permdock 0.7.0 → 0.8.0

package/dist/testing/index.js

@@ -1,46 +1,47 @@
 import { r as isRecord } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { i as principal } from "../refs-CNJBiTFo.js";
-import { n as role, r as allow } from "../role-builder-C1VJzvcr.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DLFrtrrC.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { i as principal } from "../refs-C8BKxc_e.js";
+import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
+import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DZ0l9UAg.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-pHneukrx.js";
-import { v as resource } from "../permission-registry-DpPtSKNZ.js";
-import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
-import { r as parseAutomation } from "../automation-ySsxp_Yp.js";
-import { f as scopeList, o as normalizeMemberships } from "../scopes-BHsc-wp-.js";
-import { u as evaluateCondition } from "../delegation-C5rOdTp5.js";
-import { a as authenticated } from "../grantee-BrRANrpT.js";
-import { n as definePolicy } from "../policy-DaJy4nK4.js";
-import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-XBgU6RGT.js";
-import { t as definePermissions } from "../permissions-CyH2MV_B.js";
-import { T as validateCustomRole } from "../evaluate-B_oqFbWC.js";
-import { n as parseSnapshot } from "../snapshot-CbGmYiJx.js";
-import { n as fromSnapshot } from "../from-snapshot-Bz469dIh.js";
-import { t as getPermDock } from "../permdock-BfWEeMqk.js";
-import { t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { i as memoryApprovalStore } from "../store-DSP9oGvh.js";
-import { t as catalogFingerprint } from "../catalog-fingerprint-C144oW4M.js";
-import { s as parseCredential } from "../credential-CIM7wHwA.js";
-import { s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { o as resolveApproval } from "../helpers-DY3vXuGs.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
-import { t as catalogSchema } from "../schema-B4v0Qrac.js";
-import { c as parseApiKey } from "../server-Bnga6I50.js";
-import { n as discoverAuthorizationServer } from "../device-BARQ8eYG.js";
-import { t as CONNECTOR_SCHEMA } from "../connector-schema-_VCSsdtD.js";
-import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-YNieBO1U.js";
-import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-nGWma08S.js";
-import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-Cv492Qev.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-B5-w6Kw9.js";
-import { i as saasPermissions } from "../permissions-DArULThq.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-Az_Kz-4D.js";
-import { t as POLICY_NOT_PUBLISHED } from "../problem-types-CJ2325SZ.js";
+import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
+import { v as resource } from "../permission-registry-B8tYxPIt.js";
+import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-nR1JesoH.js";
+import { r as parseAutomation } from "../automation-x3KEUusw.js";
+import { f as scopeList, o as normalizeMemberships } from "../scopes-0Up_UA2t.js";
+import { u as evaluateCondition } from "../delegation-CDB6_keF.js";
+import { a as authenticated } from "../grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "../compare-DTfyUunF.js";
+import { r as definePolicy } from "../policy-CLQ8__GF.js";
+import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
+import { t as definePermissions } from "../permissions-CVXmRILq.js";
+import { T as validateCustomRole } from "../evaluate-Dd8Ta0Ie.js";
+import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
+import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
+import { t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
+import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
+import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
+import { s as parseCredential } from "../credential-CyyyvCsL.js";
+import { c as problemFromDecision } from "../problem-BVLHFK33.js";
+import { o as resolveApproval } from "../helpers-DJicaG6f.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
+import { t as catalogSchema } from "../schema-BOJjqlWL.js";
+import { c as parseApiKey } from "../server-3cVlTLde.js";
+import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
+import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
+import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-2r37XRhD.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-H-mbhpZc.js";
+import { i as saasPermissions } from "../permissions-mDcTWoBs.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-iWnUdwCt.js";
+import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
 import { t as require__2020 } from "../2020-CJbO8Bvz.js";
-import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
+import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
 /** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
 function describePolicy(policy, config) {
@@ -59,7 +60,7 @@ function describePolicy(policy, config) {
 				it(title, () => {
 					const decided = state.report?.cells.find((item) => item.name === cell.name);
 					expect(decided, `cell ${cell.name} was not decided`).toBeDefined();
-					expect(decided?.failures).toEqual([]);
+					expect(decided?.failures).toStrictEqual([]);
 				});
 			}
 		});
@@ -79,8 +80,8 @@ async function outcomes(policy, entry, options) {
 	};
 }
 /**
-* Asserts that `fromSnapshot(permdock.snapshot())` never grants what the
-* server denies, and matches it exactly unless a case is marked `stricter`.
+* Asserts that `fromSnapshot(permdock.snapshot())` never grants what the server
+* denies, and matches it exactly unless a case is marked `stricter`.
 */
 function testClientParity(policy, cases, options = {}) {
 	for (const entry of cases) it(`client parity: ${entry.name}`, async () => {
@@ -95,9 +96,9 @@ function testClientParity(policy, cases, options = {}) {
 //#endregion
 //#region src/testing/legacy-parity.ts
 /**
-* Asserts that the policy answers each case as the application's legacy
-* check does, or as the case's `expect` says where the difference is
-* intended. Run it before enforcing a permission with `shadowMode`.
+* Asserts that the policy answers each case as the application's legacy check
+* does, or as the case's `expect` says where the difference is intended. Run it
+* before enforcing a permission with `shadowMode`.
 */
 function testLegacyParity(policy, legacy, cases) {
 	for (const entry of cases) it(`legacy parity: ${entry.name}`, async () => {
@@ -111,7 +112,7 @@ function testLegacyParity(policy, legacy, cases) {
 		expect({
 			permission: entry.permission.key,
 			granted: ours
-		}).toEqual({
+		}).toStrictEqual({
 			permission: entry.permission.key,
 			granted: entry.expect ?? theirs
 		});
@@ -217,9 +218,9 @@ function unreachable() {
 }
 /**
 * Race and cache scenarios for a client snapshot store: tenant switches,
-* `replace` and `refresh`, logout and a second user during a refresh, stale
-* and signed snapshots, and endpoint answers cached per tenant. Runs against
-* the saas domain; `createStore` wraps the store an adapter ships.
+* `replace` and `refresh`, logout and a second user during a refresh, stale and
+* signed snapshots, and endpoint answers cached per tenant. Runs against the
+* saas domain; `createStore` wraps the store an adapter ships.
 */
 function testClientStore(name, createStore) {
 	const acmeProject = saasProject("p1");
@@ -251,7 +252,7 @@ function testClientStore(name, createStore) {
 				fetch: net.fetch
 			});
 			await store.get().refresh({ tenant: "globex" });
-			expect(net.calls.map((call) => call.url)).toEqual(["/api/snapshot?v=1&tenant=globex"]);
+			expect(net.calls.map((call) => call.url)).toStrictEqual(["/api/snapshot?v=1&tenant=globex"]);
 			expect(store.get().subject.principal?.tenant).toBe("acme");
 			expect(store.get().can(p.project.update, acmeProject)).toBe(true);
 			expect(store.get().status()).toBe("stale");
@@ -499,15 +500,36 @@ function testClientStore(name, createStore) {
 async function snapshotFixture(policy, subject, options = {}) {
 	const instance = await getPermDock(policy, subject, options.tenant === void 0 ? {} : { tenant: options.tenant });
 	const target = options.simulated === true ? instance.simulate({}) : instance;
-	if (Array.isArray(target)) throw new Error("PermDock: snapshotFixture expected a PermDock instance");
+	if (Array.isArray(target)) throw new TypeError("PermDock: snapshotFixture expected a PermDock instance");
 	const snapshot = options.include === void 0 && options.tenants === void 0 ? target.snapshot() : target.snapshot({
 		...options.include === void 0 ? {} : { include: options.include },
 		...options.tenants === void 0 ? {} : { tenants: options.tenants }
 	});
-	if (typeof snapshot === "string" || snapshot instanceof Promise) throw new Error("PermDock: snapshotFixture expected a JSON snapshot");
+	if (typeof snapshot === "string" || snapshot instanceof Promise) throw new TypeError("PermDock: snapshotFixture expected a JSON snapshot");
 	return snapshot;
 }
 //#endregion
+//#region src/testing/seed-rows.ts
+/**
+* Inserts `factories.*` rows through the `query` function `testRlsParity`
+* takes, one parameterised `insert` per row with the row's own keys as quoted
+* column names. `undefined` fields are left to the column default. Run it as
+* the table owner, before RLS applies. Resolves to the number of rows
+* inserted.
+*/
+async function seedRows(query, rows) {
+	let inserted = 0;
+	for (const [table, list] of Object.entries(rows)) {
+		const target = quoteSqlTable(table);
+		for (const row of list) {
+			const columns = Object.keys(row).filter((key) => row[key] !== void 0);
+			await query(columns.length === 0 ? `insert into ${target} default values` : `insert into ${target} (${columns.map((column) => quoteSqlIdent(column)).join(", ")}) values (${columns.map((_, index) => `$${String(index + 1)}`).join(", ")})`, columns.map((column) => row[column]));
+			inserted += 1;
+		}
+	}
+	return inserted;
+}
+//#endregion
 //#region src/testing/http-adapter/domain.ts
 function project$1(id) {
 	const row = saasSeed.projects.find((candidate) => candidate.id === id);
@@ -828,11 +850,12 @@ function testHttpAdapter(options) {
 			return eventStream(await mounted.fetch(new Request(`http://app.test/${org}/projects/${id}/events`, { headers })));
 		};
 		scenario("tenant", "resolves the tenant from the path on every protect", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "project.get",
 				org: "acme",
 				id: "p2"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("alice", {
 				op: "project.get",
 				org: "globex",
@@ -855,11 +878,12 @@ function testHttpAdapter(options) {
 			})).status).toBe(401);
 		});
 		scenario("roles", "applies the role held in the requested org", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "project.update",
 				org: "acme",
 				id: "p1"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("alice", {
 				op: "project.update",
 				org: "globex",
@@ -884,11 +908,12 @@ function testHttpAdapter(options) {
 				name: "Contract",
 				archived: false
 			};
-			expect((await send("dave", {
+			const { status } = await send("dave", {
 				op: "project.create",
 				org: "acme",
 				body
-			})).status).toBe(201);
+			});
+			expect(status).toBe(201);
 			expect((await send("hank", {
 				op: "project.create",
 				org: "acme",
@@ -896,29 +921,34 @@ function testHttpAdapter(options) {
 			})).status).toBe(403);
 		});
 		scenario("plans", "gates a feature on the plan of the requested org", async () => {
-			expect((await send("erin", {
+			const { status } = await send("erin", {
 				op: "analytics.read",
 				org: "globex"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			const upgrade = await send("erin", {
 				op: "analytics.read",
 				org: "acme"
 			});
 			expect(upgrade.status).toBe(403);
-			expect(new Set(reasonsOf(upgrade.body))).toEqual(/* @__PURE__ */ new Set(["not-entitled"]));
+			expect(new Set(reasonsOf(upgrade.body))).toStrictEqual(/* @__PURE__ */ new Set(["not-entitled"]));
 		});
 		scenario("expired", "ignores an expired membership", async () => {
-			expect((await send("frank", {
+			const { status } = await send("frank", {
 				op: "project.get",
 				org: "acme",
 				id: "p1"
-			})).status).toBe(403);
+			});
+			expect(status).toBe(403);
 		});
 		scenario("limits", "counts a quota per subject and tenant", async () => {
-			for (let index = 0; index < 5; index += 1) expect((await send("erin", {
-				op: "apiKey.create",
-				org: "acme"
-			})).status).toBe(201);
+			for (let index = 0; index < 5; index += 1) {
+				const { status } = await send("erin", {
+					op: "apiKey.create",
+					org: "acme"
+				});
+				expect(status).toBe(201);
+			}
 			const exhausted = await send("erin", {
 				op: "apiKey.create",
 				org: "acme"
@@ -938,11 +968,12 @@ function testHttpAdapter(options) {
 				name: "New",
 				archived: false
 			};
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.create",
 				org: "acme",
 				body: valid
-			})).status).toBe(201);
+			});
+			expect(status).toBe(201);
 			const invalid = await send("bob", {
 				op: "project.create",
 				org: "acme",
@@ -978,12 +1009,13 @@ function testHttpAdapter(options) {
 				"title",
 				"permission",
 				"denials"
-			]) expect(field(denied.body, key)).toEqual(field(fromProtect.body, key));
-			expect((await send("bob", {
+			]) expect(field(denied.body, key)).toStrictEqual(field(fromProtect.body, key));
+			const { status } = await send("bob", {
 				op: "project.delete",
 				org: "acme",
 				id: "p3"
-			})).status).toBe(204);
+			});
+			expect(status).toBe(204);
 			expect((await send("bob", {
 				op: "project.delete",
 				org: "acme",
@@ -998,7 +1030,7 @@ function testHttpAdapter(options) {
 			expect(asked.status).toBe(403);
 			expect(field(asked.body, "type")).toBe("https://permdock.com/problems/approval-required");
 			const token = field(asked.body, "token");
-			expect(typeof token).toBe("string");
+			expect(token).toBeTypeOf("string");
 			await resolveApproval(domain.store, String(token), {
 				status: "approved",
 				by: await approverSubject("carol", "acme")
@@ -1017,11 +1049,12 @@ function testHttpAdapter(options) {
 			})).status).toBe(204);
 		});
 		scenario("stale-approval", "ignores an approval header meant for another request", async () => {
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.get",
 				org: "acme",
 				id: "p1"
-			}, "pd1.not-a-real-token")).status).toBe(200);
+			}, "pd1.not-a-real-token");
+			expect(status).toBe(200);
 		});
 		scenario("evaluations", "answers the decision endpoint in the path tenant", async () => {
 			const result = await send("bob", {
@@ -1045,7 +1078,7 @@ function testHttpAdapter(options) {
 			});
 			expect(result.status).toBe(200);
 			const rows = field(result.body, "evaluations");
-			expect(Array.isArray(rows) ? rows.map((row) => field(row, "decision")) : rows).toEqual([true, false]);
+			expect(Array.isArray(rows) ? rows.map((row) => field(row, "decision")) : rows).toStrictEqual([true, false]);
 		});
 		scenario("upload", "leaves a multipart body to the framework parser", async () => {
 			const file = {
@@ -1059,22 +1092,24 @@ function testHttpAdapter(options) {
 				file
 			});
 			expect(uploaded.status).toBe(201);
-			expect(uploaded.body).toEqual({
+			expect(uploaded.body).toStrictEqual({
 				name: "notes.txt",
 				size: 5
 			});
-			expect((await send("bob", {
+			const { status } = await send("bob", {
 				op: "project.upload",
 				org: "acme",
 				id: "p2",
 				file
-			})).status).toBe(403);
+			});
+			expect(status).toBe(403);
 		});
 		scenario("sub-app", "protects a route inside a sub-app", async () => {
-			expect((await send("alice", {
+			const { status } = await send("alice", {
 				op: "admin.members",
 				org: "acme"
-			})).status).toBe(200);
+			});
+			expect(status).toBe(200);
 			expect((await send("bob", {
 				op: "admin.members",
 				org: "acme"
@@ -1091,7 +1126,7 @@ function testHttpAdapter(options) {
 				org: entry.org,
 				id: entry.id
 			})).status));
-			expect(statuses).toEqual(calls.map((entry) => entry.status));
+			expect(statuses).toStrictEqual(calls.map((entry) => entry.status));
 		});
 		scenario("stream-revoked", "closes an open stream when the session is revoked", async () => {
 			expect((await openStream(null, "acme", "p1")).status).toBe(401);
@@ -1146,7 +1181,7 @@ function testHttpAdapter(options) {
 					expect(frame?.event).toBe("message");
 					ids.push(String(field(JSON.parse(frame?.data ?? "{}"), "id")));
 				}
-				expect(new Set(ids)).toEqual(/* @__PURE__ */ new Set([
+				expect(new Set(ids)).toStrictEqual(/* @__PURE__ */ new Set([
 					"p1",
 					"p3",
 					"p4"
@@ -1473,10 +1508,11 @@ function testAgentRuntime(options) {
 			const listed = await agent().allowedOperations(alice);
 			expect(listed.has("project_read")).toBe(true);
 			expect(listed.has("drop_database")).toBe(false);
-			expect([...await agent().allowedOperations(mallory)]).toEqual([]);
+			expect([...await agent().allowedOperations(mallory)]).toStrictEqual([]);
 		});
 		scenario("model-gate", "grants a model by its permission and denies one the map does not name", async () => {
-			expect((await agent().decideModel("frontier", erin)).outcome).toBe("granted");
+			const { outcome } = await agent().decideModel("frontier", erin);
+			expect(outcome).toBe("granted");
 			expect((await agent().decideModel("frontier", alice)).outcome).toBe("denied");
 			expect((await agent().decideModel("unlisted", erin)).outcome).toBe("denied");
 			expect((await agent().decideModel("standard", {
@@ -1485,15 +1521,15 @@ function testAgentRuntime(options) {
 			})).outcome).toBe("denied");
 		});
 		scenario("permitted-models", "returns the granted models in declaration order", async () => {
-			expect(await agent().permittedModels(erin)).toEqual(["standard", "frontier"]);
-			expect(await agent().permittedModels(alice)).toEqual(["standard"]);
-			expect(await agent().permittedModels(mallory)).toEqual([]);
+			expect(await agent().permittedModels(erin)).toStrictEqual(["standard", "frontier"]);
+			expect(await agent().permittedModels(alice)).toStrictEqual(["standard"]);
+			expect(await agent().permittedModels(mallory)).toStrictEqual([]);
 		});
 		scenario("results-filter", "keeps the rows the results permission grants, and none for an unknown operation", async () => {
 			const rows = projects("p1", "g1", "p2");
-			expect((await agent().filterResults("project_search", rows, alice)).map((row) => row.id)).toEqual(["p1", "p2"]);
-			expect(await agent().filterResults("project_search", rows, mallory)).toEqual([]);
-			expect(await agent().filterResults("drop_database", rows, alice)).toEqual([]);
+			expect((await agent().filterResults("project_search", rows, alice)).map((row) => row.id)).toStrictEqual(["p1", "p2"]);
+			expect(await agent().filterResults("project_search", rows, mallory)).toStrictEqual([]);
+			expect(await agent().filterResults("drop_database", rows, alice)).toStrictEqual([]);
 		});
 		scenario("gateway-options", "attributes gateway usage to the principal, and to nobody for an anonymous call", async () => {
 			const attributed = await agent().gatewayOptions(alice);
@@ -1543,7 +1579,7 @@ function testAuthzen(handle, options) {
 	}
 	for (const [index, vector] of (options.vectors.evaluations ?? []).entries()) it(`evaluations ${index}: ${vector.request.evaluations.length} items`, async () => {
 		const body = await post("/access/v1/evaluations", vector.request);
-		expect(body.evaluations.map((row) => ({ decision: row.decision }))).toEqual(vector.expected);
+		expect(body.evaluations.map((row) => ({ decision: row.decision }))).toStrictEqual(vector.expected);
 	});
 	const search = options.vectors.search ?? {};
 	for (const kind of [
@@ -1552,10 +1588,13 @@ function testAuthzen(handle, options) {
 		"action"
 	]) for (const [index, vector] of (search[kind] ?? []).entries()) it(`search/${kind} ${index}`, async () => {
 		const body = await post(`/access/v1/search/${kind}`, vector.request);
-		expect(body.results.map(sortKey).toSorted()).toEqual(vector.expected.results.map(sortKey).toSorted());
+		expect(body.results.map(sortKey).toSorted()).toStrictEqual(vector.expected.results.map(sortKey).toSorted());
 	});
 }
-/** The AuthZEN interop Todo directory: each user is addressable by email or by identity. */
+/**
+* The AuthZEN interop Todo directory: each user is addressable by email or by
+* identity.
+*/
 const authzenTodoUsers = Object.freeze([
 	{
 		id: "rick@the-citadel.com",
@@ -1600,7 +1639,10 @@ const authzenTodoPermissions = definePermissions({
 });
 const todo = authzenTodoPermissions.todo;
 const everyone = [allow(authzenTodoPermissions.user.can_read_user), allow(todo.can_read_todos)];
-/** The interop Todo rules: viewers read, editors write their own, admins delete and evil geniuses update anything. */
+/**
+* The interop Todo rules: viewers read, editors write their own, admins delete
+* and evil geniuses update anything.
+*/
 const authzenTodoPolicy = definePolicy(authzenTodoPermissions, {
 	roles: [
 		role("viewer", everyone),
@@ -1635,7 +1677,10 @@ const TODOS = Object.freeze(authzenTodoUsers.map((user, index) => ({
 	id: `todo-${String(index + 1)}`,
 	ownerID: user.id
 })));
-/** Rows for `resources.todo.list` and records for `subjects.list` in the Todo domain. */
+/**
+* Rows for `resources.todo.list` and records for `subjects.list` in the Todo
+* domain.
+*/
 const authzenTodoData = Object.freeze({
 	todos: TODOS,
 	users: Object.freeze(authzenTodoUsers.map((user) => ({ id: user.id })))
@@ -1653,9 +1698,9 @@ function expectedFor(user, action, ownerID) {
 	}
 }
 /**
-* PermDock's vectors over the interop Todo domain, in the interop layout:
-* every user against every action on their own and on Rick's todo, one batch
-* per user, and the three searches.
+* PermDock's vectors over the interop Todo domain, in the interop layout: every
+* user against every action on their own and on Rick's todo, one batch per
+* user, and the three searches.
 */
 function authzenTodoVectors() {
 	const rick = authzenTodoUsers[0];
@@ -1855,9 +1900,9 @@ function testApprovalStore(store, options = {}) {
 		});
 		const [first, second] = await Promise.all([store.consume("once-token"), store.consume("once-token")]);
 		expect([first, second].filter((item) => item !== null)).toHaveLength(1);
-		expect((first ?? second)?.consumedAt).toEqual(expect.any(String));
+		expect((first ?? second)?.consumedAt).toStrictEqual(expect.any(String));
 		expect(await store.consume("once-token")).toBeNull();
-		expect((await store.get("once-token"))?.consumedAt).toEqual(expect.any(String));
+		expect((await store.get("once-token"))?.consumedAt).toStrictEqual(expect.any(String));
 	});
 	it("refuses an approver from another tenant", async () => {
 		await store.create(tenantApproval("tenant-token", "o_1"));
@@ -1873,6 +1918,7 @@ function testApprovalStore(store, options = {}) {
 			status: "approved",
 			by: approver
 		});
+		assert.isDefined(options.reopen);
 		const reopened = await options.reopen();
 		expect((await reopened.get("restart-token"))?.status).toBe("approved");
 		expect(await reopened.consume("restart-token")).not.toBeNull();
@@ -1880,6 +1926,7 @@ function testApprovalStore(store, options = {}) {
 	});
 	it.skipIf(options.capabilities?.expire === void 0)("replaces an expired request on a new ask", async () => {
 		await store.create(sampleApproval("renew-token"));
+		assert.isDefined(options.capabilities?.expire);
 		await options.capabilities.expire("renew-token");
 		const renewed = {
 			...sampleApproval("renew-token"),
@@ -1894,8 +1941,8 @@ function testApprovalStore(store, options = {}) {
 		const request = sampleApproval("opaque-token");
 		await store.create(request);
 		const loaded = await store.get("opaque-token");
-		expect(loaded).toEqual(request);
-		expect(JSON.parse(JSON.stringify(loaded))).toEqual(request);
+		expect(loaded).toStrictEqual(request);
+		expect(JSON.parse(JSON.stringify(loaded))).toStrictEqual(request);
 		const listed = await store.list({ status: "pending" });
 		expect(listed.items.some((item) => item.token === "opaque-token")).toBe(true);
 		const resolved = await store.resolve("opaque-token", {
@@ -1906,7 +1953,7 @@ function testApprovalStore(store, options = {}) {
 		await expect(Promise.resolve().then(() => store.resolve("opaque-token", {
 			status: "rejected",
 			by: approver
-		}))).rejects.toThrow(/not pending/);
+		}))).rejects.toThrow(/not pending/u);
 		await store.create(sampleApproval("stale-token"));
 		const expired = await store.expire({ epochMilliseconds: nowMillis() + 72e5 });
 		expect(expired).toBeGreaterThanOrEqual(1);
@@ -1929,19 +1976,20 @@ function testApprovalStore(store, options = {}) {
 			principalId: "u_pager",
 			limit: 2
 		});
-		expect(first.items.map((item) => item.token)).toEqual(["page-a", "page-b"]);
-		expect(typeof first.next).toBe("string");
+		expect(first.items.map((item) => item.token)).toStrictEqual(["page-a", "page-b"]);
+		expect(first.next).toBeTypeOf("string");
+		assert.isDefined(first.next);
 		const second = await store.list({
 			principalId: "u_pager",
 			limit: 2,
 			cursor: first.next
 		});
-		expect(second.items.map((item) => item.token)).toEqual(["page-c"]);
+		expect(second.items.map((item) => item.token)).toStrictEqual(["page-c"]);
 		expect(second.next).toBeUndefined();
 		expect((await store.list({
 			principalId: "u_pager",
 			cursor: "not a cursor"
-		})).items).toEqual([]);
+		})).items).toStrictEqual([]);
 	});
 	it("refuses an approver who does not match request.approvers", async () => {
 		const request = {
@@ -1963,7 +2011,7 @@ function testApprovalStore(store, options = {}) {
 		await expect(Promise.resolve().then(() => store.resolve("gated-token", {
 			status: "approved",
 			by: member
-		}))).rejects.toThrow(/eligible|not pending|not found/);
+		}))).rejects.toThrow(/eligible|not pending|not found/u);
 	});
 	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
 		const principal = {
@@ -2018,7 +2066,7 @@ function testApprovalStore(store, options = {}) {
 			by: approver
 		});
 		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
+		expect(first.approvals).toStrictEqual([{
 			by: "u_9",
 			at: expect.any(String)
 		}]);
@@ -2032,7 +2080,7 @@ function testApprovalStore(store, options = {}) {
 			by: secondApprover
 		});
 		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.by)).toEqual(["u_9", "u_10"]);
+		expect(second.approvals?.map((item) => item.by)).toStrictEqual(["u_9", "u_10"]);
 		expect(second.resolvedBy).toBe("u_10");
 		expect(await store.consume("quorum-token")).not.toBeNull();
 	});
@@ -2068,7 +2116,7 @@ function testApprovalStore(store, options = {}) {
 		});
 		expect(resolved.status).toBe("approved");
 		expect(resolved.vouched).toBe("app-rule");
-		expect(resolved.approvals).toEqual([{
+		expect(resolved.approvals).toStrictEqual([{
 			by: "u_outsider",
 			at: expect.any(String),
 			vouched: "app-rule"
@@ -2151,7 +2199,7 @@ function testApprovalStore(store, options = {}) {
 			by: secondApprover
 		});
 		expect(first.status).toBe("pending");
-		expect(first.approvals).toEqual([{
+		expect(first.approvals).toStrictEqual([{
 			by: "u_10",
 			at: expect.any(String),
 			stage: 0
@@ -2161,7 +2209,7 @@ function testApprovalStore(store, options = {}) {
 			by: approver
 		});
 		expect(second.status).toBe("approved");
-		expect(second.approvals?.map((item) => item.stage)).toEqual([0, 1]);
+		expect(second.approvals?.map((item) => item.stage)).toStrictEqual([0, 1]);
 	});
 	it("matches a relation approver only through the verdict's relations", async () => {
 		const manager = {
@@ -2192,21 +2240,21 @@ function testApprovalStore(store, options = {}) {
 }
 /**
 * Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
-* queried tenant or to none, and every entry loads against `policy` (an
-* entry that does not would deny every call).
+* queried tenant or to none, and every entry loads against `policy` (an entry
+* that does not would deny every call).
 */
 function testApprovalPolicySource(source, options) {
 	it("answers per tenant with plain entries that load against the policy", async () => {
 		const entries = await source.approvalPoliciesFor({ tenants: [options.tenant] });
 		expect(Array.isArray(entries)).toBe(true);
 		for (const entry of entries) {
-			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect(JSON.parse(JSON.stringify(entry))).toStrictEqual(entry);
 			expect([void 0, options.tenant]).toContain(entry.tenant);
 		}
 		const loaded = await approvalPoliciesFor(options.policy, source, [options.tenant], []);
 		expect(loaded).not.toBe("failed");
 		const other = await source.approvalPoliciesFor({ tenants: [options.unknown ?? "__permdock_unknown__"] });
-		expect(other.filter((entry) => entry.tenant !== void 0)).toEqual([]);
+		expect(other.filter((entry) => entry.tenant !== void 0)).toStrictEqual([]);
 	});
 }
 const reviewItem = {
@@ -2251,7 +2299,7 @@ function testAccessReviewStore(store) {
 			limit: 1
 		});
 		expect(page.items).toHaveLength(1);
-		expect(page.next).toEqual(expect.any(String));
+		expect(page.next).toStrictEqual(expect.any(String));
 		const kept = await store.decide("rev", reviewItem.id, {
 			status: "kept",
 			decidedBy: "u_9",
@@ -2292,7 +2340,7 @@ function testApprovalDelegationSource(source, options) {
 		expect(entries.some((entry) => entry.delegate === options.delegate && entry.delegator === options.delegator)).toBe(true);
 		const instant = Date.parse(at);
 		for (const entry of entries) {
-			expect(JSON.parse(JSON.stringify(entry))).toEqual(entry);
+			expect(JSON.parse(JSON.stringify(entry))).toStrictEqual(entry);
 			expect(entry.delegate).toBe(options.delegate);
 			expect(Date.parse(entry.from)).toBeLessThanOrEqual(instant);
 			expect(Date.parse(entry.until)).toBeGreaterThan(instant);
@@ -2301,13 +2349,13 @@ function testApprovalDelegationSource(source, options) {
 			delegate: "__permdock_unknown__",
 			...options.tenant === void 0 ? {} : { tenant: options.tenant },
 			at
-		})).toEqual([]);
+		})).toStrictEqual([]);
 	});
 }
 /**
-* Checks an `IdempotencyStore`: a stored response comes back as written
-* until it expires, keys never share an entry, and a later `set` replaces an
-* earlier one.
+* Checks an `IdempotencyStore`: a stored response comes back as written until
+* it expires, keys never share an entry, and a later `set` replaces an earlier
+* one.
 */
 function testIdempotencyStore(store) {
 	it("replays a stored response per key and keeps keys apart", async () => {
@@ -2322,14 +2370,14 @@ function testIdempotencyStore(store) {
 		const later = nowMillis() + 36e5;
 		expect(await store.get(key)).toBeUndefined();
 		await store.set(key, response, later);
-		expect(await store.get(key)).toEqual(response);
+		expect(await store.get(key)).toStrictEqual(response);
 		expect(await store.get(other)).toBeUndefined();
 		const replaced = {
 			...response,
 			status: 201
 		};
 		await store.set(key, replaced, later);
-		expect(await store.get(key)).toEqual(replaced);
+		expect(await store.get(key)).toStrictEqual(replaced);
 	});
 }
 //#endregion
@@ -2347,7 +2395,7 @@ function testLimitStore(store) {
 		expect(first.remaining).toBeGreaterThanOrEqual(0);
 		const peeked = store.remaining(input);
 		if (peeked !== void 0) {
-			expect(typeof peeked.remaining).toBe("number");
+			expect(peeked.remaining).toBeTypeOf("number");
 			expect(peeked !== null && typeof peeked === "object" && "then" in peeked && typeof peeked.then === "function").toBe(false);
 		}
 		await store.consume(input);
@@ -2391,7 +2439,7 @@ function testPolicySource(source, options = {}) {
 	};
 	it("returns null or a v1 policy document synchronously", () => {
 		const document = readCurrent();
-		if (document !== null) expect(parsePolicyDocument(document)).toEqual(document);
+		if (document !== null) expect(parsePolicyDocument(document)).toStrictEqual(document);
 	});
 	it("refreshes without rejecting and keeps current() synchronous", async () => {
 		await expect(Promise.resolve(source.refresh())).resolves.toBeUndefined();
@@ -2454,7 +2502,10 @@ const TOO_MANY = problem$1("Rate limited; retry after Retry-After seconds", {
 		schema: { type: "string" }
 	}
 });
-/** The RFC 6750 section 3 challenge a refused read carries, so a client tells a dead token from a missing scope. */
+/**
+* The RFC 6750 section 3 challenge a refused read carries, so a client tells a
+* dead token from a missing scope.
+*/
 const challenge = (example) => ({ "WWW-Authenticate": {
 	description: `RFC 6750 Bearer challenge (\`${example}\`)`,
 	schema: { type: "string" }
@@ -2627,7 +2678,10 @@ const PROJECT_ID = {
 		minLength: 1
 	}
 };
-/** Routes of the platform issuer and its read API; they sit at the API root, outside /v1/environments/{env}. */
+/**
+* Routes of the platform issuer and its read API; they sit at the API root,
+* outside /v1/environments/{env}.
+*/
 const PLATFORM_PATHS = {
 	"/.well-known/oauth-authorization-server": { get: {
 		security: [],
@@ -2828,7 +2882,10 @@ const PLATFORM_SECURITY_SCHEMES = {
 //#endregion
 //#region src/testing/cloud-api/platform-checks.ts
 const ITEM = /^"[^"]+"(?:;[a-z]+=-?\d+)+$/u;
-/** Whether a RateLimit or RateLimit-Policy field value lists items with the parameters `keys` (draft-ietf-httpapi-ratelimit-headers-11). */
+/**
+* Whether a RateLimit or RateLimit-Policy field value lists items with the
+* parameters `keys` (draft-ietf-httpapi-ratelimit-headers-11).
+*/
 function rateLimitField(value, keys) {
 	if (value === null || value.trim() === "") return false;
 	return value.split(",").every((raw) => {
@@ -2853,14 +2910,14 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		body: new URLSearchParams(fields).toString()
 	});
 	it("publishes RFC 8414 metadata for the platform issuer", async () => {
-		const metadata = await discoverAuthorizationServer(url, { fetch: (input, init) => fetchFn(String(input), init) });
+		const metadata = await discoverAuthorizationServer(url, { fetch: (input, init) => fetchFn(input instanceof Request ? input.url : input.toString(), init) });
 		expect(metadata).not.toBeNull();
 		expect(metadata).toMatchObject({
 			issuer: url,
 			code_challenge_methods_supported: ["S256"]
 		});
 		const scopes = metadata?.["scopes_supported"];
-		expect(scopes).toEqual(expect.arrayContaining(Object.keys(PLATFORM_SCOPES)));
+		expect(scopes).toStrictEqual(expect.arrayContaining(Object.keys(PLATFORM_SCOPES)));
 	});
 	it("lists and reads the project and its policy with RateLimit fields", async () => {
 		const list = await read("/v1/projects", options.token);
@@ -2979,7 +3036,8 @@ function testCloudPlatform(url, environment, options, fetchFn) {
 		const loopback = await register("http://127.0.0.1:33418/callback");
 		expect(loopback.status).toBe(201);
 		expect(await loopback.json()).toMatchObject({ client_id: expect.any(String) });
-		expect((await register("http://mcp.example.invalid/callback")).status).toBe(400);
+		const { status } = await register("http://mcp.example.invalid/callback");
+		expect(status).toBe(400);
 	});
 }
 //#endregion
@@ -3998,7 +4056,8 @@ const bearer = (description) => ({
 });
 /**
 * `schemas/cloud-api-v1.json`: the PermDock Cloud HTTP API as an OpenAPI 3.1
-* document. The route tables in `adapters/cloud.mdx` and `docs:drift` keep it whole.
+* document. The route tables in `adapters/cloud.mdx` and `docs:drift` keep it
+* whole.
 */
 const CLOUD_API_DOCUMENT = freezeDeep({
 	openapi: "3.1.1",
@@ -4101,7 +4160,10 @@ function routesOf(paths) {
 function pointer(parts) {
 	return parts.map((part) => part.replaceAll("~", "~0").replaceAll("/", "~1")).join("/");
 }
-/** A checker for responses of the PermDock Cloud API, compiled once from `CLOUD_API_DOCUMENT`. */
+/**
+* A checker for responses of the PermDock Cloud API, compiled once from
+* `CLOUD_API_DOCUMENT`.
+*/
 function cloudApiValidator() {
 	const ajv = new import__2020.Ajv2020({
 		strict: false,
@@ -4211,8 +4273,8 @@ async function problemCode(response) {
 * Runs the conformance runners and the HTTP contract checks against one
 * PermDock Cloud environment, and validates every response body against
 * `cloud-api-v1.json`. Point it at a test environment: it creates approvals,
-* sends decision events and deliveries to `.invalid` addresses, and pushes
-* the catalog the environment already holds.
+* sends decision events and deliveries to `.invalid` addresses, and pushes the
+* catalog the environment already holds.
 */
 function testCloudApi(baseUrl, keys, options) {
 	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
@@ -4224,16 +4286,13 @@ function testCloudApi(baseUrl, keys, options) {
 		environment
 	});
 	const check = cloudApiValidator();
-	const problems = [];
 	const checks = [];
 	const recording = async (input, init) => {
 		const request = new Request(input, init);
 		const response = await fetchFn(request);
 		const { pathname } = new URL(request.url);
 		const path = pathname === `${METADATA}${prefix}` ? METADATA : pathname.slice(prefix.length);
-		checks.push(check(request.method, path, response.clone()).then((found) => {
-			problems.push(...found);
-		}));
+		checks.push(check(request.method, path, response.clone()));
 		return response;
 	};
 	const client = cloud({
@@ -4301,17 +4360,19 @@ function testCloudApi(baseUrl, keys, options) {
 			issuer,
 			jwks_uri: `${issuer}/.well-known/jwks.json`
 		});
-		expect((await recording(`${url}/v1/environment`)).status).toBe(401);
+		const { status } = await recording(`${url}/v1/environment`);
+		expect(status).toBe(401);
 	});
 	it("answers 403 to a key of another kind", async () => {
-		expect((await call("/hosted-grants", keys.client)).status).toBe(403);
+		const { status } = await call("/hosted-grants", keys.client);
+		expect(status).toBe(403);
 		if (keys.export !== void 0) expect((await call("/approvals", keys.export)).status).toBe(403);
 	});
 	it("sends an ETag on the approval read and refuses an approver token with a stale one", async () => {
 		const token = tag();
 		await client.approvals.create(sample(token));
 		const { request, etag } = await current(token);
-		expect(etag).toEqual(expect.any(String));
+		expect(etag).toStrictEqual(expect.any(String));
 		const stale = await resolveRaw(token, {
 			status: "approved",
 			by: admin
@@ -4372,7 +4433,7 @@ function testCloudApi(baseUrl, keys, options) {
 					aud: issuer
 				})
 			});
-			expect([typ, response.status]).toEqual([typ, 422]);
+			expect([typ, response.status]).toStrictEqual([typ, 422]);
 		}
 	});
 	it("repeats a delivery for a repeated Idempotency-Key and requires one", async () => {
@@ -4400,7 +4461,8 @@ function testCloudApi(baseUrl, keys, options) {
 		expect(first.ok && second.ok).toBe(true);
 		const [a, b] = await Promise.all([first.json(), second.json()]);
 		expect(isRecord(a) && isRecord(b) && a["id"] === b["id"]).toBe(true);
-		expect((await send({})).status).toBe(400);
+		const { status } = await send({});
+		expect(status).toBe(400);
 	});
 	it("answers unchanged for the catalog it already holds", async (context) => {
 		const response = await call("/catalog", keys.client);
@@ -4437,12 +4499,12 @@ function testCloudApi(baseUrl, keys, options) {
 		const first = await get({ "permdock-subject": token });
 		expect(first.status).toBe(200);
 		expect(first.headers.get("content-type")).toMatch(/^application\/jwt/u);
-		expect((await get({ "permdock-subject": token })).status).toBe(401);
+		const { status } = await get({ "permdock-subject": token });
+		expect(status).toBe(401);
 		expect((await get({})).status).toBe(401);
 	});
 	it("answers every request in the shapes cloud-api-v1.json documents", async () => {
-		await Promise.all(checks);
-		expect(problems).toEqual([]);
+		expect((await Promise.all(checks)).flat()).toStrictEqual([]);
 	});
 }
 //#endregion
@@ -4603,10 +4665,10 @@ const WHERE_SUBJECT = {
 	context: {}
 };
 /**
-* `matches` answers whether the compiled output selects `row`, for example
-* by running it against a table holding only that row. With it, every case
-* must select the rows the in-memory evaluator keeps, including rows whose
-* fields are NULL.
+* `matches` answers whether the compiled output selects `row`, for example by
+* running it against a table holding only that row. With it, every case must
+* select the rows the in-memory evaluator keeps, including rows whose fields
+* are NULL.
 */
 function testWhereCompiler(compiler, options) {
 	const { matches } = options;
@@ -4615,7 +4677,7 @@ function testWhereCompiler(compiler, options) {
 		const compiled = compiler(condition, options.target);
 		const selected = [];
 		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
-		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
+		expect(selected).toStrictEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
 	});
 	it("fails closed on an empty allow set", () => {
 		const compiled = compiler({
@@ -4683,7 +4745,7 @@ function testReplayStore(store) {
 		}
 		const expiresAt = nowSeconds() + 60;
 		const results = await Promise.all([store.claim("claim-key", expiresAt), store.claim("claim-key", expiresAt)]);
-		expect(results.toSorted()).toEqual([false, true]);
+		expect(results.toSorted()).toStrictEqual([false, true]);
 		expect(await store.seen("claim-key")).toBe(true);
 		await store.release("claim-key");
 		expect(await store.claim("claim-key", expiresAt)).toBe(true);
@@ -4694,18 +4756,18 @@ function testSetQueue(queue) {
 		await queue.enqueue("stream-a", "a1", "set-a1");
 		await queue.enqueue("stream-a", "a2", "set-a2");
 		await queue.enqueue("stream-b", "b1", "set-b1");
-		expect(await queue.pending("stream-a", 10)).toEqual([{
+		expect(await queue.pending("stream-a", 10)).toStrictEqual([{
 			jti: "a1",
 			set: "set-a1"
 		}, {
 			jti: "a2",
 			set: "set-a2"
 		}]);
-		expect(await queue.pending("stream-a", 1)).toEqual([{
+		expect(await queue.pending("stream-a", 1)).toStrictEqual([{
 			jti: "a1",
 			set: "set-a1"
 		}]);
-		expect(await queue.pending("stream-b", 10)).toEqual([{
+		expect(await queue.pending("stream-b", 10)).toStrictEqual([{
 			jti: "b1",
 			set: "set-b1"
 		}]);
@@ -4720,7 +4782,7 @@ function testSetQueue(queue) {
 			description: "unknown kid"
 		});
 		await queue.ack("stream-other", "c3");
-		expect(await queue.pending("stream-c", 10)).toEqual([{
+		expect(await queue.pending("stream-c", 10)).toStrictEqual([{
 			jti: "c3",
 			set: "set-c3"
 		}]);
@@ -4745,18 +4807,18 @@ function testSsfStreamStore(store) {
 		await store.create(owner, streamConfiguration(first));
 		await store.create(owner, streamConfiguration(second));
 		await store.create("someone-else", streamConfiguration(id("c")));
-		expect(await store.get(first)).toEqual({
+		expect(await store.get(first)).toStrictEqual({
 			owner,
 			configuration: streamConfiguration(first)
 		});
-		expect(await store.status(first)).toEqual({
+		expect(await store.status(first)).toStrictEqual({
 			stream_id: first,
 			status: "enabled"
 		});
 		const listed = await store.list(owner);
-		expect(listed.map((stream) => stream.configuration.stream_id)).toEqual([first, second]);
+		expect(listed.map((stream) => stream.configuration.stream_id)).toStrictEqual([first, second]);
 		const all = await store.list();
-		expect(all.map((stream) => stream.configuration.stream_id)).toEqual(expect.arrayContaining([first, second]));
+		expect(all.map((stream) => stream.configuration.stream_id)).toStrictEqual(expect.arrayContaining([first, second]));
 	});
 	it("answers null for a stream that does not exist", async () => {
 		expect(await store.get(id("missing"))).toBeNull();
@@ -4771,11 +4833,11 @@ function testSsfStreamStore(store) {
 			reason: "maintenance"
 		});
 		await store.update(streamConfiguration(stream, "renamed"));
-		expect(await store.get(stream)).toEqual({
+		expect(await store.get(stream)).toStrictEqual({
 			owner: "owner-update",
 			configuration: streamConfiguration(stream, "renamed")
 		});
-		expect(await store.status(stream)).toEqual({
+		expect(await store.status(stream)).toStrictEqual({
 			stream_id: stream,
 			status: "paused",
 			reason: "maintenance"
@@ -4807,8 +4869,8 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(revoked);
 		await vi.waitFor(() => {
-			expect(first).toEqual([revoked]);
-			expect(second).toEqual([revoked]);
+			expect(first).toStrictEqual([revoked]);
+			expect(second).toStrictEqual([revoked]);
 		});
 		stopFirst();
 		const changed = {
@@ -4818,9 +4880,9 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(changed);
 		await vi.waitFor(() => {
-			expect(second).toEqual([revoked, changed]);
+			expect(second).toStrictEqual([revoked, changed]);
 		});
-		expect(first).toEqual([revoked]);
+		expect(first).toStrictEqual([revoked]);
 		stopSecond();
 	});
 	it("keeps delivering when a listener throws", async () => {
@@ -4837,7 +4899,7 @@ function testRevocationFeed(feed) {
 		};
 		await feed.revoke(event);
 		await vi.waitFor(() => {
-			expect(seen).toEqual([event]);
+			expect(seen).toStrictEqual([event]);
 		});
 		stopThrowing();
 		stop();
@@ -4856,7 +4918,7 @@ function testRevocationFeed(feed) {
 		}]) await expect((async () => {
 			await feed.revoke(event);
 		})()).rejects.toThrow(TypeError);
-		expect(seen).toEqual([]);
+		expect(seen).toStrictEqual([]);
 		stop();
 	});
 }
@@ -4931,8 +4993,8 @@ function flipLast(value) {
 }
 /**
 * `key` is a live key the verifier knows, or a function issuing one (called
-* once). `revoke`, when given, revokes it; the runner then expects the key
-* to stop verifying.
+* once). `revoke`, when given, revokes it; the runner then expects the key to
+* stop verifying.
 */
 function testCredentialVerifier(verifier, options) {
 	let issued;
@@ -4948,7 +5010,7 @@ function testCredentialVerifier(verifier, options) {
 		const credential = parseCredential(await verifier.verify(key));
 		expect(credential).toBeDefined();
 		expect(credential?.id).toBe(parts?.id);
-		expect(parseCredential(await verifier.verify(key))).toEqual(credential);
+		expect(parseCredential(await verifier.verify(key))).toStrictEqual(credential);
 	});
 	it("never throws and answers null for every other key", async () => {
 		const key = await live();
@@ -4978,7 +5040,7 @@ function testCredentialVerifier(verifier, options) {
 		const id = parseApiKey(key)?.id ?? "";
 		await verifier.touch?.(id, { epochMilliseconds: nowMillis() });
 		await verifier.touch?.("unknown-id", { epochMilliseconds: nowMillis() });
-		expect(parseCredential(await verifier.verify(key))).toEqual(before);
+		expect(parseCredential(await verifier.verify(key))).toStrictEqual(before);
 	});
 	if (options.revoke !== void 0) {
 		const revoke = options.revoke;
@@ -4999,7 +5061,7 @@ function testTokenSigner(signer, options) {
 			audience: "https://app.example.com"
 		});
 		const header = decodeHeader(token);
-		expect(Object.keys(header).toSorted()).toEqual([
+		expect(Object.keys(header).toSorted()).toStrictEqual([
 			"alg",
 			"kid",
 			"typ"
@@ -5045,7 +5107,7 @@ function testDecisionProvider(provider, options) {
 		local: LOCAL
 	});
 	it("names itself and claims the permission synchronously", () => {
-		expect(typeof provider.name).toBe("string");
+		expect(provider.name).toBeTypeOf("string");
 		expect(provider.name.length).toBeGreaterThan(0);
 		expect(provider.handles(options.permission)).toBe(true);
 	});
@@ -5121,12 +5183,12 @@ function testRelationSource(source, options) {
 			});
 			expect(Array.isArray(full.ancestors)).toBe(true);
 			for (const ancestor of full.ancestors) {
-				expect(typeof ancestor.id).toBe("string");
+				expect(ancestor.id).toBeTypeOf("string");
 				expect(ancestor.id).not.toBe("");
 			}
 			expect(full.ancestors.length).toBeLessThanOrEqual(32);
 			const expected = options.expect?.ancestors?.[`${object.resource}:${object.id}`];
-			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toEqual(expected);
+			if (expected !== void 0) expect(full.ancestors.map((ancestor) => ancestor.id)).toStrictEqual(expected);
 			if (full.ancestors.length > 1) {
 				const short = await source.ancestors({
 					resource: object.resource,
@@ -5134,7 +5196,7 @@ function testRelationSource(source, options) {
 					through: "parent",
 					depth: 1
 				});
-				expect(short.ancestors.map((ancestor) => ancestor.id)).toEqual([full.ancestors[0]?.id]);
+				expect(short.ancestors.map((ancestor) => ancestor.id)).toStrictEqual([full.ancestors[0]?.id]);
 				expect(short.truncated).toBe(true);
 			}
 			const none = await source.ancestors({
@@ -5143,7 +5205,7 @@ function testRelationSource(source, options) {
 				through: "parent",
 				depth: 0
 			});
-			expect(none.ancestors).toEqual([]);
+			expect(none.ancestors).toStrictEqual([]);
 		}
 	});
 	it("returns well-formed holders", async () => {
@@ -5161,14 +5223,14 @@ function testRelationSource(source, options) {
 					holder.group.id,
 					holder.group.relation
 				]) {
-					expect(typeof part).toBe("string");
+					expect(part).toBeTypeOf("string");
 					expect(part).not.toBe("");
 				}
-				else expect(typeof holder.principal.id).toBe("string");
+				else expect(holder.principal.id).toBeTypeOf("string");
 				for (const instant of [holder.startsAt, holder.expiresAt]) expect(instant === void 0 || typeof instant === "number" && Number.isFinite(instant)).toBe(true);
 			}
 			const expected = options.expect?.holders?.[`${object.resource}:${object.id}#${object.relation}`];
-			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toEqual([...expected].toSorted());
+			if (expected !== void 0) expect(holders.map(holderKey).toSorted()).toStrictEqual([...expected].toSorted());
 		}
 	});
 	it("follows each link to exactly one instance", async () => {
@@ -5182,7 +5244,7 @@ function testRelationSource(source, options) {
 				through,
 				depth: 1
 			});
-			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
+			expect(linked.ancestors.map((ancestor) => ancestor.id)).toStrictEqual([id]);
 		}
 	});
 	it("reads each object's row as an object, or null when there is none", async () => {
@@ -5212,11 +5274,11 @@ function testRelationSource(source, options) {
 			...missing,
 			through: "parent",
 			depth: 16
-		})).ancestors).toEqual([]);
+		})).ancestors).toStrictEqual([]);
 		if (first.relation !== void 0) expect(await source.related({
 			...missing,
 			relation: first.relation
-		})).toEqual([]);
+		})).toStrictEqual([]);
 	});
 }
 //#endregion
@@ -5228,8 +5290,8 @@ function isFrozenDeep(value) {
 /**
 * Checks a `PrincipalSource`: `principal` answers each listed id with the
 * expected principal or `null`, never another id; `principalByIdentity`
-* resolves each listed identity to the expected principal id or `null`, and
-* an email matches trimmed and in any case.
+* resolves each listed identity to the expected principal id or `null`, and an
+* email matches trimmed and in any case.
 */
 function testPrincipalSource(source, options) {
 	it("returns the principal with the asked id, or null", async () => {
@@ -5241,8 +5303,8 @@ function testPrincipalSource(source, options) {
 				found = null;
 			}
 			expect(found === null || typeof found === "object").toBe(true);
-			if (found !== null) expect(await loadPrincipal(source, entry.id, entry.tenant)).toEqual(found);
-			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+			if (found !== null) expect(await loadPrincipal(source, entry.id, entry.tenant)).toStrictEqual(found);
+			if (entry.expect !== void 0) expect(found).toStrictEqual(entry.expect);
 		}
 	});
 	it("returns principals a caller cannot change", async () => {
@@ -5285,10 +5347,10 @@ async function automationOf(source, id, tenant) {
 	}
 }
 /**
-* Checks an `AutomationSource`: `automation(id)` answers each listed id
-* with a valid Automation v1 record of that id or `null`, never another id;
-* a record held to one tenant is `null` when asked for another; an empty or
-* unknown id is `null`.
+* Checks an `AutomationSource`: `automation(id)` answers each listed id with a
+* valid Automation v1 record of that id or `null`, never another id; a record
+* held to one tenant is `null` when asked for another; an empty or unknown id
+* is `null`.
 */
 function testAutomationSource(source, options) {
 	it("returns a valid v1 record with the asked id, or null", async () => {
@@ -5296,10 +5358,10 @@ function testAutomationSource(source, options) {
 			const found = await automationOf(source, entry.id, entry.tenant);
 			if (found !== null) {
 				const parsed = parseAutomation(found);
-				expect(parsed).toEqual(found);
+				expect(parsed).toStrictEqual(found);
 				expect(parsed?.id).toBe(entry.id);
 			}
-			if (entry.expect !== void 0) expect(found).toEqual(entry.expect);
+			if (entry.expect !== void 0) expect(found).toStrictEqual(entry.expect);
 		}
 	});
 	it("refuses a record held to another tenant", async () => {
@@ -5322,9 +5384,9 @@ async function sessionOf(source, id) {
 	}
 }
 /**
-* Checks a `SupportSessionSource`: `session(id)` answers each listed id
-* with a record of that id or `null`, never another id; `ended` is a
-* boolean when present; an empty or unknown id is `null`.
+* Checks a `SupportSessionSource`: `session(id)` answers each listed id with a
+* record of that id or `null`, never another id; `ended` is a boolean when
+* present; an empty or unknown id is `null`.
 */
 function testSupportSessionSource(source, options) {
 	it("returns the session with the asked id, or null", async () => {
@@ -5349,7 +5411,10 @@ function testSupportSessionSource(source, options) {
 	});
 }
 const SETTLED = Symbol("settled");
-/** Whether `promise` settles within `ms` milliseconds; a rejection counts as settled. */
+/**
+* Whether `promise` settles within `ms` milliseconds; a rejection counts as
+* settled.
+*/
 async function settlesWithin(promise, ms) {
 	let timer;
 	const timeout = new Promise((resolve) => {
@@ -5364,12 +5429,12 @@ async function settlesWithin(promise, ms) {
 	}
 }
 /**
-* Checks an `ApprovalWaiter`: a wait ends when its token is woken and not
-* when another token is; waking a token nobody waits on resolves; a wait
-* whose `expiresAt` has passed ends; an aborted `signal` rejects the wait with its reason.
-* Pass `expiry: false` or `abort: false` for a waiter whose runner offers no
-* timer or no cancellation, `pending` when the waiter reads a store, and
-* `parked` when a wait parks asynchronously.
+* Checks an `ApprovalWaiter`: a wait ends when its token is woken and not when
+* another token is; waking a token nobody waits on resolves; a wait whose
+* `expiresAt` has passed ends; an aborted `signal` rejects the wait with its
+* reason. Pass `expiry: false` or `abort: false` for a waiter whose runner
+* offers no timer or no cancellation, `pending` when the waiter reads a store,
+* and `parked` when a wait parks asynchronously.
 */
 function testApprovalWaiter(waiter, options = {}) {
 	const timeout = options.timeout ?? 1e3;
@@ -5431,9 +5496,9 @@ function key(suffix) {
 }
 /**
 * Conformance for a `DeliveryTransport`: it sends a checked target with its
-* idempotency key, keeps the key on a retry, refuses a target without a
-* granted decision before calling the provider, and maps provider errors to
-* retryable or final failures without rejecting.
+* idempotency key, keeps the key on a retry, refuses a target without a granted
+* decision before calling the provider, and maps provider errors to retryable
+* or final failures without rejecting.
 */
 function testDeliveryTransport(name, options) {
 	const targetWith = async (decision) => ({
@@ -5447,14 +5512,14 @@ function testDeliveryTransport(name, options) {
 		it("names its channel and provider", () => {
 			const { transport } = options.create();
 			expect(transport.channel).toBe(options.channel);
-			expect(typeof transport.name).toBe("string");
+			expect(transport.name).toBeTypeOf("string");
 			expect(transport.name).not.toBe("");
 		});
 		it("sends a checked target with its idempotency key", async () => {
 			const harness = options.create();
 			const result = await send(harness, await targetWith(await grantedDecision()), "a");
 			expect(result.status).toBe("sent");
-			expect(await harness.received()).toEqual([{ idempotencyKey: "pdd_runner_a" }]);
+			expect(await harness.received()).toStrictEqual([{ idempotencyKey: "pdd_runner_a" }]);
 		});
 		it("passes the same key on a retry of the same delivery", async () => {
 			const harness = options.create();
@@ -5480,7 +5545,7 @@ function testDeliveryTransport(name, options) {
 				cause: "invalid-recipient",
 				retryable: false
 			});
-			expect(await harness.received()).toEqual([]);
+			expect(await harness.received()).toStrictEqual([]);
 		});
 		it("maps a retryable provider error to a retryable failure", async () => {
 			const harness = options.create();
@@ -5511,7 +5576,7 @@ function testDeliveryTransport(name, options) {
 				status: "failed",
 				retryable: true
 			});
-			expect(await harness.received()).toEqual([]);
+			expect(await harness.received()).toStrictEqual([]);
 		});
 	});
 }
@@ -5549,7 +5614,7 @@ function testMembershipSource(source, options) {
 				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
 			}
 			const expected = options.expect?.[principal.id];
-			if (expected !== void 0) expect(memberships).toEqual(expected);
+			if (expected !== void 0) expect(memberships).toStrictEqual(expected);
 		}
 	});
 	if (source.list !== void 0) it("lists every member of an instance it returns a membership for", async () => {
@@ -5581,9 +5646,9 @@ function testEntitlementSource(source, options) {
 	it("returns plan names for a tenant and none without one", async () => {
 		const found = await source.entitlementsFor(options.principal, { tenant: options.tenant });
 		expect(Array.isArray(found)).toBe(true);
-		for (const name of found) expect(typeof name).toBe("string");
-		if (options.expect !== void 0) expect([...found].toSorted()).toEqual([...options.expect].toSorted());
-		expect(await source.entitlementsFor(options.principal, {})).toEqual([]);
+		for (const name of found) expect(name).toBeTypeOf("string");
+		if (options.expect !== void 0) expect([...found].toSorted()).toStrictEqual([...options.expect].toSorted());
+		expect(await source.entitlementsFor(options.principal, {})).toStrictEqual([]);
 	});
 }
 function testCustomRoleSource(source, options) {
@@ -5593,7 +5658,7 @@ function testCustomRoleSource(source, options) {
 		for (const role of roles) {
 			expect(role.tenant).toBe(options.tenant);
 			for (const included of role.includes ?? []) expect(declared).toContain(included);
-			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toEqual([]);
+			if (options.policy !== void 0) expect(validateCustomRole(options.policy, role).dropped).toStrictEqual([]);
 		}
 		if (source.assignable !== void 0) {
 			const assignable = await source.assignable(options.tenant);
@@ -5603,7 +5668,7 @@ function testCustomRoleSource(source, options) {
 	const every = options.every;
 	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
 		const roles = await source.rolesFor(options.tenant, { held: [] });
-		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
+		expect([...new Set(roles.map((role) => role.name))].toSorted()).toStrictEqual([...new Set(every)].toSorted());
 	});
 }
 function testDirectoryStore(store, options) {
@@ -5633,7 +5698,7 @@ function testDirectoryStore(store, options) {
 				created: "",
 				lastModified: ""
 			}
-		})).rejects.toThrow(/userName/);
+		})).rejects.toThrow(/userName/u);
 		const group = await store.putGroup(home, {
 			id: "g_editors",
 			displayName: "Editors",
@@ -5644,11 +5709,11 @@ function testDirectoryStore(store, options) {
 				lastModified: ""
 			}
 		});
-		expect(await store.groupsFor(home, created.id)).toEqual([expect.objectContaining({
+		expect(await store.groupsFor(home, created.id)).toStrictEqual([expect.objectContaining({
 			id: group.id,
 			displayName: "Editors"
 		})]);
-		expect(await store.groupsFor(other, created.id)).toEqual([]);
+		expect(await store.groupsFor(other, created.id)).toStrictEqual([]);
 		const patched = await store.patchUser(home, created.id, [{
 			op: "replace",
 			path: "active",
@@ -5656,13 +5721,13 @@ function testDirectoryStore(store, options) {
 		}]);
 		expect(patched.active).toBe(false);
 		const source = directoryMembershipSource(store, { assignable: ["editor"] });
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([]);
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([]);
 		await store.patchUser(home, created.id, [{
 			op: "replace",
 			path: "active",
 			value: true
 		}]);
-		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toEqual([{
+		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([{
 			tenant: home,
 			roles: ["editor"],
 			via: `group:${group.id}`,
@@ -5673,7 +5738,7 @@ function testDirectoryStore(store, options) {
 			path: "members",
 			value: [{ value: created.id }]
 		}]);
-		expect(await store.groupsFor(home, created.id)).toEqual([]);
+		expect(await store.groupsFor(home, created.id)).toStrictEqual([]);
 	});
 	it("ends sessions when scimHandler deactivates a user in this store", async () => {
 		const feed = memoryRevocationFeed();
@@ -5726,7 +5791,7 @@ function testDirectoryStore(store, options) {
 			kind: "session-revoked"
 		});
 		expect(seen.every((event) => event.kind === "session-revoked")).toBe(true);
-		expect(kinds).toEqual(["changed", "session-revoked"]);
+		expect(kinds).toStrictEqual(["changed", "session-revoked"]);
 	});
 }
 /** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
@@ -5734,13 +5799,13 @@ function testSettingsSource(source, options) {
 	it("answers per tenant with plain settings and nothing for an unknown tenant", async () => {
 		const settings = await source.settingsFor(options.tenant);
 		if (settings !== void 0) {
-			expect(typeof settings).toBe("object");
+			expect(settings).toBeTypeOf("object");
 			const credentials = settings.credentials;
 			if (credentials !== void 0) {
 				expect(credentials.maxTtl === void 0 || Number.isFinite(credentials.maxTtl) && credentials.maxTtl >= 0).toBe(true);
 				expect(credentials.kinds === void 0 || credentials.kinds.every((kind) => kind === "user" || kind === "service" || kind === "feed")).toBe(true);
 			}
-			expect(JSON.parse(JSON.stringify(settings))).toEqual(settings);
+			expect(JSON.parse(JSON.stringify(settings))).toStrictEqual(settings);
 		}
 		expect(await source.settingsFor(options.unknown ?? "__permdock_unknown__")).toBeUndefined();
 	});
@@ -6175,8 +6240,8 @@ const supabaseClaimVectors = {
 /**
 * The `permdock supabase inspect --json` manifest for a policy with one
 * `tenant` scope, the default `supabase.hook` and a `features` claim from
-* `public.feature_claims`. A package that reads the manifest tests its
-* parser against this value.
+* `public.feature_claims`. A package that reads the manifest tests its parser
+* against this value.
 */
 const supabaseHookManifestFixture = {
 	$schema: "https://permdock.com/schemas/supabase-manifest-v1.json",
@@ -6467,4 +6532,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };