permdock 0.6.0 → 0.8.0

package/dist/testing/index.d.ts

@@ -1,179 +1,34 @@
-import { J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, Vt as Snapshot, W as CustomRoleSource, Zn as CustomRole, Zt as DeliveryChannel, ar as Subject, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, mt as WhereCompiler, nr as Membership, ot as SnapshotSource, q as DecisionSink, rr as Principal, st as SubjectResolver, ut as TokenSigner } from "../policy-types-n0uRTsW8.js";
-import { C as InferPermissionTree, k as ResourceInit, r as Role, w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { Q as LegacyCheck } from "../index-DuWxc5dt.js";
-import { S as ApprovalPolicySource, c as WhereResult, d as PrincipalIdentity, g as Limits, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-SV8ZINYT.js";
-import { o as PolicySource } from "../hosted-BPk51-kX.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { a as ProblemDetails } from "../errors-DH5QEGXh.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-CBMmFie-.js";
-import { c as AccessReviewStore } from "../types-C_IiEs64.js";
-import { F as IdempotencyStore } from "../index-C-6Letxg.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { s as SupportSessionSource } from "../index-B8YjkEZ4.js";
-import { a as AutomationSource, t as Automation } from "../automation-BNM3TtDo.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-BtHtcKMr.js";
-import { n as SupabaseHookManifest } from "../manifest-mx5ghSFM.js";
-import { t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
-import { t as CloudApproverOptions } from "../types-8RnwUAvE.js";
-import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
-import { g as SetQueue, l as ReplayStore } from "../types-C791HFu9.js";
-import { r as SnapshotStorage } from "../types-C863OQiR.js";
-import { y as DirectoryStore } from "../index-Ch8LpNDp.js";
-import { a as SaasProject } from "../permissions-u_KHg-sN.js";
-import { n as saasPolicy } from "../policy-77FSAq_V.js";
+import { Gt as Snapshot, J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, W as CustomRoleSource, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, lr as Subject, mt as WhereCompiler, or as Membership, ot as SnapshotSource, q as DecisionSink, sr as Principal, st as SubjectResolver, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
+import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
+import { r as Role } from "../vocabulary-DEJ5j4mR.js";
+import { st as LegacyCheck } from "../index-BW_0MZOS.js";
+import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-B6Sf4T_S.js";
+import { s as PolicySource } from "../hosted-Cmtxogd0.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-B_tiYvk8.js";
+import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
+import { c as AccessReviewStore } from "../types-B2mlGuhW.js";
+import { R as IdempotencyStore } from "../index-_9UiQIkt.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { s as SupportSessionSource } from "../index-B8s204GL.js";
+import { a as AutomationSource, t as Automation } from "../automation-DqEoWHBc.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-yUuPR5Hy.js";
+import { r as SupabaseHookManifest } from "../manifest-CzzWtnAb.js";
+import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
+import { t as CloudApproverOptions } from "../types-AMJ5qoU_.js";
+import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
+import { g as SetQueue, l as ReplayStore } from "../types-DjuMBNF9.js";
+import { r as SnapshotStorage } from "../types-HzqOtvsJ.js";
+import { x as DirectoryStore } from "../index-BT5-1VsX.js";
+import { S as SsfStreamStore } from "../index-BhxEUY9J.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-hWIARPDz.js";
+import { a as SaasProject } from "../permissions-Bx6UI8n1.js";
+import { n as saasPolicy } from "../policy-Ba4bDhaj.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
-type MatrixOutcome = "granted" | "denied" | "approval-required";
-type MatrixCell = MatrixOutcome | {
-  readonly outcome?: MatrixOutcome;
-  readonly denials?: readonly {
-    readonly role?: string | null;
-    readonly reason: string;
-  }[];
-  readonly alternatives?: readonly string[];
-  /** Obligation kinds a granted decision carries, in order; `[]` asserts none. */
-  readonly obligations?: readonly string[];
-  /** The `name` of the deny grant `explain` reports as the one that won. */
-  readonly deniedBy?: string;
-};
-type DescribePolicyConfig<TSubject> = {
-  readonly subjects: Record<string, TSubject>;
-  readonly fixtures?: Record<string, unknown>;
-  readonly matrix: Record<string, Record<string, MatrixCell | Record<string, MatrixCell>>>;
-  readonly exhaustive?: boolean;
-  readonly options?: PermDockOptions;
-  /**
-   * Also assert every granted or denied cell against `fromSnapshot(permdock.snapshot())`,
-   * the client a Server Component hands down. Closures cannot cross a snapshot and deny on the client.
-   */
-  readonly snapshot?: boolean;
-};
+/** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
 export declare function describePolicy<TSubject>(policy: Policy, config: DescribePolicyConfig<TSubject>): void;
 //#endregion
-//#region src/testing/rls-parity.d.ts
-type RlsDbOutcome = "allowed" | "filtered" | "rejected";
-type RlsParitySubject = {
-  readonly id: string;
-  readonly roles?: readonly string[];
-  readonly tenant?: string;
-  readonly memberships?: readonly Membership[];
-  /**
-   * Extra token claims, read in memory as `principal.claims.*`. They join the
-   * JWT claims (`supabase`, `neon`); under `guc` each top-level claim is its
-   * own `<prefix>.<name>` setting, strings as is and anything else as JSON.
-   */
-  readonly claims?: Readonly<Record<string, unknown>>;
-};
-type RlsParityFixture = {
-  readonly name: string;
-  readonly subject: RlsParitySubject;
-  readonly permission: Permission;
-  readonly row: Readonly<Record<string, unknown>>;
-  readonly table: string;
-};
-type RlsQueryResult = {
-  readonly rows: readonly Record<string, unknown>[];
-  readonly rowCount?: number;
-  readonly code?: string;
-};
-type RlsQueryFn = (sql: string, values?: readonly unknown[]) => Promise<RlsQueryResult>;
-type RlsParityOptions = {
-  readonly query: RlsQueryFn;
-  readonly fixtures: readonly RlsParityFixture[];
-  /**
-   * `supabase` and `neon` set `request.jwt.claims`; a test database stubs
-   * `auth.jwt()` / `auth.uid()` or `auth.session()` / `auth.user_id()` over it.
-   */
-  readonly dialect?: "supabase" | "neon" | "guc";
-  readonly gucPrefix?: string;
-  readonly tenantClaim?: string;
-  /** Claim (or `guc` setting) the RLS helpers read global roles from. Default `user_role`. */
-  readonly roleClaim?: string;
-  readonly role?: "authenticated" | "anon";
-  /**
-   * Tenant-defined roles the subjects' memberships may hold. `decide` resolves them through a
-   * `CustomRoleSource`; each membership's claim carries them as the compact `grants` map, which the
-   * helpers read in `jwt` mode. Seeding the `database`-mode tables is the caller's job.
-   */
-  readonly customRoles?: readonly CustomRole[];
-  /** Also decide each case from the subject's serialized snapshot (`fromSnapshot`); it must agree. */
-  readonly snapshot?: boolean;
-  /**
-   * With `rls generate --fields views`: for each instance read, the row of
-   * `<table>_visible` must hold exactly the columns `pick` keeps (plus the key,
-   * which always passes through). A table with no view is read directly.
-   */
-  readonly fieldViews?: boolean;
-};
-/** Columns with a value in the view's row and in `pick`'s result, sorted. */
-type RlsFieldsOutcome = {
-  readonly app: readonly string[];
-  readonly database: readonly string[] | string;
-};
-type RlsParityCase = {
-  readonly name: string;
-  readonly granted: boolean;
-  readonly database: RlsDbOutcome;
-  /** The snapshot's decision, with `snapshot: true`. */
-  readonly snapshot?: boolean;
-  /** The field view check, with `fieldViews: true`; `database` is an error code when the read failed. */
-  readonly fields?: RlsFieldsOutcome;
-  readonly ok: boolean;
-};
-type RlsParityReport = {
-  readonly ok: boolean;
-  readonly results: readonly RlsParityCase[];
-};
-export declare function testRlsParity<TUser>(policy: Policy<TUser>, options: RlsParityOptions): Promise<RlsParityReport>;
-//#endregion
-//#region src/testing/orm-parity.d.ts
-type OrmParityScenario<TUser = unknown> = {
-  readonly name: string;
-  /** What the policy's `subject` mapper receives, as in `createPermDock(policy, user)`. */
-  readonly user: TUser;
-  /** The active tenant and role sources, as in `createPermDock(policy, user, options)`. */
-  readonly options?: PermDockOptions;
-  /** An instance permission; its `where()` filters the table. */
-  readonly permission: Permission<string, unknown, "instance">;
-  /** Every row of the table, exactly as the database holds them. */
-  readonly rows: readonly Readonly<Record<string, unknown>>[];
-};
-type OrmParityRunInput<TUser = unknown> = {
-  readonly scenario: OrmParityScenario<TUser>;
-  readonly where: WhereResult;
-};
-type OrmParityOptions<TUser = unknown> = {
-  /** Runs `toWhere(where)` against the database and returns the matching row ids. */
-  readonly run: (input: OrmParityRunInput<TUser>) => Promise<readonly unknown[]>;
-  /** The row id field; default `id`. */
-  readonly id?: string;
-};
-type OrmParityCase = {
-  readonly name: string;
-  readonly expected: readonly string[];
-  readonly actual: readonly string[];
-  /**
-   * `where()` left out a non-portable grant. `toWhere` refusing it is
-   * fail-closed and passes; rows it does return must be a subset.
-   */
-  readonly partial: boolean;
-  readonly error?: string;
-  readonly ok: boolean;
-};
-type OrmParityReport = {
-  readonly ok: boolean;
-  readonly results: readonly OrmParityCase[];
-};
-/**
- * ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
- * must be exactly the rows the database returns for `toWhere(permdock.where())`.
- * With a `relations` option, the graph is loaded for the rows first, so the
- * in-memory side walks the same graph the database query does.
- * A partial `where()` (a closure grant it cannot compile) may be refused or
- * return fewer rows, never more.
- */
-export declare function testOrmParity<TUser>(policy: Policy<TUser>, scenarios: readonly OrmParityScenario<TUser>[], options: OrmParityOptions<TUser>): Promise<OrmParityReport>;
-//#endregion
 //#region src/testing/client-parity.d.ts
 type ClientParityCase = {
   readonly name: string;
@@ -183,8 +38,8 @@ type ClientParityCase = {
   readonly permission: Permission;
   readonly row?: unknown;
   /**
-   * `true` when the client may deny what the server grants, because the
-   * outcome depends on a closure, a quota or an approval the snapshot omits.
+   * `true` when the client may deny what the server grants, because the outcome
+   * depends on a closure, a quota or an approval the snapshot omits.
    */
   readonly stricter?: boolean;
 };
@@ -192,8 +47,8 @@ type ClientParityOptions = {
   readonly customRoles?: CustomRoleSource;
 };
 /**
- * Asserts that `fromSnapshot(permdock.snapshot())` never grants what the
- * server denies, and matches it exactly unless a case is marked `stricter`.
+ * Asserts that `fromSnapshot(permdock.snapshot())` never grants what the server
+ * denies, and matches it exactly unless a case is marked `stricter`.
  */
 export declare function testClientParity(policy: Policy, cases: readonly ClientParityCase[], options?: ClientParityOptions): void;
 //#endregion
@@ -211,9 +66,9 @@ type LegacyParityCase = {
   readonly expect?: boolean;
 };
 /**
- * Asserts that the policy answers each case as the application's legacy
- * check does, or as the case's `expect` says where the difference is
- * intended. Run it before enforcing a permission with `shadowMode`.
+ * Asserts that the policy answers each case as the application's legacy check
+ * does, or as the case's `expect` says where the difference is intended. Run it
+ * before enforcing a permission with `shadowMode`.
  */
 export declare function testLegacyParity(policy: Policy, legacy: LegacyCheck, cases: readonly LegacyParityCase[]): void;
 //#endregion
@@ -221,17 +76,20 @@ export declare function testLegacyParity(policy: Policy, legacy: LegacyCheck, ca
 type ClientStoreStatus = "ready" | "pending" | "stale" | "server-only";
 /** The client surface every UI adapter hands to components. */
 type ClientStorePermDock = PermDock & {
-  status(permission?: Permission, data?: unknown): ClientStoreStatus;
-  refresh(query?: {
+  status: (permission?: Permission, data?: unknown) => ClientStoreStatus;
+  refresh: (query?: {
     readonly tenant?: string;
-  }): Promise<void>;
-  clear(): void;
-  subscribe(listener: () => void): () => void;
+  }) => Promise<void>;
+  clear: () => void;
+  subscribe: (listener: () => void) => () => void;
 };
 type ClientStoreHandle = {
-  get(): ClientStorePermDock;
-  /** Hydrate from a server-pushed snapshot (a Server Action result, a socket message). */
-  replace(value: unknown): void;
+  get: () => ClientStorePermDock;
+  /**
+   * Hydrate from a server-pushed snapshot (a Server Action result, a socket
+   * message).
+   */
+  replace: (value: unknown) => void;
 };
 type ClientStoreFactoryOptions = {
   readonly snapshot: Snapshot | string;
@@ -244,9 +102,9 @@ type ClientStoreFactoryOptions = {
 type ClientStoreFactory = (options: ClientStoreFactoryOptions) => ClientStoreHandle;
 /**
  * Race and cache scenarios for a client snapshot store: tenant switches,
- * `replace` and `refresh`, logout and a second user during a refresh, stale
- * and signed snapshots, and endpoint answers cached per tenant. Runs against
- * the saas domain; `createStore` wraps the store an adapter ships.
+ * `replace` and `refresh`, logout and a second user during a refresh, stale and
+ * signed snapshots, and endpoint answers cached per tenant. Runs against the
+ * saas domain; `createStore` wraps the store an adapter ships.
  */
 export declare function testClientStore(name: string, createStore: ClientStoreFactory): void;
 //#endregion
@@ -260,6 +118,18 @@ export declare function snapshotFixture(policy: Policy, subject: unknown, option
   readonly simulated?: boolean;
 }): Promise<Snapshot>;
 //#endregion
+//#region src/testing/seed-rows.d.ts
+/** Rows per table; tables are inserted in key order, so list parents first. */
+type SeedRows = Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
+/**
+ * Inserts `factories.*` rows through the `query` function `testRlsParity`
+ * takes, one parameterised `insert` per row with the row's own keys as quoted
+ * column names. `undefined` fields are left to the column default. Run it as
+ * the table owner, before RLS applies. Resolves to the number of rows
+ * inserted.
+ */
+export declare function seedRows(query: RlsQueryFn, rows: SeedRows): Promise<number>;
+//#endregion
 //#region src/testing/http-adapter/domain.d.ts
 /**
  * What a mount wires into its framework. Every value is server-side: the
@@ -269,9 +139,9 @@ export declare function snapshotFixture(policy: Policy, subject: unknown, option
 type HttpScenarioDomain = {
   readonly policy: typeof saasPolicy;
   /**
-   * The verified principal for an `Authorization` header, with the plans of
-   * the org in the first segment of `path`. The path, not a route param, so
-   * the answer is the same in a global middleware that runs before routing.
+   * The verified principal for an `Authorization` header, with the plans of the
+   * org in the first segment of `path`. The path, not a route param, so the
+   * answer is the same in a global middleware that runs before routing.
    */
   readonly subject: (authorization: string | null | undefined, path: string) => Promise<Principal | null>;
   /** `subject` as a full `Subject` whose `expiresAt` is the token's `exp`. */
@@ -348,26 +218,30 @@ type HttpMounted = {
    *
    * - `GET /:org/projects/:id`: `protect(project.read, row)`, 200 with the row
    * - `PATCH /:org/projects/:id`: `protect(project.update, row)`, 200
-   * - `POST /:org/projects`: `protect(project.create, body, { trusted: false })`, 201 with the body
+   * - `POST /:org/projects`: `protect(project.create, body, { trusted: false })`,
+   *   201 with the body
    * - `DELETE /:org/projects/:id`: `protect(project.read, row)`, then the handler
    *   calls `permdock.assert(project.delete, row)`; 204
    * - `POST /:org/projects/:id/files`: `protect(project.update, row)`, then the
-   *   framework's own multipart parser reads field `file`; 201 `{ name, size }`
+   *   framework's own multipart parser reads field `file`; 201 `{ name, size
+   *   }`
    * - `GET /:org/analytics`: `protect(analytics.read)`, 200
    * - `POST /:org/api-keys`: `protect(apiKey.create)`, 201
    * - `POST /:org/api-keys/revoke-all`: `protect(apiKey.revokeAll)`, 204
-   * - `GET /:org/admin/members`: in a sub-app, router or group; `protect(member.list)`, 200
-   * - `POST /:org/permdock/access/v1/evaluations`: the adapter's decision endpoint
+   * - `GET /:org/admin/members`: in a sub-app, router or group;
+   *   `protect(member.list)`, 200
+   * - `POST /:org/permdock/access/v1/evaluations`: the adapter's decision
+   *   endpoint
    *
    * A global `permdock()` middleware runs before every route.
    *
    * With `streams: true` it also serves `GET /:org/projects/:id/events`:
-   * `protect(project.read, row)` with the subject from `domain.session`,
-   * then a connection opened for `project.read` on the row with
-   * `revocations: domain.revocations`, streaming `domain.ticks(org)` as
-   * `text/event-stream` `data:` frames of JSON rows, dropping rows the
-   * subscriber cannot `project.update`, and ending with an
-   * `event: permdock` frame carrying the Problem Details when the connection aborts.
+   * `protect(project.read, row)` with the subject from `domain.session`, then a
+   * connection opened for `project.read` on the row with `revocations:
+   * domain.revocations`, streaming `domain.ticks(org)` as `text/event-stream`
+   * `data:` frames of JSON rows, dropping rows the subscriber cannot
+   * `project.update`, and ending with an `event: permdock` frame carrying the
+   * Problem Details when the connection aborts.
    */
   readonly fetch?: (request: Request) => Promise<Response>;
   /** RPC adapters map a call to a procedure and its error to an HTTP status. */
@@ -378,7 +252,10 @@ type HttpScenarioName = "tenant" | "roles" | "custom-roles" | "plans" | "expired
 type HttpAdapterOptions = {
   readonly name: string;
   readonly mount: (domain: HttpScenarioDomain) => HttpMounted | Promise<HttpMounted>;
-  /** Scenarios the transport cannot express (multipart over RPC), each with a reason. */
+  /**
+   * Scenarios the transport cannot express (multipart over RPC), each with a
+   * reason.
+   */
   readonly skip?: Readonly<Partial<Record<HttpScenarioName, string>>>;
   /** The mount serves the events stream; the `stream-*` scenarios run only then. */
   readonly streams?: boolean;
@@ -399,9 +276,9 @@ export declare const AGENT_THROWING_USER = "throws";
 export declare const AGENT_THROWING_ROW = "throws";
 type AgentToolName = "project_read" | "api_keys_revoke_all";
 /**
- * What a mount wires into its adapter. The subject and the tenant come from
- * the server-side context the mount builds for each call, never from the
- * tool arguments.
+ * What a mount wires into its adapter. The subject and the tenant come from the
+ * server-side context the mount builds for each call, never from the tool
+ * arguments.
  */
 type AgentScenarioDomain = {
   readonly policy: typeof saasPolicy;
@@ -411,9 +288,8 @@ type AgentScenarioDomain = {
    */
   readonly subject: (user: string | null, org: string) => Principal | null;
   /**
-   * `project_read` loads the row named by `args.id`: `null` for an unknown
-   * id, a throw for `AGENT_THROWING_ROW`. `api_keys_revoke_all` needs
-   * approval.
+   * `project_read` loads the row named by `args.id`: `null` for an unknown id,
+   * a throw for `AGENT_THROWING_ROW`. `api_keys_revoke_all` needs approval.
    */
   readonly tools: ToolMap & { readonly [K in AgentToolName]: ToolMap[K]; };
   readonly customRoles: CustomRoleSource;
@@ -448,7 +324,10 @@ type AgentAdapterOptions = {
 export declare function testAgentAdapter(options: AgentAdapterOptions): void;
 //#endregion
 //#region src/testing/agent-runtime.d.ts
-/** The server-side context of one call; the subject and tenant come from here, never from arguments. */
+/**
+ * The server-side context of one call; the subject and tenant come from here,
+ * never from arguments.
+ */
 type AgentRuntimeContext = {
   /** `null` for a call with no authenticated user. */
   readonly user: string | null;
@@ -459,7 +338,10 @@ type AgentRuntimeModel = "standard" | "frontier";
 /** What a mount wires into its `AgentPermDock`. */
 type AgentRuntimeDomain = {
   readonly policy: typeof saasPolicy;
-  /** The principal for `user` with the plans of `org`, or `null`. Throws for `AGENT_THROWING_USER`. */
+  /**
+   * The principal for `user` with the plans of `org`, or `null`. Throws for
+   * `AGENT_THROWING_USER`.
+   */
   readonly subject: (user: string | null, org: string) => Principal | null;
   /**
    * `project_read` loads the row named by `args.id`; `project_search` has a
@@ -560,16 +442,25 @@ type TodoUser = {
   readonly identity: string;
   readonly roles: readonly ("admin" | "editor" | "viewer" | "evil_genius")[];
 };
-/** The AuthZEN interop Todo directory: each user is addressable by email or by identity. */
+/**
+ * The AuthZEN interop Todo directory: each user is addressable by email or by
+ * identity.
+ */
 export declare const authzenTodoUsers: readonly TodoUser[];
 type AuthzenTodoDefinition = {
   readonly user: ResourceInit<unknown, readonly ["can_read_user"], readonly []>;
   readonly todo: ResourceInit<unknown, readonly ["can_read_todos", "can_create_todo", "can_update_todo", "can_delete_todo"], readonly []>;
 };
 export declare const authzenTodoPermissions: InferPermissionTree<AuthzenTodoDefinition>;
-/** The interop Todo rules: viewers read, editors write their own, admins delete and evil geniuses update anything. */
+/**
+ * The interop Todo rules: viewers read, editors write their own, admins delete
+ * and evil geniuses update anything.
+ */
 export declare const authzenTodoPolicy: Policy;
-/** Rows for `resources.todo.list` and records for `subjects.list` in the Todo domain. */
+/**
+ * Rows for `resources.todo.list` and records for `subjects.list` in the Todo
+ * domain.
+ */
 export declare const authzenTodoData: {
   readonly todos: readonly {
     readonly id: string;
@@ -580,23 +471,34 @@ export declare const authzenTodoData: {
   }[];
 };
 /**
- * PermDock's vectors over the interop Todo domain, in the interop layout:
- * every user against every action on their own and on Rick's todo, one batch
- * per user, and the three searches.
+ * PermDock's vectors over the interop Todo domain, in the interop layout: every
+ * user against every action on their own and on Rick's todo, one batch per
+ * user, and the three searches.
  */
 export declare function authzenTodoVectors(): AuthzenVectors;
 //#endregion
 //#region src/testing/cloud-api/platform-checks.d.ts
 type TestCloudPlatformOptions = {
-  /** A `PERMDOCK_CLOUD_TOKEN` for `project`: read-only, pinned to one environment. */
+  /**
+   * A `PERMDOCK_CLOUD_TOKEN` for `project`: read-only, pinned to one
+   * environment.
+   */
   readonly token: string;
   /** The project the token reads; defaults to the environment. */
   readonly project?: string;
-  /** A project with no `cloud push` yet and a login token that reads it; the `policy-not-published` check is skipped without it. */
+  /**
+   * A project with no `cloud push` yet and a login token that reads it; the
+   * `policy-not-published` check is skipped without it.
+   */
   readonly unpublished?: {
     readonly project: string;
     readonly token: string;
   };
+  /**
+   * A login token with `projects:read` and without `policy:read`; the
+   * `insufficient_scope` check is skipped without it.
+   */
+  readonly projectsOnly?: string;
   /** Registers a test MCP client with RFC 7591; skipped unless true. */
   readonly registration?: boolean;
 };
@@ -613,13 +515,22 @@ type CloudApiKeys = {
 type TestCloudApiOptions = {
   readonly environment?: string;
   readonly fetch?: typeof globalThis.fetch;
-  /** Signs the `PermDock-Approver` tokens; its issuer is a trusted issuer for `approver`. */
+  /**
+   * Signs the `PermDock-Approver` tokens; its issuer is a trusted issuer for
+   * `approver`.
+   */
   readonly approver: CloudApproverOptions;
-  /** A fresh `PermDock-Subject` token per call; the snapshot checks are skipped without it. */
+  /**
+   * A fresh `PermDock-Subject` token per call; the snapshot checks are skipped
+   * without it.
+   */
   readonly subject?: () => string | Promise<string>;
   /** Verifies the environment's policy documents for `testPolicySource`. */
   readonly verifier?: TokenVerifier;
-  /** AuthZEN vectors for the hosted ADS, with the caller's credentials as `headers`. */
+  /**
+   * AuthZEN vectors for the hosted ADS, with the caller's credentials as
+   * `headers`.
+   */
   readonly authzen?: {
     readonly vectors: AuthzenVectors;
     readonly headers?: Readonly<Record<string, string>>;
@@ -631,25 +542,33 @@ type TestCloudApiOptions = {
  * Runs the conformance runners and the HTTP contract checks against one
  * PermDock Cloud environment, and validates every response body against
  * `cloud-api-v1.json`. Point it at a test environment: it creates approvals,
- * sends decision events and deliveries to `.invalid` addresses, and pushes
- * the catalog the environment already holds.
+ * sends decision events and deliveries to `.invalid` addresses, and pushes the
+ * catalog the environment already holds.
  */
 export declare function testCloudApi(baseUrl: string, keys: CloudApiKeys, options: TestCloudApiOptions): void;
 //#endregion
 //#region src/testing/conformance/approvals.d.ts
 type ApprovalStoreOptions = {
   /**
-   * Opens a second store over the same backing storage, as a restarted process
-   * would. Omit it for stores that do not persist (the resume-after-restart
-   * case is then skipped).
+   * Opens a second client over the same backing storage, as a restarted process
+   * would: for a hosted store, `() => cloud(...).approvals`. Omit it for stores
+   * that do not persist (the resume-after-restart case is then skipped).
    */
   readonly reopen?: () => ApprovalStore | Promise<ApprovalStore>;
+  readonly capabilities?: {
+    /**
+     * Marks the record for `token` expired, or moves its `expiresAt` into the
+     * past, in the backing storage. Without it the replace-on-expiry case is
+     * skipped.
+     */
+    readonly expire?: (token: string) => Promise<void> | void;
+  };
 };
 export declare function testApprovalStore(store: ApprovalStore, options?: ApprovalStoreOptions): void;
 /**
  * Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
- * queried tenant or to none, and every entry loads against `policy` (an
- * entry that does not would deny every call).
+ * queried tenant or to none, and every entry loads against `policy` (an entry
+ * that does not would deny every call).
  */
 export declare function testApprovalPolicySource(source: ApprovalPolicySource, options: {
   readonly policy: Policy;
@@ -672,19 +591,19 @@ export declare function testApprovalDelegationSource(source: ApprovalDelegationS
   readonly at?: string;
 }): void;
 /**
- * Checks an `IdempotencyStore`: a stored response comes back as written
- * until it expires, keys never share an entry, and a later `set` replaces an
- * earlier one.
+ * Checks an `IdempotencyStore`: a stored response comes back as written until
+ * it expires, keys never share an entry, and a later `set` replaces an earlier
+ * one.
  */
 export declare function testIdempotencyStore(store: IdempotencyStore): void;
 //#endregion
 //#region src/testing/conformance/where.d.ts
 type WhereRow = Readonly<Record<string, unknown>>;
 /**
- * `matches` answers whether the compiled output selects `row`, for example
- * by running it against a table holding only that row. With it, every case
- * must select the rows the in-memory evaluator keeps, including rows whose
- * fields are NULL.
+ * `matches` answers whether the compiled output selects `row`, for example by
+ * running it against a table holding only that row. With it, every case must
+ * select the rows the in-memory evaluator keeps, including rows whose fields
+ * are NULL.
  */
 export declare function testWhereCompiler<TTarget>(compiler: WhereCompiler<TTarget>, options: {
   readonly target: TTarget;
@@ -695,6 +614,7 @@ export declare function testWhereCompiler<TTarget>(compiler: WhereCompiler<TTarg
 //#region src/testing/conformance/credentials.d.ts
 export declare function testReplayStore(store: ReplayStore): void;
 export declare function testSetQueue(queue: SetQueue): void;
+export declare function testSsfStreamStore(store: SsfStreamStore): void;
 export declare function testRevocationFeed(feed: RevocationFeed): void;
 export declare function testTokenVerifier(verifier: TokenVerifier, options?: {
   readonly audience?: string;
@@ -702,8 +622,8 @@ export declare function testTokenVerifier(verifier: TokenVerifier, options?: {
 }): void;
 /**
  * `key` is a live key the verifier knows, or a function issuing one (called
- * once). `revoke`, when given, revokes it; the runner then expects the key
- * to stop verifying.
+ * once). `revoke`, when given, revokes it; the runner then expects the key to
+ * stop verifying.
  */
 export declare function testCredentialVerifier(verifier: CredentialVerifier, options: {
   readonly key: string | (() => string | Promise<string>);
@@ -761,14 +681,17 @@ export declare function testRelationSource(source: RelationSource, options: {
 /**
  * Checks a `PrincipalSource`: `principal` answers each listed id with the
  * expected principal or `null`, never another id; `principalByIdentity`
- * resolves each listed identity to the expected principal id or `null`, and
- * an email matches trimmed and in any case.
+ * resolves each listed identity to the expected principal id or `null`, and an
+ * email matches trimmed and in any case.
  */
 export declare function testPrincipalSource(source: PrincipalSource, options: {
   readonly principals: readonly {
     readonly id: string;
     readonly tenant?: string;
-    /** The principal `principal(id)` returns, or `null` for none; omit to check only the shape. */
+    /**
+     * The principal `principal(id)` returns, or `null` for none; omit to
+     * check only the shape.
+     */
     readonly expect?: Principal | null;
   }[];
   readonly identities?: readonly {
@@ -780,41 +703,50 @@ export declare function testPrincipalSource(source: PrincipalSource, options: {
 //#endregion
 //#region src/testing/conformance/automations.d.ts
 /**
- * Checks an `AutomationSource`: `automation(id)` answers each listed id
- * with a valid Automation v1 record of that id or `null`, never another id;
- * a record held to one tenant is `null` when asked for another; an empty or
- * unknown id is `null`.
+ * Checks an `AutomationSource`: `automation(id)` answers each listed id with a
+ * valid Automation v1 record of that id or `null`, never another id; a record
+ * held to one tenant is `null` when asked for another; an empty or unknown id
+ * is `null`.
  */
 export declare function testAutomationSource(source: AutomationSource, options: {
   readonly automations: readonly {
     readonly id: string;
     readonly tenant?: string;
-    /** The record `automation(id)` returns, or `null` for none; omit to check only the shape. */
+    /**
+     * The record `automation(id)` returns, or `null` for none; omit to check
+     * only the shape.
+     */
     readonly expect?: Automation | null;
   }[];
 }): void;
 /**
- * Checks a `SupportSessionSource`: `session(id)` answers each listed id
- * with a record of that id or `null`, never another id; `ended` is a
- * boolean when present; an empty or unknown id is `null`.
+ * Checks a `SupportSessionSource`: `session(id)` answers each listed id with a
+ * record of that id or `null`, never another id; `ended` is a boolean when
+ * present; an empty or unknown id is `null`.
  */
 export declare function testSupportSessionSource(source: SupportSessionSource, options: {
   readonly sessions: readonly {
     readonly id: string;
-    /** `true` for an ended session, `false` for a live one, `null` for an unknown one. */
+    /**
+     * `true` for an ended session, `false` for a live one, `null` for an
+     * unknown one.
+     */
     readonly ended?: boolean | null;
   }[];
 }): void;
 /**
- * Checks an `ApprovalWaiter`: a wait ends when its token is woken and not
- * when another token is; waking a token nobody waits on resolves; a wait
- * whose `expiresAt` has passed ends; an aborted `signal` rejects the wait with its reason.
- * Pass `expiry: false` or `abort: false` for a waiter whose runner offers no
- * timer or no cancellation, `pending` when the waiter reads a store, and
- * `parked` when a wait parks asynchronously.
+ * Checks an `ApprovalWaiter`: a wait ends when its token is woken and not when
+ * another token is; waking a token nobody waits on resolves; a wait whose
+ * `expiresAt` has passed ends; an aborted `signal` rejects the wait with its
+ * reason. Pass `expiry: false` or `abort: false` for a waiter whose runner
+ * offers no timer or no cancellation, `pending` when the waiter reads a store,
+ * and `parked` when a wait parks asynchronously.
  */
 export declare function testApprovalWaiter(waiter: ApprovalWaiter, options?: {
-  /** Opens a pending approval request and returns its token; a fixed token per label when absent. */
+  /**
+   * Opens a pending approval request and returns its token; a fixed token per
+   * label when absent.
+   */
   readonly pending?: (label: string) => string | Promise<string>;
   /** Resolves once `wait(token)` has parked; one macrotask when absent. */
   readonly parked?: (token: string) => Promise<void>;
@@ -825,18 +757,24 @@ export declare function testApprovalWaiter(waiter: ApprovalWaiter, options?: {
 }): void;
 //#endregion
 //#region src/testing/delivery-transport.d.ts
-/** How a provider fails on its next call: a retryable error, a final error, or a throw from its client. */
+/**
+ * How a provider fails on its next call: a retryable error, a final error, or a
+ * throw from its client.
+ */
 type DeliveryFailureKind = "retryable" | "final" | "throw";
 type DeliveryTransportHarness<C extends DeliveryChannel> = {
   readonly transport: DeliveryTransport<C>;
-  /** What the provider accepted, one entry per delivery, with the idempotency key it received. */
-  received(): readonly {
+  /**
+   * What the provider accepted, one entry per delivery, with the idempotency
+   * key it received.
+   */
+  received: () => readonly {
     readonly idempotencyKey: string;
   }[] | Promise<readonly {
     readonly idempotencyKey: string;
   }[]>;
   /** Makes the provider's next call fail this way. */
-  fail(kind: DeliveryFailureKind): void;
+  fail: (kind: DeliveryFailureKind) => void;
 };
 type DeliveryTransportOptions<C extends DeliveryChannel> = {
   readonly channel: C;
@@ -844,13 +782,13 @@ type DeliveryTransportOptions<C extends DeliveryChannel> = {
   readonly address: string;
   readonly message: TransportMessages[C];
   /** A fresh harness per test. */
-  create(): DeliveryTransportHarness<C>;
+  create: () => DeliveryTransportHarness<C>;
 };
 /**
  * Conformance for a `DeliveryTransport`: it sends a checked target with its
- * idempotency key, keeps the key on a retry, refuses a target without a
- * granted decision before calling the provider, and maps provider errors to
- * retryable or final failures without rejecting.
+ * idempotency key, keeps the key on a retry, refuses a target without a granted
+ * decision before calling the provider, and maps provider errors to retryable
+ * or final failures without rejecting.
  */
 export declare function testDeliveryTransport<C extends DeliveryChannel>(name: string, options: DeliveryTransportOptions<C>): void;
 //#endregion
@@ -864,9 +802,15 @@ export declare function testMembershipSource(source: MembershipSource, options:
     readonly kind?: string;
   }[];
   readonly expect?: Record<string, readonly Membership[]>;
-  /** With the policy, every membership must name one of its scopes and carry its parent ids. */
+  /**
+   * With the policy, every membership must name one of its scopes and carry
+   * its parent ids.
+   */
   readonly policy?: Policy;
-  /** Passed to every `membershipsFor`; a source keyed by tenant answers nothing without one. */
+  /**
+   * Passed to every `membershipsFor`; a source keyed by tenant answers
+   * nothing without one.
+   */
   readonly tenant?: string;
 }): void;
 export declare function testEntitlementSource(source: EntitlementSource, options: {
@@ -923,16 +867,18 @@ export declare const jwtFixtureTokens: {
 //#endregion
 //#region src/testing/supabase-fixtures.d.ts
 /**
- * Claim sets in the shape the Supabase custom access token hook produces (the RBAC guide's
- * `user_role` claim, optionally mirrored into `app_metadata`, plus a `memberships` array for
- * multi-org apps). `tenantPlans` has scoped memberships, `tenant_id` and per-tenant plans in
- * `features`, read with `claims: { plans: 'features' }`. `full` sets every field of the
- * claim contract plus a `hook.claims` extra claim; `portalContact`, `oauthClient` and
- * `actChain` cover a customer contact, a Supabase OAuth server token and an RFC 8693 chain.
- * `supportSession`, `supportSessionReadOnly` and `impersonation` are the `act.kind` tokens
- * of a support tool; `anonymousSignIn` is a `signInAnonymously()` token read with
- * `anonymousSignIns: 'deny'`. Every fixture passes `supabaseClaims()` and
- * `schemas/supabase-claims-v1.json`. Plain data: no Supabase types.
+ * Claim sets in the shape the Supabase custom access token hook produces (the
+ * RBAC guide's `user_role` claim, optionally mirrored into `app_metadata`, plus
+ * a `memberships` array for multi-org apps). `tenantPlans` has scoped
+ * memberships, `tenant_id` and per-tenant plans in `features`, read with
+ * `claims: { plans: 'features' }`. `full` sets every field of the claim
+ * contract plus a `hook.claims` extra claim; `portalContact`, `oauthClient` and
+ * `actChain` cover a customer contact, a Supabase OAuth server token and an RFC
+ * 8693 chain. `supportSession`, `supportSessionReadOnly` and `impersonation`
+ * are the `act.kind` tokens of a support tool; `anonymousSignIn` is a
+ * `signInAnonymously()` token read with `anonymousSignIns: 'deny'`. Every
+ * fixture passes `supabaseClaims()` and `schemas/supabase-claims-v1.json`.
+ * Plain data: no Supabase types.
  */
 type SupabaseClaimFixture = {
   readonly claims: Readonly<Record<string, unknown>>;
@@ -975,7 +921,10 @@ type SupabaseClaimFixture = {
       readonly sessionId: string;
       readonly readOnly: boolean;
     };
-    /** `subject.delegation`: the `scope` claim and the `act` chain of an `oauth-client` actor. */
+    /**
+     * `subject.delegation`: the `scope` claim and the `act` chain of an
+     * `oauth-client` actor.
+     */
     readonly delegation?: {
       readonly scopes?: readonly string[];
       readonly chain?: Readonly<Record<string, unknown>>;
@@ -988,7 +937,8 @@ export declare const supabaseClaimFixtures: Readonly<Record<SupabaseClaimFixture
  * `supabaseClaimFixtures` as a `supabase/sdk` conformance vector file
  * (`schema/conformance.schema.json`): each case's `input` is a verified
  * `getClaims()` payload and the `subjectFromSupabase` options, `expected` the
- * subject fields it maps to. `JSON.stringify` it for a port in another language.
+ * subject fields it maps to. `JSON.stringify` it for a port in another
+ * language.
  */
 type SupabaseClaimVectors = {
   readonly feature: "auth.session.get_claims";
@@ -1005,15 +955,15 @@ export declare const supabaseClaimVectors: SupabaseClaimVectors;
 /**
  * The `permdock supabase inspect --json` manifest for a policy with one
  * `tenant` scope, the default `supabase.hook` and a `features` claim from
- * `public.feature_claims`. A package that reads the manifest tests its
- * parser against this value.
+ * `public.feature_claims`. A package that reads the manifest tests its parser
+ * against this value.
  */
 export declare const supabaseHookManifestFixture: SupabaseHookManifest;
 //#endregion
 //#region src/core/problem-types.d.ts
 /**
- * The Problem Details types PermDock defines (RFC 9457 section 4). Every
- * other status answers with `about:blank` and its RFC 9110 reason phrase.
+ * The Problem Details types PermDock defines (RFC 9457 section 4). Every other
+ * status answers with `about:blank` and its RFC 9110 reason phrase.
  */
 declare const PROBLEM_TYPES: readonly ["denied", "approval-required", "validation", "step-up-required", "not-entitled", "rate-limited", "limit-unavailable", "invalid-signature", "approver-not-eligible"];
 type ProblemType = (typeof PROBLEM_TYPES)[number];
@@ -1027,4 +977,4 @@ type ProblemType = (typeof PROBLEM_TYPES)[number];
  */
 export declare const PROBLEM_EXAMPLES: Readonly<Record<ProblemType, ProblemDetails>>;
 //#endregion
-export { type AgentAdapterOptions, type AgentCall, type AgentMounted, type AgentOutcome, type AgentRuntimeContext, type AgentRuntimeDomain, type AgentRuntimeModel, type AgentRuntimeMounted, type AgentRuntimeOperation, type AgentRuntimeOptions, type AgentRuntimeScenarioName, type AgentScenarioDomain, type AgentScenarioName, type AgentToolName, type ApprovalStoreOptions, type AuthzenEvaluationVector, type AuthzenEvaluationsVector, type AuthzenSearchVector, type AuthzenVectors, type ClientParityCase, type ClientParityOptions, type ClientStoreFactory, type ClientStoreFactoryOptions, type ClientStoreHandle, type ClientStorePermDock, type ClientStoreStatus, type CloudApiKeys, type DecisionProviderRunnerOptions, type DeliveryFailureKind, type DeliveryTransportHarness, type DeliveryTransportOptions, type DescribePolicyConfig, type HttpAdapterOptions, type HttpCall, type HttpMounted, type HttpOp, type HttpResult, type HttpScenarioDomain, type HttpScenarioName, type LegacyParityCase, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, type SupabaseClaimFixture, type SupabaseClaimFixtureName, type SupabaseClaimVectors, type TestAuthzenOptions, type TestCloudApiOptions, type TestCloudPlatformOptions, expectTypeOf, supabaseMembershipsBudget };
+export { type AgentAdapterOptions, type AgentCall, type AgentMounted, type AgentOutcome, type AgentRuntimeContext, type AgentRuntimeDomain, type AgentRuntimeModel, type AgentRuntimeMounted, type AgentRuntimeOperation, type AgentRuntimeOptions, type AgentRuntimeScenarioName, type AgentScenarioDomain, type AgentScenarioName, type AgentToolName, type ApprovalStoreOptions, type AuthzenEvaluationVector, type AuthzenEvaluationsVector, type AuthzenSearchVector, type AuthzenVectors, type ClientParityCase, type ClientParityOptions, type ClientStoreFactory, type ClientStoreFactoryOptions, type ClientStoreHandle, type ClientStorePermDock, type ClientStoreStatus, type CloudApiKeys, type DecisionProviderRunnerOptions, type DeliveryFailureKind, type DeliveryTransportHarness, type DeliveryTransportOptions, type DescribePolicyConfig, type HttpAdapterOptions, type HttpCall, type HttpMounted, type HttpOp, type HttpResult, type HttpScenarioDomain, type HttpScenarioName, type LegacyParityCase, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, type SeedRows, type SupabaseClaimFixture, type SupabaseClaimFixtureName, type SupabaseClaimVectors, type TestAuthzenOptions, type TestCloudApiOptions, type TestCloudPlatformOptions, expectTypeOf, policyMatrix, supabaseMembershipsBudget, testOrmParity, testRlsParity };