the npm package.",
+		responses: { "200": oauthJson("The OpenAPI 3.1 document", {
+			type: "object",
+			required: ["openapi", "paths"]
+		}) }
+	} },
 	"/oauth/authorize": { get: {
 		security: [],
 		summary: "Authorization code with PKCE S256 for public clients, including the RFC 8252 loopback redirect http://127.0.0.1:{port}/callback",
@@ -2981,17 +2774,25 @@ const PLATFORM_PATHS = {
 			"400": oauthJson("invalid_redirect_uri or invalid_client_metadata", ref$1("OAuthError"))
 		}
 	} },
-	"/v1/projects": read("projects:read", "The projects the token reads", { "200": limited("The projects", {
-		type: "object",
-		required: ["items"],
-		properties: {
-			items: {
-				type: "array",
-				items: ref$1("Project")
-			},
-			next: { type: "string" }
-		}
-	}) }),
+	"/v1/projects": {
+		parameters: [{
+			name: "cursor",
+			in: "query",
+			description: "The `next` of the previous page",
+			schema: { type: "string" }
+		}],
+		...read("projects:read", "The projects the token reads", { "200": limited("The projects", {
+			type: "object",
+			required: ["items"],
+			properties: {
+				items: {
+					type: "array",
+					items: ref$1("Project")
+				},
+				next: { type: "string" }
+			}
+		}) })
+	},
 	"/v1/projects/{id}": {
 		parameters: [PROJECT_ID],
 		...read("projects:read", "One project", {
@@ -3038,6 +2839,7 @@ function rateLimitField(value, keys) {
 function rateLimited(response) {
 	return rateLimitField(response.headers.get("ratelimit"), ["r", "t"]) && rateLimitField(response.headers.get("ratelimit-policy"), ["q", "w"]);
 }
+const challengeOf = (response) => bearerChallenge(response.headers.get("www-authenticate"));
 function problemType(response, body) {
 	return (response.headers.get("content-type") ?? "").startsWith("application/problem+json") && isRecord(body) ? body["type"] : void 0;
 }
@@ -3106,6 +2908,38 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		expect(response.status).toBe(401);
 		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
 	});
+	it("answers 401 with an error=\"invalid_token\" challenge to an unknown token", async () => {
+		const response = await read("/v1/projects", `unknown-${globalThis.crypto.randomUUID()}`);
+		expect(response.status).toBe(401);
+		expect(challengeOf(response)).toMatchObject({
+			scheme: "bearer",
+			params: { error: "invalid_token" }
+		});
+	});
+	it("answers 403 with an error=\"insufficient_scope\" challenge naming the scope", async (context) => {
+		if (options.projectsOnly === void 0) {
+			context.skip();
+			return;
+		}
+		const response = await read(`/v1/projects/${encodeURIComponent(project)}/policy`, options.projectsOnly);
+		expect(response.status).toBe(403);
+		expect(challengeOf(response)).toMatchObject({
+			scheme: "bearer",
+			params: {
+				error: "insufficient_scope",
+				scope: "policy:read"
+			}
+		});
+	});
+	it("serves its OpenAPI document at /openapi.json", async () => {
+		const response = await read("/openapi.json", null);
+		expect(response.status).toBe(200);
+		const body = await response.json();
+		expect(body).toMatchObject({
+			openapi: expect.stringMatching(/^3\.[1-9]\d*\./u),
+			paths: expect.objectContaining({ "/v1/projects": expect.any(Object) })
+		});
+	});
 	it("refuses a catalog push with the read-only token", async () => {
 		const response = await fetchFn(`${url}/v1/environments/${encodeURIComponent(project)}/catalog`, {
 			method: "POST",
@@ -3149,432 +2983,8 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 	});
 }
 //#endregion
-//#region src/testing/cloud-api/connector-schema.ts
-var import__2020 = require__2020();
-/**
-* `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
-* `oneOf` branch per kind with a closed `config`. No branch holds a secret.
-*/
-const CONNECTOR_SCHEMA = freezeDeep({
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.com/schemas/connector-v1.json",
-	title: "PermDock Cloud connector",
-	description: "A connector on PermDock Cloud's /connectors route, wire format v1: the closed list of kinds, one branch per kind. Trusted issuers have their own route (/trusted-issuers).",
-	oneOf: [
-		{
-			description: "CloudEvents batches signed with Standard Webhooks.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "webhook" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["url"],
-					properties: {
-						url: {
-							type: "string",
-							pattern: "^https://"
-						},
-						types: {
-							type: "array",
-							items: {
-								type: "string",
-								minLength: 1
-							},
-							uniqueItems: true,
-							description: "CloudEvents types to deliver; all when absent."
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "OTLP/HTTP log records and spans with the permdock.* attributes.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "otlp" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["endpoint"],
-					properties: {
-						endpoint: {
-							type: "string",
-							pattern: "^https://"
-						},
-						headers: {
-							type: "object",
-							additionalProperties: { type: "string" }
-						},
-						signals: {
-							type: "array",
-							items: { enum: ["logs", "traces"] },
-							minItems: 1,
-							uniqueItems: true
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "The OCSF projection posted to a SIEM ingest API.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "siem" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["destination", "endpoint"],
-					properties: {
-						destination: { enum: [
-							"splunk-hec",
-							"sentinel",
-							"security-lake",
-							"google-secops",
-							"elastic",
-							"datadog"
-						] },
-						endpoint: {
-							type: "string",
-							pattern: "^https://"
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "A scheduled decision-log export.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "evidence" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["format", "destination"],
-					properties: {
-						format: { enum: [
-							"jws",
-							"ocsf",
-							"csv"
-						] },
-						destination: {
-							type: "string",
-							pattern: "^https://"
-						},
-						schedule: { enum: ["hourly", "daily"] }
-					}
-				}
-			}
-		},
-		{
-			description: "A hosted SCIM 2.0 relay for one tenant, replayed to the application's scimHandler.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "scim" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["tenant", "target"],
-					properties: {
-						tenant: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						target: {
-							type: "string",
-							pattern: "^https://"
-						},
-						groupRoles: {
-							type: "object",
-							description: "Group id to declared assignable role.",
-							additionalProperties: {
-								type: "string",
-								minLength: 1,
-								maxLength: 256
-							}
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "An SSF transmitter whose SETs the Cloud receives (POST /ssf/receive/:connector, or poll).",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "caep-transmitter" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["issuer", "delivery"],
-					properties: {
-						issuer: {
-							type: "string",
-							pattern: "^https://"
-						},
-						jwks_uri: {
-							type: "string",
-							pattern: "^https://"
-						},
-						delivery: { enum: ["push", "poll"] },
-						poll_endpoint: {
-							type: "string",
-							pattern: "^https://"
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "An OIDC upstream the Cloud issuer federates to with authorization code plus PKCE.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "federated-upstream" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["discovery", "client_id"],
-					properties: {
-						discovery: {
-							type: "string",
-							pattern: "^https://"
-						},
-						client_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						scopes: {
-							type: "array",
-							items: {
-								type: "string",
-								minLength: 1
-							},
-							uniqueItems: true
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "Approval cards through the Vercel Chat SDK.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "chat" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["platform", "workspace"],
-					properties: {
-						platform: { enum: ["slack", "teams"] },
-						workspace: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "The Cloud's hosted email sender for approval and delivery messages.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "email" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["from"],
-					properties: { from: {
-						type: "string",
-						pattern: "^[^@\\s]+@[^@\\s]+$"
-					} }
-				}
-			}
-		},
-		{
-			description: "Vercel OIDC federation tokens accepted as hosted ADS callers.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "vercel-oidc" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["team_id"],
-					properties: {
-						team_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						project_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						environment: { enum: [
-							"production",
-							"preview",
-							"development"
-						] }
-					}
-				}
-			}
-		}
-	]
-});
-//#endregion
 //#region src/testing/cloud-api/document.ts
+var import__2020 = require__2020();
 const ENV = "/v1/environments/{env}";
 const COMPACT_JWS = String.raw`^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+$`;
 const APPROVAL_REQUEST = "https://permdock.com/schemas/approval-request-v1.json";
@@ -4073,6 +3483,31 @@ const APPROVALS = {
 	}) }
 };
 const RUNTIME = {
+	"/v1/environment": { get: client({
+		summary: "The environment the key belongs to; cloud() calls it when no environment is configured",
+		responses: { "200": json("The key's environment", {
+			type: "object",
+			required: [
+				"environment",
+				"issuer",
+				"jwks_uri"
+			],
+			properties: {
+				environment: {
+					type: "string",
+					minLength: 1
+				},
+				issuer: {
+					type: "string",
+					format: "uri"
+				},
+				jwks_uri: {
+					type: "string",
+					format: "uri"
+				}
+			}
+		}) }
+	}) },
 	[`${ENV}/decisions`]: { post: client({
 		summary: "sink.write and sink.flush",
 		requestBody: body({
@@ -4783,9 +4218,10 @@ function testCloudApi(baseUrl, keys, options) {
 	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
 	const url = trimSlash(baseUrl);
 	const prefix = trimSlash(new URL(url).pathname);
+	const environment = options.environment ?? "production";
 	const { issuer } = cloudEndpoints({
 		url,
-		...options.environment === void 0 ? {} : { environment: options.environment }
+		environment
 	});
 	const check = cloudApiValidator();
 	const problems = [];
@@ -4805,7 +4241,7 @@ function testCloudApi(baseUrl, keys, options) {
 		key: keys.client,
 		fetch: recording,
 		approver: options.approver,
-		...options.environment === void 0 ? {} : { environment: options.environment },
+		environment,
 		...options.verifier === void 0 ? {} : { verifier: options.verifier }
 	});
 	const call = (path, key, init = {}) => {
@@ -4851,12 +4287,22 @@ function testCloudApi(baseUrl, keys, options) {
 		origin: issuer,
 		...options.authzen.headers === void 0 ? {} : { headers: options.authzen.headers }
 	});
-	if (options.platform !== void 0) testCloudPlatform(url, options.environment ?? "production", options.platform, recording);
+	if (options.platform !== void 0) testCloudPlatform(url, environment, options.platform, recording);
 	it("answers 401 Problem Details without a key", async () => {
 		const response = await call("/approvals", null);
 		expect(response.status).toBe(401);
 		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
 	});
+	it("names the client key's environment at GET /v1/environment", async () => {
+		const response = await recording(`${url}/v1/environment`, { headers: { authorization: `Bearer ${keys.client}` } });
+		expect(response.status).toBe(200);
+		expect(await response.json()).toMatchObject({
+			environment,
+			issuer,
+			jwks_uri: `${issuer}/.well-known/jwks.json`
+		});
+		expect((await recording(`${url}/v1/environment`)).status).toBe(401);
+	});
 	it("answers 403 to a key of another kind", async () => {
 		expect((await call("/hosted-grants", keys.client)).status).toBe(403);
 		if (keys.export !== void 0) expect((await call("/approvals", keys.export)).status).toBe(403);
@@ -5280,6 +4726,70 @@ function testSetQueue(queue) {
 		}]);
 	});
 }
+function streamConfiguration(id, description) {
+	return {
+		stream_id: id,
+		iss: "https://transmitter.example",
+		aud: "receiver",
+		events_requested: [],
+		delivery: { method: "urn:ietf:rfc:8936" },
+		...description === void 0 ? {} : { description }
+	};
+}
+function testSsfStreamStore(store) {
+	const id = (suffix) => `stream-${suffix}-${crypto.randomUUID()}`;
+	it("creates an enabled stream and reads it back by id and by owner", async () => {
+		const first = id("a");
+		const second = id("b");
+		const owner = `owner-${crypto.randomUUID()}`;
+		await store.create(owner, streamConfiguration(first));
+		await store.create(owner, streamConfiguration(second));
+		await store.create("someone-else", streamConfiguration(id("c")));
+		expect(await store.get(first)).toEqual({
+			owner,
+			configuration: streamConfiguration(first)
+		});
+		expect(await store.status(first)).toEqual({
+			stream_id: first,
+			status: "enabled"
+		});
+		const listed = await store.list(owner);
+		expect(listed.map((stream) => stream.configuration.stream_id)).toEqual([first, second]);
+		const all = await store.list();
+		expect(all.map((stream) => stream.configuration.stream_id)).toEqual(expect.arrayContaining([first, second]));
+	});
+	it("answers null for a stream that does not exist", async () => {
+		expect(await store.get(id("missing"))).toBeNull();
+		expect(await store.status(id("missing"))).toBeNull();
+	});
+	it("replaces the configuration and keeps the owner and status", async () => {
+		const stream = id("update");
+		await store.create("owner-update", streamConfiguration(stream));
+		await store.setStatus({
+			stream_id: stream,
+			status: "paused",
+			reason: "maintenance"
+		});
+		await store.update(streamConfiguration(stream, "renamed"));
+		expect(await store.get(stream)).toEqual({
+			owner: "owner-update",
+			configuration: streamConfiguration(stream, "renamed")
+		});
+		expect(await store.status(stream)).toEqual({
+			stream_id: stream,
+			status: "paused",
+			reason: "maintenance"
+		});
+	});
+	it("forgets a deleted stream and its status", async () => {
+		const stream = id("delete");
+		await store.create("owner-delete", streamConfiguration(stream));
+		await store.delete(stream);
+		expect(await store.get(stream)).toBeNull();
+		expect(await store.status(stream)).toBeNull();
+		expect((await store.list("owner-delete")).some((entry) => entry.configuration.stream_id === stream)).toBe(false);
+	});
+}
 function testRevocationFeed(feed) {
 	it("delivers each event to every subscriber until it unsubscribes", async () => {
 		const first = [];
@@ -6957,4 +6467,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };