security-plugin.test.ts

// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

import { describe, it, expect, vi } from 'vitest';
import { assertEngineUpdateDispatch, assertEngineFindOnePredicate, type EngineFindOneQueryInput } from '@objectstack/metadata-core';
import { recordNotFoundError } from '@objectstack/core';
import { SecurityPlugin } from './security-plugin.js';
import { PermissionEvaluator, crudBucketForOperation } from './permission-evaluator.js';
import { FieldMasker } from './field-masker.js';
import { RLSCompiler, RLS_DENY_FILTER } from './rls-compiler.js';
// #4983 — `isSupportedRlsExpression` now lives in @objectstack/formula, and its
// SHAPE unit tests moved with it (`formula/src/rls-predicate.test.ts`). What
// stays here is the consumer-side half: that this compiler's drop / warn /
// fail-closed behaviour really is what that predicate describes.
import { isSupportedRlsExpression } from '@objectstack/formula';
import type { PermissionSet } from '@objectstack/spec/security';
import { RLS } from '@objectstack/spec/security';
import { BUILTIN_OPERATION_MESSAGES } from '@objectstack/spec/system';

/**
 * The registry answer for the doubles below that fire every `kernel:ready`
 * handler, as the kernel does: the plugin refuses a boot whose registry lacks
 * the identity objects its authorization store reads, so a double that boots it
 * holds those two names and nothing else (`authz-identity-objects-boot-refusal.test.ts`).
 */
const identityObjectsOnly = (name: string) =>
  name === 'sys_user' || name === 'sys_member' ? { name, fields: {} } : undefined;

/**
 * [commit a016f08b8] What the ENGINE does inside the middleware's `next()` — the part of
 * `ObjectQL.insert` the doubles in this file stand in for.
 *
 * Since commit a016f08b8 the insert-side RLS `check` is not evaluated in the middleware:
 * it is INSTALLED on the operation context and run by the engine once the
 * `beforeInsert` chain has produced the row that will be stored. A double whose
 * executor is a bare `async () => {}` therefore models an engine that carries a
 * write past a gate that never ran — and the middleware refuses exactly that,
 * fail-closed, rather than vouching for it. A looser double would convert a
 * green suite into no suite at all, which is the family `check:engine-double-contract`
 * exists for.
 *
 * So the executor honours the seam the way the engine does: the flag first (it
 * answers "did the seam run", never "did the write pass"), then the judgement.
 * These doubles run no hooks, so the rows an insert would store ARE
 * `opCtx.data` — each element of an array insert ([#19964]).
 *
 * [#19950] A predicate (`multi`) update installs the same seam, and the engine
 * hands it every row the composed AST matches, merged with the payload. These
 * doubles hold no table, so that match set is empty: the judgement runs over
 * no rows, exactly as a real engine's would over an empty one.
 *
 * [#19989] A by-id update installs it too, and a real engine hands it the one
 * row it writes, merged with the final payload. These doubles hold no row to
 * merge onto, so that judgement also runs over none here: the cells in this
 * file exercise the middleware's own change-set judgement, which still runs,
 * and the stored-row judgement is pinned against the real engine in
 * `rls-check-by-id-update-post-hook.test.ts`.
 */
const runEngineWriteBody = async (opCtx: any): Promise<void> => {
  const seam = opCtx?.postHookWriteImageCheck;
  if (!seam) return;
  seam.honoured = true;
  if (opCtx.operation === 'update') {
    await seam.evaluate([]);
    return;
  }
  await seam.evaluate(Array.isArray(opCtx.data) ? opCtx.data : [opCtx.data]);
};

// ---------------------------------------------------------------------------
// SecurityPlugin – basic metadata
// ---------------------------------------------------------------------------
describe('SecurityPlugin', () => {
  it('should have correct metadata', () => {
    const plugin = new SecurityPlugin();
    expect(plugin.name).toBe('com.objectstack.security');
    expect(plugin.type).toBe('standard');
    expect(plugin.version).toBe('1.0.0');
    expect(plugin.dependencies).toContain('com.objectstack.engine.objectql');
  });

  it('should register services during init', async () => {
    const plugin = new SecurityPlugin();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        return undefined;
      }),
    };
    await plugin.init(ctx);
    expect(ctx.registerService).toHaveBeenCalledWith('security.permissions', expect.any(PermissionEvaluator));
    expect(ctx.registerService).toHaveBeenCalledWith('security.rls', expect.any(RLSCompiler));
    expect(ctx.registerService).toHaveBeenCalledWith('security.fieldMasker', expect.any(FieldMasker));
    expect(manifestService.register).toHaveBeenCalled();
  });

  it('should warn and return when objectql service is missing', async () => {
    const plugin = new SecurityPlugin();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        throw new Error('not found');
      }),
    };
    await plugin.init(ctx);
    await plugin.start(ctx);
    expect(ctx.logger.warn).toHaveBeenCalled();
  });

  it('should warn when objectql does not support middleware', async () => {
    const plugin = new SecurityPlugin();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        return {}; // objectql without registerMiddleware
      }),
    };
    await plugin.init(ctx);
    await plugin.start(ctx);
    expect(ctx.logger.warn).toHaveBeenCalled();
  });

  it('should register middleware when objectql supports it', async () => {
    const plugin = new SecurityPlugin();
    const registerMiddleware = vi.fn();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        return { registerMiddleware };
      }),
    };
    await plugin.init(ctx);
    await plugin.start(ctx);
    expect(registerMiddleware).toHaveBeenCalledWith(expect.any(Function));
  });

  it('should destroy without error', async () => {
    const plugin = new SecurityPlugin();
    await expect(plugin.destroy()).resolves.toBeUndefined();
  });

  // -------------------------------------------------------------------------
  // Bootstrap-replay wiring — the middleware registered in start() re-runs
  // the bootstrap for exactly the writes `shouldReplayBootstrapFor` admits.
  // The predicate itself is pinned exhaustively next to its producer
  // (bootstrap-platform-admin-walled-owner.test.ts); THIS pin is that the
  // middleware actually consults it. [#11974 / #11663 L4] The trigger set is
  // NARROWED: commit c0714eb5d's update arm (email_verified / email) retired with the
  // walled elevation it existed to re-attempt — under `single` (this suite's
  // posture) only a sys_user insert/create can change the promotion answer.
  // -------------------------------------------------------------------------
  it('re-runs the bootstrap on a sys_user insert, and no longer on the verifying update (#11974 narrowed #11343)', async () => {
    const plugin = new SecurityPlugin();
    const middlewares: any[] = [];
    const manifestService = { register: vi.fn() };
    // A ql fake rich enough for runBootstrap to COMPLETE (that is what arms
    // the replay: `bootstrapRanOnce` is only set on completion, right before
    // the 'platform bootstrap complete' log this pin counts).
    const ql: any = {
      registerMiddleware: (mw: any) => middlewares.push(mw),
      find: vi.fn(async () => []),
      findOne: vi.fn(async (object: string, query?: EngineFindOneQueryInput) => { assertEngineFindOnePredicate(object, query); return null; }),
      insert: vi.fn(async (_o: string, d: any) => ({ id: d?.id ?? 'x' })),
      // Opens with the PRODUCER's own dispatch predicate, never a hand-mirrored
      // guard (check:engine-double-contract) — same shape as the makeQl double
      // in bootstrap-platform-admin-walled-owner.test.ts.
      update: vi.fn(async (_o: string, d: any, o?: any) => {
        assertEngineUpdateDispatch(d, o);
        return true;
      }),
      getSchema: identityObjectsOnly,
    };
    const metadata = { get: async () => null, list: async () => [] };
    const services: Record<string, any> = { manifest: manifestService, objectql: ql, metadata };
    const hook = vi.fn();
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
      registerService: vi.fn(),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
      hook,
    };
    await plugin.init(ctx);
    await plugin.start(ctx);

    // Drive the initial bootstrap to completion by firing every kernel:ready
    // callback in registration order — exactly what the kernel does. start()
    // registers several (runBootstrap is not the first), so firing only one
    // would leave the replay disarmed and every assertion below vacuous.
    const ready = hook.mock.calls.filter((c: any[]) => c[0] === 'kernel:ready');
    expect(ready.length).toBeGreaterThan(0);
    for (const [, cb] of ready) await cb();
    const completions = () =>
      ctx.logger.info.mock.calls.filter((c: any[]) => String(c[0]).includes('platform bootstrap complete')).length;
    // Positive control: the initial run completed — the replay is armed. If
    // this line fails, the fake ql was not rich enough and every assertion
    // below would be vacuous.
    expect(completions()).toBe(1);

    const drive = async (opCtx: any) => {
      for (const mw of middlewares) {
        try {
          await mw(opCtx, () => runEngineWriteBody(opCtx));
        } catch {
          // Another middleware (e.g. the CRUD-authorization one) may refuse a
          // bare opCtx — irrelevant here: the replay middleware never throws.
        }
      }
    };

    // The formerly-verifying write (better-auth flips emailVerified on link
    // click) ⇒ NO re-run any more: the walled elevation it re-attempted is
    // retired, and `single` never read this column.
    await drive({ object: 'sys_user', operation: 'update', data: { id: 'u1', email_verified: true } });
    expect(completions()).toBe(1);

    // An unrelated profile edit ⇒ NO re-run (unchanged).
    await drive({ object: 'sys_user', operation: 'update', data: { id: 'u1', name: 'New Name' } });
    expect(completions()).toBe(1);

    // The original insert trigger still fires — the over-denial control: the
    // narrowing must not retire `single`'s first-user promotion path.
    await drive({ object: 'sys_user', operation: 'insert', data: { email: 'a@b.c' } });
    expect(completions()).toBe(2);
  });

  // [ADR-0105 D2 / #3623] start() hands the engine a posture accessor so the
  // driver-level native tenant scope can widen to the membership union under
  // `group`. Wired from the enforcement layer on purpose: no SecurityPlugin,
  // no widening.
  it('wires the tenancy-posture provider onto the engine, reporting the LIVE cached posture', async () => {
    const plugin = new SecurityPlugin();
    const registerMiddleware = vi.fn();
    const setTenancyPostureProvider = vi.fn();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        if (name === 'tenancy') return { posture: 'group' };
        return { registerMiddleware, setTenancyPostureProvider };
      }),
    };
    await plugin.init(ctx);
    await plugin.start(ctx);
    expect(setTenancyPostureProvider).toHaveBeenCalledWith(expect.any(Function));
    const provider = setTenancyPostureProvider.mock.calls[0][0] as () => string;
    expect(provider()).toBe('group');
  });

  it('an engine without the provider seam is tolerated (older engine)', async () => {
    const plugin = new SecurityPlugin();
    const registerMiddleware = vi.fn();
    const manifestService = { register: vi.fn() };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return manifestService;
        if (name === 'tenancy') return { posture: 'group' };
        return { registerMiddleware };
      }),
    };
    await plugin.init(ctx);
    await expect(plugin.start(ctx)).resolves.toBeUndefined();
  });

  // -------------------------------------------------------------------------
  // org-scoping probe — when @objectstack/plugin-org-scoping is installed
  // (i.e. the `org-scoping` service is registered), SecurityPlugin keeps
  // wildcard `current_user.organization_id` RLS policies. Otherwise it
  // strips them so single-tenant deployments aren't filtered to nothing.
  // -------------------------------------------------------------------------
  const makeMiddlewareCtx = (overrides: { permissionSets: PermissionSet[]; objectFields?: string[]; schemaExtra?: Record<string, any>; orgScoping?: boolean; findOneImpl?: (query: any) => any; sharing?: any }) => {
    const fields: Record<string, any> = {};
    for (const f of overrides.objectFields ?? ['id', 'organization_id', 'owner_id', 'name']) {
      fields[f] = { name: f };
    }
    const baseSchema: any = { name: 'task', fields, ...(overrides.schemaExtra ?? {}) };
    let middleware: any;
    // The pre-image write-authorization check re-reads the target row via
    // `ql.findOne(object, { where: { $and: [{ id }, writeFilter] }, … })`.
    // `findOneImpl` lets a test decide whether that row is "visible" (owned /
    // in-tenant) or filtered out (someone else's row → null → deny).
    // [#21829] With `find` beside it this is an engine double, so its `findOne`
    // refuses what the real engine refuses (`check:engine-double-contract`).
    const findOne = vi.fn(async (object: string, query: any) => {
      assertEngineFindOnePredicate(object, query as EngineFindOneQueryInput);
      return overrides.findOneImpl ? overrides.findOneImpl(query) : null;
    });
    // [#21829] A predicate update or delete asks the read door which matched
    // rows the caller can read, and a `ql` that cannot answer refuses the
    // write. This double holds no rows, so the read answers none.
    const find = vi.fn(async (_object: string, _query: any) => [] as Record<string, unknown>[]);
    const ql = {
      registerMiddleware: (mw: any) => {
        // Capture only the FIRST middleware (the security CRUD one);
        // ignore the secondary bootstrap-replay middleware registered
        // later in `start()`.
        if (!middleware) middleware = mw;
      },
      getSchema: () => baseSchema,
      findOne,
      find,
    };
    const metadata = {
      get: async () => baseSchema,
      list: async () => overrides.permissionSets,
    };
    const services: Record<string, any> = {
      manifest: { register: vi.fn() },
      objectql: ql,
      metadata,
    };
    if (overrides.orgScoping) {
      // Sentinel object — SecurityPlugin only checks truthiness.
      services['org-scoping'] = { name: 'com.objectstack.org-scoping' };
    }
    // [#4467] The optional plugin-sharing service. Absent by default, which is
    // exactly the deployment shape every case above assumes; supply it to
    // exercise the OWD/sharing half of the read scope.
    if (overrides.sharing) services['sharing'] = overrides.sharing;
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
    };
    return {
      ctx,
      findOne,
      run: async (opCtx: any) => {
        await middleware(opCtx, () => runEngineWriteBody(opCtx));
        return opCtx;
      },
    };
  };

  const tenantPolicySet: PermissionSet = {
    name: 'member_default',
    label: 'Member',
    objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    rowLevelSecurity: [
      { name: 'tenant_isolation', object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' },
    ],
  } as any;

  // Note: `organization_id` auto-injection lives in `@objectstack/plugin-org-scoping`
  // and is covered by that package's tests. SecurityPlugin only owns
  // `owner_id` auto-stamping.
  it('owner_id is always auto-injected on insert (regardless of org-scoping)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    // The row carries the caller's own organization, as the org-scoping
    // auto-stamp writes it in `beforeInsert` ahead of the post-image check. The
    // `tenant_isolation` policy declares no `check`, so its `using` is the
    // insert check (ADR-0058 D4 default) and a row with no organization would
    // be refused. This double runs no hooks, so the payload stands in for them.
    const opCtx: any = {
      object: 'task', operation: 'insert', data: { name: 'A', organization_id: 'org-1' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    // SecurityPlugin does not touch organization_id — that's plugin-org-scoping's
    // job — so the value arrives exactly as sent.
    expect(opCtx.data.organization_id).toBe('org-1');
    expect(opCtx.data.owner_id).toBe('u1');
  });

  // -------------------------------------------------------------------------
  // [#3004] `owner_id` anchor guard — the ownership anchor is system-managed
  // for non-privileged writers: forging it on insert or transferring it on
  // update requires the transfer grant (allowTransfer / modifyAllRecords).
  // -------------------------------------------------------------------------
  describe('owner_id anchor guard (#3004)', () => {
    const memberSet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;
    const transferSet: PermissionSet = {
      name: 'can_transfer',
      label: 'Transfer',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowTransfer: true } },
    } as any;
    const modifyAllSet: PermissionSet = {
      name: 'org_admin_like',
      label: 'Admin',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, modifyAllRecords: true } },
    } as any;

    const boot = async (sets: PermissionSet[], findOneImpl?: (query: any) => any) => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: sets, findOneImpl });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };
    const memberCtx = (extra: Record<string, unknown> = {}) =>
      ({ userId: 'u1', tenantId: 'org-1', positions: [], permissions: [], ...extra });

    it('insert forging another user as owner is denied for a plain member', async () => {
      const harness = await boot([memberSet]);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: 'victim' },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('insert with owner_id = self passes without any transfer grant', async () => {
      const harness = await boot([memberSet]);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: 'u1' },
        context: memberCtx(),
      };
      await harness.run(opCtx);
      expect(opCtx.data.owner_id).toBe('u1');
    });

    it('insert forging another owner passes with allowTransfer', async () => {
      const harness = await boot([memberSet, transferSet]);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: 'colleague' },
        context: memberCtx({ permissions: ['can_transfer'] }),
      };
      await harness.run(opCtx);
      expect(opCtx.data.owner_id).toBe('colleague');
    });

    it('insert forging another owner passes with modifyAllRecords (implies transfer)', async () => {
      const harness = await boot([memberSet, modifyAllSet]);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: 'colleague' },
        context: memberCtx({ permissions: ['org_admin_like'] }),
      };
      await harness.run(opCtx);
      expect(opCtx.data.owner_id).toBe('colleague');
    });

    it('batch insert: empty owners are stamped per row, a forged row denies the batch', async () => {
      const harness = await boot([memberSet]);
      const stamped: any = {
        object: 'task', operation: 'insert', data: [{ name: 'a' }, { name: 'b', owner_id: '' }],
        context: memberCtx(),
      };
      await harness.run(stamped);
      expect(stamped.data.map((r: any) => r.owner_id)).toEqual(['u1', 'u1']);

      const forged: any = {
        object: 'task', operation: 'insert', data: [{ name: 'a' }, { name: 'b', owner_id: 'victim' }],
        context: memberCtx(),
      };
      await expect(harness.run(forged)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('update transferring ownership is denied for a plain member', async () => {
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: 'admin' },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('update disowning (owner_id: null) is denied for a plain member', async () => {
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: null },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('update echoing the unchanged owner back (form save) is tolerated', async () => {
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', name: 'renamed', owner_id: 'u1' },
        context: memberCtx(),
      };
      await harness.run(opCtx); // must not throw
    });

    it('update transferring ownership passes with allowTransfer', async () => {
      const harness = await boot([memberSet, transferSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: 'colleague' },
        context: memberCtx({ permissions: ['can_transfer'] }),
      };
      await harness.run(opCtx);
      expect(opCtx.data.owner_id).toBe('colleague');
    });

    it('bulk update carrying owner_id fails closed for a plain member (no pre-image to compare)', async () => {
      const harness = await boot([memberSet]);
      const opCtx: any = {
        object: 'task', operation: 'update', data: { owner_id: 'u1' },
        options: { where: { status: 'open' }, multi: true },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('update without owner_id in the change-set is untouched by the guard', async () => {
      // [#21771] The addressed by-id update now asks the read door whether the
      // caller can read `t1`, so the double answers that read with the row.
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', name: 'renamed' },
        context: memberCtx(),
      };
      await harness.run(opCtx); // must not throw — the guard reads no owner here
    });

    it('update disowning via owner_id:undefined is denied (mongo $set null hazard)', async () => {
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: undefined },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('insert with a NON-SCALAR owner_id (array) is denied, not coerced to self', async () => {
      const harness = await boot([memberSet]);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: ['u1'] },
        context: memberCtx(),
      };
      // String(['u1']) === 'u1' would have passed as self; scalar-only rejects it.
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('update echo with a NON-SCALAR owner_id equal-by-coercion is denied', async () => {
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: ['u1'] },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('array-shaped update change-set carrying owner_id fails closed (no silent bypass)', async () => {
      const harness = await boot([memberSet]);
      const opCtx: any = {
        object: 'task', operation: 'update', data: [{ id: 't1', owner_id: 'attacker' }],
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/owner_id.*system-managed/);
    });

    it('a prototype-chain owner_id (not own property) does not trip the guard', async () => {
      // [#21771] The double answers the addressed write's read question with the row.
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'u1' }));
      const proto = { owner_id: 'attacker' };
      const data: any = Object.create(proto);
      data.id = 't1';
      data.name = 'renamed'; // only own props; owner_id is inherited
      const opCtx: any = { object: 'task', operation: 'update', data, context: memberCtx() };
      await harness.run(opCtx); // must not throw — owner_id is not an own property
    });

    it('[#3023] an engine referential FK clear (__referentialFieldClear) is exempt — owner_id:null cascade is allowed for a plain member', async () => {
      // cascadeDeleteRelations nulls owner_id on dependents when the referenced
      // sys_user is deleted; that integrity write must not be blocked by the
      // disown guard. The same payload WITHOUT the marker is denied (covered
      // by the disown test above).
      const harness = await boot([memberSet], () => ({ id: 't1', owner_id: 'someone' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: null },
        context: memberCtx({ __referentialFieldClear: true }),
      };
      await harness.run(opCtx); // must not throw — engine-internal referential clear
    });
  });

  // -------------------------------------------------------------------------
  // [ADR-0138 D1] The owner-anchor stamp's GUEST branch: the guest is a
  // principal, never an owner. The anonymous principal is stamped with
  // nothing, its empty owner stays unset, and an owner it supplies is refused
  // on insert and on update WHATEVER it is granted — the sets below carry the
  // transfer bit and `modifyAllRecords`, which the anchor tier keeps off a real
  // guest binding, precisely so the refusal is shown not to lean on that tier.
  // Every refusal carries its control: the same write by a signed-in member,
  // and the same guest write without the owner. The door-level pins, on a
  // booted stack, are `packages/qa/dogfood/test/guest-owner-stamp.dogfood.test.ts`.
  // -------------------------------------------------------------------------
  describe('owner_id anchor guard — the guest branch (ADR-0138 D1)', () => {
    const guestWriter: PermissionSet = {
      name: 'synth_guest_writer',
      label: 'Guest writer',
      objects: { task: { allowRead: true, allowCreate: true } },
    } as any;
    const guestTransfer: PermissionSet = {
      name: 'synth_guest_transfer',
      label: 'Guest writer with transfer',
      objects: { task: { allowRead: true, allowCreate: true, allowEdit: true, allowTransfer: true } },
    } as any;
    const guestModifyAll: PermissionSet = {
      name: 'synth_guest_modify_all',
      label: 'Guest writer with modify-all',
      objects: { task: { allowRead: true, allowCreate: true, allowEdit: true, modifyAllRecords: true } },
    } as any;
    const memberSet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true } },
    } as any;
    const memberTransfer: PermissionSet = {
      name: 'can_transfer',
      label: 'Transfer',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowTransfer: true } },
    } as any;
    const ALL = [guestWriter, guestTransfer, guestModifyAll, memberSet, memberTransfer];

    const boot = async (findOneImpl?: (query: any) => any) => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: ALL, findOneImpl });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };
    const guestCtx = (permissions: string[]) =>
      ({ principalKind: 'guest', positions: ['guest'], isSystem: false, permissions, tenantId: 'org-1' });
    const memberCtx = (permissions: string[] = []) =>
      ({ principalKind: 'human', userId: 'u1', tenantId: 'org-1', positions: [], permissions });

    /** The middleware's verdict: admitted, or the refusal's ADR-0112 `code` + `status`. */
    const verdict = async (harness: { run(opCtx: any): Promise<any> }, opCtx: any) => {
      try {
        await harness.run(opCtx);
        return { admitted: true } as const;
      } catch (e) {
        const err = e as { code?: unknown; status?: unknown };
        return { admitted: false, code: err.code, status: err.status } as const;
      }
    };
    const REFUSED = { admitted: false, code: 'PERMISSION_DENIED', status: 403 } as const;
    const GUEST_GRANTS: Array<[string, string[]]> = [
      ['create only', [guestWriter.name]],
      ['the transfer bit', [guestTransfer.name]],
      ['modifyAllRecords', [guestModifyAll.name]],
    ];
    const FORGED_OWNERS = ['u_victim', 'usr_system', 'guest'];

    it('a guest insert with no owner is stamped with nothing — the row stays unset', async () => {
      const harness = await boot();
      const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A' }, context: guestCtx([guestWriter.name]) };
      expect(await verdict(harness, opCtx)).toEqual({ admitted: true });
      expect(opCtx.data).not.toHaveProperty('owner_id');
      // Control: the stamp is live — a signed-in member's same insert is stamped.
      const member: any = { object: 'task', operation: 'insert', data: { name: 'A' }, context: memberCtx() };
      expect(await verdict(harness, member)).toEqual({ admitted: true });
      expect(member.data.owner_id).toBe('u1');
    });

    it('a guest\'s empty owner (null or an empty string) is left unset, never a value', async () => {
      const harness = await boot();
      for (const empty of [null, '']) {
        const opCtx: any = {
          object: 'task', operation: 'insert', data: { name: 'A', owner_id: empty }, context: guestCtx([guestWriter.name]),
        };
        expect(await verdict(harness, opCtx), JSON.stringify(empty)).toEqual({ admitted: true });
        expect(opCtx.data.owner_id, JSON.stringify(empty)).toBeNull();
      }
    });

    it('a guest-supplied owner is refused 403 PERMISSION_DENIED on insert, whatever the guest holds', async () => {
      const harness = await boot();
      for (const [grant, permissions] of GUEST_GRANTS) {
        for (const owner of FORGED_OWNERS) {
          const opCtx: any = {
            object: 'task', operation: 'insert', data: { name: 'A', owner_id: owner }, context: guestCtx(permissions),
          };
          expect(await verdict(harness, opCtx), `${grant} / ${owner}`).toEqual(REFUSED);
        }
        // Control: the same guest, the same grant, no owner — admitted.
        const plain: any = { object: 'task', operation: 'insert', data: { name: 'A' }, context: guestCtx(permissions) };
        expect(await verdict(harness, plain), grant).toEqual({ admitted: true });
      }
      // Control: a member holding the transfer grant sets the same owner.
      const member: any = {
        object: 'task', operation: 'insert', data: { name: 'A', owner_id: 'u_victim' }, context: memberCtx([memberTransfer.name]),
      };
      expect(await verdict(harness, member)).toEqual({ admitted: true });
      expect(member.data.owner_id).toBe('u_victim');
    });

    it('batch: one guest-supplied owner refuses the whole batch, and empty rows stay unset', async () => {
      const harness = await boot();
      const forged: any = {
        object: 'task', operation: 'insert', data: [{ name: 'a' }, { name: 'b', owner_id: 'u_victim' }],
        context: guestCtx([guestTransfer.name]),
      };
      expect(await verdict(harness, forged)).toEqual(REFUSED);
      const clean: any = {
        object: 'task', operation: 'insert', data: [{ name: 'a' }, { name: 'b', owner_id: '' }],
        context: guestCtx([guestTransfer.name]),
      };
      expect(await verdict(harness, clean)).toEqual({ admitted: true });
      expect(clean.data.map((r: any) => r.owner_id ?? null)).toEqual([null, null]);
    });

    it('a guest update carrying an owner is refused — a transfer, a disown and an echo alike — whatever it holds', async () => {
      const harness = await boot(() => ({ id: 't1', owner_id: 'u_victim' }));
      for (const [grant, permissions] of GUEST_GRANTS.slice(1)) {
        for (const owner of ['u_other', null, 'u_victim']) {
          const opCtx: any = {
            object: 'task', operation: 'update', data: { id: 't1', owner_id: owner }, context: guestCtx(permissions),
          };
          expect(await verdict(harness, opCtx), `${grant} / ${JSON.stringify(owner)}`).toEqual(REFUSED);
        }
        // Control: the same guest's update without the owner is admitted.
        const plain: any = { object: 'task', operation: 'update', data: { id: 't1', name: 'renamed' }, context: guestCtx(permissions) };
        expect(await verdict(harness, plain), grant).toEqual({ admitted: true });
      }
      // Control: a member holding the transfer grant transfers the same row.
      const member: any = {
        object: 'task', operation: 'update', data: { id: 't1', owner_id: 'u_other' }, context: memberCtx([memberTransfer.name]),
      };
      expect(await verdict(harness, member)).toEqual({ admitted: true });
    });
  });

  // -------------------------------------------------------------------------
  // [ADR-0095 D1 / #2937 Finding 1] step 3.7 — the Layer 0 tenant wall on the
  // WRITE post-image. A SUPPLIED (non-empty) `organization_id` in an insert /
  // update payload must satisfy the same Layer 0 filter the read side uses;
  // a forged (insert) or re-pointed (update) value that would land the row in
  // another tenant is denied fail-closed. Previously only the read-side Layer 0
  // and the multitenant dogfood covered this — these are the package-level
  // write-side unit tests for the wall.
  //
  // A plain-CRUD permission set with NO `tenant_isolation` RLS policy is used on
  // purpose, so Layer 0 (step 3.7) — not a business RLS `check` (step 3.6) — is
  // the sole enforcer under test. `orgScoping: true` flips
  // `SecurityPlugin.orgScopingEnabled`, which is what makes Layer 0 active.
  // -------------------------------------------------------------------------
  describe('organization_id tenant wall on writes (step 3.7)', () => {
    const memberSet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;

    const boot = async (findOneImpl?: (query: any) => any) => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [memberSet], orgScoping: true, findOneImpl });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };
    const memberCtx = (extra: Record<string, unknown> = {}) =>
      ({ userId: 'u1', tenantId: 'org-1', positions: [], permissions: [], ...extra });

    it('insert forging a cross-tenant organization_id is denied', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', organization_id: 'org-2' },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/would place .* in another tenant/);
    });

    it("insert supplying the caller's own organization_id passes", async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', organization_id: 'org-1' },
        context: memberCtx(),
      };
      await harness.run(opCtx); // must not throw
      expect(opCtx.data.organization_id).toBe('org-1');
    });

    it('update re-pointing organization_id to another tenant is denied', async () => {
      // Pre-image is visible (in-tenant), so step 2.7 passes and 3.7 is reached.
      const harness = await boot(() => ({ id: 't1', organization_id: 'org-1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', organization_id: 'org-2' },
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/would place .* in another tenant/);
    });

    it("update echoing the caller's own organization_id passes", async () => {
      const harness = await boot(() => ({ id: 't1', organization_id: 'org-1' }));
      const opCtx: any = {
        object: 'task', operation: 'update', data: { id: 't1', name: 'renamed', organization_id: 'org-1' },
        context: memberCtx(),
      };
      await harness.run(opCtx); // must not throw
    });

    it("a write that doesn't supply organization_id is untouched (auto-stamp's job)", async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A' },
        context: memberCtx(),
      };
      await harness.run(opCtx); // must not throw — no cross-tenant check on an absent value
      // [ADR-0105 D5/D12] SecurityPlugin never stamps organization_id. That stays
      // with the organizations runtime, which is also what activates a
      // walled posture — so a forged `org-scoping` registration yields NULL-org
      // rows the wall hides (a broken deployment), not a working unlicensed one.
      expect(opCtx.data.organization_id).toBeUndefined();
    });

    it('[ADR-0105 D5] a BULK insert leaves rows that omit organization_id untouched', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert',
        data: [{ name: 'A' }, { name: 'B', organization_id: 'org-1' }],
        context: memberCtx(),
      };
      await harness.run(opCtx);
      expect(opCtx.data.map((r: any) => r.organization_id)).toEqual([undefined, 'org-1']);
    });

    it('[ADR-0105 D5] a BULK insert with ONE forged row is denied entirely', async () => {
      // The pre-D5 check required a non-array payload, so an array of rows could
      // carry a forged organization_id past the wall — the #2937 defect one call
      // site down. No partial landing: one bad row denies the write.
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert',
        data: [{ name: 'A', organization_id: 'org-1' }, { name: 'B', organization_id: 'org-2' }],
        context: memberCtx(),
      };
      await expect(harness.run(opCtx)).rejects.toThrow(/another tenant|organization scope/i);
    });

    it('a system-context write bypasses the wall (import / migration / SYSTEM_CTX)', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A', organization_id: 'org-2' },
        context: memberCtx({ isSystem: true }),
      };
      await harness.run(opCtx); // isSystem short-circuits the whole middleware — legit cross-org moves unaffected
    });
  });

  // [ADR-0105 D3] Stripping is decided by PROVENANCE, not by pattern-matching
  // the `current_user.organization_id` token. `tenantPolicySet` above is an
  // APP-AUTHORED fixture, so with isolation off it is now RETAINED and fails
  // closed at compile time — it is no longer silently dropped (finding F1, the
  // ADR-0049 "declared but unenforced" class). Only the platform's own shipped
  // tenant policies are stripped; that half is covered in
  // `platform-tenant-policies.test.ts`.
  it('without org-scoping — an APP-AUTHORED tenant policy is RETAINED (never silently dropped)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    // Layer 0 is inert (no wall), so this filter is the AUTHORED policy alone.
    expect(opCtx.ast.where).toEqual({ organization_id: 'org-1' });
    // ...and the operator is told why, once.
    expect(harness.ctx.logger.warn).toHaveBeenCalledWith(
      expect.stringContaining('ADR-0105'),
      expect.objectContaining({ object: 'task', policy: 'tenant_isolation' }),
    );
  });

  it('without org-scoping — a retained authored tenant policy FAILS CLOSED with no active org', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    // The context variable is unavailable → the policy drops out at compile
    // time → deny sentinel. Zero rows, loudly — never fail-open.
    expect(opCtx.ast.where).toEqual(RLS_DENY_FILTER);
  });

  it('with org-scoping plugin — applies tenant_isolation RLS to find', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    // [ADR-0095 D1] Layer 0 (the tenant wall) AND the fixture's own legacy
    // tenant_isolation policy (Layer 1) — same rows. Production seeds no longer
    // carry the Layer-1 tenant policy, so in production this is Layer 0's
    // `{organization_id}` alone; this fixture keeps it to exercise composition.
    expect(opCtx.ast.where).toEqual({ $and: [{ organization_id: 'org-1' }, { organization_id: 'org-1' }] });
  });

  // Regression: when a schema explicitly opts out of tenancy
  // (`tenancy.enabled === false` — e.g. `sys_package` Marketplace catalog),
  // the wildcard `tenant_isolation` policy targeting `organization_id`
  // must be treated as "not applicable" and SKIPPED, NOT fail-closed
  // with RLS_DENY_FILTER. Otherwise the registry skips injecting the
  // tenant column (correct) but the security plugin still produces zero
  // rows on every read (wrong) — which silently broke the cloud
  // Marketplace UI.
  it('tenancy.enabled=false — wildcard organization_id RLS is skipped, not denied', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [tenantPolicySet],
      // Catalog table without organization_id; opts out of tenancy.
      objectFields: ['id', 'manifest_id', 'visibility', 'owner_org_id'],
      schemaExtra: { tenancy: { enabled: false } },
      orgScoping: true,
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    // No deny sentinel, no organization_id where clause: the read
    // passes through and the catalog row is visible to every tenant.
    expect(opCtx.ast.where).toBeUndefined();
  });

  // ── publicFormGrant — server-managed anchor stripping (#3022) ───────────
  // The ADR-0056 Option A grant short-circuits the middleware BEFORE every
  // write gate (FLS 2.5, owner anchor 3.5, tenant CHECK), so the grant branch
  // itself must force the system-managed anchors: an anonymous public-form
  // insert can never forge `owner_id` / `organization_id` / audit columns,
  // no matter what the route-side field allow-list let through.
  describe('publicFormGrant — server-managed anchor stripping (#3022)', () => {
    const anonFormCtx = { publicFormGrant: { object: 'task' }, permissions: ['guest_portal'], anonymous: true };

    const boot = async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };

    it('strips forged owner_id / organization_id / audit anchors from an insert', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert',
        data: {
          name: 'Ada', id: 'rec_forged', owner_id: 'usr_victim', organization_id: 'org_victim',
          created_by: 'usr_victim', updated_by: 'usr_victim',
          created_at: '2020-01-01T00:00:00Z', updated_at: '2020-01-01T00:00:00Z',
        },
        context: anonFormCtx,
      };
      await harness.run(opCtx);
      // Business fields survive; every server-managed anchor is gone
      // (ownership stays unset for hooks / first-admin bootstrap to assign).
      expect(opCtx.data).toEqual({ name: 'Ada' });
    });

    it('strips anchors from EVERY row of a batch insert', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert',
        data: [
          { name: 'A', owner_id: 'usr_victim' },
          { name: 'B', organization_id: 'org_victim' },
          { name: 'C' },
        ],
        context: anonFormCtx,
      };
      await harness.run(opCtx);
      expect(opCtx.data).toEqual([{ name: 'A' }, { name: 'B' }, { name: 'C' }]);
    });

    it('a clean insert passes through untouched', async () => {
      const harness = await boot();
      const opCtx: any = {
        object: 'task', operation: 'insert',
        data: { name: 'Ada', email: 'ada@example.com' },
        context: anonFormCtx,
      };
      await harness.run(opCtx);
      expect(opCtx.data).toEqual({ name: 'Ada', email: 'ada@example.com' });
    });

    it('the grant still refuses non-granted operations and foreign objects', async () => {
      const harness = await boot();
      await expect(
        harness.run({
          object: 'task', operation: 'update', data: { owner_id: 'usr_victim' },
          context: anonFormCtx,
        }),
      ).rejects.toThrow(/public-form grant permits only create\/read-back/);
      await expect(
        harness.run({
          object: 'sys_user', operation: 'insert', data: { name: 'x' },
          context: anonFormCtx,
        }),
      ).rejects.toThrow(/public-form grant permits only create\/read-back/);
    });
  });

  // ── Row-level WRITE authorization (pre-image check, #1985) ──────────────
  // A by-id update/delete never builds an RLS `where`, so the owner/tenant
  // predicate must be enforced by re-reading the target row before mutating.
  describe('pre-image write authorization', () => {
    const ownerPolicySet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      rowLevelSecurity: [
        { name: 'owner_only_writes', object: '*', operation: 'update', using: 'created_by = current_user.id' },
        { name: 'owner_only_deletes', object: '*', operation: 'delete', using: 'created_by = current_user.id' },
      ],
    } as any;
    const memberCtx = { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] };
    const ownerFields = ['id', 'created_by', 'name'];

    it('DENIES an update when the target row is not visible under the write filter (not the owner)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [ownerPolicySet],
        objectFields: ownerFields,
        // The owner policies are WRITE-only (`update` / `delete`): the row is
        // readable, and filtered out only by `created_by` on the write re-read.
        findOneImpl: (q: any) => (q?.where?.$and ? null : { id: 'r1', created_by: 'u2', name: 'theirs' }),
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'update',
        data: { id: 'r1', name: 'hijack' }, options: { where: { id: 'r1' } },
        context: memberCtx,
      };
      await expect(harness.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
      // [#21771] Two reads: the write re-read, then — the row being refused —
      // the read question that keeps this caller's 403 (they can read it).
      expect(harness.findOne).toHaveBeenCalledTimes(2);
      // the re-read ANDs the row id with the owner write filter
      const [, query] = harness.findOne.mock.calls[0];
      expect(query.where.$and[0]).toEqual({ id: 'r1' });
      expect(harness.findOne.mock.calls[1][1].where).toEqual({ id: 'r1' });
    });

    it('[#21771] a row the caller cannot READ answers what a nonexistent id answers, not 403', async () => {
      // Every read of `r1` under the caller's context comes back empty: the
      // row is hidden from this caller, so the write door says what the read
      // door says — the shared not-found producer, never the 403.
      for (const operation of ['update', 'delete'] as const) {
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({ permissionSets: [ownerPolicySet], objectFields: ownerFields, findOneImpl: () => null });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);
        const opCtx: any = {
          object: 'task', operation,
          ...(operation === 'update' ? { data: { id: 'r1', name: 'hijack' } } : {}),
          options: { where: { id: 'r1' } },
          context: memberCtx,
        };
        const err: any = await harness.run(opCtx).then(() => null, (e: unknown) => e);
        const missing: any = recordNotFoundError('task', 'r1');
        expect({ code: err?.code, status: err?.status, message: err?.message }, operation)
          .toEqual({ code: 'RECORD_NOT_FOUND', status: 404, message: missing.message });
        expect(err?.name, operation).not.toBe('PermissionDeniedError');
      }
    });

    it('ALLOWS an update when the target row IS visible under the write filter (the owner)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [ownerPolicySet],
        objectFields: ownerFields,
        findOneImpl: () => ({ id: 'r1', created_by: 'u1', name: 'mine' }),
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'delete',
        options: { where: { id: 'r1' } },
        context: memberCtx,
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      expect(harness.findOne).toHaveBeenCalledTimes(1);
    });

    it('DENIES a purge AT the object gate, before any row is read (#12497 — bits tombstoned, rows retired)', async () => {
      // Until #12497 this case pinned the pre-image RLS check on a purge whose
      // `allowPurge` grant had cleared the object gate (the #1883 pre-wiring).
      // The bits retired with their mapping rows — `allowPurge` on a legacy
      // stored set (`as any`: the spec type now spells it `never`) grants
      // nothing, and the dispatch is refused fail-closed by the object-level
      // gate. The row-level machinery must never even be consulted: no
      // pre-image read, no sharing probe. (The pre-image coverage claim for
      // by-id destructive writes lives on with `delete` above, and returns for
      // purge with the M2 batch.)
      const purgerSet: PermissionSet = {
        name: 'purger', label: 'Purger',
        objects: { '*': { allowRead: true, allowPurge: true } },
        rowLevelSecurity: [
          { name: 'owner_only_deletes', object: '*', operation: 'delete', using: 'created_by = current_user.id' },
        ],
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'purger' });
      const harness = makeMiddlewareCtx({
        permissionSets: [purgerSet],
        objectFields: ownerFields,
        findOneImpl: () => null,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'purge',
        options: { where: { id: 'r1' } },
        context: memberCtx,
      };
      await expect(harness.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
      expect(harness.findOne).toHaveBeenCalledTimes(0);
    });

    it('SKIPS the write-class re-read when no RLS policy applies (e.g. modifyAllRecords / admin) — the read question only', async () => {
      const adminSet: PermissionSet = {
        name: 'admin_full_access', label: 'Admin',
        objects: { '*': { allowRead: true, allowEdit: true, allowDelete: true, modifyAllRecords: true, viewAllRecords: true } },
        // no rowLevelSecurity
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'admin_full_access' });
      const harness = makeMiddlewareCtx({
        permissionSets: [adminSet],
        objectFields: ownerFields,
        findOneImpl: (q: any) => (q?.where?.$and ? null : { id: 'r1', name: 'x' }),
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'update',
        data: { id: 'r1', name: 'x' }, options: { where: { id: 'r1' } },
        context: { userId: 'admin', roles: ['admin_full_access'], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      // [#21771] Ruling A asks every principal class whether it can read the
      // addressed row — one plain by-id read, and still no write-class re-read.
      expect(harness.findOne).toHaveBeenCalledTimes(1);
      expect(harness.findOne.mock.calls[0][1].where).toEqual({ id: 'r1' });
    });

    it('SKIPS the check for a multi-row predicate id ({$in}) — only single-id by-pk writes are guarded', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [ownerPolicySet], objectFields: ownerFields, findOneImpl: () => null,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'update', multi: true,
        data: { name: 'bulk' }, options: { multi: true, where: { id: { $in: ['r1', 'r2'] } } },
        context: memberCtx,
      };
      await harness.run(opCtx);
      expect(harness.findOne).not.toHaveBeenCalled();
    });
  });

  it('tenancy.enabled=false via systemFields.tenant=false — also skipped', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [tenantPolicySet],
      objectFields: ['id', 'name'],
      schemaExtra: { systemFields: { tenant: false } },
      orgScoping: true,
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    expect(opCtx.ast.where).toBeUndefined();
  });

  it('tenancy enabled (default) — wildcard organization_id RLS still denies when field is missing', async () => {
    // Sanity check: dropping the deny sentinel must remain in effect
    // for objects that did NOT opt out — otherwise a wildcard policy
    // applied to a half-migrated table would silently expose every row.
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [tenantPolicySet],
      objectFields: ['id', 'name'], // no organization_id, no opt-out
      orgScoping: true,
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
    };
    await harness.run(opCtx);
    expect(opCtx.ast.where).toEqual(RLS_DENY_FILTER);
  });

  // Post-resolution fallback: roles is non-empty (e.g. better-auth
  // sys_member.role = 'owner') but no sys_position binding maps that name to
  // a permission set, so resolvePermissionSets returns []. Without the
  // post-resolution fallback both CRUD and RLS would be skipped → users
  // with org membership but no granted permission set could read every
  // tenant's data. The fallback re-resolves with `member_default` so
  // tenant_isolation still applies.
  it('post-resolution fallback — non-empty roles resolving to no permission sets still get tenant_isolation RLS', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    // The metadata only carries `member_default` (loaded via
    // `permissionSets: [tenantPolicySet]`). The role name 'owner' is
    // not bound anywhere, so `resolvePermissionSets(['owner'])` → [].
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task', operation: 'find', ast: { where: undefined },
      context: { userId: 'u1', tenantId: 'org-1', roles: ['owner'], permissions: [] },
    };
    await harness.run(opCtx);
    // [ADR-0095 D1] Tenant scope is now guaranteed by Layer 0 regardless of which
    // Layer-1 sets resolve; ANDed with the fixture's legacy tenant policy (same rows).
    expect(opCtx.ast.where).toEqual({ $and: [{ organization_id: 'org-1' }, { organization_id: 'org-1' }] });
  });

  // -------------------------------------------------------------------------
  // ADR-0066 D2/D3 — private posture + requiredPermissions (full middleware)
  // -------------------------------------------------------------------------
  describe('ADR-0066 private posture + requiredPermissions (middleware)', () => {
    const memberSet: PermissionSet = {
      name: 'member_default', label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;
    // Platform super-admin: super-user wildcard + the capability + a tenant_isolation
    // RLS policy (to prove the posture-gated bypass actually short-circuits it).
    const adminSet: PermissionSet = {
      name: 'admin_full_access', label: 'Admin',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true, viewAllRecords: true, modifyAllRecords: true } },
      systemPermissions: ['manage_platform_settings'],
      rowLevelSecurity: [
        { name: 'tenant_isolation', object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' },
      ],
    } as any;

    it('DENIES a non-admin (plain wildcard) on a private object — wildcard does not cover it', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [memberSet],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { access: { default: 'private' } },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await expect(harness.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    // ── [#2850 / #7626] $expand sub-read — the gate is NOT relaxed ───────────
    // The engine's expand path re-enters `find` for the referenced object with
    // a server-set `__expandRead` marker, which is what puts that object's RLS
    // + FLS on the expansion (#2850). #2850 also waived the object-level CRUD /
    // requiredPermissions gate whenever `access.default !== 'private'` — an
    // axis almost no object declares, and one it never paired with a check that
    // the caller actually held a covering grant. #7626 measured what that cost
    // on the running app (a `contributor`-only session read a private,
    // admin-owned contact it was 403'd from, in full, via `?$expand=contact`)
    // and deleted the waiver. One rule now, for public and private alike:
    // expansion may reveal only rows the caller could have read directly.
    //
    // These are the UNIT half. They cannot be the whole regression story and
    // deliberately are not: the pin that stayed green through the disclosure
    // was exactly this shape. The end-to-end, two-persona proof — admin sees
    // the expansion, the denied persona does not, through every expand door —
    // lives in `packages/qa/dogfood/test/showcase-expand-crud-gate.dogfood.test.ts`.
    it('[#7626] __expandRead does NOT waive the CRUD gate for a caller holding no grant', async () => {
      const noGrantSet: PermissionSet = {
        name: 'member_default', label: 'Member', objects: {},
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [noGrantSet],
        objectFields: ['id', 'organization_id', 'name'],
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const base = (): any => ({
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      });
      // Control: a DIRECT read with no grant on the object is denied.
      await expect(harness.run(base())).rejects.toMatchObject({ name: 'PermissionDeniedError' });
      // The SAME read tagged as an expand sub-read is denied TOO. Before #7626
      // this resolved — the object declares no `access` block, so it read as
      // "public, already broadly readable" and the gate was skipped for a
      // caller whose permission set grants literally nothing.
      const expandCtx = base();
      expandCtx.context.__expandRead = true;
      await expect(harness.run(expandCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('[#7626] __expandRead does NOT waive the requiredPermissions AND-gate', async () => {
      // The other throw-gate the waiver covered. `requiredPermissions` is an
      // access-NARROWING declaration (ADR-0049), so a sub-read is the last
      // place it may be skipped — the same stance the `unresolved` fail-closed
      // above takes for the very same field.
      const memberOnly: PermissionSet = {
        name: 'member_default', label: 'Member',
        objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [memberOnly],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { requiredPermissions: ['manage_platform_settings'] },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [], __expandRead: true },
      };
      await expect(harness.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('[#2850] __expandRead does NOT waive the gate for a PRIVATE referenced object', async () => {
      // Same shape as "DENIES a non-admin on a private object", but as an expand
      // sub-read: private objects stay strict — expand may not reveal a row the
      // caller could not have queried directly.
      const plainWildcard: PermissionSet = {
        name: 'member_default', label: 'Member',
        objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [plainWildcard],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { access: { default: 'private' } },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [], __expandRead: true },
      };
      await expect(harness.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('[#2850] __expandRead still injects RLS on the expand sub-read (the referenced object is scoped, not merely gated)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [tenantPolicySet],
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [], __expandRead: true },
      };
      await harness.run(opCtx);
      // The tenant wall is still AND-injected: `__expandRead` marks the sub-read
      // for the layers that strip it as a privileged input, it never loosens
      // row-level scoping on the referenced object.
      expect(opCtx.ast.where).toEqual({ $and: [{ organization_id: 'org-1' }, { organization_id: 'org-1' }] });
    });

    it('DENIES a caller missing the required capability (D3 AND-gate)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [memberSet],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { requiredPermissions: ['manage_platform_settings'] },
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      // [#7451] Re-spelled, not weakened. `requires capability` was the
      // capability AND-gate's DEVELOPER sentence; it is now `developerMessage`
      // (logged at the throw site, never shipped), and `message` is the
      // user-facing catalog entry — the same `permission_denied` the CRUD gate
      // renders, deliberately, because a caller missing a capability and a
      // caller missing a CRUD bit are in the same situation and have the same
      // remedy. Asserted against the catalog CONSTANT so a copy edit needs no
      // re-spell here; the developer half still pins WHICH gate answered.
      await expect(harness.run(opCtx)).rejects.toMatchObject({
        name: 'PermissionDeniedError',
        message: BUILTIN_OPERATION_MESSAGES.en.permission_denied,
        developerMessage: expect.stringContaining('requires capability'),
      });
    });

    it('ALLOWS the platform admin and BYPASSES wildcard RLS on a private object (read)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'admin_full_access' });
      const harness = makeMiddlewareCtx({
        permissionSets: [adminSet],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { access: { default: 'private' }, requiredPermissions: ['manage_platform_settings'] },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'admin', tenantId: 'org-1', roles: ['admin_full_access'], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      // Without the bypass this would be { organization_id: 'org-1' } and the
      // platform admin would miss null-/cross-org rows (the sys_license bug).
      expect(opCtx.ast.where).toBeUndefined();
    });

    it('BYPASSES the write pre-image check for a modifyAll admin on a private object', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'admin_full_access' });
      const harness = makeMiddlewareCtx({
        permissionSets: [adminSet],
        objectFields: ['id', 'organization_id', 'signed_token'],
        schemaExtra: { access: { default: 'private' }, requiredPermissions: ['manage_platform_settings'] },
        orgScoping: true,
        // The write-class re-read would DENY if it ran; the read question
        // (#21771) finds the row the admin reads.
        findOneImpl: (q: any) => (q?.where?.$and ? null : { id: 'r1', signed_token: 'old' }),
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'update',
        data: { id: 'r1', signed_token: 'x' }, options: { where: { id: 'r1' } },
        context: { userId: 'admin', tenantId: 'org-1', roles: ['admin_full_access'], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      expect(harness.findOne).toHaveBeenCalledTimes(1);
      expect(harness.findOne.mock.calls[0][1].where).toEqual({ id: 'r1' });
    });

    // ADR-0135 D4 / cloud#551 — `managedBy: 'better-auth'` identity tables get the
    // SAME posture-gated superuser bypass as private/non-tenant objects (their
    // rows are written without a tenant stamp, so the wildcard tenant_isolation
    // would otherwise hide every row from a platform admin).
    it('ALLOWS the platform admin and BYPASSES wildcard RLS on a better-auth-managed object', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'admin_full_access' });
      const harness = makeMiddlewareCtx({
        permissionSets: [adminSet],
        objectFields: ['id', 'organization_id', 'provider_id'],
        schemaExtra: { managedBy: 'better-auth' }, // NOT private, NOT tenancy-disabled
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'admin', tenantId: 'org-1', roles: ['admin_full_access'], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      expect(opCtx.ast.where).toBeUndefined(); // bypassed — admin sees all identity rows
    });

    it('does NOT bypass for a non-admin on a better-auth-managed object (no leak)', async () => {
      const memberWithRls: PermissionSet = {
        name: 'member_default', label: 'Member',
        objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
        rowLevelSecurity: [
          { name: 'tenant_isolation', object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' },
        ],
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [memberWithRls],
        objectFields: ['id', 'organization_id', 'provider_id'],
        schemaExtra: { managedBy: 'better-auth' },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await harness.run(opCtx);
      // The member is still tenant-scoped — the managedBy superuser bypass is
      // admin-only (Layer 0's exemption requires the platform-admin bit). Here
      // the object HAS organization_id, so Layer 0 applies the wall; ANDed with
      // the fixture's legacy tenant policy (Layer 1) — same rows, no leak.
      expect(opCtx.ast.where).toEqual({ $and: [{ organization_id: 'org-1' }, { organization_id: 'org-1' }] });
    });
  });

  // -------------------------------------------------------------------------
  // ADR-0066 ⑤ — per-operation requiredPermissions (read-open / write-gated)
  // -------------------------------------------------------------------------
  describe('ADR-0066 ⑤ per-operation requiredPermissions (middleware)', () => {
    const memberSet: PermissionSet = {
      name: 'member_default', label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;
    const memberWithCap: PermissionSet = {
      name: 'member_default', label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      systemPermissions: ['manage_x'],
    } as any;

    // Object is read-open (no `read` key) but create-gated on `manage_x`.
    const createGated = { requiredPermissions: { create: ['manage_x'] } };

    it('does NOT gate read — a caller without the capability can find', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [memberSet], schemaExtra: createGated });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
    });

    it('DENIES the gated operation (create) for a caller missing the capability', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [memberSet], schemaExtra: createGated });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A' },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      // [#7451] Re-spelled onto `developerMessage`, which is where the machine
      // detail now lives; `message` is the user-facing catalog entry. What this
      // case proves is unchanged and still proved: the refusal came from the
      // capability gate FOR THE INSERT operation, i.e. the per-operation
      // narrowing (ADR-0066 ⑤) really is per-operation — the sibling case above
      // shows `find` on the same object is admitted.
      await expect(harness.run(opCtx)).rejects.toMatchObject({
        name: 'PermissionDeniedError',
        message: BUILTIN_OPERATION_MESSAGES.en.permission_denied,
        developerMessage: expect.stringContaining("operation 'insert'"),
      });
    });

    it('ALLOWS the gated operation once the caller holds the capability', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [memberWithCap], schemaExtra: createGated });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const opCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A' },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await expect(harness.run(opCtx)).resolves.toBeDefined();
      expect(opCtx.data.owner_id).toBe('u1'); // proves it flowed past the gate
    });

    it('array form still gates EVERY operation (backward compat)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [memberSet],
        schemaExtra: { requiredPermissions: ['manage_x'] },
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      // read is denied under the array form (unlike the per-op map above)…
      const readCtx: any = {
        object: 'task', operation: 'find', ast: { where: undefined },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await expect(harness.run(readCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
      // …and so is create.
      const createCtx: any = {
        object: 'task', operation: 'insert', data: { name: 'A' },
        context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] },
      };
      await expect(harness.run(createCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });
  });

  // -------------------------------------------------------------------------
  // getReadFilter service (ADR-0021 D-C) — the reusable READ scope the
  // analytics raw-SQL path bridges to. Must produce the SAME FilterCondition
  // the engine middleware injects on `find`, and fail CLOSED on any error.
  // -------------------------------------------------------------------------
  describe('getReadFilter service', () => {
    it('registers a "security" service exposing getReadFilter', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const call = (harness.ctx.registerService as any).mock.calls.find(
        (c: any[]) => c[0] === 'security',
      );
      expect(call).toBeTruthy();
      expect(typeof call[1].getReadFilter).toBe('function');
    });

    it('returns the SAME tenant filter the find-path injects (org-scoping on)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const ctx = { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] };
      const filter = await plugin.getReadFilter('task', ctx);
      // [ADR-0095 D1] Same Layer0-AND-Layer1 composition as the find path — the
      // point of this test (getReadFilter parity) holds by construction.
      expect(filter).toEqual({ $and: [{ organization_id: 'org-1' }, { organization_id: 'org-1' }] });
    });

    it('[ADR-0105 D3] keeps an APP-AUTHORED tenant policy in scope even with org-scoping off', async () => {
      // Parity with the find path: getReadFilter reads the same collection, so an
      // authored policy must reach analytics/raw-SQL consumers too. Returning
      // `undefined` here (the pre-D3 behavior) handed them an UNSCOPED read.
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] });
      expect(filter).toEqual({ organization_id: 'org-1' });
    });

    it('fail-closed: wildcard org policy on an object missing the column → deny sentinel', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [tenantPolicySet],
        objectFields: ['id', 'name'], // no organization_id, tenancy not opted out
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] });
      expect(filter).toEqual(RLS_DENY_FILTER);
    });

    it('[ADR-0090 D10] fail-closed on an on-behalf-of (delegated) context whose delegator does not exist', async () => {
      // getReadFilter composes the D10 intersection for a delegated context
      // (ADR-0139 D5.1 as amended; `readable-ids-delegated-compose.test.ts`
      // measures it on the real stack). This harness answers no `sys_user`
      // row, so the link names a delegator who does not exist: there is no
      // leg to intersect against, and the read DENIES rather than serve the
      // agent's own (wider) scope — the dangling-link rule every D10 gate
      // shares, logged as the failure it is.
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', {
        userId: 'agent-1',
        tenantId: 'org-1',
        positions: [],
        permissions: ['member_default'],
        onBehalfOf: { userId: 'user-1' },
      });
      expect(filter).toEqual(RLS_DENY_FILTER);
      expect(harness.ctx.logger.error).toHaveBeenCalled();
    });

    it('[#2852] a system on-behalf-of context bypasses before the deny sentinel', async () => {
      // isSystem short-circuits to `undefined` (no scope) ahead of the
      // on-behalf-of guard — engine self-invocation must not be denied.
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', {
        isSystem: true,
        userId: 'agent-1',
        onBehalfOf: { userId: 'user-1' },
      });
      expect(filter).toBeUndefined();
    });

    it('[#2936] fail-closed on a CANONICAL `==` wildcard policy targeting a missing column → deny sentinel', async () => {
      // The `=`-form twin above is the L692 test. This is its canonical-CEL
      // sibling: pre-#2936 `extractTargetField` did not recognize `==`, so the
      // field-existence net was INERT for it — the policy slipped through and
      // compiled to a phantom `{ organization_id: … }` filter against a column
      // the object lacks. The net now recognizes `==` and fails closed here,
      // exactly as it always did for the legacy `=` form. Real seeds/business
      // policies author equality as `==`, so this is the path that mattered.
      const eqPolicySet: PermissionSet = {
        name: 'member_default',
        label: 'Member',
        objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
        rowLevelSecurity: [
          { name: 'tenant_isolation', object: '*', operation: 'all', using: 'organization_id == current_user.organization_id' },
        ],
      } as any;
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [eqPolicySet],
        objectFields: ['id', 'name'], // no organization_id, tenancy not opted out
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] });
      expect(filter).toEqual(RLS_DENY_FILTER);
    });

    it('tenancy opt-out → undefined (not denied), matching the find-path', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [tenantPolicySet],
        objectFields: ['id', 'name'],
        schemaExtra: { tenancy: { enabled: false } },
        orgScoping: true,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] });
      expect(filter).toBeUndefined();
    });

    it('system context bypasses scoping (returns undefined)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { isSystem: true, userId: 'u1', tenantId: 'org-1' });
      expect(filter).toBeUndefined();
    });

    it('[#21908] principal-less (no userId/positions/permissions, not system) → the deny sentinel (ADR-0096 D5)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      const filter = await plugin.getReadFilter('task', { positions: [], permissions: [] });
      expect(filter).toEqual({ ...RLS_DENY_FILTER });
    });

    it('fail-closed: a permission-resolution throw yields the deny sentinel (never allow-all)', async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], orgScoping: true });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      // Force resolution to blow up.
      (plugin as any).permissionEvaluator.resolvePermissionSets = async () => {
        throw new Error('metadata service unavailable');
      };
      const filter = await plugin.getReadFilter('task', { userId: 'u1', tenantId: 'org-1', positions: [], permissions: [] });
      expect(filter).toEqual(RLS_DENY_FILTER);
    });

    // -----------------------------------------------------------------------
    // [#4467] The OWD / record-sharing half of the read scope.
    //
    // `getReadFilter` promises "the same filter the engine middleware AND-s
    // into every find". That chain is TWO sibling middlewares — this plugin's
    // RLS injection and plugin-sharing's owner/share visibility filter — and
    // only the RLS half was ever computed here. The analytics raw-SQL path has
    // no other source of scope, so `POST /analytics/query` ran with no owner
    // predicate at all. Live repro on showcase before the fix, member holding
    // shares on 2 of an admin's 5 private notes and no `viewAllRecords`:
    //
    //   GET  /data/showcase_private_note          member → total 2   correct
    //   POST /analytics/query {measures:[count]}  member → count 5   LEAK
    //   ... + dimensions:["title"]                member → all 5 titles
    //
    // The dimension case is why this is a disclosure and not just a bad count:
    // grouping returns the VALUES of a column the caller may not read.
    // -----------------------------------------------------------------------
    describe('[#4467] OWD / sharing composition', () => {
      /** A plugin-sharing double that scopes `task` to owner-or-shared. */
      const ownerOrShared = {
        buildReadFilter: vi.fn(async (_object: string, ctx: any) => ({
          $or: [{ owner_id: ctx.userId }, { id: { $in: ['rec-1', 'rec-2'] } }],
        })),
      };

      it('AND-composes the sharing predicate with the RLS filter', async () => {
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({
          permissionSets: [tenantPolicySet],
          sharing: ownerOrShared,
        });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        const filter = await plugin.getReadFilter('task', {
          userId: 'u1', tenantId: 'org-1', positions: [], permissions: [],
        });

        // Pre-fix this was `{ organization_id: 'org-1' }` alone — every row of
        // the tenant, regardless of ownership.
        expect(filter).toEqual({
          $and: [
            { organization_id: 'org-1' },
            { $or: [{ owner_id: 'u1' }, { id: { $in: ['rec-1', 'rec-2'] } }] },
          ],
        });
      });

      it('returns the sharing predicate alone when RLS contributes nothing', async () => {
        // An owner-private object in a deployment with no tenant policy: the
        // sharing half is then the ONLY thing standing between the caller and
        // every row, so it must survive on its own rather than collapsing to
        // `undefined` with the empty RLS half.
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({
          permissionSets: [{
            name: 'member_default',
            label: 'Member',
            objects: { '*': { allowRead: true } },
          } as any],
          sharing: ownerOrShared,
        });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        const filter = await plugin.getReadFilter('task', {
          userId: 'u1', tenantId: 'org-1', positions: [], permissions: [],
        });

        expect(filter).toEqual({ $or: [{ owner_id: 'u1' }, { id: { $in: ['rec-1', 'rec-2'] } }] });
      });

      it('passes the ADR-0057 D1 read DEPTH the middleware would have stashed', async () => {
        // plugin-sharing widens its owner-match from `__readScope`, which the
        // engine middleware writes onto the context before the sharing
        // middleware runs. No middleware runs on this path, so getReadFilter
        // must compute it — otherwise a caller granted `org` read depth is
        // silently narrowed to `own` here while `/data` shows them everything.
        const capture = { buildReadFilter: vi.fn(async () => null) };
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({
          permissionSets: [{
            name: 'member_default',
            label: 'Member',
            objects: { '*': { allowRead: true, readScope: 'unit' } },
          } as any],
          sharing: capture,
        });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        await plugin.getReadFilter('task', {
          userId: 'u1', tenantId: 'org-1', positions: [], permissions: [],
        });

        expect(capture.buildReadFilter).toHaveBeenCalledWith(
          'task',
          expect.objectContaining({ __readScope: 'unit', userId: 'u1' }),
        );
      });

      it('fail-closed: a sharing-resolution throw denies rather than under-scoping', async () => {
        // Dropping this predicate is precisely the leak, so an unresolvable
        // sharing layer must deny — never fall through to the RLS half alone.
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({
          permissionSets: [tenantPolicySet],
          sharing: { buildReadFilter: async () => { throw new Error('share store unavailable'); } },
        });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        const filter = await plugin.getReadFilter('task', {
          userId: 'u1', tenantId: 'org-1', positions: [], permissions: [],
        });

        expect(filter).toEqual(RLS_DENY_FILTER);
      });

      it('a system context still bypasses both halves', async () => {
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const sharing = { buildReadFilter: vi.fn(async () => ({ owner_id: 'u1' })) };
        const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet], sharing });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        const filter = await plugin.getReadFilter('task', { isSystem: true, userId: 'u1', tenantId: 'org-1' });

        expect(filter).toBeUndefined();
        expect(sharing.buildReadFilter).not.toHaveBeenCalled();
      });

      it('a deployment without plugin-sharing is unaffected', async () => {
        // The service is optional; its absence must not change the RLS answer
        // (and must not throw on the lookup).
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);

        const filter = await plugin.getReadFilter('task', {
          userId: 'u1', tenantId: 'org-1', positions: [], permissions: [],
        });

        expect(filter).toEqual({ organization_id: 'org-1' });
      });
    });
  });

  // -------------------------------------------------------------------------
  // FLS write enforcement (Backend FLS strip — gap #1)
  // -------------------------------------------------------------------------
  // Permission set that allows full CRUD on `task` but denies edit on
  // two specific fields: `salary` (read-only) and `ssn` (hidden).
  const flsPolicySet: PermissionSet = {
    name: 'member_default',
    label: 'Member',
    objects: {
      '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
    },
    fields: {
      'task.salary': { readable: true, editable: false },
      'task.ssn': { readable: false, editable: false },
    },
  } as any;

  it('FLS write — insert with a forbidden field throws PermissionDeniedError', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A', salary: 9999 },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toThrow(/Field write denied/);
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['salary'] },
    });
  });

  it('FLS write — update with a forbidden field throws PermissionDeniedError', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'update',
      data: { ssn: 'leaked-123' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['ssn'] },
    });
  });

  // -------------------------------------------------------------------------
  // [#25866 / ruling of record 6408558941] A field permission entry with a
  // row condition (`when`) votes only on the rows the condition names: the
  // incoming row of an insert, the STORED row of a by-id update (before the
  // write). The judge is the write gate's own in-process one
  // (`RLSCompiler.compileRowPredicate` + `storedFormCheckJudge`), never a
  // query rewrite; a row that cannot be judged applies the entry as its lock.
  // -------------------------------------------------------------------------
  const whenFields = ['id', 'owner_id', 'name', 'amount', 'status', 'assigned_to'];
  const whenSetWith = (when: string): PermissionSet => ({
    name: 'member_default',
    label: 'Member',
    objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    fields: { 'task.amount': { readable: true, editable: false, when } },
  } as any);
  const whenCtx = { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] };
  const bootWhen = async (when: string, over: { findOneImpl?: (q: any) => any } = {}) => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [whenSetWith(when)], objectFields: whenFields, ...over });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    return { plugin, harness };
  };
  const APPROVED_LOCK = "status == 'approved'";

  it('[#25866] insert — the condition is judged on the INCOMING row: a draft admits the locked field', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK);
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', amount: 5, status: 'draft' }, context: whenCtx };
    await expect(harness.run(opCtx)).resolves.toBeDefined();
    // No row-condition line: the row was judged, not locked blind.
    expect(harness.ctx.logger.warn).not.toHaveBeenCalledWith(expect.stringMatching(/row condition/));
  });

  it('[#25866] insert — an approved incoming row matches the condition and the lock refuses the field', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK);
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', amount: 5, status: 'approved' }, context: whenCtx };
    await expect(harness.run(opCtx)).rejects.toThrow(/Field write denied/);
    await expect(harness.run(opCtx)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
  });

  it('[#25866] insert — a bulk payload judges each row on its own and refuses the union', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK);
    const opCtx: any = {
      object: 'task', operation: 'insert', context: whenCtx,
      data: [{ name: 'A', amount: 1, status: 'draft' }, { name: 'B', amount: 2, status: 'approved' }],
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
    const drafts: any = {
      object: 'task', operation: 'insert', context: whenCtx,
      data: [{ name: 'A', amount: 1, status: 'draft' }, { name: 'B', amount: 2 }],
    };
    await expect(harness.run(drafts)).resolves.toBeDefined();
  });

  it('[#25866] update by id — judged on the STORED row before the write, not on the payload', async () => {
    // The stored row is approved: the lock applies even though the payload
    // would move the row back to draft in the same write.
    const { harness } = await bootWhen(APPROVED_LOCK, {
      findOneImpl: () => ({ id: 'r1', owner_id: 'u1', name: 'A', amount: 1, status: 'approved' }),
    });
    const opCtx: any = {
      object: 'task', operation: 'update', context: whenCtx,
      data: { amount: 2, status: 'draft' }, options: { where: { id: 'r1' } },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
  });

  it('[#25866] update by id — a stored draft row admits the field, even when the payload approves it', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK, {
      findOneImpl: () => ({ id: 'r1', owner_id: 'u1', name: 'A', amount: 1, status: 'draft' }),
    });
    const opCtx: any = {
      object: 'task', operation: 'update', context: whenCtx,
      data: { amount: 2, status: 'approved' }, options: { where: { id: 'r1' } },
    };
    await expect(harness.run(opCtx)).resolves.toBeDefined();
    // The pre-image was read as the CALLER, by id, exactly once for the operation.
    expect(harness.findOne).toHaveBeenCalledWith('task', expect.objectContaining({ where: { id: 'r1' }, context: whenCtx }));
  });

  it('[#25866] update — a predicate update has no single row to judge and applies the entry as its lock', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK);
    const opCtx: any = {
      object: 'task', operation: 'update', context: whenCtx,
      data: { amount: 2 }, options: { where: { status: 'draft' }, multi: true },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
    expect(harness.ctx.logger.warn).toHaveBeenCalledWith(expect.stringMatching(/row condition.*applied as its lock/));
  });

  it('[#25866] update by id — a stored row the caller cannot read (or that is absent) applies the lock', async () => {
    // In the middleware the row-level pre-image gate (2.7) runs first and
    // answers a null pre-image with 404 RECORD_NOT_FOUND, so the write never
    // reaches the field gate. The field gate's OWN reading of a null pre-image
    // is still the lock — the second line, and the one `canWriteObject` and a
    // predicate update rely on — so it is pinned here on the derivation itself.
    const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => null });
    const opCtx: any = {
      object: 'task', operation: 'update', context: whenCtx,
      data: { amount: 2 }, options: { where: { id: 'r1' } },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({ code: 'RECORD_NOT_FOUND' });
    const forbidden = await (plugin as any).computeForbiddenFieldWrites(
      'task', { amount: 2 }, { fieldRequiredPermissions: {} }, [whenSetWith(APPROVED_LOCK)], null,
      { operation: 'update', context: whenCtx, preImage: async () => null },
    );
    expect(forbidden).toEqual(['amount']);
    expect(harness.ctx.logger.warn).toHaveBeenCalledWith(expect.stringMatching(/stored row could not be read as the caller.*applied as its lock/));
    // The same derivation with a readable draft pre-image admits the field.
    const admitted = await (plugin as any).computeForbiddenFieldWrites(
      'task', { amount: 2 }, { fieldRequiredPermissions: {} }, [whenSetWith(APPROVED_LOCK)], null,
      { operation: 'update', context: whenCtx, preImage: async () => ({ id: 'r1', status: 'draft' }) },
    );
    expect(admitted).toEqual([]);
  });

  it('[#25866] the condition resolves `current_user.*` against the caller, as an RLS predicate does', async () => {
    const { harness } = await bootWhen('assigned_to == current_user.id');
    const mine: any = { object: 'task', operation: 'insert', data: { name: 'A', amount: 1, assigned_to: 'u1' }, context: whenCtx };
    await expect(harness.run(mine)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
    const theirs: any = { object: 'task', operation: 'insert', data: { name: 'A', amount: 1, assigned_to: 'u2' }, context: whenCtx };
    await expect(harness.run(theirs)).resolves.toBeDefined();
  });

  it('[#25866] a condition that does not resolve for this request applies the lock and says why', async () => {
    const { harness } = await bootWhen('assigned_to == current_user.nope');
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', amount: 1, assigned_to: 'u1' }, context: whenCtx };
    await expect(harness.run(opCtx)).rejects.toMatchObject({ details: { forbiddenFields: ['amount'] } });
    expect(harness.ctx.logger.warn).toHaveBeenCalledWith(expect.stringMatching(/cannot be judged for this request.*applied as its lock/));
  });

  it('[#25866] a field the entry does not name is never refused, matched or not', async () => {
    const { harness } = await bootWhen(APPROVED_LOCK);
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', status: 'approved' }, context: whenCtx };
    await expect(harness.run(opCtx)).resolves.toBeDefined();
  });

  it('[#25866] canWriteObject — an insert is judged on the payload; an update holds no row and applies the lock', async () => {
    const { plugin } = await bootWhen(APPROVED_LOCK);
    await expect(plugin.canWriteObject('task', 'insert', whenCtx, { name: 'A', amount: 1, status: 'draft' })).resolves.toBe(true);
    await expect(plugin.canWriteObject('task', 'insert', whenCtx, { name: 'A', amount: 1, status: 'approved' })).resolves.toBe(false);
    await expect(plugin.canWriteObject('task', 'update', whenCtx, { amount: 2 })).resolves.toBe(false);
    await expect(plugin.canWriteObject('task', 'update', whenCtx, { name: 'renamed' })).resolves.toBe(true);
  });

  // [#26594 / ruling of record 6457467702] The record-scoped field projection:
  // its edit half is the step 2.5 gate's own verdict on the stored row, so it
  // must agree with a by-id update of that row, both ways, field by field.
  describe('[#26594] getRecordFieldAccess — the field projection of one record', () => {
    const rowOf = (status: string) => ({ id: 'r1', owner_id: 'u1', name: 'A', amount: 1, status, assigned_to: null });
    const gateAdmits = async (harness: any, data: Record<string, unknown>) => {
      const opCtx: any = { object: 'task', operation: 'update', context: whenCtx, data, options: { where: { id: 'r1' } } };
      return harness.run(opCtx).then(() => true, (e: any) => {
        if (e?.details?.forbiddenFields) return false;
        throw e;
      });
    };

    it('a row the condition does not name: the conditioned field is editable, and the gate admits its write', async () => {
      const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf('draft') });
      const access = await plugin.getRecordFieldAccess('task', 'r1', whenCtx);
      expect(access).toEqual({ object: 'task', recordId: 'r1', readable: whenFields, editable: whenFields, writable: true });
      await expect(gateAdmits(harness, { amount: 2 })).resolves.toBe(true);
      // Read as the CALLER, by id — the gate's own pre-image reader.
      expect(harness.findOne).toHaveBeenCalledWith('task', expect.objectContaining({ where: { id: 'r1' }, context: whenCtx }));
    });

    it('a row the condition names: the field is locked, and the gate refuses its write', async () => {
      const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf('approved') });
      const access = await plugin.getRecordFieldAccess('task', 'r1', whenCtx);
      expect(access?.editable).toEqual(whenFields.filter((f) => f !== 'amount'));
      expect(access?.readable).toEqual(whenFields);
      await expect(gateAdmits(harness, { amount: 2 })).resolves.toBe(false);
    });

    it('equals the gate verdict for every field, on a row each side of the condition', async () => {
      for (const status of ['draft', 'approved']) {
        const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf(status) });
        const access = await plugin.getRecordFieldAccess('task', 'r1', whenCtx);
        for (const field of whenFields) {
          // The stored value written back, so no other gate (an ownership
          // change, a move across the condition) answers instead of 2.5.
          const admitted = await gateAdmits(harness, { [field]: (rowOf(status) as any)[field] ?? 'x' });
          expect(access!.editable.includes(field), `${status}.${field}`).toBe(admitted);
        }
      }
    });

    it('a row that is absent or that the caller cannot read answers null — no projection is served for it', async () => {
      const { plugin } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => null });
      await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toBeNull();
    });

    it('the row-less projection is unchanged: it still reports the conditioned entry as its lock', async () => {
      const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf('draft') });
      await expect(plugin.getWritableFields('task', whenCtx)).resolves.toEqual(whenFields.filter((f) => f !== 'amount'));
      // …and it reads no row to say so.
      expect(harness.findOne).not.toHaveBeenCalled();
    });

    it('an unresolvable schema is "no answer", and a system context reads every field', async () => {
      const { plugin } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf('approved') });
      await expect(plugin.getRecordFieldAccess('', 'r1', whenCtx)).resolves.toBeUndefined();
      await expect(plugin.getRecordFieldAccess('task', 'r1', { isSystem: true })).resolves.toEqual({
        object: 'task', recordId: 'r1', readable: whenFields, editable: whenFields, writable: true,
      });
    });

    // [#27175] `writable`: the row's own verdict, from the registered
    // middleware run over a by-id update of the row — so it must agree with
    // that update, both ways, and must leave nothing behind.
    describe('[#27175] writable — the row write verdict', () => {
      const ownRowsSet = (allowEdit: boolean): PermissionSet => ({
        name: 'member_default',
        label: 'Member',
        objects: { '*': { allowRead: true, allowCreate: true, allowEdit, allowDelete: true } },
        rowLevelSecurity: [
          { name: 'own_rows_update', object: 'task', operation: 'update', using: 'owner_id = current_user.id' },
        ],
      } as any);
      const bootRows = async (opts: { allowEdit?: boolean; inWriteScope: boolean; sharing?: any }) => {
        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
        const harness = makeMiddlewareCtx({
          permissionSets: [ownRowsSet(opts.allowEdit ?? true)],
          objectFields: whenFields,
          // The by-id read answers the row; the step 2.7 re-read
          // (`{ id } AND <write filter>`) answers it only inside the write scope.
          findOneImpl: (q) => (q?.where?.$and && !opts.inWriteScope ? null : rowOf('draft')),
          ...(opts.sharing ? { sharing: opts.sharing } : {}),
        });
        await plugin.init(harness.ctx);
        await plugin.start(harness.ctx);
        return { plugin, harness };
      };
      const updateAdmitted = (harness: any) =>
        harness
          .run({ object: 'task', operation: 'update', context: { ...whenCtx }, data: { name: 'renamed' }, options: { where: { id: 'r1' } } })
          .then(() => true, () => false);

      it('equals a by-id update of the row: inside the row-level write scope true, outside it false', async () => {
        for (const inWriteScope of [true, false]) {
          const { plugin, harness } = await bootRows({ inWriteScope });
          const access = await plugin.getRecordFieldAccess('task', 'r1', whenCtx);
          expect(access?.writable, `inWriteScope=${inWriteScope}`).toBe(inWriteScope);
          await expect(updateAdmitted(harness)).resolves.toBe(inWriteScope);
          // `editable` stays field-level: the row verdict does not empty it.
          expect(access?.editable).toEqual(whenFields);
        }
      });

      it('an object grant without edit answers false, as the update is refused', async () => {
        const { plugin, harness } = await bootRows({ allowEdit: false, inWriteScope: true });
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: false });
        await expect(updateAdmitted(harness)).resolves.toBe(false);
      });

      it('a stored row outside a row-level check answers false, while a save moving it back inside passes', async () => {
        // The check judges the post-image; the probe's post-image is the stored
        // row as it is. So `false` is "an update that leaves the row as stored",
        // not "every update" — the describe says exactly that.
        const checkSet = {
          ...ownRowsSet(true),
          rowLevelSecurity: [
            { name: 'own_rows_update', object: 'task', operation: 'update', using: 'owner_id = current_user.id', check: "status != 'archived'" },
          ],
        } as any;
        for (const status of ['draft', 'archived']) {
          const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
          const harness = makeMiddlewareCtx({ permissionSets: [checkSet], objectFields: whenFields, findOneImpl: () => rowOf(status) });
          await plugin.init(harness.ctx);
          await plugin.start(harness.ctx);
          const writable = status !== 'archived';
          await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx), status).resolves.toMatchObject({ writable });
          const save = (data: Record<string, unknown>) =>
            harness
              .run({ object: 'task', operation: 'update', context: { ...whenCtx }, data, options: { where: { id: 'r1' } } })
              .then(() => true, () => false);
          await expect(save({ name: 'renamed' }), status).resolves.toBe(writable);
          await expect(save({ status: 'draft' }), status).resolves.toBe(true);
        }
      });

      it('a refused probe logs at debug, tagged probe: true; a refused update still warns', async () => {
        const { plugin, harness } = await bootRows({ inWriteScope: false });
        harness.ctx.logger.debug = vi.fn();
        const denials = () =>
          harness.ctx.logger.warn.mock.calls.filter((c: any[]) => String(c[0]).includes('Access denied'));
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: false });
        expect(denials()).toEqual([]);
        expect(harness.ctx.logger.debug).toHaveBeenCalledWith(
          expect.stringContaining('row-level security'),
          expect.objectContaining({ operation: 'update', recordId: 'r1', probe: true }),
        );
        // Positive control: the same refusal on a real update is a warning.
        await expect(updateAdmitted(harness)).resolves.toBe(false);
        expect(denials()).toEqual([
          [expect.stringContaining('row-level security'), expect.not.objectContaining({ probe: true })],
        ]);
      });

      it('leaves nothing behind: no write epoch advanced, the caller\'s context unstamped', async () => {
        const { plugin, harness } = await bootRows({ inWriteScope: true });
        const epoch = (plugin as any).epoch;
        const bump = vi.spyOn(epoch, 'bump');
        const callerContext = { ...whenCtx };
        await expect(plugin.getRecordFieldAccess('task', 'r1', callerContext)).resolves.toMatchObject({ writable: true });
        expect(bump).not.toHaveBeenCalled();
        expect(callerContext).toEqual(whenCtx);
        // Positive control: a real by-id update through the same handler does advance it.
        await expect(updateAdmitted(harness)).resolves.toBe(true);
        expect(bump).toHaveBeenCalledWith('write');
      });

      it('asks plugin-sharing\'s by-id gate at the chain\'s end, with the context as the middleware stamped it', async () => {
        const admitsByIdWrite = vi.fn(async () => false);
        const sharing = { byIdWriteGateInstalled: true, admitsByIdWrite };
        const { plugin } = await bootRows({ inWriteScope: true, sharing });
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: false });
        expect(admitsByIdWrite).toHaveBeenCalledWith('task', 'r1', 'update', expect.objectContaining({ userId: 'u1', __writeScope: expect.any(String) }));
        admitsByIdWrite.mockResolvedValue(true);
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: true });
        // A sharing service whose middleware is not installed imposes nothing, as on the write.
        sharing.byIdWriteGateInstalled = false;
        admitsByIdWrite.mockClear();
        admitsByIdWrite.mockResolvedValue(false);
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: true });
        expect(admitsByIdWrite).not.toHaveBeenCalled();
      });

      it('fails closed when no middleware was registered', async () => {
        const { plugin } = await bootRows({ inWriteScope: true });
        (plugin as any).authzMiddleware = null;
        await expect(plugin.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toMatchObject({ writable: false });
      });
    });

    it('is the method the registered security service answers from', async () => {
      const { plugin, harness } = await bootWhen(APPROVED_LOCK, { findOneImpl: () => rowOf('approved') });
      const svc = harness.ctx.registerService.mock.calls.find((c: any[]) => c[0] === 'security')?.[1];
      expect(typeof svc?.getRecordFieldAccess).toBe('function');
      await expect(svc.getRecordFieldAccess('task', 'r1', whenCtx)).resolves.toEqual(
        await plugin.getRecordFieldAccess('task', 'r1', whenCtx),
      );
    });
  });

  it('[#2982 follow-up] bulk-write predicate guard inspects the CALLER predicate, not injected owner/RLS filters', async () => {
    // The anti-oracle guard (2.9) must reject a caller filtering on an
    // FLS-hidden field, but must NOT reject an owner_id predicate a sibling
    // middleware (plugin-sharing) composed onto opCtx.ast — otherwise a bulk
    // write on an object whose owner_id is FLS-hidden 403s purely because the
    // injected filter mentions it, and the result depends on middleware order.
    const ownerHiddenSet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      fields: { 'task.owner_id': { readable: false, editable: false }, 'task.ssn': { readable: false, editable: false } },
    } as any;
    const boot = async () => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({ permissionSets: [ownerHiddenSet], objectFields: ['id', 'owner_id', 'name', 'ssn', 'status'] });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };
    const ctx = { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] };

    // Injected owner_id in the AST, but the caller's own predicate is clean → allowed.
    const injected: any = await boot();
    const okCtx: any = {
      object: 'task', operation: 'update', data: { name: 'renamed' },
      options: { where: { status: 'open' }, multi: true },
      ast: { where: { $and: [{ status: 'open' }, { owner_id: 'u1' }] } }, // as plugin-sharing would compose
      context: ctx,
    };
    await injected.run(okCtx); // must NOT throw — owner_id is only in the injected filter

    // The caller's OWN predicate references a hidden field → still rejected.
    const probing: any = await boot();
    const denyCtx: any = {
      object: 'task', operation: 'update', data: { name: 'renamed' },
      options: { where: { ssn: 'guess' }, multi: true },
      ast: { where: { ssn: 'guess' } },
      context: ctx,
    };
    await expect(probing.run(denyCtx)).rejects.toThrow(/filter oracle|not readable/);
  });

  it('FLS write — the record echoed back by an update is masked (no read-leak of hidden fields)', async () => {
    // Regression: a caller with edit-but-not-field-read must not be able to
    // read a read-protected field back out of the mutation response. The write
    // itself only touches an editable field; the engine echoes the full row.
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'update',
      data: { name: 'edited' }, // only editable field written → passes write gate
      // Engine's echoed post-image (pre-set; harness `next` is a no-op).
      result: { id: 't1', name: 'edited', salary: 9999, ssn: 'secret-leak' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await harness.run(opCtx);
    // ssn (readable:false) stripped; salary (readable:true) retained.
    expect(opCtx.result.ssn).toBeUndefined();
    expect(opCtx.result.salary).toBe(9999);
    expect(opCtx.result.name).toBe('edited');
  });

  it('FLS write — the record echoed back by an insert is masked', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A' },
      result: { id: 't2', name: 'A', salary: 100, ssn: 'server-generated' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await harness.run(opCtx);
    expect(opCtx.result.ssn).toBeUndefined();
    expect(opCtx.result.salary).toBe(100);
  });

  // FLS aggregate-input gate (2.5b): result masking never runs for `aggregate`
  // (output rows carry only aliases), so a protected field's statistics would
  // leak straight through `sum(ssn) AS x` — the gate rejects on the INPUT.
  it('FLS aggregate — aggregating an unreadable field is denied fail-closed', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'aggregate',
      ast: {
        object: 'task',
        aggregations: [{ function: 'count_distinct', field: 'ssn', alias: 'n' }],
      },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toThrow(/Field read denied/);
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['ssn'] },
    });
  });

  it('FLS aggregate — grouping BY an unreadable field is denied (group keys reveal values)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'aggregate',
      ast: {
        object: 'task',
        // Structured groupBy item — the gate must see through {field} objects.
        groupBy: [{ field: 'ssn', dateGranularity: undefined }],
        aggregations: [{ function: 'count', alias: 'n' }],
      },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['ssn'] },
    });
  });

  it('FLS aggregate — readable fields aggregate fine (and count(*) needs no field)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'aggregate',
      ast: {
        object: 'task',
        groupBy: ['name'],
        // salary is readable:true (only editable:false) → aggregating it is a READ, allowed.
        aggregations: [
          { function: 'sum', field: 'salary', alias: 'total' },
          { function: 'count', alias: 'n' },
        ],
      },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).resolves.toBeDefined();
  });

  it('fails CLOSED when permission resolution throws — denies, never bypasses (P0-2)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    // Simulate the permission/metadata subsystem failing mid-resolution.
    (plugin as any).permissionEvaluator = {
      resolvePermissionSets: async () => { throw new Error('metadata service unavailable'); },
    };
    const opCtx: any = {
      object: 'task',
      operation: 'find',
      data: {},
      context: { userId: 'u1', tenantId: 'org-1', roles: ['member'], permissions: [] },
    };
    // Resolution failed → the request must be DENIED, not waved through.
    await expect(harness.run(opCtx)).rejects.toThrow(/permission subsystem unavailable/);
    expect(harness.ctx.logger.error).toHaveBeenCalled();
  });

  it('a system operation still bypasses security regardless (P0-2)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    (plugin as any).permissionEvaluator = {
      resolvePermissionSets: async () => { throw new Error('should not be called'); },
    };
    const opCtx: any = { object: 'task', operation: 'find', context: { isSystem: true } };
    await expect(harness.run(opCtx)).resolves.toBeDefined(); // bypass short-circuits before resolution
  });

  it('FLS write — multiple forbidden fields are all listed in the error', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A', salary: 1, ssn: 'x' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['salary', 'ssn'] },
    });
  });

  it('FLS write — insert that touches only editable fields passes', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).resolves.toBeTruthy();
    // owner_id was auto-injected (still in scope for tests)
    expect(opCtx.data.owner_id).toBe('u1');
  });

  it('FLS write — bulk insert array catches forbidden field on any row', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: [
        { name: 'a' },
        { name: 'b', salary: 9 },  // offender on row 2
      ],
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).rejects.toMatchObject({
      details: { forbiddenFields: ['salary'] },
    });
  });

  it('FLS write — system context (isSystem) bypasses the check entirely', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A', salary: 9999, ssn: 'sys' },
      context: { isSystem: true },
    };
    await expect(harness.run(opCtx)).resolves.toBeTruthy();
  });

  it('FLS write — fields without any rule pass through (allow-list semantics)', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn', 'description'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    // `description` has no field rule → must be writable.
    const opCtx: any = {
      object: 'task',
      operation: 'insert',
      data: { name: 'A', description: 'foo' },
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    await expect(harness.run(opCtx)).resolves.toBeTruthy();
  });

  it('FLS write — does not interfere with read (find) — masker still strips read', async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const harness = makeMiddlewareCtx({
      permissionSets: [flsPolicySet],
      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
    });
    await plugin.init(harness.ctx);
    await plugin.start(harness.ctx);
    const opCtx: any = {
      object: 'task',
      operation: 'find',
      ast: { where: undefined },
      result: undefined,
      context: { userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] },
    };
    // emulate the engine populating result inside next()
    const orig = harness.run;
    await orig.call(harness, opCtx);
    // No throw — find is not a write operation.
  });


  // ---------------------------------------------------------------------------
  // ADR-0058 D4 — RLS `check` clause (write post-image validation)
  //
  // `using` gates which EXISTING rows a write may target (pre-image, step 2.7);
  // `check` validates the NEW / CHANGED row (post-image) on insert/update — the
  // PostgreSQL WITH CHECK analog — compiled by the canonical compiler and matched
  // in-memory. Fail closed (D5). Scoped to policies that explicitly declare check.
  // ---------------------------------------------------------------------------
  describe('RLS check enforcement (ADR-0058 D4)', () => {
    const checkPolicySet: PermissionSet = {
      name: 'member_default',
      label: 'Member',
      objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
      rowLevelSecurity: [
        { name: 'emea_insert_check', object: '*', operation: 'insert', check: "region == 'EMEA'" },
        { name: 'emea_update_check', object: '*', operation: 'update', check: "region == 'EMEA'" },
      ],
    } as any;

    const started = async (findOneImpl?: (q: any) => any) => {
      const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
      const harness = makeMiddlewareCtx({
        permissionSets: [checkPolicySet],
        objectFields: ['id', 'region', 'owner_id', 'name'],
        findOneImpl,
      });
      await plugin.init(harness.ctx);
      await plugin.start(harness.ctx);
      return harness;
    };
    const ctx = () => ({ userId: 'u1', tenantId: 'org-1', positions: [], permissions: ['member_default'] });

    it('INSERT whose post-image satisfies the check succeeds', async () => {
      const h = await started();
      const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', region: 'EMEA' }, context: ctx() };
      await expect(h.run(opCtx)).resolves.toBeDefined();
    });

    it('INSERT whose post-image VIOLATES the check is denied (fail closed)', async () => {
      const h = await started();
      const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', region: 'APAC' }, context: ctx() };
      await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('INSERT missing the checked field is denied (fail closed)', async () => {
      const h = await started();
      const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A' }, context: ctx() };
      await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('UPDATE whose post-image (pre-image ∪ change) satisfies the check succeeds', async () => {
      // Pre-image is APAC; the update moves it to EMEA → post-image is valid.
      const h = await started(() => ({ id: 'r1', region: 'APAC', name: 'X' }));
      const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', region: 'EMEA' }, context: ctx() };
      await expect(h.run(opCtx)).resolves.toBeDefined();
    });

    it('UPDATE that changes a valid row to violate the check is denied', async () => {
      // Pre-image is EMEA (valid); the update moves it to APAC → post-image invalid.
      const h = await started(() => ({ id: 'r1', region: 'EMEA', name: 'X' }));
      const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', region: 'APAC' }, context: ctx() };
      await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    });

    it('UPDATE leaving the checked field unchanged uses the pre-image value (valid stays valid)', async () => {
      const h = await started(() => ({ id: 'r1', region: 'EMEA', name: 'X' }));
      const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', name: 'renamed' }, context: ctx() };
      await expect(h.run(opCtx)).resolves.toBeDefined();
    });

    it('DELETE is unaffected by check (no new row to validate)', async () => {
      const h = await started(() => ({ id: 'r1', region: 'APAC' }));
      const opCtx: any = { object: 'task', operation: 'delete', data: { id: 'r1' }, context: ctx() };
      await expect(h.run(opCtx)).resolves.toBeDefined();
    });
  });
});
// ---------------------------------------------------------------------------
describe('PermissionEvaluator', () => {
  const makePermSet = (
    name: string,
    objects: PermissionSet['objects'] = {},
    fields: PermissionSet['fields'] = {}
  ): PermissionSet => ({ name, objects, fields });

  it('should allow read when allowRead is true', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('admin', { contact: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false } });
    expect(evaluator.checkObjectPermission('find', 'contact', [ps])).toBe(true);
    expect(evaluator.checkObjectPermission('findOne', 'contact', [ps])).toBe(true);
    expect(evaluator.checkObjectPermission('count', 'contact', [ps])).toBe(true);
  });

  it('should deny when no permission set matches', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('readonly', { contact: { allowRead: false, allowCreate: false, allowEdit: false, allowDelete: false } });
    expect(evaluator.checkObjectPermission('insert', 'contact', [ps])).toBe(false);
  });

  it('should allow unknown (non-destructive) operations by default', () => {
    const evaluator = new PermissionEvaluator();
    expect(evaluator.checkObjectPermission('unknownOp', 'contact', [])).toBe(true);
  });

  it('denies transfer/restore/purge without the matching RBAC bit (#1883)', () => {
    const evaluator = new PermissionEvaluator();
    // Full CRUD does NOT imply the destructive lifecycle class: `transfer` is
    // gated by its own bit (`allowTransfer`) and must be denied when the bit
    // is absent — never default-allow (ADR-0049). `restore`/`purge` are denied
    // unconditionally since #12497 (bits tombstoned, mapping rows retired).
    const ps = makePermSet('member', {
      contact: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
    });
    expect(evaluator.checkObjectPermission('transfer', 'contact', [ps])).toBe(false);
    expect(evaluator.checkObjectPermission('restore', 'contact', [ps])).toBe(false);
    expect(evaluator.checkObjectPermission('purge', 'contact', [ps])).toBe(false);
    // …and an empty permission-set list denies too (fail-closed baseline).
    expect(evaluator.checkObjectPermission('purge', 'contact', [])).toBe(false);
  });

  it('allows transfer via its specific RBAC bit (#1883/#3004)', () => {
    const evaluator = new PermissionEvaluator();
    const transferOnly = makePermSet('t', { contact: { allowTransfer: true } });
    expect(evaluator.checkObjectPermission('transfer', 'contact', [transferOnly])).toBe(true);
    // The bit never leaks to another destructive op.
    expect(evaluator.checkObjectPermission('purge', 'contact', [transferOnly])).toBe(false);
    expect(evaluator.checkObjectPermission('restore', 'contact', [transferOnly])).toBe(false);
  });

  it('restore/purge are denied FAIL-CLOSED even for a legacy stored grant (#12497)', () => {
    // `allowRestore`/`allowPurge` retired with their mapping rows (#12497,
    // ADR-0049 — the ops never existed; the keys return with M2, #1883). A
    // 17-era STORED permission-set row can still carry the bits (`as any` —
    // the spec type now spells them `never`, and a fresh parse rejects them),
    // and it must grant nothing: denial is unconditional via the
    // DESTRUCTIVE_OPERATIONS backstop, before any bit or bypass is consulted.
    const evaluator = new PermissionEvaluator();
    const legacy = makePermSet('legacy', {
      contact: { allowRestore: true, allowPurge: true },
    } as any);
    expect(evaluator.checkObjectPermission('restore', 'contact', [legacy])).toBe(false);
    expect(evaluator.checkObjectPermission('purge', 'contact', [legacy])).toBe(false);
  });

  it('modifyAllRecords super-user bypass covers transfer; restore/purge stay fail-closed (#1883/#12497)', () => {
    const evaluator = new PermissionEvaluator();
    const admin = makePermSet('admin', { contact: { modifyAllRecords: true } });
    expect(evaluator.checkObjectPermission('transfer', 'contact', [admin])).toBe(true);
    // Unmapped destructive ops are denied before the bypass is consulted —
    // "Modify All Data" re-covers restore/purge only when the M2 batch re-adds
    // their mapping rows (Salesforce semantics, #1883 disposition).
    expect(evaluator.checkObjectPermission('restore', 'contact', [admin])).toBe(false);
    expect(evaluator.checkObjectPermission('purge', 'contact', [admin])).toBe(false);
  });

  it('should allow via viewAllRecords', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('viewer', { task: { allowRead: false, allowCreate: false, allowEdit: false, allowDelete: false, viewAllRecords: true } });
    expect(evaluator.checkObjectPermission('find', 'task', [ps])).toBe(true);
  });

  it('should allow edit/delete via modifyAllRecords', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('manager', { task: { allowRead: false, allowCreate: false, allowEdit: false, allowDelete: false, modifyAllRecords: true } });
    expect(evaluator.checkObjectPermission('update', 'task', [ps])).toBe(true);
    expect(evaluator.checkObjectPermission('delete', 'task', [ps])).toBe(true);
  });

  it('should merge field permissions (most permissive)', () => {
    const evaluator = new PermissionEvaluator();
    const ps1 = makePermSet('ps1', {}, { 'contact.email': { readable: true, editable: false } });
    const ps2 = makePermSet('ps2', {}, { 'contact.email': { readable: false, editable: true } });
    const result = evaluator.getFieldPermissions('contact', [ps1, ps2]);
    expect(result['email']).toEqual({ readable: true, editable: true });
  });

  it('[#25866] a conditioned entry votes by the judge: matched as declared, unmatched ABSENT, unjudged as its lock', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('ps', {}, { 'contact.email': { readable: true, editable: true, when: "x == 1" } as any });
    expect(evaluator.getFieldPermissions('contact', [ps], () => 'matched')).toEqual({ email: { readable: true, editable: true } });
    expect(evaluator.getFieldPermissions('contact', [ps], () => 'unmatched')).toEqual({});
    expect(evaluator.getFieldPermissions('contact', [ps], () => 'unjudged')).toEqual({ email: { readable: true, editable: false } });
    // No judge — every reader that holds no row — is the unjudged reading.
    expect(evaluator.getFieldPermissions('contact', [ps])).toEqual({ email: { readable: true, editable: false } });
  });

  it('[#25866] an unmatched conditioned lock leaves a sibling grant intact; an entry without a `when` votes on every row', () => {
    const evaluator = new PermissionEvaluator();
    const lock = makePermSet('lock', {}, { 'contact.email': { readable: true, editable: false, when: "x == 1" } as any });
    const grant = makePermSet('grant', {}, { 'contact.email': { readable: true, editable: true } });
    const judge = vi.fn(() => 'unmatched' as const);
    expect(evaluator.getFieldPermissions('contact', [lock, grant], judge)).toEqual({ email: { readable: true, editable: true } });
    expect(judge).toHaveBeenCalledTimes(1);
    expect(judge).toHaveBeenCalledWith('x == 1');
    // Matched, the lock is present — and the most-permissive merge still lets the grant win (union without deny).
    expect(evaluator.getFieldPermissions('contact', [lock, grant], () => 'matched')).toEqual({ email: { readable: true, editable: true } });
    expect(evaluator.getFieldPermissions('contact', [lock], () => 'matched')).toEqual({ email: { readable: true, editable: false } });
  });

  it('[#25866] conditionedFieldEntries lists the row-conditioned entries of the object, as authored', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('hr', {}, {
      'contact.email': { readable: true, editable: false, when: "status == 'approved'" } as any,
      'contact.phone': { readable: true, editable: false },
      'task.title': { readable: true, editable: true, when: 'done == false' } as any,
    });
    expect(evaluator.conditionedFieldEntries('contact', [ps])).toEqual([
      { field: 'email', set: 'hr', when: "status == 'approved'", editable: false, supersededBy: [] },
    ]);
    expect(evaluator.conditionedFieldEntries('task', [ps])).toEqual([
      { field: 'title', set: 'hr', when: 'done == false', editable: true, supersededBy: [] },
    ]);
  });

  it('should filter field permissions to the correct object', () => {
    const evaluator = new PermissionEvaluator();
    const ps = makePermSet('ps', {}, {
      'contact.email': { readable: true, editable: false },
      'task.title': { readable: true, editable: true },
    });
    const result = evaluator.getFieldPermissions('contact', [ps]);
    expect(result['email']).toBeDefined();
    expect(result['title']).toBeUndefined();
  });

  it('should resolve permission sets from metadata service by role name', async () => {
    const evaluator = new PermissionEvaluator();
    const ps1 = { name: 'admin' };
    const ps2 = { name: 'viewer' };
    const metadata = { list: vi.fn().mockReturnValue([ps1, ps2]) };
    const result = await evaluator.resolvePermissionSets(['admin'], metadata);
    expect(result).toEqual([ps1]);
  });

  it('should return empty array when metadata has no permission sets', async () => {
    const evaluator = new PermissionEvaluator();
    const metadata = { list: vi.fn().mockReturnValue([]) };
    await expect(
      evaluator.resolvePermissionSets(['admin'], metadata),
    ).resolves.toEqual([]);
  });

  it('resolves permission sets via async metadata.list (real MetadataManager shape)', async () => {
    const evaluator = new PermissionEvaluator();
    const psAdmin = { name: 'admin_full_access' };
    const metadata = {
      list: vi.fn().mockResolvedValue([psAdmin, { name: 'viewer_readonly' }]),
    };
    const result = await evaluator.resolvePermissionSets(
      ['admin_full_access'],
      metadata,
    );
    expect(metadata.list).toHaveBeenCalledWith('permission');
    expect(result).toEqual([psAdmin]);
  });

  it('warns (and keeps resolving) when the dbLoader throws — #2565 observability', async () => {
    const evaluator = new PermissionEvaluator();
    const psAdmin = { name: 'admin_full_access' };
    const metadata = { list: vi.fn().mockReturnValue([psAdmin]) };
    const warns: Array<{ msg: string; meta?: Record<string, any> }> = [];
    const result = await evaluator.resolvePermissionSets(
      ['admin_full_access', 'custom_sales'],
      metadata,
      [],
      async () => { throw new Error('db down'); },
      { logger: { warn: (msg, meta) => warns.push({ msg, meta }) } },
    );
    // behavior unchanged: metadata-resolved set still returned, unresolved grants nothing
    expect(result).toEqual([psAdmin]);
    // ...but the swallow is surfaced, naming the unresolved sets
    expect(warns.length).toBe(1);
    expect(warns[0].msg).toContain('catalog lookup failed');
    expect(warns[0].meta?.unresolved).toEqual(['custom_sales']);
    expect(warns[0].meta?.error).toBe('db down');
  });

  it('warns (and keeps resolving via bootstrap) when metadata list() throws — #2565', async () => {
    const evaluator = new PermissionEvaluator();
    const metadata = { list: vi.fn().mockImplementation(() => { throw new Error('index broken'); }) };
    const bootstrap = [{ name: 'member_default', objects: {} } as any];
    const warns: string[] = [];
    const result = await evaluator.resolvePermissionSets(
      ['member_default'],
      metadata,
      bootstrap,
      undefined,
      { logger: { warn: (msg) => warns.push(msg) } },
    );
    expect(result.map((p) => p.name)).toEqual(['member_default']);
    expect(warns.some((w) => w.includes('metadata list() failed'))).toBe(true);
  });

  it('stays silent when no logger is provided (back-compat)', async () => {
    const evaluator = new PermissionEvaluator();
    const metadata = { list: vi.fn().mockReturnValue([]) };
    await expect(
      evaluator.resolvePermissionSets(['x'], metadata, [], async () => { throw new Error('db down'); }),
    ).resolves.toEqual([]);
  });

  it('matches by both role and explicit permission-set identifiers', async () => {
    const evaluator = new PermissionEvaluator();
    const sets = [
      { name: 'admin_full_access' },
      { name: 'viewer_readonly' },
      { name: 'export_reports' },
    ];
    const metadata = { list: vi.fn().mockReturnValue(sets) };
    const result = await evaluator.resolvePermissionSets(
      ['admin_full_access', 'export_reports'],
      metadata,
    );
    expect(result.map((p) => p.name).sort()).toEqual([
      'admin_full_access',
      'export_reports',
    ]);
  });
});

// ---------------------------------------------------------------------------
// PermissionEvaluator — ADR-0066 D2 (private posture) + D3 (capabilities)
// ---------------------------------------------------------------------------
describe('PermissionEvaluator — ADR-0066 posture + capabilities', () => {
  const ps = (name: string, objects: PermissionSet['objects'] = {}, systemPermissions?: string[]): PermissionSet =>
    ({ name, objects, ...(systemPermissions ? { systemPermissions } : {}) });
  const plainWildcard = ps('member', { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } });
  const superWildcard = ps('admin', { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true, viewAllRecords: true, modifyAllRecords: true } });
  const explicitGrant = ps('license_reader', { sys_license: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false } });

  it('private object is NOT covered by a plain (non-superuser) wildcard', () => {
    const ev = new PermissionEvaluator();
    expect(ev.checkObjectPermission('find', 'sys_license', [plainWildcard], { isPrivate: true })).toBe(false);
    // ...but a public object still is (today's allow-by-default).
    expect(ev.checkObjectPermission('find', 'crm_account', [plainWildcard])).toBe(true);
    expect(ev.checkObjectPermission('find', 'crm_account', [plainWildcard], { isPrivate: false })).toBe(true);
  });

  it('private object IS covered by a super-user wildcard (View/Modify All Data)', () => {
    const ev = new PermissionEvaluator();
    expect(ev.checkObjectPermission('find', 'sys_license', [superWildcard], { isPrivate: true })).toBe(true);
    expect(ev.checkObjectPermission('insert', 'sys_license', [superWildcard], { isPrivate: true })).toBe(true);
    expect(ev.checkObjectPermission('update', 'sys_license', [superWildcard], { isPrivate: true })).toBe(true);
  });

  it('private object IS covered by an explicit per-object grant (no superuser bit needed)', () => {
    const ev = new PermissionEvaluator();
    expect(ev.checkObjectPermission('find', 'sys_license', [explicitGrant], { isPrivate: true })).toBe(true);
    expect(ev.checkObjectPermission('update', 'sys_license', [explicitGrant], { isPrivate: true })).toBe(false);
  });

  it('getSystemPermissions unions capabilities across sets', () => {
    const ev = new PermissionEvaluator();
    const a = ps('a', {}, ['manage_users', 'export_data']);
    const b = ps('b', {}, ['export_data', 'manage_platform_settings']);
    expect([...ev.getSystemPermissions([a, b])].sort()).toEqual(['export_data', 'manage_platform_settings', 'manage_users']);
    expect([...ev.getSystemPermissions([plainWildcard])]).toEqual([]);
  });

  it('hasSuperuserReadBypass honours the private posture', () => {
    const ev = new PermissionEvaluator();
    // plain wildcard: bypasses on a public object, NOT on a private one.
    expect(ev.hasSuperuserReadBypass('crm_account', [plainWildcard], { isPrivate: false })).toBe(false); // no viewAll bit
    expect(ev.hasSuperuserReadBypass('sys_license', [superWildcard], { isPrivate: true })).toBe(true);
    expect(ev.hasSuperuserReadBypass('sys_license', [plainWildcard], { isPrivate: true })).toBe(false);
    // explicit grant without viewAll → no read bypass.
    expect(ev.hasSuperuserReadBypass('sys_license', [explicitGrant], { isPrivate: true })).toBe(false);
  });

  it('hasSuperuserWriteBypass requires modifyAllRecords', () => {
    const ev = new PermissionEvaluator();
    const viewOnly = ps('vo', { '*': { allowRead: true, viewAllRecords: true } });
    expect(ev.hasSuperuserWriteBypass('sys_license', [superWildcard], { isPrivate: true })).toBe(true);
    expect(ev.hasSuperuserWriteBypass('sys_license', [viewOnly], { isPrivate: true })).toBe(false);
  });
});

// ---------------------------------------------------------------------------
// ADR-0066 ⑤ — crudBucketForOperation (operation → CRUD class mapping)
// ---------------------------------------------------------------------------
describe('crudBucketForOperation (ADR-0066 ⑤)', () => {
  it('maps read operations to `read`', () => {
    for (const op of ['find', 'findOne', 'count', 'aggregate']) {
      expect(crudBucketForOperation(op)).toBe('read');
    }
  });
  it('maps insert to `create`', () => {
    expect(crudBucketForOperation('insert')).toBe('create');
  });
  it('folds update/transfer into `update`', () => {
    for (const op of ['update', 'transfer']) {
      expect(crudBucketForOperation(op)).toBe('update');
    }
  });
  it('folds delete into `delete`', () => {
    expect(crudBucketForOperation('delete')).toBe('delete');
  });
  it('restore/purge resolve null since #12497 — out of the map with their retired bits', () => {
    // Their dispatch is denied at the object gate before any per-operation map
    // is consulted; the M2 batch re-adds the rows (restore→update,
    // purge→delete) together with the bits.
    expect(crudBucketForOperation('restore')).toBeNull();
    expect(crudBucketForOperation('purge')).toBeNull();
  });
  it('returns null for an operation with no CRUD mapping', () => {
    expect(crudBucketForOperation('customReadSideOp')).toBeNull();
  });
});

// ---------------------------------------------------------------------------
// FieldMasker
// ---------------------------------------------------------------------------
describe('FieldMasker', () => {
  it('should return results unchanged when no field permissions', () => {
    const masker = new FieldMasker();
    const records = [{ id: '1', name: 'Alice', email: 'alice@example.com' }];
    expect(masker.maskResults(records, {}, 'contact')).toEqual(records);
  });

  it('should remove non-readable fields from records', () => {
    const masker = new FieldMasker();
    const records = [{ id: '1', name: 'Alice', email: 'alice@example.com' }];
    const perms = { email: { readable: false, editable: false } };
    const result = masker.maskResults(records, perms, 'contact') as any[];
    expect(result[0].email).toBeUndefined();
    expect(result[0].name).toBe('Alice');
  });

  it('should handle single record (non-array)', () => {
    const masker = new FieldMasker();
    const record = { id: '1', ssn: '123-45-6789', name: 'Bob' };
    const perms = { ssn: { readable: false, editable: false } };
    const result = masker.maskResults(record, perms, 'person') as any;
    expect(result.ssn).toBeUndefined();
    expect(result.name).toBe('Bob');
  });

  it('should preserve readable fields', () => {
    const masker = new FieldMasker();
    const record = { id: '1', name: 'Carol', secret: 'x' };
    const perms = {
      name: { readable: true, editable: true },
      secret: { readable: false, editable: false },
    };
    const result = masker.maskResults(record, perms, 'user') as any;
    expect(result.name).toBe('Carol');
    expect(result.secret).toBeUndefined();
  });

  it('should return non-editable fields', () => {
    const masker = new FieldMasker();
    const perms = {
      email: { readable: true, editable: false },
      name: { readable: true, editable: true },
    };
    const nonEditable = masker.getNonEditableFields(perms);
    expect(nonEditable).toContain('email');
    expect(nonEditable).not.toContain('name');
  });

  it('should strip non-editable fields from write data', () => {
    const masker = new FieldMasker();
    const data = { name: 'Dave', email: 'dave@example.com', createdAt: '2024' };
    const perms = {
      email: { readable: true, editable: false },
      createdAt: { readable: true, editable: false },
      name: { readable: true, editable: true },
    };
    const result = masker.stripNonEditableFields(data, perms);
    expect(result.name).toBe('Dave');
    expect(result.email).toBeUndefined();
    expect(result.createdAt).toBeUndefined();
  });

  describe('detectForbiddenWrites', () => {
    it('returns [] when no field permissions defined', () => {
      const masker = new FieldMasker();
      expect(
        masker.detectForbiddenWrites({ salary: 9999 }, {}),
      ).toEqual([]);
    });

    it('returns [] when all fields are editable', () => {
      const masker = new FieldMasker();
      const perms = {
        salary: { readable: true, editable: true },
      };
      expect(
        masker.detectForbiddenWrites({ salary: 9999 }, perms),
      ).toEqual([]);
    });

    it('returns [] when payload only contains fields without permission rules', () => {
      const masker = new FieldMasker();
      const perms = {
        salary: { readable: true, editable: false },
      };
      // 'name' has no field rule → passes through.
      expect(
        masker.detectForbiddenWrites({ name: 'Dave' }, perms),
      ).toEqual([]);
    });

    it('returns the non-editable fields present in payload (single record)', () => {
      const masker = new FieldMasker();
      const perms = {
        salary: { readable: true, editable: false },
        ssn: { readable: false, editable: false },
      };
      expect(
        masker.detectForbiddenWrites(
          { name: 'Dave', salary: 9999, ssn: '...' },
          perms,
        ),
      ).toEqual(['salary', 'ssn']);
    });

    it('handles array (bulk insert) — returns union of offenders, deduped, sorted', () => {
      const masker = new FieldMasker();
      const perms = {
        salary: { readable: true, editable: false },
        ssn: { readable: false, editable: false },
      };
      const rows = [
        { name: 'a', salary: 1 },
        { name: 'b', ssn: 'x' },
        { name: 'c', salary: 2, ssn: 'y' },
      ];
      expect(masker.detectForbiddenWrites(rows, perms)).toEqual([
        'salary',
        'ssn',
      ]);
    });

    it('ignores null/non-object rows in a bulk array', () => {
      const masker = new FieldMasker();
      const perms = { salary: { readable: true, editable: false } };
      // null inside array should be skipped, not crash
      const rows = [null as any, { salary: 1 }, 'string' as any];
      expect(masker.detectForbiddenWrites(rows, perms)).toEqual(['salary']);
    });

    it('readable-but-not-editable counts as forbidden write (a user who can see a field still cannot change it)', () => {
      const masker = new FieldMasker();
      const perms = {
        approved_by: { readable: true, editable: false },
      };
      expect(
        masker.detectForbiddenWrites({ approved_by: 'u2' }, perms),
      ).toEqual(['approved_by']);
    });
  });
});

// ---------------------------------------------------------------------------
// RLSCompiler
// ---------------------------------------------------------------------------
describe('RLSCompiler', () => {
  it('should return null for empty policies', () => {
    const compiler = new RLSCompiler();
    expect(compiler.compileFilter([])).toBeNull();
  });

  it('should compile equality expression with current_user property', () => {
    const compiler = new RLSCompiler();
    const policy: any = { object: 'task', operation: 'select', using: 'owner_id = current_user.id' };
    const ctx: any = { userId: 'user-42', tenantId: 'tenant-1', positions: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ owner_id: 'user-42' });
  });

  it('resolves current_user.email to the literal (unique owner anchor)', () => {
    // Email is the seedable, unique owner anchor — a data column like
    // `owner` can be authored against it and compiles to a concrete literal,
    // which is what lets controlled_by_parent resolve master ids under a
    // system find (the value is baked in, not a placeholder).
    const compiler = new RLSCompiler();
    const policy: any = { object: 'showcase_invoice', operation: 'select', using: 'owner = current_user.email' };
    const ctx: any = { userId: 'u1', email: 'ada@example.com', positions: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ owner: 'ada@example.com' });
  });

  it('does NOT resolve current_user.name (collision-prone) → fail-closed', () => {
    // Display names are intentionally NOT exposed to RLS: they collide, and a
    // collision on an ownership predicate is an access leak. An unresolved
    // variable drops the (only) policy → deny sentinel.
    const compiler = new RLSCompiler();
    const policy: any = { object: 'showcase_invoice', operation: 'select', using: 'owner = current_user.name' };
    const ctx: any = { userId: 'u1', email: 'ada@example.com', positions: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual(RLS_DENY_FILTER);
  });

  it('should compile literal equality expression', () => {
    const compiler = new RLSCompiler();
    const policy: any = { object: 'doc', operation: 'select', using: "status = 'published'" };
    const filter = compiler.compileFilter([policy]);
    expect(filter).toEqual({ status: 'published' });
  });

  it('should compile IN expression with array property', () => {
    const compiler = new RLSCompiler();
    const policy: any = { object: 'project', operation: 'select', using: 'id IN (current_user.positions)' };
    const ctx: any = { userId: 'u1', tenantId: 't1', positions: ['pos-a', 'pos-b'] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ id: { $in: ['pos-a', 'pos-b'] } });
  });

  it('should compile IN expression against pre-resolved org_user_ids', () => {
    // Covers the sys_user_org_members policy that lets members see
    // fellow collaborators in the active organization. The runtime
    // resolver populates ctx.org_user_ids from sys_member; the
    // compiler reads it as an arbitrary current_user.* property.
    const compiler = new RLSCompiler();
    const policy: any = {
      object: 'sys_user',
      operation: 'select',
      using: 'id IN (current_user.org_user_ids)',
    };
    const ctx: any = {
      userId: 'u1',
      tenantId: 'org-1',
      positions: [],
      org_user_ids: ['u1', 'u2', 'u3'],
    };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ id: { $in: ['u1', 'u2', 'u3'] } });
  });

  it('should fail-closed for IN when org_user_ids is empty', () => {
    // No active org → no fellow members. The IN policy drops out;
    // since it was the only policy supplied, the compiler returns
    // the deny sentinel (zero rows). Real callers usually pair this
    // with a sys_user_self policy so the user still sees their own row.
    const compiler = new RLSCompiler();
    const policy: any = {
      object: 'sys_user',
      operation: 'select',
      using: 'id IN (current_user.org_user_ids)',
    };
    const ctx: any = { userId: 'u1', tenantId: null, positions: [], org_user_ids: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual(RLS_DENY_FILTER);
  });

  it('should OR-combine multiple policies', () => {
    const compiler = new RLSCompiler();
    const p1: any = { object: 'task', operation: 'select', using: 'owner_id = current_user.id' };
    const p2: any = { object: 'task', operation: 'select', using: "status = 'public'" };
    const ctx: any = { userId: 'u99', tenantId: 't1', positions: [] };
    const filter = compiler.compileFilter([p1, p2], ctx);
    expect(filter).toEqual({ $or: [{ owner_id: 'u99' }, { status: 'public' }] });
  });

  it('should fail-closed (deny filter) when expression is unsupported', () => {
    // Previously returned null, which is fail-OPEN (no RLS applied →
    // every row visible). Now returns the deny sentinel so a misconfigured
    // policy doesn't silently disable tenant isolation.
    const compiler = new RLSCompiler();
    const policy: any = { object: 'x', operation: 'select', using: 'complex expression WITH unsupported syntax' };
    const filter = compiler.compileFilter([policy]);
    expect(filter).toEqual(RLS_DENY_FILTER);
  });

  it('should fail-closed when the only policy depends on a missing user-context value', () => {
    // Repro: a logged-in user without an active organization. The
    // tenant_isolation rule would compile to `organization_id = null`,
    // which previously either (a) returned every row from tables that
    // lack `organization_id` (e.g. sys_user) or (b) returned every row
    // because compileFilter dropped it as null. We now fail-closed so
    // the user sees zero rows on tenant-aware tables until they pick an
    // active organization. Per-object rules that *do* compile (e.g.
    // `sys_user_self`) still grant access — see the next test.
    const compiler = new RLSCompiler();
    const policy: any = { object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' };
    const ctx: any = { userId: 'u1', tenantId: null, positions: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual(RLS_DENY_FILTER);
  });

  it('should still apply policy when only one of multiple has a usable value', () => {
    // tenant policy can't compile (null tenantId) but sys_user_self can.
    // Result: just the self-row filter — the broken tenant policy drops out.
    const compiler = new RLSCompiler();
    const tenantPolicy: any = { object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' };
    const selfPolicy: any = { object: 'sys_user', operation: 'select', using: 'id = current_user.id' };
    const ctx: any = { userId: 'u1', tenantId: null, positions: [] };
    const filter = compiler.compileFilter([tenantPolicy, selfPolicy], ctx);
    expect(filter).toEqual({ id: 'u1' });
  });

  it('should compile tenant policy normally when an active organization is set', () => {
    // Sanity check — the deny path is only triggered by *missing* values.
    const compiler = new RLSCompiler();
    const policy: any = { object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' };
    const ctx: any = { userId: 'u1', tenantId: 'org-1', positions: [] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ organization_id: 'org-1' });
  });

  it('should get applicable policies for object and operation', () => {
    const compiler = new RLSCompiler();
    const policies: any[] = [
      { object: 'task', operation: 'select', using: 'owner_id = current_user.id' },
      { object: 'task', operation: 'insert', using: "status = 'open'" },
      { object: 'contact', operation: 'all', using: 'organization_id = current_user.organization_id' },
      { object: '*', operation: 'all', using: "active = 'true'" },
    ];

    const taskSelect = compiler.getApplicablePolicies('task', 'find', policies);
    expect(taskSelect).toHaveLength(2); // task select + * all
    const taskInsert = compiler.getApplicablePolicies('task', 'insert', policies);
    expect(taskInsert).toHaveLength(2); // task insert + * all
    const contactFind = compiler.getApplicablePolicies('contact', 'find', policies);
    expect(contactFind).toHaveLength(2); // contact all + * all
  });

  // `enabled` — "Disabled policies are not evaluated" (the schema's promise).
  // Found unread by the 2026-07 security-subset liveness re-verification:
  // applicable policies OR-combine (any match ALLOWS access), so a disabled
  // policy kept granting the rows an admin believed they had switched off.
  // These pin the gate in both directions.
  it('excludes a policy explicitly disabled with enabled:false', () => {
    const compiler = new RLSCompiler();
    const policies: any[] = [
      { object: 'task', operation: 'select', using: 'owner_id = current_user.id' },
      { object: 'task', operation: 'select', using: "visibility = 'public'", enabled: false },
    ];
    const applicable = compiler.getApplicablePolicies('task', 'find', policies);
    expect(applicable).toHaveLength(1);
    expect(applicable[0]!.using).toBe('owner_id = current_user.id');
  });

  it('treats enabled:true and an ABSENT enabled key as active (schema default)', () => {
    // Rows round-tripped through sys_permission_set may omit the key entirely —
    // absent must mean active, or every legacy row would silently stop enforcing.
    const compiler = new RLSCompiler();
    const policies: any[] = [
      { object: 'task', operation: 'select', using: 'owner_id = current_user.id', enabled: true },
      { object: 'task', operation: 'select', using: "status = 'open'" },
    ];
    expect(compiler.getApplicablePolicies('task', 'find', policies)).toHaveLength(2);
  });

  it('a disabled policy no longer contributes its OR-branch to the compiled filter', () => {
    // The over-share this closes: owner-only policy + a disabled public-read
    // policy must compile to owner-only, not owner-OR-public.
    const compiler = new RLSCompiler();
    const policies: any[] = [
      { object: 'task', operation: 'select', using: 'owner_id = current_user.id' },
      { object: 'task', operation: 'select', using: "visibility = 'public'", enabled: false },
    ];
    const ctx: any = { userId: 'user-42', positions: [] };
    const applicable = compiler.getApplicablePolicies('task', 'find', policies);
    const filter = compiler.compileFilter(applicable, ctx);
    expect(filter).toEqual({ owner_id: 'user-42' });
  });

  it('disabling the ONLY policy leaves no applicable policies (caller decides posture, not a silent grant)', () => {
    const compiler = new RLSCompiler();
    const policies: any[] = [
      { object: 'task', operation: 'select', using: "visibility = 'public'", enabled: false },
    ];
    expect(compiler.getApplicablePolicies('task', 'find', policies)).toHaveLength(0);
  });

  // §7.3.1 dynamic membership — arbitrary pre-resolved sets in rlsMembership
  it('should resolve IN against a §7.3.1 pre-resolved rlsMembership set', () => {
    // Manager hierarchy: the runtime resolved the manager's reports into
    // ctx.rlsMembership.team_member_ids. The compiler merges that bag into
    // the user context so `IN (current_user.team_member_ids)` resolves
    // without any subquery support.
    const compiler = new RLSCompiler();
    const policy: any = {
      object: 'task',
      operation: 'select',
      using: 'assigned_to_id IN (current_user.team_member_ids)',
    };
    const ctx: any = {
      userId: 'mgr-1',
      tenantId: 'org-1',
      roles: ['manager'],
      rlsMembership: { team_member_ids: ['u2', 'u3', 'u4'] },
    };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ assigned_to_id: { $in: ['u2', 'u3', 'u4'] } });
  });

  it('should fail-closed when a §7.3.1 membership set is empty', () => {
    // A manager with no reports → empty team_member_ids → the IN policy
    // drops out → sole policy → deny sentinel (zero rows). Never fail-open.
    const compiler = new RLSCompiler();
    const policy: any = {
      object: 'task',
      operation: 'select',
      using: 'assigned_to_id IN (current_user.team_member_ids)',
    };
    const ctx: any = { userId: 'mgr-1', tenantId: 'org-1', positions: [], rlsMembership: { team_member_ids: [] } };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual(RLS_DENY_FILTER);
  });

  it('should not let a rlsMembership key clobber a named context field', () => {
    // positions is a first-class field; a hostile/misconfigured membership bag
    // must not override it. The named `positions` (['real-position']) wins;
    // the policy compiles against it, not the injected ['spoofed'].
    const compiler = new RLSCompiler();
    const policy: any = { object: 'x', operation: 'select', using: 'position_id IN (current_user.positions)' };
    const ctx: any = {
      userId: 'u1',
      tenantId: 'org-1',
      positions: ['real-position'],
      rlsMembership: { positions: ['spoofed'] },
    };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({ position_id: { $in: ['real-position'] } });
  });

  // Always-true literal — makes RLS.allowAllPolicy grant access instead of
  // silently failing closed.
  it('should compile "1 = 1" to an unrestricted (empty) filter', () => {
    const compiler = new RLSCompiler();
    const policy: any = { object: 'account', operation: 'all', using: '1 = 1', roles: ['ceo'] };
    const ctx: any = { userId: 'u1', tenantId: 'org-1', roles: ['ceo'] };
    const filter = compiler.compileFilter([policy], ctx);
    expect(filter).toEqual({}); // matches every row
  });

  it('should grant allow-all via RLS.allowAllPolicy instead of denying', () => {
    // Regression guard: '1 = 1' used to be unsupported → deny sentinel,
    // making the helper do the opposite of its name. Now it grants.
    const compiler = new RLSCompiler();
    const policy = RLS.allowAllPolicy('account', ['ceo', 'cfo']) as any;
    const filter = compiler.compileFilter([policy]);
    expect(filter).toEqual({});
    expect(filter).not.toEqual(RLS_DENY_FILTER);
  });
});

// ---------------------------------------------------------------------------
// ADR-0056 D4 — RLS predicates that won't compile must not vanish in silence
// ---------------------------------------------------------------------------
describe('RLSCompiler D4 — uncompilable predicates are surfaced', () => {
  /**
   * The consumer-side statement the hoist (#4983) has to keep true: whatever
   * `isSupportedRlsExpression` says about a predicate is what THIS compiler
   * does with it. The shape assertions themselves moved to
   * `@objectstack/formula`'s `rls-predicate.test.ts`; re-asserting them here
   * would be a copy of the tests to go with the copy of the code we refused to
   * make. This one runs the corpus through the real compiler instead, which is
   * the claim `@objectstack/lint`'s new authoring gate relies on: `false` here
   * means the runtime drops the policy and warns.
   */
  it('the compiler DROPS exactly the predicates isSupportedRlsExpression rejects', () => {
    const corpus = [
      // supported — compile to a FilterCondition against a populated context
      'owner_id = current_user.id',
      'owner_id == current_user.id',
      "status = 'published'",
      'id IN (current_user.org_user_ids)',
      // unsupported — no input can lower these
      'amount + 1 > 2',
      'id IN (SELECT id FROM users)',
      'record.a.b == 1',
      'a = current_user.id AND b = 1',
    ];
    const userCtx = { id: 'u1', status: 'published', org_user_ids: ['u1'] } as Record<string, unknown>;
    for (const source of corpus) {
      const compiler = new RLSCompiler();
      const compiled = compiler.compileExpression(source, userCtx) !== null;
      expect({ source, compiled }).toEqual({ source, compiled: isSupportedRlsExpression(source) });
    }
  });

  it('WARNS (does not silently drop) an unsupported-shape policy', () => {
    const warned: string[] = [];
    const compiler = new RLSCompiler();
    compiler.setLogger({ warn: (message: string) => warned.push(message) });
    // ADR-0058: a genuinely non-pushdownable shape (arithmetic) — no input can
    // lower it, so it must WARN (vs a valid shape whose var is merely absent).
    const policy: any = { name: 'bad', object: 'thing', operation: 'select', using: 'amount + 1 > 2' };
    const filter = compiler.compileFilter([policy], { userId: 'u1' } as any);
    expect(filter).toEqual(RLS_DENY_FILTER); // only policy dropped → fail-closed
    expect(warned.length).toBe(1);
    expect(warned[0]).toContain('uncompilable predicate');
  });

  it('a SUPPORTED shape whose context var is absent gets the DENY line, not the uncompilable one', () => {
    const warned: string[] = [];
    const compiler = new RLSCompiler();
    compiler.setLogger({ warn: (message: string) => warned.push(message) });
    // Valid shape; `department` simply isn't in the context. This is the
    // fail-closed path, NOT an authoring fault — so it must not be reported as
    // "uncompilable". [#13639] It used to be reported as nothing at all: the
    // caller got zero rows, no error, and an empty log, which is the exact
    // failure shape that card measured. It now says which variable did not
    // resolve. (CEL form; SQL `=` would additionally emit a deprecation warn.)
    const policy: any = { name: 'dept', object: 'thing', operation: 'select', using: 'dept == current_user.department' };
    expect(compiler.compileFilter([policy], { userId: 'u1' } as any)).toEqual(RLS_DENY_FILTER);
    expect(warned.length).toBe(1);
    expect(warned[0]).toContain('DENY (fail closed)');
    expect(warned[0]).toContain('current_user.department');
    expect(warned[0]).not.toContain('uncompilable predicate');
  });
});


// ---------------------------------------------------------------------------
// ADR-0058 D1 — SQL→CEL deprecation bridge: legacy SQL-style RLS predicates
// still COMPILE (back-compat for stored predicates) but emit a deprecation warn;
// canonical CEL passes through silently (idempotent bridge).
// ---------------------------------------------------------------------------
describe('RLSCompiler — SQL→CEL deprecation bridge (ADR-0058 D1)', () => {
  it('a legacy SQL-style predicate still compiles AND warns deprecation', () => {
    const warned: string[] = [];
    const compiler = new RLSCompiler();
    compiler.setLogger({ warn: (m: string) => warned.push(m) });
    const policy: any = { object: 'task', operation: 'select', using: 'owner_id = current_user.id' };
    const filter = compiler.compileFilter([policy], { userId: 'u1' } as any);
    expect(filter).toEqual({ owner_id: 'u1' }); // bridge keeps it working
    expect(warned.some((m) => m.includes('DEPRECATED SQL-style'))).toBe(true);
  });

  it('a legacy SQL `IN (...)` predicate still compiles AND warns', () => {
    const warned: string[] = [];
    const compiler = new RLSCompiler();
    compiler.setLogger({ warn: (m: string) => warned.push(m) });
    const policy: any = { object: 'p', operation: 'select', using: 'id IN (current_user.org_user_ids)' };
    const filter = compiler.compileFilter([policy], { userId: 'u1', org_user_ids: ['u1', 'u2'] } as any);
    expect(filter).toEqual({ id: { $in: ['u1', 'u2'] } });
    expect(warned.some((m) => m.includes('DEPRECATED SQL-style'))).toBe(true);
  });

  it('canonical CEL passes through with NO deprecation warn (idempotent bridge)', () => {
    const warned: string[] = [];
    const compiler = new RLSCompiler();
    compiler.setLogger({ warn: (m: string) => warned.push(m) });
    const policy: any = { object: 'task', operation: 'select', using: 'owner_id == current_user.id' };
    const filter = compiler.compileFilter([policy], { userId: 'u1' } as any);
    expect(filter).toEqual({ owner_id: 'u1' }); // identical result to the SQL form
    expect(warned.length).toBe(0);
  });
});

describe('SecurityPlugin – metadata-change cache invalidation', () => {
  // [#26596, #26698] Driven through the protocol's `onMetadataMutation`, the
  // signal every metadata authoring door emits. The rest of the subscription
  // contract (drafts, `metadata:reloaded`, absence, `destroy()`) is pinned in
  // `metadata-change-invalidation.test.ts`.
  it('clears metadata-derived caches when a metadata mutation lands at runtime', async () => {
    const plugin = new SecurityPlugin();
    const listeners: Array<(evt: { type: string; name: string; state: string }) => void> = [];
    const protocol = {
      onMetadataMutation: (listener: (typeof listeners)[number]) => {
        listeners.push(listener);
        return () => {};
      },
    };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      hook: vi.fn(),
      getService: vi.fn().mockImplementation((name: string) => {
        if (name === 'manifest') return { register: vi.fn() };
        if (name === 'metadata') return {};
        if (name === 'protocol') return protocol;
        if (name === 'objectql') return { registerMiddleware: vi.fn() };
        return undefined;
      }),
    };
    await plugin.init(ctx);
    await plugin.start(ctx);

    expect(listeners.length).toBeGreaterThan(0);

    (plugin as any).fieldNamesCache.set('crm_account', new Set(['name']));
    (plugin as any).tenancyDisabledCache.set('crm_account', true);
    (plugin as any).cbpRelCache.set('crm_account', null);
    (plugin as any).objectSecurityMetaCache.set('crm_account', { owdOpensRowWrites: false });

    for (const listener of listeners) listener({ type: 'object', name: 'crm_account', state: 'active' });

    expect((plugin as any).fieldNamesCache.size).toBe(0);
    expect((plugin as any).tenancyDisabledCache.size).toBe(0);
    expect((plugin as any).cbpRelCache.size).toBe(0);
    expect((plugin as any).objectSecurityMetaCache.size).toBe(0);
  });
});


// ---------------------------------------------------------------------------
// ADR-0066 D3 — field-level requiredPermissions (read-mask + write-deny)
// ---------------------------------------------------------------------------
describe('SecurityPlugin — ADR-0066 D3 field-level requiredPermissions', () => {
  const fieldsSchema = {
    fields: {
      id: { name: 'id' },
      name: { name: 'name' },
      salary: { name: 'salary', requiredPermissions: ['view_salary'] },
    },
  };
  const setNoCap: PermissionSet = {
    name: 'fld_member',
    objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
  } as any;
  const setWithCap: PermissionSet = {
    name: 'fld_cap',
    objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    systemPermissions: ['view_salary'],
  } as any;

  const harnessFor = (sets: PermissionSet[], fallback: string) => {
    let middleware: any;
    const schema = { name: 'task', ...fieldsSchema };
    const ql: any = {
      registerMiddleware: (mw: any) => { if (!middleware) middleware = mw; },
      getSchema: () => schema,
      findOne: async (object: string, query?: EngineFindOneQueryInput) => { assertEngineFindOnePredicate(object, query); return null; },
      find: async () => [],
    };
    const metadata = { get: async () => schema, list: async () => sets };
    const services: Record<string, any> = { manifest: { register: vi.fn() }, objectql: ql, metadata };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: (n: string) => { if (!(n in services)) throw new Error(`service not registered: ${n}`); return services[n]; },
    };
    const plugin = new SecurityPlugin({ fallbackPermissionSet: fallback });
    return { plugin, ctx, run: async (opCtx: any) => { await middleware(opCtx, () => runEngineWriteBody(opCtx)); return opCtx; } };
  };

  it('masks a capability-gated field on read when the caller lacks the capability', async () => {
    const h = harnessFor([setNoCap], 'fld_member');
    await h.plugin.init(h.ctx); await h.plugin.start(h.ctx);
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, result: [{ id: 'r1', name: 'A', salary: 100 }], context: { userId: 'u1', positions: [], permissions: [] } };
    await h.run(opCtx);
    expect(opCtx.result[0].name).toBe('A');
    expect(opCtx.result[0].salary).toBeUndefined();
  });

  it('does NOT mask when the caller holds the capability', async () => {
    const h = harnessFor([setWithCap], 'fld_cap');
    await h.plugin.init(h.ctx); await h.plugin.start(h.ctx);
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, result: [{ id: 'r1', name: 'A', salary: 100 }], context: { userId: 'u1', positions: [], permissions: ['fld_cap'] } };
    await h.run(opCtx);
    expect(opCtx.result[0].salary).toBe(100);
  });

  it('denies a write to a capability-gated field when the caller lacks the capability', async () => {
    const h = harnessFor([setNoCap], 'fld_member');
    await h.plugin.init(h.ctx); await h.plugin.start(h.ctx);
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', salary: 200 }, context: { userId: 'u1', positions: [], permissions: [] } };
    await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  it('allows the write when the caller holds the capability', async () => {
    const h = harnessFor([setWithCap], 'fld_cap');
    await h.plugin.init(h.ctx); await h.plugin.start(h.ctx);
    const opCtx: any = { object: 'task', operation: 'insert', data: { name: 'A', salary: 200 }, context: { userId: 'u1', positions: [], permissions: ['fld_cap'] } };
    await expect(h.run(opCtx)).resolves.toBeDefined();
  });
});

// ---------------------------------------------------------------------------
// ADR-0090 D6 × D12 — explainAccessForCaller authorization: manage_users OR a
// delegated adminScope whose BU subtree covers the target user.
// ---------------------------------------------------------------------------
describe('explainAccessForCaller (ADR-0090 D6/D12)', () => {
  const EAST_SCOPE = {
    businessUnit: 'east',
    includeSubtree: true,
    manageAssignments: true,
    assignablePermissionSets: ['sales_user'],
  };

  const memberDefault: PermissionSet = {
    name: 'member_default', label: 'Member',
    objects: { task: { allowRead: true } },
  } as any;
  const subAdmin: PermissionSet = {
    name: 'sub_admin', label: 'East delegate',
    objects: {}, adminScope: EAST_SCOPE,
  } as any;
  const hrAdmin: PermissionSet = {
    name: 'hr_admin', label: 'HR admin',
    objects: {}, systemPermissions: ['manage_users'],
  } as any;

  /** Middleware harness + in-memory tables for BU subtree / membership reads. */
  const makeExplainHarness = () => {
    const tables: Record<string, any[]> = {
      sys_business_unit: [
        { id: 'bu_hq', name: 'hq', parent_business_unit_id: null },
        { id: 'bu_east', name: 'east', parent_business_unit_id: 'bu_hq' },
        { id: 'bu_west', name: 'west', parent_business_unit_id: 'bu_hq' },
      ],
      sys_business_unit_member: [
        { id: 'm1', business_unit_id: 'bu_east', user_id: 'u_east_1' },
        { id: 'm2', business_unit_id: 'bu_west', user_id: 'u_west_1' },
      ],
      sys_user: [{ id: 'u_delegate' }, { id: 'u_east_1' }, { id: 'u_west_1' }, { id: 'u_hr' }],
      sys_user_position: [],
      sys_user_permission_set: [],
      sys_permission_set: [],
      sys_position: [],
    };
    const matches = (row: any, where: any): boolean =>
      Object.entries(where ?? {}).every(([k, v]) => {
        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
        if (v && typeof v === 'object' && Array.isArray((v as any).$in)) return (v as any).$in.includes(row[k]);
        // An absent column reads as NULL, as it does in SQL (`organization_id: null`).
        if (v === null) return (row[k] ?? null) === null;
        return row[k] === v;
      });
    const baseSchema: any = { name: 'task', fields: { id: { name: 'id' }, owner_id: { name: 'owner_id' }, name: { name: 'name' } } };
    // [ADR-0131 D3/D4] The engine registry the security catalog reads the sets from.
    const catalogSets = () => [memberDefault, subAdmin, hrAdmin];
    const ql = {
      registerMiddleware: vi.fn(),
      getSchema: () => baseSchema,
      registry: {
        getItem: (type: string, name: string) => (type === 'permission' ? catalogSets().find((d: any) => d.name === name) : undefined),
        listItems: (type: string) => (type === 'permission' ? catalogSets() : []),
        isPackageDisabled: () => false,
      },
      async find(object: string, opts: any) {
        const rows = (tables[object] ?? []).filter((r) => matches(r, opts?.where));
        return typeof opts?.limit === 'number' ? rows.slice(0, opts.limit) : rows;
      },
      async findOne(object: string, opts: any) {
        assertEngineFindOnePredicate(object, opts);
        const rows = (tables[object] ?? []).filter((r) => matches(r, opts?.where));
        return rows[0] ?? null;
      },
    };
    const services: Record<string, any> = {
      manifest: { register: vi.fn() },
      objectql: ql,
      metadata: {
        get: async (type: string, name: string) =>
          type === 'permission' ? [memberDefault, subAdmin, hrAdmin].find((s: any) => s.name === name) ?? null : baseSchema,
        list: async () => [memberDefault, subAdmin, hrAdmin],
      },
    };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
    };
    return { ctx, tables };
  };

  const boot = async () => {
    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
    const h = makeExplainHarness();
    await plugin.init(h.ctx);
    await plugin.start(h.ctx);
    return { plugin, h };
  };

  it('a delegated admin may explain a user INSIDE their scope subtree without manage_users', async () => {
    const { plugin } = await boot();
    const caller = { userId: 'u_delegate', positions: [], permissions: ['sub_admin'] };
    const d = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_east_1' }, caller);
    expect(d.principal.userId).toBe('u_east_1');
    expect(d.object).toBe('task');
  });

  it('the same delegate is DENIED for a user OUTSIDE the subtree (fail closed)', async () => {
    const { plugin } = await boot();
    const caller = { userId: 'u_delegate', positions: [], permissions: ['sub_admin'] };
    await expect(
      plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, caller),
    ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  it('manage_users still explains anyone (tenant-level path unchanged)', async () => {
    const { plugin } = await boot();
    const caller = { userId: 'u_hr', positions: [], permissions: ['hr_admin'] };
    const d = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, caller);
    expect(d.principal.userId).toBe('u_west_1');
  });

  it('no manage_users and no covering scope → denied; self-explain needs neither', async () => {
    const { plugin } = await boot();
    const plain = { userId: 'u_east_1', positions: [], permissions: [] };
    await expect(
      plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, plain),
    ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
    const self = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_east_1' }, plain);
    expect(self.principal.userId).toBe('u_east_1');
  });

  // [#26641] Explaining ANOTHER user by an id no `sys_user` row has is refused
  // `404 RECORD_NOT_FOUND`, naming the id: the resolver synthesises a baseline
  // principal for any id, so it used to answer a verdict about nobody. The
  // existence read runs only after the caller is admitted to explain others.
  describe('[#26641] an id no sys_user row has', () => {
    const GHOST = 'u_no_such_user_26641';
    /** The ids `sys_user` was asked about, in order. */
    const userReads = (plugin: any): string[] => {
      const seen: string[] = [];
      const ql = (plugin as any).ql;
      const findOne = ql.findOne.bind(ql);
      ql.findOne = async (object: string, opts: any) => {
        if (object === 'sys_user') seen.push(String(opts?.where?.id));
        return findOne(object, opts);
      };
      return seen;
    };

    it('a caller holding manage_users is refused 404 RECORD_NOT_FOUND naming the id', async () => {
      const { plugin } = await boot();
      const caller = { userId: 'u_hr', positions: [], permissions: ['hr_admin'] };
      for (const operation of ['read', 'create']) {
        const err: any = await plugin
          .explainAccessForCaller({ object: 'task', operation, userId: GHOST }, caller)
          .then(() => null, (e) => e);
        expect(err, `${operation}: refused, not answered`).toMatchObject({
          name: 'ExplainUserNotFoundError', code: 'RECORD_NOT_FOUND', status: 404, statusCode: 404, userId: GHOST,
        });
        expect(err.message).toContain(`'${GHOST}'`);
      }
    });

    it('a caller who may not explain others gets their 403 first, and no existence read is made', async () => {
      const { plugin } = await boot();
      const seen = userReads(plugin);
      for (const caller of [
        { userId: 'u_east_1', positions: [], permissions: [] },
        { userId: 'u_delegate', positions: [], permissions: ['sub_admin'] },
      ]) {
        await expect(
          plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: GHOST }, caller),
          `${caller.userId}: the same refusal an existing user outside their reach gets`,
        ).rejects.toMatchObject({ name: 'PermissionDeniedError', code: 'PERMISSION_DENIED' });
      }
      expect(seen, 'the unknown id is never looked up for a caller refused the right').not.toContain(GHOST);
    });

    it('an existing user is still explained, and a self-explanation is never refused for its id', async () => {
      const { plugin } = await boot();
      const hr = { userId: 'u_hr', positions: [], permissions: ['hr_admin'] };
      const other = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, hr);
      expect(other.principal.userId).toBe('u_west_1');
      // Explaining yourself is unchanged: no `userId`, or your own, explains the
      // request's own context, whether or not a row carries its id.
      const ghostSelf = { userId: GHOST, positions: [], permissions: [] };
      for (const request of [{}, { userId: GHOST }]) {
        const self = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', ...request }, ghostSelf);
        expect(self.principal.userId).toBe(GHOST);
      }
    });
  });

  // [#27442] An explicit empty `userId` names nobody, so it is never read as
  // "explain me": it goes through the other-user arm, where it is refused like
  // any id no `sys_user` row has. The REST door refuses it 400 before this; the
  // engine holds the same line for a caller that reaches it directly.
  describe('[#27442] an explicit empty userId', () => {
    it('is never answered as the caller: manage_users gets 404, a plain member 403', async () => {
      const { plugin } = await boot();
      const hr = { userId: 'u_hr', positions: [], permissions: ['hr_admin'] };
      const admin: any = await plugin
        .explainAccessForCaller({ object: 'task', operation: 'read', userId: '' }, hr)
        .then((d) => d, (e) => e);
      expect(admin, 'refused, not an explanation of the caller').toMatchObject({
        name: 'ExplainUserNotFoundError', code: 'RECORD_NOT_FOUND', status: 404, userId: '',
      });
      const plain = { userId: 'u_east_1', positions: [], permissions: [] };
      await expect(
        plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: '' }, plain),
      ).rejects.toMatchObject({ name: 'PermissionDeniedError', code: 'PERMISSION_DENIED' });
    });

    it('an omitted userId still explains the caller', async () => {
      const { plugin } = await boot();
      const plain = { userId: 'u_east_1', positions: [], permissions: [] };
      const self = await plugin.explainAccessForCaller({ object: 'task', operation: 'read' }, plain);
      expect(self.principal.userId).toBe('u_east_1');
    });
  });

  // [#20515] Explaining ANOTHER user resolves that user's grants in the CALLER's
  // organization — the one the explain right was checked in. A grant scoped to
  // an organization applies only while that organization is the one resolved
  // in; with no organization only global grants do, which is what enforcement
  // answers for that user with none.
  describe('[#20515] the explained user is resolved in the caller\'s organization', () => {
    const scopedTarget = async () => {
      const b = await boot();
      b.h.tables.sys_user_permission_set.push(
        { user_id: 'u_west_1', permission_set_id: 'ps_sub', permission_set: 'sub_admin', organization_id: 'org_alpha' },
      );
      b.h.tables.sys_permission_set.push({ id: 'ps_sub', name: 'sub_admin' });
      return b;
    };
    const hr = (tenantId?: string) => ({
      userId: 'u_hr', positions: [], permissions: ['hr_admin'], ...(tenantId ? { tenantId } : {}),
    });

    it('caller in org_alpha: the org_alpha-scoped set is part of the explained principal', async () => {
      const { plugin } = await scopedTarget();
      const d = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, hr('org_alpha'));
      expect(d.principal.permissionSets).toContain('sub_admin');
    });

    it('caller in another organization, or in none: it is not', async () => {
      const { plugin } = await scopedTarget();
      const inBeta = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, hr('org_beta'));
      expect(inBeta.principal.permissionSets).not.toContain('sub_admin');
      const orgless = await plugin.explainAccessForCaller({ object: 'task', operation: 'read', userId: 'u_west_1' }, hr());
      expect(orgless.principal.permissionSets).not.toContain('sub_admin');
    });
  });
});

// ---------------------------------------------------------------------------
// ADR-0090 D10 — agent/service intersection. A principal acting `onBehalfOf` a
// user gets the INTERSECTION of its own grants and the delegator's grants, at
// EVERY axis (capability, object-CRUD, FLS, depth, row-level using/check,
// VAMA). Confused-deputy prevention: an over-privileged agent may never exceed
// the reach of the user it stands in for, and vice-versa. Gated on the
// delegation LINK — the non-delegated path must stay byte-identical.
// ---------------------------------------------------------------------------
describe('SecurityPlugin — ADR-0090 D10 agent intersection', () => {
  const AGENT = 'user_agent';
  const DELEGATOR = 'user_delegator';
  /**
   * The organization every request below runs in, and the owner of every
   * delegator holding: a holding takes effect only in its own organization
   * (`grantAppliesInTenant`), so an organization-less one would leave the
   * delegator holding nothing and every deny below passing for want of a grant.
   */
  const D10_ORG = 'org-1';

  // task carries every field the RLS/FLS policies below target, so no policy is
  // dropped as a fail-closed "missing field" deny.
  const TASK_FIELDS = ['id', 'name', 'owner_id', 'manager_id', 'salary', 'region', 'created_by'];

  /**
   * In-memory harness (modelled on the D6/D12 explain harness) that resolves the
   * delegator's sets from `sys_user_permission_set` and answers the `sys_user`
   * existence check. Business-object (`task`) reads route to `taskFindOne` so a
   * write pre-image can be made visible or hidden per test; sys_* reads route to
   * the seeded tables. Every set named in `metadata.list()` resolves by name.
   */
  const makeD10Harness = (opts: {
    sets: PermissionSet[];
    agentSets: string[];
    delegatorSets: string[] | null; // null → delegator has NO sys_user row (deleted)
    schemaExtra?: Record<string, any>;
    taskFindOne?: (query: any) => any;
  }) => {
    const tables: Record<string, any[]> = {
      sys_user: [{ id: AGENT, email: 'agent@x' }],
      sys_user_position: [],
      sys_user_permission_set: [],
      sys_permission_set: [],
      sys_position: [],
    };
    if (opts.delegatorSets !== null) {
      tables.sys_user.push({ id: DELEGATOR, email: 'delegator@x' });
      // Direct grants: a position grants only what its definition names, and
      // this harness declares no position definitions.
      for (const p of opts.delegatorSets) {
        tables.sys_user_permission_set.push({ user_id: DELEGATOR, permission_set: p, organization_id: D10_ORG });
      }
    }
    const matches = (row: any, where: any): boolean =>
      Object.entries(where ?? {}).every(([k, v]) => {
        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
        if (v && typeof v === 'object' && Array.isArray((v as any).$in)) return (v as any).$in.includes(row[k]);
        return row[k] === v;
      });
    const fields: Record<string, any> = {};
    for (const f of TASK_FIELDS) fields[f] = { name: f };
    const baseSchema: any = { name: 'task', fields, ...(opts.schemaExtra ?? {}) };
    const taskFindOne = vi.fn((query: any) => (opts.taskFindOne ? opts.taskFindOne(query) : { id: 'r1' }));
    let middleware: any;
    const ql: any = {
      registerMiddleware: (mw: any) => { if (!middleware) middleware = mw; },
      getSchema: () => baseSchema,
      // The security catalog the direct grants below are read through
      // (ADR-0131 D4): every set in `opts.sets`, by name.
      registry: {
        getItem: (type: string, name: string) => (type === 'permission' ? opts.sets.find((s) => s.name === name) : undefined),
        listItems: (type: string) => (type === 'permission' ? opts.sets : []),
        isPackageDisabled: () => false,
      },
      async find(object: string, o: any) {
        const rows = (tables[object] ?? []).filter((r) => matches(r, o?.where));
        return typeof o?.limit === 'number' ? rows.slice(0, o.limit) : rows;
      },
      async findOne(object: string, o: any) {
        assertEngineFindOnePredicate(object, o);
        if (object.startsWith('sys_')) {
          return (tables[object] ?? []).filter((r) => matches(r, o?.where))[0] ?? null;
        }
        return taskFindOne(o);
      },
    };
    const services: Record<string, any> = {
      manifest: { register: vi.fn() },
      objectql: ql,
      metadata: { get: async () => baseSchema, list: async () => opts.sets },
    };
    // The registered `security` service is captured, not discarded: the
    // ADR-0090 D10 diagnostic (`describeDelegationNarrowing`) is published ON
    // that service, and asserting it through the same boot the enforcement
    // tests use is what keeps the two from drifting.
    let registeredSecurity: any = null;
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn((name: string, impl: any) => {
        if (name === 'security') registeredSecurity = impl;
      }),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
    };
    return {
      ctx, taskFindOne,
      security: () => registeredSecurity,
      run: async (opCtx: any) => { await middleware(opCtx, () => runEngineWriteBody(opCtx)); return opCtx; },
    };
  };

  const boot = async (opts: Parameters<typeof makeD10Harness>[0]) => {
    // No baseline set — isolate the intersection from the additive member_default.
    const plugin = new SecurityPlugin({ fallbackPermissionSet: null });
    const h = makeD10Harness(opts);
    await plugin.init(h.ctx);
    await plugin.start(h.ctx);
    return { plugin, h };
  };

  const agentCtx = (extra?: Record<string, any>) => ({
    userId: AGENT, tenantId: D10_ORG, positions: [], permissions: ['agent_set'],
    onBehalfOf: { userId: DELEGATOR, principalKind: 'human' }, principalKind: 'agent',
    ...(extra ?? {}),
  });

  // ── CRUD intersection ───────────────────────────────────────────────────
  const editor = (name: string): PermissionSet => ({
    name, label: name,
    objects: { task: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
  } as any);
  const reader = (name: string): PermissionSet => ({
    name, label: name, objects: { task: { allowRead: true } },
  } as any);

  it('agent may EDIT but delegator is read-only → update DENIED (agent cannot exceed the user it acts for)', async () => {
    const { h } = await boot({ sets: [editor('agent_set'), reader('del_set')], agentSets: ['agent_set'], delegatorSets: ['del_set'] });
    const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', name: 'x' }, options: { where: { id: 'r1' } }, context: agentCtx() };
    await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  it('delegator may EDIT but agent is read-only → update DENIED (symmetry)', async () => {
    const { h } = await boot({ sets: [reader('agent_set'), editor('del_set')], agentSets: ['agent_set'], delegatorSets: ['del_set'] });
    const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', name: 'x' }, options: { where: { id: 'r1' } }, context: agentCtx() };
    await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  it('both grant edit → update is ALLOWED', async () => {
    const { h } = await boot({ sets: [editor('agent_set'), editor('del_set')], agentSets: ['agent_set'], delegatorSets: ['del_set'], taskFindOne: () => ({ id: 'r1' }) });
    const opCtx: any = { object: 'task', operation: 'update', data: { id: 'r1', name: 'x' }, options: { where: { id: 'r1' } }, context: agentCtx() };
    await expect(h.run(opCtx)).resolves.toBeDefined();
  });

  // ── capability intersection ─────────────────────────────────────────────
  it('delegator lacks a required capability → DENIED even though the agent holds it', async () => {
    const capGated = { requiredPermissions: ['export_data'] }; // array form → gates EVERY op
    const agentWithCap: PermissionSet = { name: 'agent_set', label: 'a', objects: { task: { allowRead: true } }, systemPermissions: ['export_data'] } as any;
    const delNoCap = reader('del_set');
    const { h } = await boot({ sets: [agentWithCap, delNoCap], agentSets: ['agent_set'], delegatorSets: ['del_set'], schemaExtra: capGated });
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: agentCtx() };
    await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  // ── read RLS composition (AND of both filters) ──────────────────────────
  const rlsReader = (name: string, using: string): PermissionSet => ({
    name, label: name,
    objects: { task: { allowRead: true } },
    rowLevelSecurity: [{ name: `${name}_rls`, object: 'task', operation: 'all', using }],
  } as any);

  it('read filter is the AND (intersection) of the agent and delegator RLS', async () => {
    const { h } = await boot({
      sets: [rlsReader('agent_set', 'owner_id = current_user.id'), rlsReader('del_set', 'manager_id = current_user.id')],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
    });
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: agentCtx() };
    await h.run(opCtx);
    // Composite where AND-s the agent's owner scoping (its id) with the
    // delegator's manager scoping (the DELEGATOR's id).
    expect(opCtx.ast.where).toEqual({ $and: [{ owner_id: AGENT }, { manager_id: DELEGATOR }] });
  });

  it('non-delegated principal is byte-identical (only the agent filter, no delegator read)', async () => {
    const { h } = await boot({
      sets: [rlsReader('agent_set', 'owner_id = current_user.id'), rlsReader('del_set', 'manager_id = current_user.id')],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
    });
    // Same context, but WITHOUT onBehalfOf.
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: { userId: AGENT, tenantId: D10_ORG, positions: [], permissions: ['agent_set'] } };
    await h.run(opCtx);
    expect(opCtx.ast.where).toEqual({ owner_id: AGENT });
  });

  it("agent's View-All does not widen past the delegator (VAMA survives only if BOTH hold it)", async () => {
    const agentViewAll: PermissionSet = { name: 'agent_set', label: 'a', objects: { task: { allowRead: true, viewAllRecords: true } } } as any;
    const delScoped = rlsReader('del_set', 'owner_id = current_user.id');
    const { h } = await boot({
      sets: [agentViewAll, delScoped], agentSets: ['agent_set'], delegatorSets: ['del_set'],
      schemaExtra: { sharingModel: 'private' },
    });
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: agentCtx() };
    await h.run(opCtx);
    // Agent alone (View-All on a private object) would inject NO filter; the
    // delegator's owner scoping still applies → the composite is exactly it.
    expect(opCtx.ast.where).toEqual({ owner_id: DELEGATOR });
  });

  // ── FLS intersection ────────────────────────────────────────────────────
  it('masks a field the delegator cannot read even though the agent can', async () => {
    const agentFull = reader('agent_set');
    const delMask: PermissionSet = { name: 'del_set', label: 'd', objects: { task: { allowRead: true } }, fields: { 'task.salary': { readable: false, editable: false } } } as any;
    const { h } = await boot({ sets: [agentFull, delMask], agentSets: ['agent_set'], delegatorSets: ['del_set'] });
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, result: [{ id: 'r1', name: 'A', salary: 999 }], context: agentCtx() };
    await h.run(opCtx);
    expect(opCtx.result[0].name).toBe('A');
    expect(opCtx.result[0].salary).toBeUndefined();
  });

  // ── depth intersection (per-identity stash for plugin-sharing) ───────────
  it("stashes the agent's own depth AND the delegator's depth SEPARATELY (identity-scoped OWD intersection)", async () => {
    const agentViewAll: PermissionSet = { name: 'agent_set', label: 'a', objects: { task: { allowRead: true, viewAllRecords: true } } } as any;
    const delOwn: PermissionSet = { name: 'del_set', label: 'd', objects: { task: { allowRead: true, readScope: 'own' } } } as any;
    const { h } = await boot({ sets: [agentViewAll, delOwn], agentSets: ['agent_set'], delegatorSets: ['del_set'], schemaExtra: { sharingModel: 'private' } });
    const ctx: any = agentCtx();
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: ctx };
    await h.run(opCtx);
    // The agent keeps its own (org-wide) depth so plugin-sharing scopes the
    // AGENT identity correctly; the delegator's narrower depth is stashed apart
    // so plugin-sharing can re-run the owner-match under the DELEGATOR identity.
    expect(ctx.__readScope).toBe('org');
    expect(ctx.__delegatorReadScope).toBe('own');
  });

  // ── [#16549 / maintainer ruling 2026-09-08] "a ceiling that says nothing
  //    subtracts nothing" — the OAuth-agent parity half of the ruling ─────────
  //
  // The shipped MCP ceilings (`mcp_agent_data_read` / `_write`) are pure
  // CAPABILITY sets: a `'*'` grant with no `readScope` and no `viewAllRecords`.
  // `getEffectiveScope`'s owner-only default turned that silence into `'own'`,
  // so the agent leg imposed an owner-match nobody declared and every
  // `viewAllRecords` manager collapsed to `own + shares` the moment an OAuth
  // MCP client asked on her behalf: measured 9/23/45 through an API key,
  // 5/0/0 over OAuth, same account, same questions, same server.
  //
  // `silentCeiling` is that exact shape. The pins below fix BOTH directions —
  // what the ruling widened, and every subtraction it did not.
  const silentCeiling = (name: string, extra?: Record<string, unknown>): PermissionSet => ({
    name, label: name, objects: { task: { allowRead: true, ...(extra ?? {}) } },
  } as any);
  const viewAllDelegator = (name: string): PermissionSet => ({
    name, label: name, objects: { task: { allowRead: true, viewAllRecords: true } },
  } as any);

  it('[#16549] a ceiling silent about depth contributes NO owner narrowing — the delegator\'s viewAllRecords stands', async () => {
    const { h } = await boot({
      sets: [silentCeiling('agent_set'), viewAllDelegator('del_set')],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
      schemaExtra: { sharingModel: 'private' },
    });
    const ctx: any = agentCtx();
    await h.run({ object: 'task', operation: 'find', ast: { where: undefined }, context: ctx });
    // Was 'own' before the ruling — the manufactured opinion that produced
    // `crm_opportunity: 0`. Both legs now say 'org', so plugin-sharing's
    // `buildReadFilter` returns null on each and the agent reads exactly the
    // rows the human reads. THIS is pin 1: equal, not merely closer.
    expect(ctx.__readScope).toBe('org');
    expect(ctx.__delegatorReadScope).toBe('org');
  });

  it('[#16549] NEGATIVE CONTROL: a delegator WITHOUT viewAllRecords is unchanged — the delegator leg still bounds the read', async () => {
    const delOwn: PermissionSet = { name: 'del_set', label: 'd', objects: { task: { allowRead: true, readScope: 'own' } } } as any;
    const { h } = await boot({
      sets: [silentCeiling('agent_set'), delOwn],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
      schemaExtra: { sharingModel: 'private' },
    });
    const ctx: any = agentCtx();
    await h.run({ object: 'task', operation: 'find', ast: { where: undefined }, context: ctx });
    // The widening is on the CEILING's leg only. The delegator's own 'own'
    // depth is untouched and still AND-s in, so a user with no viewAllRecords
    // sees exactly what she saw before: own + shares. ⛔ The fix widens the
    // manager's view, not everyone's.
    expect(ctx.__readScope).toBe('org');
    expect(ctx.__delegatorReadScope).toBe('own');
  });

  it('[#16549] NEGATIVE CONTROL: a ceiling that DOES declare a depth keeps its full subtractive force', async () => {
    const declaringCeiling: PermissionSet = { name: 'agent_set', label: 'a', objects: { task: { allowRead: true, readScope: 'own' } } } as any;
    const { h } = await boot({
      sets: [declaringCeiling, viewAllDelegator('del_set')],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
      schemaExtra: { sharingModel: 'private' },
    });
    const ctx: any = agentCtx();
    await h.run({ object: 'task', operation: 'find', ast: { where: undefined }, context: ctx });
    // Silence is "no opinion"; a DECLARATION is an opinion and still narrows.
    expect(ctx.__readScope).toBe('own');
    expect(ctx.__delegatorReadScope).toBe('org');
  });

  it('[#16549] the write leg follows the same rule — a silent write ceiling takes the delegator\'s modifyAllRecords depth', async () => {
    const silentWriteCeiling: PermissionSet = {
      name: 'agent_set', label: 'a',
      objects: { task: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;
    const modifyAllDelegator: PermissionSet = {
      name: 'del_set', label: 'd',
      objects: { task: { allowRead: true, allowEdit: true, allowDelete: true, modifyAllRecords: true } },
    } as any;
    const { h } = await boot({
      sets: [silentWriteCeiling, modifyAllDelegator],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
      schemaExtra: { sharingModel: 'private' },
    });
    const ctx: any = agentCtx();
    await h.run({ object: 'task', operation: 'update', data: { id: 'r1', name: 'x' }, options: { where: { id: 'r1' } }, context: ctx });
    expect(ctx.__writeScope).toBe('org');
    expect(ctx.__delegatorWriteScope).toBe('org');
  });

  it('[#16549] NEGATIVE CONTROL: the read-only ceiling still cannot WRITE, whatever the delegator holds', async () => {
    // The shipped `mcp_agent_data_read` shape against a delegator who CAN edit
    // and holds modifyAllRecords. Depth is now 'org' on the agent leg — and the
    // CRUD gate refuses anyway, because depth and capability are different axes
    // and the ruling moved only the first.
    const modifyAllDelegator: PermissionSet = {
      name: 'del_set', label: 'd',
      objects: { task: { allowRead: true, allowEdit: true, modifyAllRecords: true } },
    } as any;
    const { h } = await boot({
      sets: [silentCeiling('agent_set'), modifyAllDelegator],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
    });
    await expect(h.run({
      object: 'task', operation: 'update', data: { id: 'r1', name: 'x' },
      options: { where: { id: 'r1' } }, context: agentCtx(),
    })).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  it('[#16549] NEGATIVE CONTROL: allowTransfer is still refused — a write ceiling without it cannot move owner_id', async () => {
    const silentWriteCeiling: PermissionSet = {
      name: 'agent_set', label: 'a',
      objects: { task: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } },
    } as any;
    const transferringDelegator: PermissionSet = {
      name: 'del_set', label: 'd',
      objects: { task: { allowRead: true, allowEdit: true, modifyAllRecords: true } },
    } as any;
    const { h } = await boot({
      sets: [silentWriteCeiling, transferringDelegator],
      agentSets: ['agent_set'], delegatorSets: ['del_set'],
    });
    // The delegator holds transfer via modifyAllRecords; the ceiling does not
    // declare `allowTransfer` and D10 requires BOTH. ⛔ The ruling explicitly
    // fenced this off — and it is the reason the fix lands on the intersection
    // rather than putting `modifyAllRecords` on the ceiling, which would have
    // granted transfer (MODIFY_ALL_WRITE_KEYS covers it) and reached `private`
    // objects through the superuser wildcard.
    await expect(h.run({
      object: 'task', operation: 'update', data: { id: 'r1', owner_id: 'someone_else' },
      options: { where: { id: 'r1' } }, context: agentCtx(),
    })).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  // ── [#16549 consequence 2] the diagnostic, INDEPENDENT of the parity half ──
  describe('describeDelegationNarrowing — a narrowed delegated read says so', () => {
    it('reports the narrowing when the ceiling declares a depth below the delegator\'s', async () => {
      const declaringCeiling: PermissionSet = { name: 'agent_set', label: 'a', objects: { task: { allowRead: true, readScope: 'own' } } } as any;
      const { h } = await boot({
        sets: [declaringCeiling, viewAllDelegator('del_set')],
        agentSets: ['agent_set'], delegatorSets: ['del_set'],
      });
      const verdict = await h.security().describeDelegationNarrowing('task', agentCtx());
      expect(verdict.narrowed).toBe(true);
      expect(verdict.effectiveScope).toBe('own');
      expect(verdict.delegatorScope).toBe('org');
      // The sentence is for an AI consumer: it must say the rows are ABSENT
      // from the result rather than from the object, or the agent reports
      // `total: 0` as an answer — the whole cost of this card.
      expect(verdict.statement).toMatch(/D10 intersection/);
      expect(verdict.statement).toMatch(/NOT absent from the object/);
      expect(verdict.statement).toContain(DELEGATOR);
      expect(verdict.statement).toContain('task');
    });

    it('reports NO narrowing for a silent ceiling — an un-narrowed delegated read carries no statement', async () => {
      const { h } = await boot({
        sets: [silentCeiling('agent_set'), viewAllDelegator('del_set')],
        agentSets: ['agent_set'], delegatorSets: ['del_set'],
      });
      const verdict = await h.security().describeDelegationNarrowing('task', agentCtx());
      expect(verdict).toEqual({ narrowed: false });
    });

    it('reports NO narrowing for a NON-delegated principal', async () => {
      const { h } = await boot({
        sets: [silentCeiling('agent_set'), viewAllDelegator('del_set')],
        agentSets: ['agent_set'], delegatorSets: ['del_set'],
      });
      const humanCtx = { userId: DELEGATOR, tenantId: D10_ORG, positions: [], permissions: ['del_set'] };
      expect(await h.security().describeDelegationNarrowing('task', humanCtx)).toEqual({ narrowed: false });
    });

    it('reports NO narrowing for a system context — a diagnostic never speaks for the engine\'s own writer', async () => {
      const { h } = await boot({
        sets: [silentCeiling('agent_set'), viewAllDelegator('del_set')],
        agentSets: ['agent_set'], delegatorSets: ['del_set'],
      });
      expect(await h.security().describeDelegationNarrowing('task', { isSystem: true })).toEqual({ narrowed: false });
    });

    it('a DANGLING delegator is a denial upstream, not a narrowing — the probe stays silent', async () => {
      const { h } = await boot({
        sets: [silentCeiling('agent_set')],
        agentSets: ['agent_set'], delegatorSets: null,
      });
      expect(await h.security().describeDelegationNarrowing('task', agentCtx())).toEqual({ narrowed: false });
    });
  });

  // ── fail-closed on a dangling delegation link ───────────────────────────
  it('delegator no longer exists → fail CLOSED (PermissionDeniedError, not baseline access)', async () => {
    const { h } = await boot({ sets: [reader('agent_set')], agentSets: ['agent_set'], delegatorSets: null });
    const opCtx: any = { object: 'task', operation: 'find', ast: { where: undefined }, context: agentCtx() };
    await expect(h.run(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
  });

  // ── explain attribution (D6 × D10) ──────────────────────────────────────
  it('explain reports the D10 intersection deny when the delegator lacks the grant', async () => {
    const { plugin } = await boot({ sets: [editor('agent_set'), reader('del_set')], agentSets: ['agent_set'], delegatorSets: ['del_set'] });
    const caller = { userId: AGENT, positions: [], permissions: ['agent_set'], onBehalfOf: { userId: DELEGATOR } };
    const d = await plugin.explainAccessForCaller({ object: 'task', operation: 'update' }, caller);
    expect(d.allowed).toBe(false);
    const crud = d.layers.find((l) => l.layer === 'object_crud');
    expect(crud?.verdict).toBe('denies');
    expect(crud?.detail).toMatch(/delegator/i);
    expect(d.principal.onBehalfOf?.userId).toBe(DELEGATOR);
  });
});

// ---------------------------------------------------------------------------
// [#3325] Registry-driven managed-object write denies — reference-sharing pin.
// runBootstrap unions the better-auth denies from the LIVE registry into the
// in-memory bootstrapPermissionSets — the SAME array the evaluator resolves and
// bootstrapPlatformAdmin serializes. This pins that a registry object the static
// baseline does NOT list still gets denied (the one real implementation risk:
// if the registry ever cloned items, the in-place mutation would stop reaching
// the evaluator).
// ---------------------------------------------------------------------------
describe('managed-object write denies wiring (#3325)', () => {
  it('injects a registry-only better-auth object into the shared default sets', async () => {
    const ql: any = {
      registerMiddleware: vi.fn(),
      getSchema: () => undefined,
      findOne: async (object: string, query?: EngineFindOneQueryInput) => { assertEngineFindOnePredicate(object, query); return null; },
      find: async () => [],
      count: async () => 0,
      insert: async (_o: string, d: any) => ({ id: d?.id ?? 'x' }),
      update: async () => {},
      // A better-auth object the static BETTER_AUTH_MANAGED_OBJECTS list does NOT contain.
      registry: {
        listItems: (type: string) =>
          type === 'object' ? [{ name: 'sys_fake_identity', managedBy: 'better-auth' }] : [],
      },
    };
    const services: Record<string, any> = {
      manifest: { register: vi.fn() },
      objectql: ql,
      metadata: { get: async () => null, list: async () => [] },
    };
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
      registerService: vi.fn(),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
      // No `hook` → start() runs runBootstrap synchronously via the fallback,
      // and the transform executes in runBootstrap's synchronous prefix (before
      // the first await), so the mutation is visible right after start() resolves.
    };
    const plugin = new SecurityPlugin();
    await plugin.init(ctx);
    await plugin.start(ctx);

    const sets = (plugin as any).bootstrapPermissionSets as any[];
    const member = sets.find((s) => s.name === 'member_default');
    expect(member.objects.sys_fake_identity).toEqual({
      allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false,
    });
    // admin_full_access keeps its bare wildcard — never denied.
    const admin = sets.find((s) => s.name === 'admin_full_access');
    expect(admin.objects.sys_fake_identity).toBeUndefined();
  });
});

// ---------------------------------------------------------------------------
// [#18535] ADR-0090 D5 — 「平台系统权限;带 package provenance 的应用声明
// capability 令牌不计」 at the two runtime doors this plugin owns.
//
// PR #17811 landed the predicate half: `describeHighPrivilegeBits(def,
// context?)` excuses a `systemPermissions` name when the caller says this stack
// DECLARED it. No consumer passed a context, so an app's own "every employee
// holds this" set stayed unbindable to `everyone` — declared ≠ enforced, on a
// contract both the ADR and the spec had already ruled.
//
// Each door gets THREE cases, never one: "the declared token binds" alone is
// equally satisfied by a door that stopped judging `systemPermissions`
// altogether, so the undeclared-token control and the platform-floor control
// are what make the accepting case mean anything.
// ---------------------------------------------------------------------------
describe('audience-anchor bindings read the stack\'s declared capabilities (#18535)', () => {
  const APP_DEFAULT = (token: string): PermissionSet => ({
    name: 'app_member_default',
    label: 'App Member Default',
    isDefault: true,
    systemPermissions: [token],
    objects: { app_announcement: { allowRead: true } },
  }) as any;

  /**
   * Boot the plugin far enough to run `runBootstrap` to completion, with the
   * stack's declarations held where a real boot holds them: in the engine
   * registry, under the declaring package (`registerApp` stamps `_packageId`),
   * beside the platform's own curated declarations. That registry is a declared
   * capability's one home (ADR-0131 D3), and no `sys_capability` row is written
   * for it.
   * [Stage 6a] The `everyone` baseline is the anchor's declared
   * `permissionSets`; the boot writes no junction row for it.
   */
  async function boot(token: string, declaredCapabilities: any[]) {
    const tables: Record<string, any[]> = {
      sys_position: [{ id: 'pos_everyone', name: 'everyone' }],
      sys_permission_set: [{ id: 'ps_app', name: 'app_member_default' }],
      sys_position_permission_set: [],
    };
    const inserts: Array<{ object: string; data: any }> = [];
    // [ADR-0131 D3/D4] The registry the built-in positions are declared to —
    // where `everyone` names the baseline the boot binding above judges.
    const items = new Map<string, any>();
    const registry = {
      // Stamped with `_packageId` as the engine registry stamps it: the declared-capability
      // reader tells the platform's own capability items apart by it.
      registerItem: (type: string, item: any, _key?: string, packageId?: string) => {
        items.set(`${type}:${item.name}`, packageId ? { ...item, _packageId: packageId } : item);
      },
      getItem: (type: string, name: string) => items.get(`${type}:${name}`),
      listItems: (type: string) => [...items.entries()].filter(([k]) => k.startsWith(`${type}:`)).map(([, v]) => v),
      isPackageDisabled: () => false,
    };
    for (const capability of declaredCapabilities) {
      registry.registerItem('capability', capability, 'name', 'com.example.app');
    }
    const ql: any = {
      registry,
      registerMiddleware: () => {},
      find: async (object: string, opts?: any) => {
        const where = opts?.where ?? {};
        const matched = (tables[object] ?? []).filter((r: any) =>
          // The matcher REFUSES what it does not implement rather than
          // answering as if it had: a `$or` key compared as a field name
          // matches no row and reports that as "no rows"
          // (`check:where-matcher` — refusal is the conforming cheap answer for
          // a double that only ever sees scalar equality).
          Object.entries(where).every(([k, v]) => {
            if (k.startsWith('$')) {
              throw new Error(`test double: unsupported WHERE combinator '${k}' — implement it or narrow the fixture`);
            }
            return r[k] === v;
          }),
        );
        // The caller's bound, applied BY PRESENCE and after the filter — the
        // plugin reads `limit: 5` here to tell an organization-less row from
        // this organization's own (`check:objectql-double-limit`).
        return typeof opts?.limit === 'number' ? matched.slice(0, opts.limit) : matched;
      },
      findOne: async (object: string, query?: EngineFindOneQueryInput) => {
        assertEngineFindOnePredicate(object, query);
        return null;
      },
      insert: async (object: string, d: any) => {
        inserts.push({ object, data: d });
        (tables[object] ??= []).push(d);
        return { id: d?.id ?? 'x' };
      },
      // The PRODUCER's own dispatch predicate, never a hand-mirrored guard.
      update: async (_o: string, d: any, o?: any) => {
        assertEngineUpdateDispatch(d, o);
        return true;
      },
      getSchema: identityObjectsOnly,
    };
    const metadata = {
      get: async () => null,
      list: async () => [],
    };
    const services: Record<string, any> = {
      manifest: { register: vi.fn() },
      objectql: ql,
      metadata,
    };
    const hook = vi.fn();
    const ctx: any = {
      logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
      registerService: vi.fn(),
      getService: (name: string) => {
        if (!(name in services)) throw new Error(`service not registered: ${name}`);
        return services[name];
      },
      hook,
    };
    const plugin = new SecurityPlugin({ defaultPermissionSets: [APP_DEFAULT(token)] });
    await plugin.init(ctx);
    await plugin.start(ctx);
    for (const [, cb] of hook.mock.calls.filter((c: any[]) => c[0] === 'kernel:ready')) await cb();

    // Positive control: the pass really completed. Without it every assertion
    // below would be satisfied by a boot that fell over before the binding.
    expect(
      ctx.logger.info.mock.calls.filter((c: any[]) => String(c[0]).includes('platform bootstrap complete')),
    ).toHaveLength(1);

    const bindings = inserts.filter((i) => i.object === 'sys_position_permission_set');
    const declaredRefusals = ctx.logger.warn.mock.calls.filter((c: any[]) =>
      String(c[0]).includes('the everyone anchor does not name a baseline set'),
    );
    const everyoneSets = registry.getItem('position', 'everyone')?.permissionSets;
    return { plugin, ql, ctx, bindings, declaredRefusals, everyoneSets };
  }

  // [ADR-0131 D3/D4] The `everyone` definition names the baseline, judged by
  // the high-privilege check against the stack's declared capabilities. The
  // undeclared leg is the control: declarations exist and name a DIFFERENT
  // capability — it is MEMBERSHIP that excuses a token, not the presence of a
  // declaration list.
  it('the everyone definition names the isDefault set when the stack declares its token, and not when it does not', async () => {
    const declared = await boot('crm.export_pipeline', [{ name: 'crm.export_pipeline', label: 'Export Pipeline' }]);
    expect(declared.declaredRefusals).toHaveLength(0);
    expect(declared.everyoneSets).toEqual(['app_member_default', 'member_default']);
    const undeclared = await boot('crm.settle_ledger', [{ name: 'crm.export_pipeline', label: 'Export Pipeline' }]);
    expect(undeclared.declaredRefusals).toHaveLength(1);
    expect(undeclared.declaredRefusals[0][1]).toMatchObject({ set: 'app_member_default', offending: 'system permissions' });
    expect(undeclared.everyoneSets).toEqual(['member_default']);
  });

  it('still refuses a PLATFORM capability the stack declares a same-named capability for', async () => {
    const { declaredRefusals, everyoneSets } = await boot('manage_users', [{ name: 'manage_users', label: 'Not Yours' }]);
    expect(declaredRefusals).toHaveLength(1);
    expect(everyoneSets).toEqual(['member_default']);
  });

  // [Stage 6a] The baseline junction writer is retired: no boot writes a
  // `sys_position_permission_set` row, declared token or not.
  it('writes no junction row for the baseline', async () => {
    for (const token of ['crm.export_pipeline', 'crm.settle_ledger']) {
      const { bindings } = await boot(token, [{ name: 'crm.export_pipeline', label: 'Export Pipeline' }]);
      expect(bindings).toEqual([]);
    }
  });
});