@jwilleke/ngdpbase-types 5.26.0 → 5.28.0

package/lib/src/managers/PageManager.d.ts

@@ -184,6 +184,15 @@ export type PageRead<T> = {
 export interface PageConvertResult extends NcmResult {
     fixes: FixChange[];
 }
+/**
+ * A write refused because the page's `audience` leaves the writer out (#1964).
+ * Someone outside a page's audience may neither read nor edit it; an
+ * administrator (`admin-system`) is the exception. Routes answer it with 403.
+ */
+export declare class PageAudienceRefusedError extends Error {
+    readonly pageName: string;
+    constructor(pageName: string);
+}
 export declare class PageContentValidationError extends Error {
     readonly validationErrors: FilterValidationError[];
     constructor(pageName: string, validationErrors: FilterValidationError[]);
@@ -797,10 +806,22 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * the normal getPage() path sanitises or normalises away. Returns null
      * when the page is unknown or the provider doesn't support raw reads.
      */
-    getRawPageContent(identifier: string): Promise<{
+    getRawPageContent(identifier: string, ctx: ActorContext): Promise<{
         filePath: string;
         content: string;
     } | null>;
+    /**
+     * The write door's audience check (#1964, operator 2026-10-23): someone a
+     * page's `audience` leaves out may neither read nor edit it, by any route —
+     * the editor, the raw editor, the API, a rename, a delete. The rule is the
+     * PIP's (`audienceAdmits`, the same one Tier 1 applies), asked with the
+     * caller's context; an administrator (`admin-system`) is admitted. A page
+     * that states no audience is not checked here — the routes ask the full
+     * page decision before they call the door.
+     *
+     * @throws PageAudienceRefusedError when the audience leaves `ctx` out
+     */
+    private assertAudienceAdmits;
     /**
      * Admin-override save (#689): the admin "Edit raw" textarea, split into
      * frontmatter and body and written through the door (#1462).
@@ -1107,6 +1128,38 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * const deleted = await pageManager.deletePage('Old Page', req.userContext);
      */
     deletePage(identifier: string, ctx: ActorContext): Promise<boolean>;
+    /**
+     * Delete the pages a test made (#2008): every shared page carrying the
+     * `test-artifact` system keyword (#1355), and never a page without it.
+     * `only` narrows the set further — a deleted test account's profile is
+     * `{ author, systemCategory: 'user-profile' }`.
+     *
+     * Each page is recorded as `page-delete` before it is deleted (on-failure
+     * refuse: a page whose record cannot be written is not deleted), then goes
+     * through {@link deletePage}, so the delete is soft and the shared indexes
+     * follow. One page's failure never stops the rest; it is reported.
+     *
+     * The caller decides who may ask: the sweep route asks `admin-system`, and
+     * an account delete has already been decided as `user-delete`. Private
+     * vault pages are not in the shared index, so they are not reached here.
+     *
+     * @param ctx - Who is acting; named in every record
+     * @param only - Narrow to one author and/or system-category
+     */
+    deleteTestArtifacts(ctx: ActorContext, only?: {
+        author?: string;
+        systemCategory?: string;
+    }): Promise<{
+        deleted: Array<{
+            title: string;
+            uuid: string;
+        }>;
+        failed: Array<{
+            title: string;
+            uuid: string;
+            error: string;
+        }>;
+    }>;
     /**
      * The name a page was reached by, as the shared indexes key it: a private
      * page's path (#1456), else its title — the caller may have used a uuid or
@@ -1290,6 +1343,29 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @param action  - Legacy verb (`view`, `edit`) or policy action; default `view`
      */
     filterPagesFor(subject: ActorContext | PermissionSubject | null | undefined, names: readonly string[], action?: string): Promise<string[]>;
+    /**
+     * The `addon:<slug>` entries on a page that can match nobody (#1964): the
+     * slugs it names in `audience` or `access` that are not a loaded per-person
+     * add-on. Such an entry still decides — it refuses everyone it would have
+     * let in — so the author is told.
+     *
+     * @param metadata - The page's frontmatter
+     * @returns The slugs, in the order the page names them
+     */
+    unmatchableAddonAudience(metadata: Partial<PageFrontmatter> | null | undefined): string[];
+    /** Warn, naming the page and each slug, about {@link unmatchableAddonAudience}. */
+    private warnUnmatchableAddonAudience;
+    /**
+     * At startup, once add-ons have loaded (#1964): warn about every page whose
+     * `audience` or `access` names an add-on that can match nobody — unknown,
+     * not per-person, or not loaded.
+     *
+     * @returns Each page and slug warned about
+     */
+    reportUnmatchableAddonAudiences(): Promise<Array<{
+        page: string;
+        slug: string;
+    }>>;
     /**
      * Get all page titles (explicit alias for getAllPages)
      * Prefer this for new code that only needs page names.

package/lib/src/managers/PersonManager.d.ts

@@ -23,8 +23,13 @@ export type LinkOfferOutcome = 'sent' | 'no-match' | 'several' | 'unavailable' |
  * `linkAccount` take the caller's context first and ask the PDP: `contact-read`
  * to list, search or get; `contact-manage` to change (`linkAccount` also `user-edit`). Each change is recorded as
  * the `contact-manage` audit event. A refusal throws `ContactRefusedError`.
- * `getById` / `getByIdentifier` stay as context-free lookups for core's own
- * hot paths (RoleManager resolves roles through them on every request).
+ *
+ * Every lookup takes the caller's context too (#2018): `getById`,
+ * `getByIdentifier` and `getByUserIdentifier`. A user reads their own identity
+ * record, and `update` changes it, under `profile-manage`; anyone else's needs
+ * `contact-read` / `contact-manage`. Core's own reads (RoleManager resolving
+ * roles on every request, UserManager's account lifecycle) pass the system
+ * context, allowed without a policy evaluation (`requireRecordAccess`).
  *
  * A later sign-up joins a person with no account in one of two ways: the new
  * account confirms an emailed link (`offerSignUpLink` → `confirmSignUpLink`),
@@ -32,8 +37,8 @@ export type LinkOfferOutcome = 'sent' | 'no-match' | 'several' | 'unavailable' |
  * person keeps its `@id` and takes the account; the person made for the new
  * account is folded into it and removed, so there is never a second person.
  *
- * `getByUserIdentifier(username)` remains as a lazy-migration entry point
- * for legacy users that pre-date the sync wiring.
+ * `getByUserIdentifier(ctx, username)` remains as a lazy-migration entry
+ * point for legacy users that pre-date the sync wiring.
  */
 declare class PersonManager extends BaseManager {
     readonly description = "Canonical Person records (#617)";
@@ -56,15 +61,26 @@ declare class PersonManager extends BaseManager {
      */
     backupFolders(): BackupFolder[];
     getProvider(): PersonProvider | null;
-    getById(id: string): Promise<Person | null>;
-    getByIdentifier(identifier: string): Promise<Person | null>;
+    /**
+     * One identity record by `@id` (#2018): the caller's own under
+     * `profile-manage`, anyone else's under `contact-read`, core's own work
+     * under the system context. A refusal throws `ContactRefusedError`.
+     */
+    getById(ctx: ActorContext, id: string): Promise<Person | null>;
+    /**
+     * The identity record whose `identifier` is `identifier` (a username, or a
+     * contact's `person:<uuid>`), decided as {@link getById} before it is read.
+     */
+    getByIdentifier(ctx: ActorContext, identifier: string): Promise<Person | null>;
+    private cachedById;
+    private cachedByIdentifier;
     /** #1006: how many people this instance holds. Count only, never records. */
     getManagerStats(): Promise<ManagerStats>;
     /** True when the person has no account: its identifier is `person:<uuid>` (#1930). */
     static isAccountless(person: Pick<Person, 'identifier'>): boolean;
     /** Every person, for a caller who may read contacts (`contact-read`). */
     list(ctx: ActorContext): Promise<Person[]>;
-    /** One person by `@id`, for a caller who may read contacts (`contact-read`). */
+    /** One person by `@id`: {@link getById}, the caller's own under `profile-manage`, anyone else's under `contact-read`. */
     get(ctx: ActorContext, id: string): Promise<Person | null>;
     /**
      * Persons whose name (`name`, `givenName`, `familyName`) or `email` contains
@@ -82,7 +98,11 @@ declare class PersonManager extends BaseManager {
      * person yet: that is how UserManager makes the person for a new account.
      */
     create(ctx: ActorContext, input: PersonInput): Promise<Person>;
-    /** Change a person's fields, affiliations included. `@id` and `identifier` never change here. */
+    /**
+     * Change a person's fields, affiliations included. `@id` and `identifier`
+     * never change here. The caller's own identity record under
+     * `profile-manage`, anyone else's under `contact-manage` (#2018).
+     */
     update(ctx: ActorContext, id: string, patch: PersonUpdate): Promise<Person | null>;
     delete(ctx: ActorContext, id: string): Promise<boolean>;
     /**
@@ -123,7 +143,10 @@ declare class PersonManager extends BaseManager {
      * to it, and that person is removed. Never a second person.
      */
     private join;
-    /** Each affiliation names an organization that exists; `role` is trimmed text. Throws on any other shape. */
+    /**
+     * Each affiliation names an organization that exists, looked up with the
+     * caller's context; `role` is trimmed text. Throws on any other shape.
+     */
     private checkedAffiliations;
     private configNumber;
     /**
@@ -136,9 +159,11 @@ declare class PersonManager extends BaseManager {
      *
      * Returns the Person paired to `username`. If none exists and a matching
      * User does, a Person is created from the User's email/displayName and
-     * persisted. Subsequent calls return the persisted record.
+     * persisted. Subsequent calls return the persisted record. Decided as
+     * {@link getByIdentifier} (#2018): a signed-in user's own under
+     * `profile-manage` ("your receipts"), anyone else's under `contact-read`.
      */
-    getByUserIdentifier(username: string): Promise<Person | null>;
+    getByUserIdentifier(ctx: ActorContext, username: string): Promise<Person | null>;
     private requireProvider;
     private getMetrics;
     private normalizeProviderName;

package/lib/src/managers/RoleManager.d.ts

@@ -12,6 +12,9 @@ declare class RoleManager extends BaseManager {
     private storageDir;
     private memberCache;
     private byOrgPositionCache;
+    private cacheGeneration;
+    /** #2015: one membership change at a time per role record, read included. */
+    private readonly membership;
     private metricsRef;
     constructor(engine: WikiEngine);
     initialize(config?: Record<string, unknown>): Promise<void>;
@@ -42,7 +45,8 @@ declare class RoleManager extends BaseManager {
     backupFolders(): BackupFolder[];
     /** Provider accessor, mainly for tests. */
     getProvider(): RoleProvider | null;
-    getById(id: string): Promise<Role | null>;
+    /** One role record by `@id`: its members are identity records, so `contact-read`, or core's own work (#2018). */
+    getById(ctx: ActorContext, id: string): Promise<Role | null>;
     getByOrgAndPosition(organizationId: string, namedPosition: string): Promise<Role | null>;
     listByMember(personId: string): Promise<Role[]>;
     list(): Promise<Role[]>;
@@ -65,8 +69,13 @@ declare class RoleManager extends BaseManager {
      *
      * Returns `[]` when PersonManager is unavailable, the user has no Person
      * record, no record lists them, or the lookup throws.
+     *
+     * `ctx` is who is asking (#2018), decided by PersonManager's door: a user
+     * about themselves under `profile-manage`, about anyone else under
+     * `contact-read`; core's own work passes the system context. A refusal is
+     * thrown as `ContactRefusedError`, never answered as "no roles".
      */
-    resolveUserRoles(username: string): Promise<string[]>;
+    resolveUserRoles(ctx: ActorContext, username: string): Promise<string[]>;
     /**
      * The `required-aal` levels the OPERATOR set in their own config (#448,
      * #1523), as opposed to the shipped defaults. An operator's level that no
@@ -86,15 +95,26 @@ declare class RoleManager extends BaseManager {
      * `anonymous`) requires nothing beyond being signed in.
      */
     roleRequiredAal(): Record<string, 1 | 2 | 3>;
-    hasRole(username: string, roleName: string): Promise<boolean>;
-    /** Assign one role to an existing account, and record it (#1204). */
+    /** Whether `username` holds `roleName` now, asked by `ctx`; decided as {@link resolveUserRoles} (#2018). */
+    hasRole(ctx: ActorContext, username: string, roleName: string): Promise<boolean>;
+    /**
+     * Assign one role to an existing account, and record it (#1204). A role
+     * that cannot be given is refused (#2015): the error is thrown, admins are
+     * notified, and the attempt is recorded as a failed user-edit.
+     */
     assignRole(username: string, roleName: string, ctx: ActorContext): Promise<boolean>;
-    /** Remove one role from an existing account, and record it (#1204). */
+    /** Remove one role from an existing account, and record it (#1204); refused like `assignRole` when it cannot be done. */
     removeRole(username: string, roleName: string, ctx: ActorContext): Promise<boolean>;
     /**
      * Make the user's memberships go from `oldRoles` to `newRoles`. Used by
      * UserManager when an account is created or edited; the account write
      * records its own audit event, so this records none.
+     *
+     * All or nothing (#2015): when any change cannot be made, the ones already
+     * made are undone and a `RoleChangeError` is thrown, after it is logged as
+     * an error and admins are notified. That includes a change that cannot even
+     * be attempted: no PersonManager, no Person record for the username, or no
+     * anchor Organization.
      */
     applyRoleDiff(username: string, oldRoles: string[], newRoles: string[]): Promise<void>;
     /**
@@ -108,28 +128,67 @@ declare class RoleManager extends BaseManager {
      * a role change and is recorded as one, under the system context `ctx`,
      * deferred until the audit sink is up when this runs at boot.
      *
+     * #2015: each account gets the role or not. One that does not is recorded as
+     * a failed user-edit, and every miss is an error in the log and one error
+     * notification for admins naming the accounts to fix by hand. The boot goes
+     * on: nobody asked, so there is nobody to refuse.
+     *
      * @returns how many accounts were given the role (0 once it has been given)
      */
     grantToEveryAccountOnce(roleName: string, usernames: readonly string[], ctx: JobContext): Promise<number>;
     /**
      * Move every membership held by one Person `@id` to another (#1930): when
      * PersonManager joins an account to an existing person, the roles the
-     * account's person held go with the account. One write per role record;
-     * returns how many records changed. PersonManager's join records the change.
+     * account's person held go with the account. Returns how many records
+     * changed. PersonManager's join records the change. All or nothing (#2015).
      */
     moveMemberships(fromPersonId: string, toPersonId: string): Promise<number>;
-    /** Remove a deleted account's Person from every role it held. */
-    removeAllMemberships(username: string): Promise<void>;
     /**
-     * Add the user's Person `@id` to the role record for (installOrg, roleName).
-     * Idempotent: a no-op when the Person is already a member.
-     *
-     * Failures are logged, not thrown — account writes must succeed even when
-     * role storage is degraded. #1027: every abandon path says why, because a
-     * silent one is indistinguishable from success.
+     * Remove a deleted account's Person from every role it held. All or nothing
+     * (#2015): when any removal fails the others are put back and it throws, so
+     * the account delete is refused. Returns the undo, for a delete that fails
+     * after this: it gives every role back. An account with no Person holds no
+     * role, so there is nothing to remove.
+     */
+    removeAllMemberships(username: string): Promise<() => Promise<void>>;
+    /** The roles `username` gains and loses, all or nothing; `notify` false lets a batch send one notice. */
+    private changeRoles;
+    /**
+     * The Person `@id` and anchor Organization a username's role changes need
+     * (#1027). Either missing refuses the change (#2015): an account must not
+     * be left without the role it was given, nor keep one it was meant to lose.
+     */
+    private membershipTarget;
+    /** One member change and its inverse. */
+    private memberChange;
+    /**
+     * Make each change in turn (#2015). When one fails, undo the ones made, in
+     * reverse, and throw. Returns the changes made, for a later undo.
+     */
+    private allOrNothing;
+    /** Undo `done`, newest first; returns the labels that could not be undone. */
+    private undoAll;
+    /**
+     * A role change that did not happen is always an error (operator,
+     * 2026-10-23): logged at error level, and an error notification for admins
+     * unless the caller sends one for a whole batch. Returns the error to throw.
+     */
+    private roleFailure;
+    /** An error notification for admins; a notification that cannot be sent is logged, never thrown. */
+    private reportToAdmins;
+    /** #2015: the membership queue's key for one role record. */
+    private membershipKey;
+    /**
+     * Make `personId` a member of the role record, or not, one change at a time
+     * per record (#2015). The record is read inside the queue, so a change never
+     * works from a member list another change has since replaced. A missing
+     * record is created in `createIn` for an add; with no `createIn` an add to a
+     * missing record throws, and a removal from one changes nothing. False,
+     * writing nothing, when the person already is (or is not) a member.
      */
-    private addMember;
-    private removeMember;
+    private setMember;
+    /** assignRole / removeRole: the change, recorded as a user-edit whether it happened or not (#1204, #2015). */
+    private recordedRoleChange;
     /**
      * The role record for (installOrg, namedPosition), created when missing.
      *

package/lib/src/managers/UserManager.d.ts

@@ -153,7 +153,7 @@ interface UserCreateInput {
 /**
  * User update input data
  */
-interface UserUpdateInput {
+export interface UserUpdateInput {
     email?: string;
     displayName?: string;
     password?: string;
@@ -166,6 +166,16 @@ interface UserUpdateInput {
     profilePage?: string;
     [key: string]: unknown;
 }
+/**
+ * A change worked out from the account as it is now (#2025), the function form
+ * of `updateUser`. It runs inside the account's key, is handed a copy of the
+ * account without the password hash (an add-on's own fields included, as
+ * `UserUpdateInput` allows them), and returns the fields to merge, or
+ * `undefined` to change nothing.
+ */
+export type UserUpdateFn = (current: Omit<User, 'password'> & {
+    [key: string]: unknown;
+}) => UserUpdateInput | undefined | Promise<UserUpdateInput | undefined>;
 /**
  * UserManager - Handles user authentication, authorization, and roles
  *
@@ -208,6 +218,8 @@ declare class UserManager extends BaseManager {
     private provider;
     private providerClass?;
     private passwordSalt?;
+    /** One read-merge-write at a time per account, keyed by the normalized username (#2025). */
+    private readonly accountWrites;
     /**
      * Creates a new UserManager instance
      *
@@ -358,6 +370,15 @@ declare class UserManager extends BaseManager {
     upgradePasswordHash(username: string, newHash: string, legacy: boolean): Promise<void>;
     /** Count a completed sign-in on the account: last sign-in and sign-in count (#1758; AuthManager calls it for a sign-in, never a re-check). */
     recordSignIn(username: string): Promise<void>;
+    /** Run `task` inside the account's key: one read-merge-write at a time per account (#2025). Not re-entrant. */
+    private inAccountKey;
+    /**
+     * Read an account, change it and write it back, inside its key (#2025): for
+     * core's own bookkeeping (sign-in counters, the hash upgrade, the profile
+     * page), which is not an edit and is not recorded. False when there is no
+     * such account.
+     */
+    private patchAccount;
     /**
      * Check if a display name conflicts with existing page names or other users
      * @param {string} displayName - Display name to check
@@ -400,6 +421,12 @@ declare class UserManager extends BaseManager {
      * @returns {Promise<Omit<User, 'password'>>} Created user (without password)
      */
     createUser(userData: UserCreateInput, ctx: ActorContext): Promise<Omit<User, 'password'>>;
+    /**
+     * Take back an account whose roles could not be given (#2015): its Person,
+     * then the account. A failure here is an error in the log; the role failure
+     * that caused it is what the caller is told.
+     */
+    private undoAccountCreate;
     /**
      * Update user
      */
@@ -419,7 +446,31 @@ declare class UserManager extends BaseManager {
      * which accounts exist.
      */
     resetPasswordWithRecoveryWords(username: string, words: string, newPassword: string, ctx: ActorContext): Promise<boolean>;
-    updateUser(username: string, updates: UserUpdateInput, ctx: ActorContext): Promise<User>;
+    /**
+     * Change an account (#2025: one change at a time per account).
+     *
+     * `updates` is the fields to merge, or a function that works them out from
+     * the account as it is now: `(current) => updates`. The function runs inside
+     * the account's `KeyedSerial` key, between the read and the write, so two
+     * changes to one account never read the same old record. It gets a copy of
+     * the account without the password hash, and returns the fields to merge, or
+     * `undefined` to change nothing (nothing is written or recorded). It must not
+     * call `updateUser` for the same account: the key is not re-entrant.
+     * Either form is checked, applied and recorded the same way.
+     *
+     * Returns the account as written (as read, when nothing changed), without
+     * the password hash: the hash never leaves UserManager except to the
+     * password check (`storedPasswordHash`).
+     */
+    updateUser(username: string, updates: UserUpdateInput | UserUpdateFn, ctx: ActorContext): Promise<Omit<User, 'password'>>;
+    /**
+     * The steps of an account change that come after the write, outside the
+     * account's key: they reach other managers, which may change the account
+     * themselves.
+     */
+    private finishEdit;
+    /** Read, check and write one account change. Runs inside the account's key (#2025). */
+    private editAccount;
     /**
      * Delete user
      */
@@ -469,6 +520,8 @@ declare class UserManager extends BaseManager {
      * who changed it, so the record says why.
      */
     private personSyncContext;
+    /** Core's bookkeeping for an account write, the read of its roles included (#2018): the system context, saying what and who changed the account. */
+    private lifecycleContext;
     /**
      * Persist a Person record paired with a newly-created User. The install's
      * anchor org (when configured) is referenced via `memberOf`; without it

package/lib/src/security/PolicyDecisionPoint.d.ts

@@ -27,8 +27,15 @@ import type { PermissionSubject, JobSubject } from '../managers/UserManager.js';
 import type { WikiEngine } from '../types/WikiEngine.js';
 import type { Decision, DecisionRequest, Policy } from '../types/Policy.js';
 import { type RoleGrant } from '../utils/roleGrants.js';
+import { type ActorContext } from '../context/ActorContext.js';
 export declare const POLICIES_KEY = "ngdpbase.access.policies";
 export declare const POLICIES_ENABLED_KEY = "ngdpbase.access.policies.enabled";
+/**
+ * What `decide`, `permits` and `holds` take (#2022): the caller's own context
+ * — a request's `PermissionSubject` or a job's `JobContext` — or a subject
+ * already in decision form (`JobSubject`). A caller passes what it was given.
+ */
+type DecisionInput = ActorContext | JobSubject | null | undefined;
 export declare class PolicyDecisionPoint extends BaseManager {
     /**
      * A manager so every PEP can reach it through `engine.getManager`, the same
@@ -84,10 +91,11 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * of {@link decide} for a capability. It was `UserManager.hasPermission`
      * until #1431 step 14; the decision was already here, only the door moved.
      *
-     * Takes a `PermissionSubject` — the request's own identity, forwarded from
-     * `req.userContext` (WikiContext, ApiContext, ParseContext) or a
-     * `JobContext` for work with no request (#631). Roles arrive already
-     * resolved; the session middleware did that once per request.
+     * Takes the caller's context as it was given (#2022): a `PermissionSubject`
+     * — the request's own identity, forwarded from `req.userContext`
+     * (WikiContext, ApiContext, ParseContext), roles already resolved by the
+     * session middleware — or a `JobContext` for work with no request (#631),
+     * which the PDP turns into a subject itself. Never convert one first.
      *
      * #1173 Part B: the username-string overload this method once accepted is
      * gone. A string cannot carry `viaToken`, so the agent-token ceiling below
@@ -98,12 +106,13 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * separate question {@link userHoldsPermission} — "does the named user hold
      * this?" — which is a lookup about somebody else, not an authorisation.
      *
-     * @param subject - The identity being authorised, with `roles` resolved and
-     *                  `viaToken` present when a bearer token authenticated it.
+     * @param subject - The caller's context: the request's subject, with
+     *                  `viaToken` present when a bearer token authenticated it,
+     *                  or a job's context.
      * @param action - Action/permission to check (e.g., 'page-create', 'user-read')
      * @returns True if the subject may perform the action under current policy
      */
-    permits(subject: PermissionSubject | JobSubject | null | undefined, action: string): Promise<boolean>;
+    permits(subject: DecisionInput, action: string): Promise<boolean>;
     /**
      * Does the subject HOLD this permission (#1635)? Policy alone — the
      * step-up freshness rule is not applied. A different question from
@@ -112,7 +121,7 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * person whose sign-in is not fresh still sees the way to the prompt that
      * makes it fresh. A door never asks this.
      */
-    holds(subject: PermissionSubject | JobSubject | null | undefined, action: string): Promise<boolean>;
+    holds(subject: DecisionInput, action: string): Promise<boolean>;
     /**
      * Step-up (#1525, #1635), decided here — in the one place every door asks —
      * rather than by routes in front of the doors. A permission marked
@@ -252,7 +261,7 @@ export declare class PolicyDecisionPoint extends BaseManager {
      *    time, not at enqueue time (#631, #1212).
      * 4. __The policies__, through `PolicyEvaluator`.
      */
-    decide(subject: PermissionSubject | JobSubject | null | undefined, request: DecisionRequest): Promise<Decision>;
+    decide(subject: DecisionInput, request: DecisionRequest): Promise<Decision>;
     /** `decide`, with the step-up rule applied or not — {@link holds} is the only caller that leaves it out. */
     private evaluate;
 }