permdock 0.6.0 → 0.8.0

package/dist/testing/index.js

@@ -1,312 +1,70 @@
-import { t as require__2020 } from "../2020-C9VN-x8c.js";
 import { r as isRecord } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as principal } from "../refs-K6eWUJ0H.js";
-import { n as role, r as allow } from "../role-builder-uWQZ4v84.js";
-import { E as memoryCustomRoleSource, _ as limits, s as snapshotFor, v as memoryLimitStore, x as approvalPoliciesFor } from "../src-Cu2m75uo.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { i as principal } from "../refs-C8BKxc_e.js";
+import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
+import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DZ0l9UAg.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-pHneukrx.js";
-import { _ as resource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
-import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
-import { r as parseAutomation } from "../automation-DVjOckjV.js";
-import { a as normalizeMemberships, d as scopeList } from "../scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "../delegation-j6-rc37o.js";
-import { a as authenticated } from "../grantee-hxrUsbpM.js";
-import { n as definePolicy } from "../policy-DbM5YYtV.js";
-import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { a as mergeHostedGrants, o as parsePolicyDocument } from "../hosted-B46-5LYE.js";
-import { t as definePermissions } from "../permissions-B-wCP5ZC.js";
-import { C as validateCustomRole, y as membershipsClaim } from "../evaluate-CNClBvcj.js";
-import { n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
-import { n as fromSnapshot } from "../from-snapshot-CTCMsFZk.js";
-import { t as getPermDock } from "../permdock-BrAscV28.js";
-import { t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { i as memoryApprovalStore } from "../store-BDutJkDL.js";
-import { t as catalogFingerprint } from "../catalog-fingerprint-CCP0-yQS.js";
-import { s as parseCredential } from "../credential-BcoiejpY.js";
-import { s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
-import { t as catalogSchema } from "../schema-B4v0Qrac.js";
-import { c as parseApiKey } from "../server-C3WXAHZj.js";
-import { n as discoverAuthorizationServer } from "../device-BARQ8eYG.js";
-import { T as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-ClHtpyV3.js";
-import { a as approverHeaders, r as cloudEndpoints, t as cloud } from "../create-CQWIpUG-.js";
-import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "../sql-B5T1IL83.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-C0kK_8V0.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
-import { i as saasPermissions } from "../permissions-BPxlwVhN.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-BCXRuXca.js";
-import { t as POLICY_NOT_PUBLISHED } from "../problem-types-CJ2325SZ.js";
-import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
+import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
+import { v as resource } from "../permission-registry-B8tYxPIt.js";
+import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-nR1JesoH.js";
+import { r as parseAutomation } from "../automation-x3KEUusw.js";
+import { f as scopeList, o as normalizeMemberships } from "../scopes-0Up_UA2t.js";
+import { u as evaluateCondition } from "../delegation-CDB6_keF.js";
+import { a as authenticated } from "../grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "../compare-DTfyUunF.js";
+import { r as definePolicy } from "../policy-CLQ8__GF.js";
+import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
+import { t as definePermissions } from "../permissions-CVXmRILq.js";
+import { T as validateCustomRole } from "../evaluate-Dd8Ta0Ie.js";
+import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
+import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
+import { t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
+import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
+import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
+import { s as parseCredential } from "../credential-CyyyvCsL.js";
+import { c as problemFromDecision } from "../problem-BVLHFK33.js";
+import { o as resolveApproval } from "../helpers-DJicaG6f.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
+import { t as catalogSchema } from "../schema-BOJjqlWL.js";
+import { c as parseApiKey } from "../server-3cVlTLde.js";
+import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
+import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
+import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-2r37XRhD.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-H-mbhpZc.js";
+import { i as saasPermissions } from "../permissions-mDcTWoBs.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-iWnUdwCt.js";
+import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
+import { t as require__2020 } from "../2020-CJbO8Bvz.js";
+import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
-function isOutcomeCell(value) {
-	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);
-}
-/** Asserts `deniedBy` against the trace of a fresh `explain` call for the same arguments. */
-function assertDeniedBy(instance, permission, data, cell) {
-	if (typeof cell !== "object" || cell.deniedBy === void 0) return;
-	const explained = instance.explain(permission, data);
-	expect(explained.outcome).toBe("denied");
-	expect(explained.trace.denies[0]?.name).toBe(cell.deniedBy);
-}
-function expectedOutcome(cell) {
-	return typeof cell === "string" ? cell : cell.outcome ?? "denied";
-}
-function assertCell(decision, cell) {
-	expect(decision.outcome).toBe(expectedOutcome(cell));
-	if (typeof cell === "object" && cell.denials !== void 0 && decision.outcome === "denied") for (const denial of cell.denials) expect(decision.denials.some((item) => item.reason === denial.reason && (denial.role === void 0 || item.role === denial.role))).toBe(true);
-	if (typeof cell === "object" && cell.alternatives !== void 0 && decision.outcome === "denied") expect(decision.alternatives.map((leaf) => leaf.key)).toEqual(cell.alternatives);
-	if (typeof cell === "object" && cell.obligations !== void 0 && decision.outcome === "granted") expect((decision.obligations ?? []).map((item) => item.kind)).toEqual(cell.obligations);
-}
-function assertSnapshotCell(instance, permission, data, cell) {
-	const outcome = expectedOutcome(cell);
-	if (outcome === "approval-required") return;
-	const client = fromSnapshot(JSON.parse(JSON.stringify(instance.snapshot())));
-	expect(client.can(permission, data), "snapshot client disagrees with the server").toBe(outcome === "granted");
-}
+/** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
 function describePolicy(policy, config) {
 	describe("policy matrix", () => {
-		const permissions = listPermissions(policy.permissions);
-		const permdocks = /* @__PURE__ */ new Map();
+		const state = {};
 		beforeAll(async () => {
-			for (const [name, user] of Object.entries(config.subjects)) permdocks.set(name, await getPermDock(policy, user, config.options));
+			state.report = await policyMatrix(policy, config);
 		});
 		it("covers every permission", () => {
-			if (config.exhaustive === false) return;
-			for (const permission of permissions) expect(config.matrix[permission.key], `missing matrix for ${permission.key}`).toBeDefined();
-		});
-		for (const permission of permissions) {
-			const spec = config.matrix[permission.key];
-			if (spec === void 0) continue;
-			describe(permission.key, () => {
-				if (!Object.values(spec).some((value) => !isOutcomeCell(value))) {
-					for (const [subjectName, cell] of Object.entries(spec)) it(`${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
-						const data = permission.kind === "instance" ? Object.values(config.fixtures ?? {})[0] : void 0;
-						assertCell(instance.decide(permission, data), cell);
-						assertDeniedBy(instance, permission, data, cell);
-						if (config.snapshot === true) assertSnapshotCell(instance, permission, data, cell);
-					});
-					return;
-				}
-				for (const [fixtureName, row] of Object.entries(spec)) {
-					if (isOutcomeCell(row)) continue;
-					for (const [subjectName, cell] of Object.entries(row)) it(`${fixtureName} / ${subjectName}`, async () => {
-						const instance = permdocks.get(subjectName) ?? await getPermDock(policy, config.subjects[subjectName], config.options);
-						const fixture = config.fixtures?.[fixtureName];
-						assertCell(instance.decide(permission, fixture), cell);
-						assertDeniedBy(instance, permission, fixture, cell);
-						if (config.snapshot === true) assertSnapshotCell(instance, permission, fixture, cell);
-					});
-				}
-			});
-		}
-	});
-}
-//#endregion
-//#region src/testing/rls-parity.ts
-function toSubject(input) {
-	return {
-		principal: {
-			id: input.id,
-			roles: input.roles ?? [],
-			...input.tenant === void 0 ? {} : { tenant: input.tenant },
-			memberships: input.memberships ?? [],
-			...input.claims === void 0 ? {} : { claims: input.claims }
-		},
-		context: {}
-	};
-}
-function rowId(row) {
-	return row["id"];
-}
-function setting(name, value) {
-	return {
-		sql: "select set_config($1, $2, true)",
-		values: [name, value]
-	};
-}
-/**
-* The session state the generated helpers read: JWT claims for `supabase`,
-* GUCs for `guc` (roles as a comma list, memberships as JSON).
-*/
-function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes) {
-	const roles = subject.roles ?? [];
-	const memberships = membershipsClaim(subject.memberships ?? [], customRoles, scopes);
-	if (dialect === "supabase" || dialect === "neon") {
-		const claims = {
-			...subject.claims,
-			sub: subject.id,
-			role: "authenticated",
-			[roleClaim]: roles.length === 1 ? roles[0] : roles,
-			[tenantClaim]: subject.tenant,
-			memberships
-		};
-		return [setting("request.jwt.claims", JSON.stringify(claims))];
-	}
-	const settings = [
-		...Object.entries(subject.claims ?? {}).map(([name, value]) => {
-			if (!SQL_IDENT.test(name)) throw new Error(`PermDock: unsafe claim name '${name}'`);
-			return setting(`${gucPrefix}.${name}`, typeof value === "string" ? value : JSON.stringify(value));
-		}),
-		setting(`${gucPrefix}.user_id`, subject.id),
-		setting(`${gucPrefix}.${roleClaim}`, roles.join(",")),
-		setting(`${gucPrefix}.memberships`, JSON.stringify(memberships))
-	];
-	return subject.tenant === void 0 ? settings : [...settings, setting(`${gucPrefix}.${tenantClaim}`, subject.tenant)];
-}
-/**
-* The statement a case runs. With field views it reads back only the key, so
-* a base table whose restricted columns are revoked does not reject it.
-*/
-function statementSql(action, table, keyOnly) {
-	const quoted = quoteSqlTable(table);
-	const id = quoteSqlIdent("id");
-	const back = keyOnly ? id : "*";
-	const command = defaultSqlCommand(action) ?? "select";
-	switch (command) {
-		case "select": return `select ${back} from ${quoted} where ${id} = $1`;
-		case "update": return `update ${quoted} set ${id} = ${id} where ${id} = $1 returning ${back}`;
-		case "insert": return `insert into ${quoted} (${id}) values ($1) returning ${back}`;
-		case "delete": return `delete from ${quoted} where ${id} = $1 returning ${back}`;
-		default: return command;
-	}
-}
-function valued(row) {
-	if (row === null || typeof row !== "object") return [];
-	const record = row;
-	return Object.keys(record).filter((name) => record[name] !== null && record[name] !== void 0).toSorted();
-}
-function isRead(action) {
-	return action === "read" || action === "get" || action === "list";
-}
-async function viewColumns(query, table, key) {
-	const id = quoteSqlIdent("id");
-	await query("savepoint permdock_fields");
-	const view = await query(`select * from ${quoteSqlTable(`${table}_visible`)} where ${id} = $1`, [key]);
-	if (view.code === void 0) return valued(view.rows[0]);
-	await query("rollback to savepoint permdock_fields");
-	if (view.code !== "42P01") return view.code;
-	const base = await query(`select * from ${quoteSqlTable(table)} where ${id} = $1`, [key]);
-	return base.code ?? valued(base.rows[0]);
-}
-function dbOutcome(result) {
-	if (result.code === "42501") return "rejected";
-	return (result.rowCount ?? result.rows.length) > 0 ? "allowed" : "filtered";
-}
-async function testRlsParity(policy, options) {
-	const dialect = options.dialect ?? "guc";
-	const gucPrefix = options.gucPrefix ?? "app";
-	const tenantClaim = options.tenantClaim ?? "tenant_id";
-	const roleClaim = options.roleClaim ?? "user_role";
-	const role = options.role ?? "authenticated";
-	const customRoles = options.customRoles ?? [];
-	const scopes = scopeList(policy.scopes);
-	async function runCase(fixture) {
-		const permdock = await getPermDock(policy, toSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) });
-		const granted = fixture.permission.kind === "collection" ? permdock.can(fixture.permission, fixture.row) : permdock.can(fixture.permission, fixture.row);
-		let fromClient;
-		if (options.snapshot === true) {
-			const snapshot = permdock.snapshot();
-			if (typeof snapshot !== "object" || snapshot instanceof Promise) throw new TypeError("PermDock: testRlsParity needs an unsigned snapshot");
-			fromClient = fromSnapshot(parseSnapshot(JSON.stringify(snapshot))).can(fixture.permission, fixture.row);
-		}
-		await options.query("begin");
-		try {
-			await options.query(`set local role ${quoteSqlIdent(role === "anon" && dialect === "neon" ? "anonymous" : role)}`);
-			for (const item of subjectSettings(dialect, fixture.subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes)) await options.query(item.sql, item.values);
-			const database = dbOutcome(await options.query(statementSql(fixture.permission.action, fixture.table, options.fieldViews === true), [rowId(fixture.row)]));
-			const agrees = granted ? database === "allowed" : database === "filtered" || database === "rejected";
-			let fields;
-			if (options.fieldViews === true && fixture.permission.kind === "instance" && isRead(fixture.permission.action)) {
-				const key = policy.resources.get(fixture.permission.resource)?.id ?? "id";
-				const kept = new Set(granted ? valued(permdock.pick(fixture.permission, fixture.row)) : []);
-				if (granted && fixture.row[key] !== null && fixture.row[key] !== void 0) kept.add(key);
-				fields = {
-					app: [...kept].toSorted(),
-					database: await viewColumns(options.query, fixture.table, rowId(fixture.row))
-				};
+			for (const key of state.report?.missing ?? []) expect.fail(`missing matrix for ${key}`);
+		});
+		const layout = policyMatrixLayout(policy, config);
+		for (const permission of new Set(layout.map((cell) => cell.permission))) describe(permission, () => {
+			for (const cell of layout.filter((item) => item.permission === permission)) {
+				const title = cell.fixture === void 0 ? cell.subject : `${cell.fixture} / ${cell.subject}`;
+				it(title, () => {
+					const decided = state.report?.cells.find((item) => item.name === cell.name);
+					expect(decided, `cell ${cell.name} was not decided`).toBeDefined();
+					expect(decided?.failures).toStrictEqual([]);
+				});
 			}
-			const fieldsOk = fields === void 0 || typeof fields.database !== "string" && fields.database.join("\0") === fields.app.join("\0");
-			const ok = agrees && fieldsOk && (fromClient === void 0 || fromClient === granted);
-			return {
-				name: fixture.name,
-				granted,
-				database,
-				...fromClient === void 0 ? {} : { snapshot: fromClient },
-				...fields === void 0 ? {} : { fields },
-				ok
-			};
-		} finally {
-			await options.query("rollback");
-		}
-	}
-	async function runAll(remaining, acc) {
-		const [head, ...tail] = remaining;
-		if (head === void 0) return acc;
-		return runAll(tail, [...acc, await runCase(head)]);
-	}
-	const results = await runAll(options.fixtures, []);
-	return {
-		ok: results.every((item) => item.ok),
-		results
-	};
-}
-//#endregion
-//#region src/testing/orm-parity.ts
-function sortedIds(values) {
-	return values.map(String).toSorted();
-}
-function subsetOf(small, large) {
-	return small.every((value) => large.includes(value));
-}
-/**
-* ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
-* must be exactly the rows the database returns for `toWhere(permdock.where())`.
-* With a `relations` option, the graph is loaded for the rows first, so the
-* in-memory side walks the same graph the database query does.
-* A partial `where()` (a closure grant it cannot compile) may be refused or
-* return fewer rows, never more.
-*/
-async function testOrmParity(policy, scenarios, options) {
-	const idField = options.id ?? "id";
-	async function runCase(scenario) {
-		const permdock = await getPermDock(policy, scenario.user, scenario.options);
-		if (scenario.options?.relations !== void 0) await permdock.prefetchRelations(scenario.permission, scenario.rows);
-		const expected = sortedIds(permdock.filter(scenario.permission, scenario.rows).map((row) => row[idField]));
-		const where = permdock.where(scenario.permission);
-		try {
-			const actual = sortedIds(await options.run({
-				scenario,
-				where
-			}));
-			const ok = where.partial ? subsetOf(actual, expected) : actual.length === expected.length && subsetOf(actual, expected);
-			return {
-				name: scenario.name,
-				expected,
-				actual,
-				partial: where.partial,
-				ok
-			};
-		} catch (error) {
-			return {
-				name: scenario.name,
-				expected,
-				actual: [],
-				partial: where.partial,
-				error: error instanceof Error ? error.message : String(error),
-				ok: where.partial
-			};
-		}
-	}
-	const results = [];
-	for (const scenario of scenarios) results.push(await runCase(scenario));
-	return {
-		ok: results.every((item) => item.ok),
-		results
-	};
+		});
+	});
 }
 //#endregion
 //#region src/testing/client-parity.ts
@@ -322,8 +80,8 @@ async function outcomes(policy, entry, options) {
 	};
 }
 /**
-* Asserts that `fromSnapshot(permdock.snapshot())` never grants what the
-* server denies, and matches it exactly unless a case is marked `stricter`.
+* Asserts that `fromSnapshot(permdock.snapshot())` never grants what the server
+* denies, and matches it exactly unless a case is marked `stricter`.
 */
 function testClientParity(policy, cases, options = {}) {
 	for (const entry of cases) it(`client parity: ${entry.name}`, async () => {
@@ -338,9 +96,9 @@ function testClientParity(policy, cases, options = {}) {
 //#endregion
 //#region src/testing/legacy-parity.ts
 /**
-* Asserts that the policy answers each case as the application's legacy
-* check does, or as the case's `expect` says where the difference is
-* intended. Run it before enforcing a permission with `shadowMode`.
+* Asserts that the policy answers each case as the application's legacy check
+* does, or as the case's `expect` says where the difference is intended. Run it
+* before enforcing a permission with `shadowMode`.
 */
 function testLegacyParity(policy, legacy, cases) {
 	for (const entry of cases) it(`legacy parity: ${entry.name}`, async () => {
@@ -354,7 +112,7 @@ function testLegacyParity(policy, legacy, cases) {
 		expect({
 			permission: entry.permission.key,
 			granted: ours
-		}).toEqual({
+		}).toStrictEqual({
 			permission: entry.permission.key,
 			granted: entry.expect ?? theirs
 		});
@@ -460,9 +218,9 @@ function unreachable() {
 }
 /**
 * Race and cache scenarios for a client snapshot store: tenant switches,
-* `replace` and `refresh`, logout and a second user during a refresh, stale
-* and signed snapshots, and endpoint answers cached per tenant. Runs against
-* the saas domain; `createStore` wraps the store an adapter ships.
+* `replace` and `refresh`, logout and a second user during a refresh, stale and
+* signed snapshots, and endpoint answers cached per tenant. Runs against the
+* saas domain; `createStore` wraps the store an adapter ships.
 */
 function testClientStore(name, createStore) {
 	const acmeProject = saasProject("p1");
@@ -494,7 +252,7 @@ function testClientStore(name, createStore) {
 				fetch: net.fetch
 			});
 			await store.get().refresh({ tenant: "globex" });
-			expect(net.calls.map((call) => call.url)).toEqual(["/api/snapshot?v=1&tenant=globex"]);
+			expect(net.calls.map((call) => call.url)).toStrictEqual(["/api/snapshot?v=1&tenant=globex"]);
 			expect(store.get().subject.principal?.tenant).toBe("acme");
 			expect(store.get().can(p.project.update, acmeProject)).toBe(true);
 			expect(store.get().status()).toBe("stale");
@@ -742,15 +500,36 @@ function testClientStore(name, createStore) {
 async function snapshotFixture(policy, subject, options = {}) {
 	const instance = await getPermDock(policy, subject, options.tenant === void 0 ? {} : { tenant: options.tenant });
 	const target = options.simulated === true ? instance.simulate({}) : instance;
-	if (Array.isArray(target)) throw new Error("PermDock: snapshotFixture expected a PermDock instance");
+	if (Array.isArray(target)) throw new TypeError("PermDock: snapshotFixture expected a PermDock instance");
 	const snapshot = options.include === void 0 && options.tenants === void 0 ? target.snapshot() : target.snapshot({
 		...options.include === void 0 ? {} : { include: options.include },
 		...options.tenants === void 0 ? {} : { tenants: options.tenants }
 	});
-	if (typeof snapshot === "string" || snapshot instanceof Promise) throw new Error("PermDock: snapshotFixture expected a JSON snapshot");
+	if (typeof snapshot === "string" || snapshot instanceof Promise) throw new TypeError("PermDock: snapshotFixture expected a JSON snapshot");
 	return snapshot;
 }
 //#endregion
+//#region src/testing/seed-rows.ts
+/**
+* Inserts `factories.*` rows through the `query` function `testRlsParity`
+* takes, one parameterised `insert` per row with the row's own keys as quoted
+* column names. `undefined` fields are left to the column default. Run it as
+* the table owner, before RLS applies. Resolves to the number of rows
+* inserted.
+*/
+async function seedRows(query, rows) {
+	let inserted = 0;
+	for (const [table, list] of Object.entries(rows)) {
+		const target = quoteSqlTable(table);
+		for (const row of list) {
+			const columns = Object.keys(row).filter((key) => row[key] !== void 0);
+			await query(columns.length === 0 ? `insert into ${target} default values` : `insert into ${target} (${columns.map((column) => quoteSqlIdent(column)).join(", ")}) values (${columns.map((_, index) => `$${String(index + 1)}`).join(", ")})`, columns.map((column) => row[column]));
+			inserted += 1;
+		}
+	}
+	return inserted;
+}
+//#endregion
 //#region src/testing/http-adapter/domain.ts
 function project$1(id) {
 	const row = saasSeed.projects.find((candidate) => candidate.id === id);
@@ -1071,11 +850,12 @@ function testHttpAdapter(options) {
 			return eventStream(await mounted.fetch(new Request(`http://app.test/${org}/projects/${id}/events`, { headers })));
 		};
 		scenario("tenant", "resolves the tenant from the path on every protect", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "project.get",
 				org: "acme",
 				id: "p2"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("alice", {
 				op: "project.get",
 				org: "globex",
@@ -1098,11 +878,12 @@ function testHttpAdapter(options) {
 			})).status).toBe(401);
 		});
 		scenario("roles", "applies the role held in the requested org", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "project.update",
 				org: "acme",
 				id: "p1"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("alice", {
 				op: "project.update",
 				org: "globex",
@@ -1127,11 +908,12 @@ function testHttpAdapter(options) {
 				name: "Contract",
 				archived: false
 			};
-			expect((await send("dave", {
+			const { status } = await send("dave", {
 				op: "project.create",
 				org: "acme",
 				body
-			})).status).toBe(201);
+			});
+			expect(status).toBe(201);
 			expect((await send("hank", {
 				op: "project.create",
 				org: "acme",
@@ -1139,29 +921,34 @@ function testHttpAdapter(options) {
 			})).status).toBe(403);
 		});
 		scenario("plans", "gates a feature on the plan of the requested org", async () => {
-			expect((await send("erin", {
+			const { status } = await send("erin", {
 				op: "analytics.read",
 				org: "globex"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			const upgrade = await send("erin", {
 				op: "analytics.read",
 				org: "acme"
 			});
 			expect(upgrade.status).toBe(403);
-			expect(new Set(reasonsOf(upgrade.body))).toEqual(/* @__PURE__ */ new Set(["not-entitled"]));
+			expect(new Set(reasonsOf(upgrade.body))).toStrictEqual(/* @__PURE__ */ new Set(["not-entitled"]));
 		});
 		scenario("expired", "ignores an expired membership", async () => {
-			expect((await send("frank", {
+			const { status } = await send("frank", {
 				op: "project.get",
 				org: "acme",
 				id: "p1"
-			})).status).toBe(403);
+			});
+			expect(status).toBe(403);
 		});
 		scenario("limits", "counts a quota per subject and tenant", async () => {
-			for (let index = 0; index < 5; index += 1) expect((await send("erin", {
-				op: "apiKey.create",
-				org: "acme"
-			})).status).toBe(201);
+			for (let index = 0; index < 5; index += 1) {
+				const { status } = await send("erin", {
+					op: "apiKey.create",
+					org: "acme"
+				});
+				expect(status).toBe(201);
+			}
 			const exhausted = await send("erin", {
 				op: "apiKey.create",
 				org: "acme"
@@ -1181,11 +968,12 @@ function testHttpAdapter(options) {
 				name: "New",
 				archived: false
 			};
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.create",
 				org: "acme",
 				body: valid
-			})).status).toBe(201);
+			});
+			expect(status).toBe(201);
 			const invalid = await send("bob", {
 				op: "project.create",
 				org: "acme",
@@ -1221,12 +1009,13 @@ function testHttpAdapter(options) {
 				"title",
 				"permission",
 				"denials"
-			]) expect(field(denied.body, key)).toEqual(field(fromProtect.body, key));
-			expect((await send("bob", {
+			]) expect(field(denied.body, key)).toStrictEqual(field(fromProtect.body, key));
+			const { status } = await send("bob", {
 				op: "project.delete",
 				org: "acme",
 				id: "p3"
-			})).status).toBe(204);
+			});
+			expect(status).toBe(204);
 			expect((await send("bob", {
 				op: "project.delete",
 				org: "acme",
@@ -1241,7 +1030,7 @@ function testHttpAdapter(options) {
 			expect(asked.status).toBe(403);
 			expect(field(asked.body, "type")).toBe("https://permdock.com/problems/approval-required");
 			const token = field(asked.body, "token");
-			expect(typeof token).toBe("string");
+			expect(token).toBeTypeOf("string");
 			await resolveApproval(domain.store, String(token), {
 				status: "approved",
 				by: await approverSubject("carol", "acme")
@@ -1260,11 +1049,12 @@ function testHttpAdapter(options) {
 			})).status).toBe(204);
 		});
 		scenario("stale-approval", "ignores an approval header meant for another request", async () => {
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.get",
 				org: "acme",
 				id: "p1"
-			}, "pd1.not-a-real-token")).status).toBe(200);
+			}, "pd1.not-a-real-token");
+			expect(status).toBe(200);
 		});
 		scenario("evaluations", "answers the decision endpoint in the path tenant", async () => {
 			const result = await send("bob", {
@@ -1288,7 +1078,7 @@ function testHttpAdapter(options) {
 			});
 			expect(result.status).toBe(200);
 			const rows = field(result.body, "evaluations");
-			expect(Array.isArray(rows) ? rows.map((row) => field(row, "decision")) : rows).toEqual([true, false]);
+			expect(Array.isArray(rows) ? rows.map((row) => field(row, "decision")) : rows).toStrictEqual([true, false]);
 		});
 		scenario("upload", "leaves a multipart body to the framework parser", async () => {
 			const file = {
@@ -1302,22 +1092,24 @@ function testHttpAdapter(options) {
 				file
 			});
 			expect(uploaded.status).toBe(201);
-			expect(uploaded.body).toEqual({
+			expect(uploaded.body).toStrictEqual({
 				name: "notes.txt",
 				size: 5
 			});
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.upload",
 				org: "acme",
 				id: "p2",
 				file
-			})).status).toBe(403);
+			});
+			expect(status).toBe(403);
 		});
 		scenario("sub-app", "protects a route inside a sub-app", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "admin.members",
 				org: "acme"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("bob", {
 				op: "admin.members",
 				org: "acme"
@@ -1334,7 +1126,7 @@ function testHttpAdapter(options) {
 				org: entry.org,
 				id: entry.id
 			})).status));
-			expect(statuses).toEqual(calls.map((entry) => entry.status));
+			expect(statuses).toStrictEqual(calls.map((entry) => entry.status));
 		});
 		scenario("stream-revoked", "closes an open stream when the session is revoked", async () => {
 			expect((await openStream(null, "acme", "p1")).status).toBe(401);
@@ -1389,7 +1181,7 @@ function testHttpAdapter(options) {
 					expect(frame?.event).toBe("message");
 					ids.push(String(field(JSON.parse(frame?.data ?? "{}"), "id")));
 				}
-				expect(new Set(ids)).toEqual(/* @__PURE__ */ new Set([
+				expect(new Set(ids)).toStrictEqual(/* @__PURE__ */ new Set([
 					"p1",
 					"p3",
 					"p4"
@@ -1716,10 +1508,11 @@ function testAgentRuntime(options) {
 			const listed = await agent().allowedOperations(alice);
 			expect(listed.has("project_read")).toBe(true);
 			expect(listed.has("drop_database")).toBe(false);
-			expect([...await agent().allowedOperations(mallory)]).toEqual([]);
+			expect([...await agent().allowedOperations(mallory)]).toStrictEqual([]);
 		});
 		scenario("model-gate", "grants a model by its permission and denies one the map does not name", async () => {
-			expect((await agent().decideModel("frontier", erin)).outcome).toBe("granted");
+			const { outcome } = await agent().decideModel("frontier", erin);
+			expect(outcome).toBe("granted");
 			expect((await agent().decideModel("frontier", alice)).outcome).toBe("denied");
 			expect((await agent().decideModel("unlisted", erin)).outcome).toBe("denied");
 			expect((await agent().decideModel("standard", {
@@ -1728,15 +1521,15 @@ function testAgentRuntime(options) {
 			})).outcome).toBe("denied");
 		});
 		scenario("permitted-models", "returns the granted models in declaration order", async () => {
-			expect(await agent().permittedModels(erin)).toEqual(["standard", "frontier"]);
-			expect(await agent().permittedModels(alice)).toEqual(["standard"]);
-			expect(await agent().permittedModels(mallory)).toEqual([]);
+			expect(await agent().permittedModels(erin)).toStrictEqual(["standard", "frontier"]);
+			expect(await agent().permittedModels(alice)).toStrictEqual(["standard"]);
+			expect(await agent().permittedModels(mallory)).toStrictEqual([]);
 		});
 		scenario("results-filter", "keeps the rows the results permission grants, and none for an unknown operation", async () => {
 			const rows = projects("p1", "g1", "p2");
-			expect((await agent().filterResults("project_search", rows, alice)).map((row) => row.id)).toEqual(["p1", "p2"]);
-			expect(await agent().filterResults("project_search", rows, mallory)).toEqual([]);
-			expect(await agent().filterResults("drop_database", rows, alice)).toEqual([]);
+			expect((await agent().filterResults("project_search", rows, alice)).map((row) => row.id)).toStrictEqual(["p1", "p2"]);
+			expect(await agent().filterResults("project_search", rows, mallory)).toStrictEqual([]);
+			expect(await agent().filterResults("drop_database", rows, alice)).toStrictEqual([]);
 		});
 		scenario("gateway-options", "attributes gateway usage to the principal, and to nobody for an anonymous call", async () => {
 			const attributed = await agent().gatewayOptions(alice);
@@ -1786,7 +1579,7 @@ function testAuthzen(handle, options) {
 	}
 	for (const [index, vector] of (options.vectors.evaluations ?? []).entries()) it(`evaluations ${index}: ${vector.request.evaluations.length} items`, async () => {
 		const body = await post("/access/v1/evaluations", vector.request);
-		expect(body.evaluations.map((row) => ({ decision: row.decision }))).toEqual(vector.expected);
+		expect(body.evaluations.map((row) => ({ decision: row.decision }))).toStrictEqual(vector.expected);
 	});
 	const search = options.vectors.search ?? {};
 	for (const kind of [
@@ -1795,10 +1588,13 @@ function testAuthzen(handle, options) {
 		"action"
 	]) for (const [index, vector] of (search[kind] ?? []).entries()) it(`search/${kind} ${index}`, async () => {
 		const body = await post(`/access/v1/search/${kind}`, vector.request);
-		expect(body.results.map(sortKey).toSorted()).toEqual(vector.expected.results.map(sortKey).toSorted());
+		expect(body.results.map(sortKey).toSorted()).toStrictEqual(vector.expected.results.map(sortKey).toSorted());
 	});
 }
-/** The AuthZEN interop Todo directory: each user is addressable by email or by identity. */
+/**
+* The AuthZEN interop Todo directory: each user is addressable by email or by
+* identity.
+*/
 const authzenTodoUsers = Object.freeze([
 	{
 		id: "rick@the-citadel.com",
@@ -1843,7 +1639,10 @@ const authzenTodoPermissions = definePermissions({
 });
 const todo = authzenTodoPermissions.todo;
 const everyone = [allow(authzenTodoPermissions.user.can_read_user), allow(todo.can_read_todos)];
-/** The interop Todo rules: viewers read, editors write their own, admins delete and evil geniuses update anything. */
+/**
+* The interop Todo rules: viewers read, editors write their own, admins delete
+* and evil geniuses update anything.
+*/
 const authzenTodoPolicy = definePolicy(authzenTodoPermissions, {
 	roles: [
 		role("viewer", everyone),
@@ -1878,7 +1677,10 @@ const TODOS = Object.freeze(authzenTodoUsers.map((user, index) => ({
 	id: `todo-${String(index + 1)}`,
 	ownerID: user.id
 })));
-/** Rows for `resources.todo.list` and records for `subjects.list` in the Todo domain. */
+/**
+* Rows for `resources.todo.list` and records for `subjects.list` in the Todo
+* domain.
+*/
 const authzenTodoData = Object.freeze({
 	todos: TODOS,
 	users: Object.freeze(authzenTodoUsers.map((user) => ({ id: user.id })))
@@ -1896,9 +1698,9 @@ function expectedFor(user, action, ownerID) {
 	}
 }
 /**
-* PermDock's vectors over the interop Todo domain, in the interop layout:
-* every user against every action on their own and on Rick's todo, one batch
-* per user, and the three searches.
+* PermDock's vectors over the interop Todo domain, in the interop layout: every
+* user against every action on their own and on Rick's todo, one batch per
+* user, and the three searches.
 */
 function authzenTodoVectors() {
 	const rick = authzenTodoUsers[0];
@@ -2098,9 +1900,9 @@ function testApprovalStore(store, options = {}) {
 		});
 		const [first, second] = await Promise.all([store.consume("once-token"), store.consume("once-token")]);
 		expect([first, second].filter((item) => item !== null)).toHaveLength(1);
-		expect((first ?? second)?.consumedAt).toEqual(expect.any(String));
+		expect((first ?? second)?.consumedAt).toStrictEqual(expect.any(String));
 		expect(await store.consume("once-token")).toBeNull();
-		expect((await store.get("once-token"))?.consumedAt).toEqual(expect.any(String));
+		expect((await store.get("once-token"))?.consumedAt).toStrictEqual(expect.any(String));
 	});
 	it("refuses an approver from another tenant", async () => {
 		await store.create(tenantApproval("tenant-token", "o_1"));
@@ -2116,17 +1918,31 @@ function testApprovalStore(store, options = {}) {
 			status: "approved",
 			by: approver
 		});
+		assert.isDefined(options.reopen);
 		const reopened = await options.reopen();
 		expect((await reopened.get("restart-token"))?.status).toBe("approved");
 		expect(await reopened.consume("restart-token")).not.toBeNull();
 		expect(await store.consume("restart-token")).toBeNull();
 	});
+	it.skipIf(options.capabilities?.expire === void 0)("replaces an expired request on a new ask", async () => {
+		await store.create(sampleApproval("renew-token"));
+		assert.isDefined(options.capabilities?.expire);
+		await options.capabilities.expire("renew-token");
+		const renewed = {
+			...sampleApproval("renew-token"),
+			id: "apr_renewed"
+		};
+		await store.create(renewed);
+		const loaded = await store.get("renew-token");
+		expect(loaded?.id).toBe("apr_renewed");
+		expect(loaded?.status).toBe("pending");
+	});
 	it("creates, gets, lists, resolves and expires", async () => {
 		const request = sampleApproval("opaque-token");
 		await store.create(request);
 		const loaded = await store.get("opaque-token");
-		expect(loaded).toEqual(request);
-		expect(JSON.parse(JSON.stringify(loaded))).toEqual(request);
+		expect(loaded).toStrictEqual(request);
+		expect(JSON.parse(JSON.stringify(loaded))).toStrictEqual(request);
 		const listed = await store.list({ status: "pending" });
 		expect(listed.items.some((item) => item.token === "opaque-token")).toBe(true);
 		const resolved = await store.resolve("opaque-token", {
@@ -2137,7 +1953,7 @@ function testApprovalStore(store, options = {}) {
 		await expect(Promise.resolve().then(() => store.resolve("opaque-token", {
 			status: "rejected",
 			by: approver
-		}))).rejects.toThrow(/not pending/);
+		}))).rejects.toThrow(/not pending/u);
 		await store.create(sampleApproval("stale-token"));
 		const expired = await store.expire({ epochMilliseconds: nowMillis() + 72e5 });
 		expect(expired).toBeGreaterThanOrEqual(1);
@@ -2160,19 +1976,20 @@ function testApprovalStore(store, options = {}) {
 			principalId: "u_pager",
 			limit: 2
 		});
-		expect(first.items.map((item) => item.token)).toEqual(["page-a", "page-b"]);
-		expect(typeof first.next).toBe("string");
+		expect(first.items.map((item) => item.token)).toStrictEqual(["page-a", "page-b"]);
+		expect(first.next).toBeTypeOf("string");
+		assert.isDefined(first.next);
 		const second = await store.list({
 			principalId: "u_pager",
 			limit: 2,
 			cursor: first.next
 		});
-		expect(second.items.map((item) => item.token)).toEqual(["page-c"]);
+		expect(second.items.map((item) => item.token)).toStrictEqual(["page-c"]);
 		expect(second.next).toBeUndefined();
 		expect((await store.list({
 			principalId: "u_pager",
 			cursor: "not a cursor"
-		})).items).toEqual([]);
+		})).items).toStrictEqual([]);
 	});
 	it("refuses an approver who does not match request.approvers", async () => {
 		const request = {
@@ -2194,7 +2011,7 @@ function testApprovalStore(store, options = {}) {
 		await expect(Promise.resolve().then(() => store.resolve("gated-token", {
 			status: "approved",
 			by: member
-		}))).rejects.toThrow(/eligible|not pending|not found/);
+		}))).rejects.toThrow(/eligible|not pending|not found/u);
 	});
 	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
 		const principal = {
@@ -2249,7 +2066,7 @@ function testApprovalStore(store, options = {}) {
 			by: approver
 		});
 		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
+		expect(first.approvals).toStrictEqual([{
 			by: "u_9",
 			at: expect.any(String)
 		}]);
@@ -2263,7 +2080,7 @@ function testApprovalStore(store, options = {}) {
 			by: secondApprover
 		});
 		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.by)).toEqual(["u_9", "u_10"]);
+		expect(second.approvals?.map((item) => item.by)).toStrictEqual(["u_9", "u_10"]);
 		expect(second.resolvedBy).toBe("u_10");
 		expect(await store.consume("quorum-token")).not.toBeNull();
 	});
@@ -2299,7 +2116,7 @@ function testApprovalStore(store, options = {}) {
 		});
 		expect(resolved.status).toBe("approved");
 		expect(resolved.vouched).toBe("app-rule");
-		expect(resolved.approvals).toEqual([{
+		expect(resolved.approvals).toStrictEqual([{
 			by: "u_outsider",
 			at: expect.any(String),
 			vouched: "app-rule"
@@ -2382,7 +2199,7 @@ function testApprovalStore(store, options = {}) {
 			by: secondApprover
 		});
 		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
+		expect(first.approvals).toStrictEqual([{
 			by: "u_10",
 			at: expect.any(String),
 			stage: 0
@@ -2392,7 +2209,7 @@ function testApprovalStore(store, options = {}) {
 			by: approver
 		});
 		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.stage)).toEqual([0, 1]);
+		expect(second.approvals?.map((item) => item.stage)).toStrictEqual([0, 1]);
 	});
 	it("matches a relation approver only through the verdict's relations", async () => {
 		const manager = {
@@ -2423,21 +2240,21 @@ function testApprovalStore(store, options = {}) {
 }
 /**
 * Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
-* queried tenant or to none, and every entry loads against `policy` (an
-* entry that does not would deny every call).
+* queried tenant or to none, and every entry loads against `policy` (an entry
+* that does not would deny every call).
 */
 function testApprovalPolicySource(source, options) {
 	it("answers per tenant with plain entries that load against the policy", async () => {
 		const entries = await source.approvalPoliciesFor({ tenants: [options.tenant] });
 		expect(Array.isArray(entries)).toBe(true);
 		for (const entry of entries) {
-			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect(JSON.parse(JSON.stringify(entry))).toStrictEqual(entry);
 			expect([void 0, options.tenant]).toContain(entry.tenant);
 		}
 		const loaded = await approvalPoliciesFor(options.policy, source, [options.tenant], []);
 		expect(loaded).not.toBe("failed");
 		const other = await source.approvalPoliciesFor({ tenants: [options.unknown ?? "__permdock_unknown__"] });
-		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
+		expect(other.filter((entry) => entry.tenant !== void 0)).toStrictEqual([]);
 	});
 }
 const reviewItem = {
@@ -2482,7 +2299,7 @@ function testAccessReviewStore(store) {
 			limit: 1
 		});
 		expect(page.items).toHaveLength(1);
-		expect(page.next).toEqual(expect.any(String));
+		expect(page.next).toStrictEqual(expect.any(String));
 		const kept = await store.decide("rev", reviewItem.id, {
 			status: "kept",
 			decidedBy: "u_9",
@@ -2523,7 +2340,7 @@ function testApprovalDelegationSource(source, options) {
 		expect(entries.some((entry) => entry.delegate === options.delegate && entry.delegator === options.delegator)).toBe(true);
 		const instant = Date.parse(at);
 		for (const entry of entries) {
-			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect(JSON.parse(JSON.stringify(entry))).toStrictEqual(entry);
 			expect(entry.delegate).toBe(options.delegate);
 			expect(Date.parse(entry.from)).toBeLessThanOrEqual(instant);
 			expect(Date.parse(entry.until)).toBeGreaterThan(instant);
@@ -2532,13 +2349,13 @@ function testApprovalDelegationSource(source, options) {
 			delegate: "__permdock_unknown__",
 			...options.tenant === void 0 ? {} : { tenant: options.tenant },
 			at
-		})).toEqual([]);
+		})).toStrictEqual([]);
 	});
 }
 /**
-* Checks an `IdempotencyStore`: a stored response comes back as written
-* until it expires, keys never share an entry, and a later `set` replaces an
-* earlier one.
+* Checks an `IdempotencyStore`: a stored response comes back as written until
+* it expires, keys never share an entry, and a later `set` replaces an earlier
+* one.
 */
 function testIdempotencyStore(store) {
 	it("replays a stored response per key and keeps keys apart", async () => {
@@ -2553,14 +2370,14 @@ function testIdempotencyStore(store) {
 		const later = nowMillis() + 36e5;
 		expect(await store.get(key)).toBeUndefined();
 		await store.set(key, response, later);
-		expect(await store.get(key)).toEqual(response);
+		expect(await store.get(key)).toStrictEqual(response);
 		expect(await store.get(other)).toBeUndefined();
 		const replaced = {
 			...response,
 			status: 201
 		};
 		await store.set(key, replaced, later);
-		expect(await store.get(key)).toEqual(replaced);
+		expect(await store.get(key)).toStrictEqual(replaced);
 	});
 }
 //#endregion
@@ -2578,7 +2395,7 @@ function testLimitStore(store) {
 		expect(first.remaining).toBeGreaterThanOrEqual(0);
 		const peeked = store.remaining(input);
 		if (peeked !== void 0) {
-			expect(typeof peeked.remaining).toBe("number");
+			expect(peeked.remaining).toBeTypeOf("number");
 			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
 		}
 		await store.consume(input);
@@ -2622,7 +2439,7 @@ function testPolicySource(source, options = {}) {
 	};
 	it("returns null or a v1 policy document synchronously", () => {
 		const document = readCurrent();
-		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+		if (document !== null) expect(parsePolicyDocument(document)).toStrictEqual(document);
 	});
 	it("refreshes without rejecting and keeps current() synchronous", async () => {
 		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
@@ -2649,7 +2466,9 @@ const OAUTH_FORM$1 = "application/x-www-form-urlencoded";
 const PLATFORM_SCOPES = {
 	"projects:read": "List and read the projects the person belongs to",
 	"policy:read": "Read a project's pushed catalog, manifest and policy",
-	"catalog:write": "Push a catalog and policy with permdock cloud push"
+	"catalog:write": "Push a catalog and policy with permdock cloud push",
+	"evidence:read": "Read a project's decision log and exports, the evidence an access review uses",
+	"approvals:read": "Read a project's approval requests and their verdicts"
 };
 const ref$1 = (name) => ({ $ref: `#/components/schemas/${name}` });
 const RATE_LIMIT_HEADERS = {
@@ -2683,14 +2502,22 @@ const TOO_MANY = problem$1("Rate limited; retry after Retry-After seconds", {
 		schema: { type: "string" }
 	}
 });
+/**
+* The RFC 6750 section 3 challenge a refused read carries, so a client tells a
+* dead token from a missing scope.
+*/
+const challenge = (example) => ({ "WWW-Authenticate": {
+	description: `RFC 6750 Bearer challenge (\`${example}\`)`,
+	schema: { type: "string" }
+} });
 const READ_SECURITY = (scope) => [{ platform: [scope] }, { cloudToken: [] }];
 const read = (scope, summary, responses) => ({ get: {
 	security: READ_SECURITY(scope),
 	summary,
 	responses: {
 		...responses,
-		"401": problem$1("Missing, expired or revoked token"),
-		"403": problem$1("The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment"),
+		"401": problem$1("Missing, expired or revoked token; a refused token carries `error=\"invalid_token\"`", challenge("Bearer realm=\"permdock\", error=\"invalid_token\"")),
+		"403": problem$1(`The token lacks ${scope} (\`error="insufficient_scope"\` with \`scope\`), or may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment`, challenge(`Bearer realm="permdock", error="insufficient_scope", scope="${scope}"`)),
 		"429": TOO_MANY
 	}
 } });
@@ -2776,6 +2603,10 @@ const PLATFORM_SCHEMAS = {
 				minLength: 1
 			},
 			name: { type: "string" },
+			slug: {
+				type: "string",
+				description: "The project's URL-safe name, unique in its organization"
+			},
 			environment: {
 				type: "string",
 				minLength: 1
@@ -2794,6 +2625,11 @@ const PLATFORM_SCHEMAS = {
 					},
 					fingerprint: { type: "string" }
 				}
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time",
+				description: "When the project last changed, RFC 3339"
 			}
 		}
 	},
@@ -2842,13 +2678,24 @@ const PROJECT_ID = {
 		minLength: 1
 	}
 };
-/** Routes of the platform issuer and its read API; they sit at the API root, outside /v1/environments/{env}. */
+/**
+* Routes of the platform issuer and its read API; they sit at the API root,
+* outside /v1/environments/{env}.
+*/
 const PLATFORM_PATHS = {
 	"/.well-known/oauth-authorization-server": { get: {
 		security: [],
 		summary: "RFC 8414 metadata of the platform issuer. For the issuer https://permdock.com/api it is served at https://permdock.com/.well-known/oauth-authorization-server/api (section 3.1) and here.",
 		responses: { "200": oauthJson("The metadata", ref$1("AuthorizationServerMetadata")) }
 	} },
+	"/openapi.json": { get: {
+		security: [],
+		summary: "This document, the contract of https://permdock.com/api. permdock/schemas/cloud-api-v1.json ships the same document in the npm package.",
+		responses: { "200": oauthJson("The OpenAPI 3.1 document", {
+			type: "object",
+			required: ["openapi", "paths"]
+		}) }
+	} },
 	"/oauth/authorize": { get: {
 		security: [],
 		summary: "Authorization code with PKCE S256 for public clients, including the RFC 8252 loopback redirect http://127.0.0.1:{port}/callback",
@@ -2981,17 +2828,25 @@ const PLATFORM_PATHS = {
 			"400": oauthJson("invalid_redirect_uri or invalid_client_metadata", ref$1("OAuthError"))
 		}
 	} },
-	"/v1/projects": read("projects:read", "The projects the token reads", { "200": limited("The projects", {
-		type: "object",
-		required: ["items"],
-		properties: {
-			items: {
-				type: "array",
-				items: ref$1("Project")
-			},
-			next: { type: "string" }
-		}
-	}) }),
+	"/v1/projects": {
+		parameters: [{
+			name: "cursor",
+			in: "query",
+			description: "The `next` of the previous page",
+			schema: { type: "string" }
+		}],
+		...read("projects:read", "The projects the token reads", { "200": limited("The projects", {
+			type: "object",
+			required: ["items"],
+			properties: {
+				items: {
+					type: "array",
+					items: ref$1("Project")
+				},
+				next: { type: "string" }
+			}
+		}) })
+	},
 	"/v1/projects/{id}": {
 		parameters: [PROJECT_ID],
 		...read("projects:read", "One project", {
@@ -3027,7 +2882,10 @@ const PLATFORM_SECURITY_SCHEMES = {
 //#endregion
 //#region src/testing/cloud-api/platform-checks.ts
 const ITEM = /^"[^"]+"(?:;[a-z]+=-?\d+)+$/u;
-/** Whether a RateLimit or RateLimit-Policy field value lists items with the parameters `keys` (draft-ietf-httpapi-ratelimit-headers-11). */
+/**
+* Whether a RateLimit or RateLimit-Policy field value lists items with the
+* parameters `keys` (draft-ietf-httpapi-ratelimit-headers-11).
+*/
 function rateLimitField(value, keys) {
 	if (value === null || value.trim() === "") return false;
 	return value.split(",").every((raw) => {
@@ -3038,6 +2896,7 @@ function rateLimitField(value, keys) {
 function rateLimited(response) {
 	return rateLimitField(response.headers.get("ratelimit"), ["r", "t"]) && rateLimitField(response.headers.get("ratelimit-policy"), ["q", "w"]);
 }
+const challengeOf = (response) => bearerChallenge(response.headers.get("www-authenticate"));
 function problemType(response, body) {
 	return (response.headers.get("content-type") ?? "").startsWith("application/problem+json") && isRecord(body) ? body["type"] : void 0;
 }
@@ -3051,14 +2910,14 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		body: new URLSearchParams(fields).toString()
 	});
 	it("publishes RFC 8414 metadata for the platform issuer", async () => {
-		const metadata = await discoverAuthorizationServer(url, { fetch: (input, init) => fetchFn(String(input), init) });
+		const metadata = await discoverAuthorizationServer(url, { fetch: (input, init) => fetchFn(input instanceof Request ? input.url : input.toString(), init) });
 		expect(metadata).not.toBeNull();
 		expect(metadata).toMatchObject({
 			issuer: url,
 			code_challenge_methods_supported: ["S256"]
 		});
 		const scopes = metadata?.["scopes_supported"];
-		expect(scopes).toEqual(expect.arrayContaining(Object.keys(PLATFORM_SCOPES)));
+		expect(scopes).toStrictEqual(expect.arrayContaining(Object.keys(PLATFORM_SCOPES)));
 	});
 	it("lists and reads the project and its policy with RateLimit fields", async () => {
 		const list = await read("/v1/projects", options.token);
@@ -3106,6 +2965,38 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		expect(response.status).toBe(401);
 		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
 	});
+	it("answers 401 with an error=\"invalid_token\" challenge to an unknown token", async () => {
+		const response = await read("/v1/projects", `unknown-${globalThis.crypto.randomUUID()}`);
+		expect(response.status).toBe(401);
+		expect(challengeOf(response)).toMatchObject({
+			scheme: "bearer",
+			params: { error: "invalid_token" }
+		});
+	});
+	it("answers 403 with an error=\"insufficient_scope\" challenge naming the scope", async (context) => {
+		if (options.projectsOnly === void 0) {
+			context.skip();
+			return;
+		}
+		const response = await read(`/v1/projects/${encodeURIComponent(project)}/policy`, options.projectsOnly);
+		expect(response.status).toBe(403);
+		expect(challengeOf(response)).toMatchObject({
+			scheme: "bearer",
+			params: {
+				error: "insufficient_scope",
+				scope: "policy:read"
+			}
+		});
+	});
+	it("serves its OpenAPI document at /openapi.json", async () => {
+		const response = await read("/openapi.json", null);
+		expect(response.status).toBe(200);
+		const body = await response.json();
+		expect(body).toMatchObject({
+			openapi: expect.stringMatching(/^3\.[1-9]\d*\./u),
+			paths: expect.objectContaining({ "/v1/projects": expect.any(Object) })
+		});
+	});
 	it("refuses a catalog push with the read-only token", async () => {
 		const response = await fetchFn(`${url}/v1/environments/${encodeURIComponent(project)}/catalog`, {
 			method: "POST",
@@ -3145,436 +3036,13 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		const loopback = await register("http://127.0.0.1:33418/callback");
 		expect(loopback.status).toBe(201);
 		expect(await loopback.json()).toMatchObject({ client_id: expect.any(String) });
-		expect((await register("http://mcp.example.invalid/callback")).status).toBe(400);
+		const { status } = await register("http://mcp.example.invalid/callback");
+		expect(status).toBe(400);
 	});
 }
 //#endregion
-//#region src/testing/cloud-api/connector-schema.ts
-var import__2020 = require__2020();
-/**
-* `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
-* `oneOf` branch per kind with a closed `config`. No branch holds a secret.
-*/
-const CONNECTOR_SCHEMA = freezeDeep({
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.com/schemas/connector-v1.json",
-	title: "PermDock Cloud connector",
-	description: "A connector on PermDock Cloud's /connectors route, wire format v1: the closed list of kinds, one branch per kind. Trusted issuers have their own route (/trusted-issuers).",
-	oneOf: [
-		{
-			description: "CloudEvents batches signed with Standard Webhooks.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "webhook" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["url"],
-					properties: {
-						url: {
-							type: "string",
-							pattern: "^https://"
-						},
-						types: {
-							type: "array",
-							items: {
-								type: "string",
-								minLength: 1
-							},
-							uniqueItems: true,
-							description: "CloudEvents types to deliver; all when absent."
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "OTLP/HTTP log records and spans with the permdock.* attributes.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "otlp" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["endpoint"],
-					properties: {
-						endpoint: {
-							type: "string",
-							pattern: "^https://"
-						},
-						headers: {
-							type: "object",
-							additionalProperties: { type: "string" }
-						},
-						signals: {
-							type: "array",
-							items: { enum: ["logs", "traces"] },
-							minItems: 1,
-							uniqueItems: true
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "The OCSF projection posted to a SIEM ingest API.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "siem" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["destination", "endpoint"],
-					properties: {
-						destination: { enum: [
-							"splunk-hec",
-							"sentinel",
-							"security-lake",
-							"google-secops",
-							"elastic",
-							"datadog"
-						] },
-						endpoint: {
-							type: "string",
-							pattern: "^https://"
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "A scheduled decision-log export.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "evidence" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["format", "destination"],
-					properties: {
-						format: { enum: [
-							"jws",
-							"ocsf",
-							"csv"
-						] },
-						destination: {
-							type: "string",
-							pattern: "^https://"
-						},
-						schedule: { enum: ["hourly", "daily"] }
-					}
-				}
-			}
-		},
-		{
-			description: "A hosted SCIM 2.0 relay for one tenant, replayed to the application's scimHandler.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "scim" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["tenant", "target"],
-					properties: {
-						tenant: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						target: {
-							type: "string",
-							pattern: "^https://"
-						},
-						groupRoles: {
-							type: "object",
-							description: "Group id to declared assignable role.",
-							additionalProperties: {
-								type: "string",
-								minLength: 1,
-								maxLength: 256
-							}
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "An SSF transmitter whose SETs the Cloud receives (POST /ssf/receive/:connector, or poll).",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "caep-transmitter" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["issuer", "delivery"],
-					properties: {
-						issuer: {
-							type: "string",
-							pattern: "^https://"
-						},
-						jwks_uri: {
-							type: "string",
-							pattern: "^https://"
-						},
-						delivery: { enum: ["push", "poll"] },
-						poll_endpoint: {
-							type: "string",
-							pattern: "^https://"
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "An OIDC upstream the Cloud issuer federates to with authorization code plus PKCE.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "federated-upstream" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["discovery", "client_id"],
-					properties: {
-						discovery: {
-							type: "string",
-							pattern: "^https://"
-						},
-						client_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						scopes: {
-							type: "array",
-							items: {
-								type: "string",
-								minLength: 1
-							},
-							uniqueItems: true
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "Approval cards through the Vercel Chat SDK.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "chat" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["platform", "workspace"],
-					properties: {
-						platform: { enum: ["slack", "teams"] },
-						workspace: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						}
-					}
-				}
-			}
-		},
-		{
-			description: "The Cloud's hosted email sender for approval and delivery messages.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "email" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["from"],
-					properties: { from: {
-						type: "string",
-						pattern: "^[^@\\s]+@[^@\\s]+$"
-					} }
-				}
-			}
-		},
-		{
-			description: "Vercel OIDC federation tokens accepted as hosted ADS callers.",
-			type: "object",
-			required: [
-				"kind",
-				"name",
-				"config"
-			],
-			properties: {
-				id: {
-					type: "string",
-					minLength: 1,
-					maxLength: 256
-				},
-				kind: { const: "vercel-oidc" },
-				name: {
-					type: "string",
-					minLength: 1,
-					maxLength: 200
-				},
-				config: {
-					type: "object",
-					additionalProperties: false,
-					required: ["team_id"],
-					properties: {
-						team_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						project_id: {
-							type: "string",
-							minLength: 1,
-							maxLength: 256
-						},
-						environment: { enum: [
-							"production",
-							"preview",
-							"development"
-						] }
-					}
-				}
-			}
-		}
-	]
-});
-//#endregion
 //#region src/testing/cloud-api/document.ts
+var import__2020 = require__2020();
 const ENV = "/v1/environments/{env}";
 const COMPACT_JWS = String.raw`^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+$`;
 const APPROVAL_REQUEST = "https://permdock.com/schemas/approval-request-v1.json";
@@ -4073,6 +3541,31 @@ const APPROVALS = {
 	}) }
 };
 const RUNTIME = {
+	"/v1/environment": { get: client({
+		summary: "The environment the key belongs to; cloud() calls it when no environment is configured",
+		responses: { "200": json("The key's environment", {
+			type: "object",
+			required: [
+				"environment",
+				"issuer",
+				"jwks_uri"
+			],
+			properties: {
+				environment: {
+					type: "string",
+					minLength: 1
+				},
+				issuer: {
+					type: "string",
+					format: "uri"
+				},
+				jwks_uri: {
+					type: "string",
+					format: "uri"
+				}
+			}
+		}) }
+	}) },
 	[`${ENV}/decisions`]: { post: client({
 		summary: "sink.write and sink.flush",
 		requestBody: body({
@@ -4563,7 +4056,8 @@ const bearer = (description) => ({
 });
 /**
 * `schemas/cloud-api-v1.json`: the PermDock Cloud HTTP API as an OpenAPI 3.1
-* document. The route tables in `adapters/cloud.mdx` and `docs:drift` keep it whole.
+* document. The route tables in `adapters/cloud.mdx` and `docs:drift` keep it
+* whole.
 */
 const CLOUD_API_DOCUMENT = freezeDeep({
 	openapi: "3.1.1",
@@ -4666,7 +4160,10 @@ function routesOf(paths) {
 function pointer(parts) {
 	return parts.map((part) => part.replaceAll("~", "~0").replaceAll("/", "~1")).join("/");
 }
-/** A checker for responses of the PermDock Cloud API, compiled once from `CLOUD_API_DOCUMENT`. */
+/**
+* A checker for responses of the PermDock Cloud API, compiled once from
+* `CLOUD_API_DOCUMENT`.
+*/
 function cloudApiValidator() {
 	const ajv = new import__2020.Ajv2020({
 		strict: false,
@@ -4776,28 +4273,26 @@ async function problemCode(response) {
 * Runs the conformance runners and the HTTP contract checks against one
 * PermDock Cloud environment, and validates every response body against
 * `cloud-api-v1.json`. Point it at a test environment: it creates approvals,
-* sends decision events and deliveries to `.invalid` addresses, and pushes
-* the catalog the environment already holds.
+* sends decision events and deliveries to `.invalid` addresses, and pushes the
+* catalog the environment already holds.
 */
 function testCloudApi(baseUrl, keys, options) {
 	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
 	const url = trimSlash(baseUrl);
 	const prefix = trimSlash(new URL(url).pathname);
+	const environment = options.environment ?? "production";
 	const { issuer } = cloudEndpoints({
 		url,
-		...options.environment === void 0 ? {} : { environment: options.environment }
+		environment
 	});
 	const check = cloudApiValidator();
-	const problems = [];
 	const checks = [];
 	const recording = async (input, init) => {
 		const request = new Request(input, init);
 		const response = await fetchFn(request);
 		const { pathname } = new URL(request.url);
 		const path = pathname === `${METADATA}${prefix}` ? METADATA : pathname.slice(prefix.length);
-		checks.push(check(request.method, path, response.clone()).then((found) => {
-			problems.push(...found);
-		}));
+		checks.push(check(request.method, path, response.clone()));
 		return response;
 	};
 	const client = cloud({
@@ -4805,7 +4300,7 @@ function testCloudApi(baseUrl, keys, options) {
 		key: keys.client,
 		fetch: recording,
 		approver: options.approver,
-		...options.environment === void 0 ? {} : { environment: options.environment },
+		environment,
 		...options.verifier === void 0 ? {} : { verifier: options.verifier }
 	});
 	const call = (path, key, init = {}) => {
@@ -4851,21 +4346,33 @@ function testCloudApi(baseUrl, keys, options) {
 		origin: issuer,
 		...options.authzen.headers === void 0 ? {} : { headers: options.authzen.headers }
 	});
-	if (options.platform !== void 0) testCloudPlatform(url, options.environment ?? "production", options.platform, recording);
+	if (options.platform !== void 0) testCloudPlatform(url, environment, options.platform, recording);
 	it("answers 401 Problem Details without a key", async () => {
 		const response = await call("/approvals", null);
 		expect(response.status).toBe(401);
 		expect(response.headers.get("content-type")).toMatch(/^application\/problem\+json/u);
 	});
+	it("names the client key's environment at GET /v1/environment", async () => {
+		const response = await recording(`${url}/v1/environment`, { headers: { authorization: `Bearer ${keys.client}` } });
+		expect(response.status).toBe(200);
+		expect(await response.json()).toMatchObject({
+			environment,
+			issuer,
+			jwks_uri: `${issuer}/.well-known/jwks.json`
+		});
+		const { status } = await recording(`${url}/v1/environment`);
+		expect(status).toBe(401);
+	});
 	it("answers 403 to a key of another kind", async () => {
-		expect((await call("/hosted-grants", keys.client)).status).toBe(403);
+		const { status } = await call("/hosted-grants", keys.client);
+		expect(status).toBe(403);
 		if (keys.export !== void 0) expect((await call("/approvals", keys.export)).status).toBe(403);
 	});
 	it("sends an ETag on the approval read and refuses an approver token with a stale one", async () => {
 		const token = tag();
 		await client.approvals.create(sample(token));
 		const { request, etag } = await current(token);
-		expect(etag).toEqual(expect.any(String));
+		expect(etag).toStrictEqual(expect.any(String));
 		const stale = await resolveRaw(token, {
 			status: "approved",
 			by: admin
@@ -4926,7 +4433,7 @@ function testCloudApi(baseUrl, keys, options) {
 					aud: issuer
 				})
 			});
-			expect([typ, response.status]).toEqual([typ, 422]);
+			expect([typ, response.status]).toStrictEqual([typ, 422]);
 		}
 	});
 	it("repeats a delivery for a repeated Idempotency-Key and requires one", async () => {
@@ -4954,7 +4461,8 @@ function testCloudApi(baseUrl, keys, options) {
 		expect(first.ok && second.ok).toBe(true);
 		const [a, b] = await Promise.all([first.json(), second.json()]);
 		expect(isRecord(a) && isRecord(b) && a["id"] === b["id"]).toBe(true);
-		expect((await send({})).status).toBe(400);
+		const { status } = await send({});
+		expect(status).toBe(400);
 	});
 	it("answers unchanged for the catalog it already holds", async (context) => {
 		const response = await call("/catalog", keys.client);
@@ -4991,12 +4499,12 @@ function testCloudApi(baseUrl, keys, options) {
 		const first = await get({ "permdock-subject": token });
 		expect(first.status).toBe(200);
 		expect(first.headers.get("content-type")).toMatch(/^application\/jwt/u);
-		expect((await get({ "permdock-subject": token })).status).toBe(401);
+		const { status } = await get({ "permdock-subject": token });
+		expect(status).toBe(401);
 		expect((await get({})).status).toBe(401);
 	});
 	it("answers every request in the shapes cloud-api-v1.json documents", async () => {
-		await Promise.all(checks);
-		expect(problems).toEqual([]);
+		expect((await Promise.all(checks)).flat()).toStrictEqual([]);
 	});
 }
 //#endregion
@@ -5157,10 +4665,10 @@ const WHERE_SUBJECT = {
 	context: {}
 };
 /**
-* `matches` answers whether the compiled output selects `row`, for example
-* by running it against a table holding only that row. With it, every case
-* must select the rows the in-memory evaluator keeps, including rows whose
-* fields are NULL.
+* `matches` answers whether the compiled output selects `row`, for example by
+* running it against a table holding only that row. With it, every case must
+* select the rows the in-memory evaluator keeps, including rows whose fields
+* are NULL.
 */
 function testWhereCompiler(compiler, options) {
 	const { matches } = options;
@@ -5169,7 +4677,7 @@ function testWhereCompiler(compiler, options) {
 		const compiled = compiler(condition, options.target);
 		const selected = [];
 		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
-		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
+		expect(selected).toStrictEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
 	});
 	it("fails closed on an empty allow set", () => {
 		const compiled = compiler({
@@ -5237,7 +4745,7 @@ function testReplayStore(store) {
 		}
 		const expiresAt = nowSeconds() + 60;
 		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
-		expect(results.toSorted()).toEqual([false, true]);
+		expect(results.toSorted()).toStrictEqual([false, true]);
 		expect(await store.seen("claim-key")).toBe(true);
 		await store.release("claim-key");
 		expect(await store.claim("claim-key", expiresAt)).toBe(true);
@@ -5248,18 +4756,18 @@ function testSetQueue(queue) {
 		await queue.enqueue("stream-a", "a1", "set-a1");
 		await queue.enqueue("stream-a", "a2", "set-a2");
 		await queue.enqueue("stream-b", "b1", "set-b1");
-		expect(await queue.pending("stream-a", 10)).toEqual([{
+		expect(await queue.pending("stream-a", 10)).toStrictEqual([{
 			jti: "a1",
 			set: "set-a1"
 		}, {
 			jti: "a2",
 			set: "set-a2"
 		}]);
-		expect(await queue.pending("stream-a", 1)).toEqual([{
+		expect(await queue.pending("stream-a", 1)).toStrictEqual([{
 			jti: "a1",
 			set: "set-a1"
 		}]);
-		expect(await queue.pending("stream-b", 10)).toEqual([{
+		expect(await queue.pending("stream-b", 10)).toStrictEqual([{
 			jti: "b1",
 			set: "set-b1"
 		}]);
@@ -5274,12 +4782,76 @@ function testSetQueue(queue) {
 			description: "unknown kid"
 		});
 		await queue.ack("stream-other", "c3");
-		expect(await queue.pending("stream-c", 10)).toEqual([{
+		expect(await queue.pending("stream-c", 10)).toStrictEqual([{
 			jti: "c3",
 			set: "set-c3"
 		}]);
 	});
 }
+function streamConfiguration(id, description) {
+	return {
+		stream_id: id,
+		iss: "https://transmitter.example",
+		aud: "receiver",
+		events_requested: [],
+		delivery: { method: "urn:ietf:rfc:8936" },
+		...description === void 0 ? {} : { description }
+	};
+}
+function testSsfStreamStore(store) {
+	const id = (suffix) => `stream-${suffix}-${crypto.randomUUID()}`;
+	it("creates an enabled stream and reads it back by id and by owner", async () => {
+		const first = id("a");
+		const second = id("b");
+		const owner = `owner-${crypto.randomUUID()}`;
+		await store.create(owner, streamConfiguration(first));
+		await store.create(owner, streamConfiguration(second));
+		await store.create("someone-else", streamConfiguration(id("c")));
+		expect(await store.get(first)).toStrictEqual({
+			owner,
+			configuration: streamConfiguration(first)
+		});
+		expect(await store.status(first)).toStrictEqual({
+			stream_id: first,
+			status: "enabled"
+		});
+		const listed = await store.list(owner);
+		expect(listed.map((stream) => stream.configuration.stream_id)).toStrictEqual([first, second]);
+		const all = await store.list();
+		expect(all.map((stream) => stream.configuration.stream_id)).toStrictEqual(expect.arrayContaining([first, second]));
+	});
+	it("answers null for a stream that does not exist", async () => {
+		expect(await store.get(id("missing"))).toBeNull();
+		expect(await store.status(id("missing"))).toBeNull();
+	});
+	it("replaces the configuration and keeps the owner and status", async () => {
+		const stream = id("update");
+		await store.create("owner-update", streamConfiguration(stream));
+		await store.setStatus({
+			stream_id: stream,
+			status: "paused",
+			reason: "maintenance"
+		});
+		await store.update(streamConfiguration(stream, "renamed"));
+		expect(await store.get(stream)).toStrictEqual({
+			owner: "owner-update",
+			configuration: streamConfiguration(stream, "renamed")
+		});
+		expect(await store.status(stream)).toStrictEqual({
+			stream_id: stream,
+			status: "paused",
+			reason: "maintenance"
+		});
+	});
+	it("forgets a deleted stream and its status", async () => {
+		const stream = id("delete");
+		await store.create("owner-delete", streamConfiguration(stream));
+		await store.delete(stream);
+		expect(await store.get(stream)).toBeNull();
+		expect(await store.status(stream)).toBeNull();
+		expect((await store.list("owner-delete")).some((entry) => entry.configuration.stream_id === stream)).toBe(false);
+	});
+}
 function testRevocationFeed(feed) {
 	it("delivers each event to every subscriber until it unsubscribes", async () => {
 		const first = [];
@@ -5297,8 +4869,8 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(revoked);
 		await vi.waitFor(() => {
-			expect(first).toEqual([revoked]);
-			expect(second).toEqual([revoked]);
+			expect(first).toStrictEqual([revoked]);
+			expect(second).toStrictEqual([revoked]);
 		});
 		stopFirst();
 		const changed = {
@@ -5308,9 +4880,9 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(changed);
 		await vi.waitFor(() => {
-			expect(second).toEqual([revoked, changed]);
+			expect(second).toStrictEqual([revoked, changed]);
 		});
-		expect(first).toEqual([revoked]);
+		expect(first).toStrictEqual([revoked]);
 		stopSecond();
 	});
 	it("keeps delivering when a listener throws", async () => {
@@ -5327,7 +4899,7 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(event);
 		await vi.waitFor(() => {
-			expect(seen).toEqual([event]);
+			expect(seen).toStrictEqual([event]);
 		});
 		stopThrowing();
 		stop();
@@ -5346,7 +4918,7 @@ function testRevocationFeed(feed) {
 		}]) await expect((async () => {
 			await feed.revoke(event);
 		})()).rejects.toThrow(TypeError);
-		expect(seen).toEqual([]);
+		expect(seen).toStrictEqual([]);
 		stop();
 	});
 }
@@ -5421,8 +4993,8 @@ function flipLast(value) {
 }
 /**
 * `key` is a live key the verifier knows, or a function issuing one (called
-* once). `revoke`, when given, revokes it; the runner then expects the key
-* to stop verifying.
+* once). `revoke`, when given, revokes it; the runner then expects the key to
+* stop verifying.
 */
 function testCredentialVerifier(verifier, options) {
 	let issued;
@@ -5438,7 +5010,7 @@ function testCredentialVerifier(verifier, options) {
 		const credential = parseCredential(await verifier.verify(key));
 		expect(credential).toBeDefined();
 		expect(credential?.id).toBe(parts?.id);
-		expect(parseCredential(await verifier.verify(key))).toEqual(credential);
+		expect(parseCredential(await verifier.verify(key))).toStrictEqual(credential);
 	});
 	it("never throws and answers null for every other key", async () => {
 		const key = await live();
@@ -5468,7 +5040,7 @@ function testCredentialVerifier(verifier, options) {
 		const id = parseApiKey(key)?.id ?? "";
 		await verifier.touch?.(id, { epochMilliseconds: nowMillis() });
 		await verifier.touch?.("unknown-id", { epochMilliseconds: nowMillis() });
-		expect(parseCredential(await verifier.verify(key))).toEqual(before);
+		expect(parseCredential(await verifier.verify(key))).toStrictEqual(before);
 	});
 	if (options.revoke !== void 0) {
 		const revoke = options.revoke;
@@ -5489,7 +5061,7 @@ function testTokenSigner(signer, options) {
 			audience: "https://app.example.com"
 		});
 		const header = decodeHeader(token);
-		expect(Object.keys(header).toSorted()).toEqual([
+		expect(Object.keys(header).toSorted()).toStrictEqual([
 			"alg",
 			"kid",
 			"typ"
@@ -5535,7 +5107,7 @@ function testDecisionProvider(provider, options) {
 		local: LOCAL
 	});
 	it("names itself and claims the permission synchronously", () => {
-		expect(typeof provider.name).toBe("string");
+		expect(provider.name).toBeTypeOf("string");
 		expect(provider.name.length).toBeGreaterThan(0);
 		expect(provider.handles(options.permission)).toBe(true);
 	});
@@ -5611,12 +5183,12 @@ function testRelationSource(source, options) {
 			});
 			expect(Array.isArray(full.ancestors)).toBe(true);
 			for (const ancestor of full.ancestors) {
-				expect(typeof ancestor.id).toBe("string");
+				expect(ancestor.id).toBeTypeOf("string");
 				expect(ancestor.id).not.toBe("");
 			}
 			expect(full.ancestors.length).toBeLessThanOrEqual(32);
 			const expected = options.expect?.ancestors?.[`${object.resource}:${object.id}`];
-			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toEqual(expected);
+			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toStrictEqual(expected);
 			if (full.ancestors.length > 1) {
 				const short = await source.ancestors({
 					resource: object.resource,
@@ -5624,7 +5196,7 @@ function testRelationSource(source, options) {
 					through: "parent",
 					depth: 1
 				});
-				expect(short.ancestors.map((ancestor) => ancestor.id)).toEqual([full.ancestors[0]?.id]);
+				expect(short.ancestors.map((ancestor) => ancestor.id)).toStrictEqual([full.ancestors[0]?.id]);
 				expect(short.truncated).toBe(true);
 			}
 			const none = await source.ancestors({
@@ -5633,7 +5205,7 @@ function testRelationSource(source, options) {
 				through: "parent",
 				depth: 0
 			});
-			expect(none.ancestors).toEqual([]);
+			expect(none.ancestors).toStrictEqual([]);
 		}
 	});
 	it("returns well-formed holders", async () => {
@@ -5651,14 +5223,14 @@ function testRelationSource(source, options) {
 					holder.group.id,
 					holder.group.relation
 				]) {
-					expect(typeof part).toBe("string");
+					expect(part).toBeTypeOf("string");
 					expect(part).not.toBe("");
 				}
-				else expect(typeof holder.principal.id).toBe("string");
+				else expect(holder.principal.id).toBeTypeOf("string");
 				for (const instant of [holder.startsAt, holder.expiresAt]) expect(instant === void 0 || typeof instant === "number" && Number.isFinite(instant)).toBe(true);
 			}
 			const expected = options.expect?.holders?.[`${object.resource}:${object.id}#${object.relation}`];
-			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toEqual([...expected].toSorted());
+			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toStrictEqual([...expected].toSorted());
 		}
 	});
 	it("follows each link to exactly one instance", async () => {
@@ -5672,7 +5244,7 @@ function testRelationSource(source, options) {
 				through,
 				depth: 1
 			});
-			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
+			expect(linked.ancestors.map((ancestor) => ancestor.id)).toStrictEqual([id]);
 		}
 	});
 	it("reads each object's row as an object, or null when there is none", async () => {
@@ -5702,11 +5274,11 @@ function testRelationSource(source, options) {
 			...missing,
 			through: "parent",
 			depth: 16
-		})).ancestors).toEqual([]);
+		})).ancestors).toStrictEqual([]);
 		if (first.relation !== void 0) expect(await source.related({
 			...missing,
 			relation: first.relation
-		})).toEqual([]);
+		})).toStrictEqual([]);
 	});
 }
 //#endregion
@@ -5718,8 +5290,8 @@ function isFrozenDeep(value) {
 /**
 * Checks a `PrincipalSource`: `principal` answers each listed id with the
 * expected principal or `null`, never another id; `principalByIdentity`
-* resolves each listed identity to the expected principal id or `null`, and
-* an email matches trimmed and in any case.
+* resolves each listed identity to the expected principal id or `null`, and an
+* email matches trimmed and in any case.
 */
 function testPrincipalSource(source, options) {
 	it("returns the principal with the asked id, or null", async () => {
@@ -5731,8 +5303,8 @@ function testPrincipalSource(source, options) {
 				found = null;
 			}
 			expect(found === null || typeof found === "object").toBe(true);
-			if (found !== null) expect(await loadPrincipal(source, entry.id, entry.tenant)).toEqual(found);
-			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+			if (found !== null) expect(await loadPrincipal(source, entry.id, entry.tenant)).toStrictEqual(found);
+			if (entry.expect !== void 0) expect(found).toStrictEqual(entry.expect);
 		}
 	});
 	it("returns principals a caller cannot change", async () => {
@@ -5775,10 +5347,10 @@ async function automationOf(source, id, tenant) {
 	}
 }
 /**
-* Checks an `AutomationSource`: `automation(id)` answers each listed id
-* with a valid Automation v1 record of that id or `null`, never another id;
-* a record held to one tenant is `null` when asked for another; an empty or
-* unknown id is `null`.
+* Checks an `AutomationSource`: `automation(id)` answers each listed id with a
+* valid Automation v1 record of that id or `null`, never another id; a record
+* held to one tenant is `null` when asked for another; an empty or unknown id
+* is `null`.
 */
 function testAutomationSource(source, options) {
 	it("returns a valid v1 record with the asked id, or null", async () => {
@@ -5786,10 +5358,10 @@ function testAutomationSource(source, options) {
 			const found = await automationOf(source, entry.id, entry.tenant);
 			if (found !== null) {
 				const parsed = parseAutomation(found);
-				expect(parsed).toEqual(found);
+				expect(parsed).toStrictEqual(found);
 				expect(parsed?.id).toBe(entry.id);
 			}
-			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+			if (entry.expect !== void 0) expect(found).toStrictEqual(entry.expect);
 		}
 	});
 	it("refuses a record held to another tenant", async () => {
@@ -5812,9 +5384,9 @@ async function sessionOf(source, id) {
 	}
 }
 /**
-* Checks a `SupportSessionSource`: `session(id)` answers each listed id
-* with a record of that id or `null`, never another id; `ended` is a
-* boolean when present; an empty or unknown id is `null`.
+* Checks a `SupportSessionSource`: `session(id)` answers each listed id with a
+* record of that id or `null`, never another id; `ended` is a boolean when
+* present; an empty or unknown id is `null`.
 */
 function testSupportSessionSource(source, options) {
 	it("returns the session with the asked id, or null", async () => {
@@ -5839,7 +5411,10 @@ function testSupportSessionSource(source, options) {
 	});
 }
 const SETTLED = Symbol("settled");
-/** Whether `promise` settles within `ms` milliseconds; a rejection counts as settled. */
+/**
+* Whether `promise` settles within `ms` milliseconds; a rejection counts as
+* settled.
+*/
 async function settlesWithin(promise, ms) {
 	let timer;
 	const timeout = new Promise((resolve) => {
@@ -5854,12 +5429,12 @@ async function settlesWithin(promise, ms) {
 	}
 }
 /**
-* Checks an `ApprovalWaiter`: a wait ends when its token is woken and not
-* when another token is; waking a token nobody waits on resolves; a wait
-* whose `expiresAt` has passed ends; an aborted `signal` rejects the wait with its reason.
-* Pass `expiry: false` or `abort: false` for a waiter whose runner offers no
-* timer or no cancellation, `pending` when the waiter reads a store, and
-* `parked` when a wait parks asynchronously.
+* Checks an `ApprovalWaiter`: a wait ends when its token is woken and not when
+* another token is; waking a token nobody waits on resolves; a wait whose
+* `expiresAt` has passed ends; an aborted `signal` rejects the wait with its
+* reason. Pass `expiry: false` or `abort: false` for a waiter whose runner
+* offers no timer or no cancellation, `pending` when the waiter reads a store,
+* and `parked` when a wait parks asynchronously.
 */
 function testApprovalWaiter(waiter, options = {}) {
 	const timeout = options.timeout ?? 1e3;
@@ -5921,9 +5496,9 @@ function key(suffix) {
 }
 /**
 * Conformance for a `DeliveryTransport`: it sends a checked target with its
-* idempotency key, keeps the key on a retry, refuses a target without a
-* granted decision before calling the provider, and maps provider errors to
-* retryable or final failures without rejecting.
+* idempotency key, keeps the key on a retry, refuses a target without a granted
+* decision before calling the provider, and maps provider errors to retryable
+* or final failures without rejecting.
 */
 function testDeliveryTransport(name, options) {
 	const targetWith = async (decision) => ({
@@ -5937,14 +5512,14 @@ function testDeliveryTransport(name, options) {
 		it("names its channel and provider", () => {
 			const { transport } = options.create();
 			expect(transport.channel).toBe(options.channel);
-			expect(typeof transport.name).toBe("string");
+			expect(transport.name).toBeTypeOf("string");
 			expect(transport.name).not.toBe("");
 		});
 		it("sends a checked target with its idempotency key", async () => {
 			const harness = options.create();
 			const result = await send(harness, await targetWith(await grantedDecision()), "a");
 			expect(result.status).toBe("sent");
-			expect(await harness.received()).toEqual([{ idempotencyKey: "pdd_runner_a" }]);
+			expect(await harness.received()).toStrictEqual([{ idempotencyKey: "pdd_runner_a" }]);
 		});
 		it("passes the same key on a retry of the same delivery", async () => {
 			const harness = options.create();
@@ -5970,7 +5545,7 @@ function testDeliveryTransport(name, options) {
 				cause: "invalid-recipient",
 				retryable: false
 			});
-			expect(await harness.received()).toEqual([]);
+			expect(await harness.received()).toStrictEqual([]);
 		});
 		it("maps a retryable provider error to a retryable failure", async () => {
 			const harness = options.create();
@@ -6001,7 +5576,7 @@ function testDeliveryTransport(name, options) {
 				status: "failed",
 				retryable: true
 			});
-			expect(await harness.received()).toEqual([]);
+			expect(await harness.received()).toStrictEqual([]);
 		});
 	});
 }
@@ -6039,7 +5614,7 @@ function testMembershipSource(source, options) {
 				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
 			}
 			const expected = options.expect?.[principal.id];
-			if (expected !== void 0) expect(memberships).toEqual(expected);
+			if (expected !== void 0) expect(memberships).toStrictEqual(expected);
 		}
 	});
 	if (source.list !== void 0) it("lists every member of an instance it returns a membership for", async () => {
@@ -6071,9 +5646,9 @@ function testEntitlementSource(source, options) {
 	it("returns plan names for a tenant and none without one", async () => {
 		const found = await source.entitlementsFor(options.principal, { tenant: options.tenant });
 		expect(Array.isArray(found)).toBe(true);
-		for (const name of found) expect(typeof name).toBe("string");
-		if (options.expect !== void 0) expect([...found].toSorted()).toEqual([...options.expect].toSorted());
-		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
+		for (const name of found) expect(name).toBeTypeOf("string");
+		if (options.expect !== void 0) expect([...found].toSorted()).toStrictEqual([...options.expect].toSorted());
+		expect(await source.entitlementsFor(options.principal, {})).toStrictEqual([]);
 	});
 }
 function testCustomRoleSource(source, options) {
@@ -6083,7 +5658,7 @@ function testCustomRoleSource(source, options) {
 		for (const role of roles) {
 			expect(role.tenant).toBe(options.tenant);
 			for (const included of role.includes ?? []) expect(declared).toContain(included);
-			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toEqual([]);
+			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toStrictEqual([]);
 		}
 		if (source.assignable !== void 0) {
 			const assignable = await source.assignable(options.tenant);
@@ -6093,7 +5668,7 @@ function testCustomRoleSource(source, options) {
 	const every = options.every;
 	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
 		const roles = await source.rolesFor(options.tenant, { held: [] });
-		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
+		expect([...new Set(roles.map((role) => role.name))].toSorted()).toStrictEqual([...new Set(every)].toSorted());
 	});
 }
 function testDirectoryStore(store, options) {
@@ -6123,7 +5698,7 @@ function testDirectoryStore(store, options) {
 				created: "",
 				lastModified: ""
 			}
-		})).rejects.toThrow(/userName/);
+		})).rejects.toThrow(/userName/u);
 		const group = await store.putGroup(home, {
 			id: "g_editors",
 			displayName: "Editors",
@@ -6134,11 +5709,11 @@ function testDirectoryStore(store, options) {
 				lastModified: ""
 			}
 		});
-		expect(await store.groupsFor(home, created.id)).toEqual([expect.objectContaining({
+		expect(await store.groupsFor(home, created.id)).toStrictEqual([expect.objectContaining({
 			id: group.id,
 			displayName: "Editors"
 		})]);
-		expect(await store.groupsFor(other, created.id)).toEqual([]);
+		expect(await store.groupsFor(other, created.id)).toStrictEqual([]);
 		const patched = await store.patchUser(home, created.id, [{
 			op: "replace",
 			path: "active",
@@ -6146,13 +5721,13 @@ function testDirectoryStore(store, options) {
 		}]);
 		expect(patched.active).toBe(false);
 		const source = directoryMembershipSource(store, { assignable: ["editor"] });
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([]);
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([]);
 		await store.patchUser(home, created.id, [{
 			op: "replace",
 			path: "active",
 			value: true
 		}]);
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([{
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([{
 			tenant: home,
 			roles: ["editor"],
 			via: `group:${group.id}`,
@@ -6163,7 +5738,7 @@ function testDirectoryStore(store, options) {
 			path: "members",
 			value: [{ value: created.id }]
 		}]);
-		expect(await store.groupsFor(home, created.id)).toEqual([]);
+		expect(await store.groupsFor(home, created.id)).toStrictEqual([]);
 	});
 	it("ends sessions when scimHandler deactivates a user in this store", async () => {
 		const feed = memoryRevocationFeed();
@@ -6216,7 +5791,7 @@ function testDirectoryStore(store, options) {
 			kind: "session-revoked"
 		});
 		expect(seen.every((event) => event.kind === "session-revoked")).toBe(true);
-		expect(kinds).toEqual(["changed", "session-revoked"]);
+		expect(kinds).toStrictEqual(["changed", "session-revoked"]);
 	});
 }
 /** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
@@ -6224,13 +5799,13 @@ function testSettingsSource(source, options) {
 	it("answers per tenant with plain settings and nothing for an unknown tenant", async () => {
 		const settings = await source.settingsFor(options.tenant);
 		if (settings !== void 0) {
-			expect(typeof settings).toBe("object");
+			expect(settings).toBeTypeOf("object");
 			const credentials = settings.credentials;
 			if (credentials !== void 0) {
 				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
 				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service" || kind === "feed")).toBe(true);
 			}
-			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
+			expect(JSON.parse(JSON.stringify(settings))).toStrictEqual(settings);
 		}
 		expect(await source.settingsFor(options.unknown ?? "__permdock_unknown__")).toBeUndefined();
 	});
@@ -6665,8 +6240,8 @@ const supabaseClaimVectors = {
 /**
 * The `permdock supabase inspect --json` manifest for a policy with one
 * `tenant` scope, the default `supabase.hook` and a `features` claim from
-* `public.feature_claims`. A package that reads the manifest tests its
-* parser against this value.
+* `public.feature_claims`. A package that reads the manifest tests its parser
+* against this value.
 */
 const supabaseHookManifestFixture = {
 	$schema: "https://permdock.com/schemas/supabase-manifest-v1.json",
@@ -6957,4 +6532,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };