test(plugin-security): type the real-engine rig explicitly

Claude-Session: https://claude.ai/code/session_011K3zqE8Pv1Evw5hc8tZCnN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/by-id-write-unreadable-not-found.test.ts

@@ -45,13 +45,22 @@ const ME = 'usr_nf_member';
 const OTHER = 'usr_nf_other';
 const CALLER = { userId: ME, positions: ['qa_pos'], permissions: ['qa_nf_guard'], posture: 'MEMBER' };
 
-type Rig = Awaited<ReturnType<typeof boot>>;
+interface Refusal { code?: string; status?: number; message: string; name?: string }
+type Outcome = { kind: 'landed' } | ({ kind: 'refused' } & Refusal);
+
+interface Rig {
+  engine: ObjectQL;
+  update: (object: string, id: string, data?: Record<string, unknown>) => Promise<Outcome>;
+  remove: (object: string, id: string) => Promise<Outcome>;
+  stored: (object: string, id: string) => Promise<Record<string, unknown> | null>;
+  teardown: () => Promise<void>;
+}
 const rigs: Rig[] = [];
 afterEach(async () => {
   for (const rig of rigs.splice(0)) await rig.teardown();
 });
 
-async function boot() {
+async function boot(): Promise<Rig> {
   const engine = new ObjectQL();
   engine.registerDriver(
     new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }) as never,
@@ -134,7 +143,7 @@ async function boot() {
   await plugin.init(ctx as never);
   await plugin.start(ctx as never);
 
-  const rig = {
+  const rig: Rig = {
     engine,
     update: (object: string, id: string, data: Record<string, unknown> = { name: 'renamed' }) =>
       outcome(engine.update(object, data, { where: { id }, context: { ...CALLER } } as never)),
@@ -148,9 +157,6 @@ async function boot() {
   return rig;
 }
 
-interface Refusal { code?: string; status?: number; message: string; name?: string }
-type Outcome = { kind: 'landed' } | ({ kind: 'refused' } & Refusal);
-
 function outcome(p: Promise<unknown>): Promise<Outcome> {
   return p.then(
     () => ({ kind: 'landed' as const }),