permdock 0.3.1 → 0.5.0

package/dist/{policy-IB6yxpC3.d.ts → policy-types-DzwivBgR.d.ts}

@@ -1,6 +1,4 @@
-import { f as Permission, m as PermissionTree, p as PermissionKind, y as ResourceNode } from "./permissions-DttnqqxC.js";
-import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-DA8a8zif.js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
+import { E as PermissionTree, H as AppDataSchema, N as ResourceNode, T as PermissionKind, U as MetaValue, V as AppData, a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan, w as Permission } from "./vocabulary-D6lPdb4Z.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -133,6 +131,54 @@ declare function isCondition(value: unknown): value is Condition;
 declare function isSqlFunctionField(value: unknown): value is SqlFunctionField;
 declare function hasConditionOp(condition: Condition | undefined, op: Condition["op"]): boolean;
 //#endregion
+//#region src/conditions/normalize.d.ts
+type FieldOperator = {
+  readonly eq?: unknown;
+  readonly ne?: unknown;
+  readonly gt?: unknown;
+  readonly gte?: unknown;
+  readonly lt?: unknown;
+  readonly lte?: unknown;
+  readonly contains?: unknown;
+  readonly in?: unknown;
+  readonly notIn?: unknown;
+  readonly isNull?: boolean;
+};
+type WhereShorthand<T = Record<string, unknown>> = {
+  readonly and?: readonly WhereShorthand<T>[];
+  readonly or?: readonly WhereShorthand<T>[];
+  readonly not?: WhereShorthand<T>;
+} & ("subject" extends keyof T ? { readonly [K in keyof T as Exclude<K, "subject">]?: FieldWhere<T[K]>; } & {
+  readonly subject?: SubjectWhere | FieldWhere<T["subject"]>;
+} : { readonly [K in keyof T]?: FieldWhere<T[K]>; } & {
+  /** Holds only when the resolver checked the session live (`liveSession: true`). */
+  readonly subject?: SubjectWhere;
+});
+type SubjectWhere = {
+  readonly session: {
+    readonly live: true;
+  };
+};
+type FieldWhere<V> = V | FieldOperator | {
+  readonly ref: string;
+};
+//#endregion
+//#region src/core/open-union.d.ts
+/**
+ * A string union that stays open: the listed values autocomplete, and an
+ * integrator may pass its own. Only for ids that core compares for equality,
+ * where an unknown value can only fail to match. A union whose members core
+ * interprets one by one (denial reasons, approval modes, condition operators,
+ * credential kinds, delivery channels) stays closed.
+ */
+type OpenUnion<T extends string> = T | (string & NonNullable<unknown>);
+/** `actor.kind`: the values PermDock's adapters set, or an integrator's own; a policy delegation matches it by equality. */
+type ActorKind = OpenUnion<"mcp-client" | "oauth-client" | "support" | "impersonation" | "ai-sdk" | "claude-agent" | "openai-agent" | "eve" | "terminal" | "web-bot-auth" | "a2a-agent" | "automation" | "job" | "caller" | "workload">;
+/** The adapter a decision event names: a PermDock entry, or an integrator's own adapter. */
+type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
+/** How a membership was obtained (`membership.via`); `viaOnly` and support rules match it by equality. */
+type MembershipVia = OpenUnion<"direct" | "contact" | "credential" | "elevated" | "feed" | "link" | "share" | "support" | "support-session" | "scim">;
+//#endregion
 //#region src/core/subject.d.ts
 type JsonWebKeyLike = {
   readonly kty?: string;
@@ -177,13 +223,13 @@ type Membership = {
   readonly roles: readonly string[];
   /** Roles the holder may activate here but does not hold; `permdock.activate` writes an elevated membership. */
   readonly eligible?: readonly string[];
-  readonly via?: string;
+  readonly via?: MembershipVia;
   readonly expiresAt?: number;
   /** The principal id that wrote this membership: who elevated, consented to or granted the access. */
   readonly grantedBy?: string;
   /** Free text recording why the membership was written: the activation or consent justification. */
   readonly reason?: string;
-  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `fromJunction` group column fills it. */
+  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `junctionMembershipSource` group column fills it. */
   readonly member?: {
     readonly group: string;
   };
@@ -197,6 +243,13 @@ type Membership = {
    * Every other grant, allow or deny, ignores it, and so do role listings.
    */
   readonly keep?: readonly string[];
+  /**
+   * Data the application owns about this membership (a department, a seat
+   * label). Plain JSON from a trusted membership source, checked by
+   * `definePolicy(…, { x: { membership } })`. Never read in evaluation,
+   * conditions or RLS, and never written into token claims.
+   */
+  readonly x?: AppData;
   /** Input only: an instance of the first scope. */
   readonly tenant?: string;
   /** Input only: an instance of the second scope, inside `tenant`. */
@@ -216,7 +269,12 @@ type CustomRoleBody = {
   readonly name: string;
   readonly includes?: readonly string[];
   readonly grants?: readonly CustomRoleGrant[];
-  readonly meta?: Readonly<Record<string, unknown>>;
+  /**
+   * Display text and app data, carried onto the role leaf
+   * `assignableRoles()` returns. `x` is checked by the role tree's
+   * `defineRoles(…, { x })` schema; an invalid `x` is dropped, not the role.
+   */
+  readonly meta?: RoleMeta;
 };
 /** A role a tenant defines, held on memberships inside that tenant. */
 type TenantCustomRole = CustomRoleBody & {
@@ -244,7 +302,13 @@ type CustomRole = TenantCustomRole | GlobalCustomRole;
 type Principal = {
   readonly id: string;
   readonly issuer?: string;
-  readonly kind?: "user" | "service" | "workload" | "link";
+  /**
+   * `contact`: an external person (a customer contact, a portal user). Only
+   * its `{ on }` memberships count; it never approves, creates keys or
+   * publishes, and is read-only unless a role whose `for` lists `contact`
+   * grants the write.
+   */
+  readonly kind?: "user" | "service" | "workload" | "link" | "feed" | "contact";
   readonly roles?: readonly string[];
   readonly plans?: readonly string[];
   readonly memberships?: readonly Membership[];
@@ -259,9 +323,9 @@ type Principal = {
 };
 type Actor = {
   readonly id: string;
-  readonly kind: string;
+  readonly kind: ActorKind;
   readonly binding?: Binding;
-  /** `true` narrows every policy delegation to this actor to its read-only permissions (`readOnlyHint`). */
+  /** `true` denies every permission without `readOnlyHint` (`not-delegated`), with or without a policy delegation. */
   readonly readOnly?: boolean;
   /** The stable name the application gives this OAuth client (`ClientNames`), set by the subject resolver from the verified client id; policy delegations match it with `to: { kind, client }`. */
   readonly client?: string;
@@ -296,98 +360,26 @@ type Subject<TPrincipal extends Principal = Principal> = {
   readonly liveSession?: true;
 };
 //#endregion
-//#region src/core/scopes.d.ts
-/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
-type ScopeDeclaration = {
-  readonly key: string;
-  readonly within?: string;
+//#region src/core/decision.d.ts
+type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
+/** The `detail` each denial reason carries, where PermDock sets a structured one. */
+type DenialDetails = {
+  readonly limit: LimitDetail;
+  /** The window the inactive allow applies in. */
+  readonly "inactive-grant": WireValidity;
+  /** The matching deny's declared `name`. */
+  readonly deny: {
+    readonly name?: string;
+  };
 };
-type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
 /**
- * A declared scope, in declaration order. `key` is absent only on the
- * implicit `tenant` / `team` pair of a policy that declares no scopes.
+ * Why a candidate grant did not apply. `Denial<"limit">` types `detail` for a
+ * reason in `DenialDetails`; any other reason's detail is `unknown`.
  */
-type Scope = {
-  readonly name: string;
-  readonly key?: string;
-  readonly within?: string;
-};
-/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
-type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
-//#endregion
-//#region src/core/grantee.d.ts
-type RoleGrantee = {
-  readonly kind: "role";
-  readonly role: string;
-  /** `'global'`, a scope name, or one resource. */
-  readonly scope: string | {
-    readonly resource: string;
-  };
-};
-type AnyoneGrantee = {
-  readonly kind: "anyone";
-};
-type AuthenticatedGrantee = {
-  readonly kind: "authenticated";
-};
-type RelationGrantee = {
-  readonly kind: "relation";
-  readonly resource: string;
-  readonly relation: string;
-  /**
-   * `'parent'`: follow the row's `parent` chain upward to `resource`, then its
-   * own parents. A list of link names: follow those to-one links from the row
-   * to `resource`, then walk its parents only when `depth` is set.
-   */
-  readonly through?: "parent" | readonly string[];
-  /** Parent hops walked above the first `resource` instance; absent means `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links. */
-  readonly depth?: number;
-};
-type PlanGrantee = {
-  readonly kind: "plan";
-  readonly plan: string;
-};
-type ActorGrantee = {
-  readonly kind: "actor";
-  readonly actor: string;
-};
-type AssuranceGrantee = {
-  readonly kind: "assurance";
-  readonly acr?: readonly string[];
-  readonly amr?: readonly string[];
-  readonly maxAge?: number;
-};
-type InheritGrantee = {
-  readonly kind: "inherit";
-  readonly permission: string;
-  readonly resource: string;
-  readonly through: "parent" | readonly string[];
-};
-type Grantee = RoleGrantee | InheritGrantee | AnyoneGrantee | AuthenticatedGrantee | RelationGrantee | PlanGrantee | ActorGrantee | AssuranceGrantee;
-type GranteeInput = Grantee | Role | Plan | string | readonly GranteeInput[];
-declare function anyone(): AnyoneGrantee;
-declare function authenticated(): AuthenticatedGrantee;
-declare function relation(resource: Permission | PermissionTree, name: string, options?: {
-  readonly through?: "parent" | readonly string[];
-  readonly depth?: number;
-}): RelationGrantee;
-declare function inherit(permission: Permission, options: {
-  readonly through: "parent" | readonly string[];
-}): InheritGrantee;
-declare function plan(name: Plan | string): PlanGrantee;
-declare function actor(kind: string): ActorGrantee;
-declare function assurance(options: {
-  readonly acr?: string | readonly string[];
-  readonly amr?: string | readonly string[];
-  readonly maxAge?: number;
-}): AssuranceGrantee;
-//#endregion
-//#region src/core/decision.d.ts
-type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
-type Denial = {
+type Denial<R extends DenialReason = DenialReason> = {
   readonly role: string | null;
-  readonly reason: DenialReason;
-  readonly detail?: unknown;
+  readonly reason: R;
+  readonly detail?: [R] extends [keyof DenialDetails] ? DenialDetails[R] : unknown;
   readonly to?: Grantee | readonly Grantee[];
 };
 type MatchedGrant = {
@@ -395,6 +387,8 @@ type MatchedGrant = {
   readonly permission: string;
   /** The grant's declared `name`, when it has one. */
   readonly name?: string;
+  /** The grant's declared `meta`, when it has one; PermDock never reads it. */
+  readonly meta?: GrantMeta;
   readonly to?: Grantee | readonly Grantee[];
   readonly where?: Grant["where"];
   readonly check?: Grant["check"];
@@ -410,26 +404,35 @@ type MatchedGrant = {
  * `limit` was past its count; `near-limit`: usage reached `alertAt`.
  * `notify` / `review`: a break-glass grant's declared follow-ups.
  * `justify`: the break-glass reason, carried so audit records why.
+ * `app`: a follow-up the application declared on the grant
+ * (`allow(p, { obligations })`); PermDock carries it and never acts on it.
  */
 type Obligation = {
   readonly kind: "over-limit" | "near-limit" | "notify" | "review";
 } | {
   readonly kind: "justify";
   readonly reason: string;
+} | AppObligation;
+/** An obligation the application declares on an allow and handles itself. */
+type AppObligation = {
+  readonly kind: "app";
+  /** Lower case letters, digits, `_` and `-`, starting with a letter. */
+  readonly name: string;
+  readonly detail?: MetaValue;
 };
-/** What is left of the `limit` that applied; `resetsAt` is Unix seconds. */
+/** What is left of the `limit` that applied; `resetsAt` is RFC 3339. */
 type Quota = {
   readonly remaining: number;
-  readonly resetsAt: number;
+  readonly resetsAt: string;
 };
 /**
- * The `detail` of a `limit` denial: the grant's `count`, its window in
- * seconds and when the window resets (Unix seconds).
+ * The `detail` of a `limit` denial: the grant's `count`, its `per` window
+ * in seconds and when the window resets (RFC 3339).
  */
 type LimitDetail = {
   readonly count: number;
-  readonly window: number;
-  readonly resetsAt: number;
+  readonly per: number;
+  readonly resetsAt: string;
 };
 /**
  * Why a candidate grant for the permission was passed over before its
@@ -479,6 +482,11 @@ type GrantedDecision = {
 };
 type DeniedDecision = {
   readonly outcome: "denied";
+  /**
+   * The key of the permission that was checked. Absent on a denial for a
+   * check that named no declared permission.
+   */
+  readonly permission?: string;
   readonly denials: readonly Denial[];
   readonly alternatives: readonly Permission[];
   /** Present only with `explain: true`. */
@@ -498,527 +506,619 @@ type ExplainedDecision = Decision & {
 };
 type Decision = GrantedDecision | DeniedDecision | ApprovalRequiredDecision;
 //#endregion
-//#region src/core/approval-policies.d.ts
-/**
- * One approval requirement kept as data, for a tenant or the whole platform.
- * It adds to what the code requires and never removes a requirement.
- */
-type ApprovalPolicy = {
-  /** The permission key; a former key from `renamed` resolves. */
-  readonly permission: string;
-  /** Absent: every tenant. */
-  readonly tenant?: string;
-  /** Actor kinds it applies to (`['agent']`); absent: every call. A call without an actor never matches a list. */
-  readonly actors?: readonly string[];
-  /** A portable condition over the row; instance permissions only, since a collection action has no row. */
-  readonly where?: Condition;
-  /** A portable condition over the call's input (the proposed row). */
-  readonly check?: Condition;
+//#region src/core/grantee.d.ts
+type RoleGrantee = {
+  readonly kind: "role";
+  readonly role: string;
+  /** `'global'`, a scope name, or one resource. */
+  readonly scope: string | {
+    readonly resource: string;
+  };
+};
+type AnyoneGrantee = {
+  readonly kind: "anyone";
+};
+type AuthenticatedGrantee = {
+  readonly kind: "authenticated";
+};
+type RelationGrantee = {
+  readonly kind: "relation";
+  readonly resource: string;
+  readonly relation: string;
   /**
-   * The same shape as `allow(..., { approval })`. An `escalation` here widens
-   * only this entry's stages, never the code's.
+   * `'parent'`: follow the row's `parent` chain upward to `resource`, then its
+   * own parents. A list of link names: follow those to-one links from the row
+   * to `resource`, then walk its parents only when `depth` is set.
    */
-  readonly approval: ApprovalOption;
+  readonly through?: "parent" | readonly string[];
+  /** Parent hops walked above the first `resource` instance; absent means `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links. */
+  readonly depth?: number;
 };
-/**
- * Data-driven approval requirements, a subject input like `RoleSource`:
- * read once per instance for the subject's tenants (entries without a
- * tenant always apply). A throw, a rejected promise or an invalid entry
- * denies every call an allow would otherwise permit.
- */
-type ApprovalPolicySource = {
-  approvalPoliciesFor(query: {
-    readonly tenants: readonly string[];
-  }): readonly ApprovalPolicy[] | Promise<readonly ApprovalPolicy[]>;
-};
-/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
-declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
-declare function memoryApprovalPolicies(policies: readonly ApprovalPolicy[]): ApprovalPolicySource;
-/**
- * Why an `ApprovalPolicy` entry does not load. `unknown-permission`: the
- * policy declares no such key (the entry applies to nothing). `invalid`: a
- * field has the wrong shape or the approval option does not normalise.
- * `where-on-collection`: `where` reads a row, which a collection action
- * never has, so the entry could never match; use `check` over the input.
- * `stale-on-without-version`: `staleOn` needs an instance permission whose
- * resource declares `version`.
- */
-type ApprovalPolicyProblem = "unknown-permission" | "invalid" | "where-on-collection" | "stale-on-without-version";
-type ApprovalPolicyValidation = {
-  readonly ok: true;
-} | {
-  readonly ok: false;
-  readonly problem: ApprovalPolicyProblem;
+type PlanGrantee = {
+  readonly kind: "plan";
+  readonly plan: string;
 };
-/**
- * Checks one entry against the policy the way `approvalPoliciesFor` loads
- * it, for an application to refuse a bad entry when it is saved instead of
- * finding every call denied. Never throws.
- */
-declare function validateApprovalPolicy(policy: Policy, entry: unknown): ApprovalPolicyValidation;
-//#endregion
-//#region src/core/arazzo.d.ts
-type ArazzoSimulateInput = {
-  readonly arazzo: unknown;
-  readonly openapi: unknown;
-  readonly workflowId?: string;
-  readonly permissions?: PermissionTree;
-  readonly inputs?: Readonly<Record<string, unknown>>;
-};
-type ArazzoStepResult = {
-  readonly stepId: string;
-  /** The nested workflow that owns the step, when it is not the plan's workflow. */
-  readonly workflowId?: string;
-  readonly operationId?: string;
-  readonly permissions: readonly Permission[];
-  readonly decision: Decision;
-  readonly provisional?: true;
-};
-type ArazzoPlan = {
-  readonly workflowId: string;
-  readonly outcome: Decision["outcome"];
-  readonly steps: readonly ArazzoStepResult[];
-};
-type ArazzoFinding = {
-  readonly stepId: string;
-  readonly workflowId: string;
-  readonly reason: "undocumented" | "unsupported" | "validation" | "unknown-key";
-  readonly detail: string;
-};
-declare function arazzoFindings(input: ArazzoSimulateInput, tree: PermissionTree | undefined): readonly ArazzoFinding[];
-declare function simulateArazzo(input: ArazzoSimulateInput, tree: PermissionTree | undefined, decide: (permission: Permission, data: unknown) => Decision): ArazzoPlan;
-//#endregion
-//#region src/core/elevated.d.ts
-/**
- * The only deny override: a break-glass grant overrides deny grants whose
- * `name` it lists, and nothing else. It is an allow that stays non-portable
- * (RLS never compiles it) and grants only once its `requires` are met.
- */
-declare function breakGlass<T>(permission: Permission<string, T> | readonly Permission<string, T>[], options?: BreakGlassOptions): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
-/**
- * Support access with tenant consent: a role a vendor holds only through a
- * consented, time-bound `via: 'support'` membership. `actorRequired` denies
- * every decision under it without an `act`; `forbid` compiles to deny grants
- * scoped to `via: 'support'`.
- */
-declare function supportAccess<const S extends string>(options: SupportAccessOptions<S> & {
-  readonly on: S;
-}): RoleBinding<S>;
-/** Support access held in the `tenant` scope. */
-declare function supportAccess(options: SupportAccessOptions<never>): RoleBinding<"tenant">;
-type ActivateInput = {
-  readonly role: string | Role;
-  /** The scope the activation applies in (a declared name or the `tenant` / `team` alias). */
-  readonly scope: string;
-  readonly id: string;
-  /** Ancestor scope ids, keyed by scope name, for a nested-scope activation. */
-  readonly within?: Readonly<Record<string, string>>;
-  /** How long the elevation lasts; capped at the role's `maxDuration`. */
-  readonly duration?: string;
-  readonly reason?: string;
+type ActorGrantee = {
+  readonly kind: "actor";
+  readonly actor: string;
+};
+type AssuranceGrantee = {
+  readonly kind: "assurance";
+  readonly acr?: readonly string[];
+  readonly amr?: readonly string[];
+  readonly maxAge?: number;
+};
+type InheritGrantee = {
+  readonly kind: "inherit";
+  readonly permission: string;
+  readonly resource: string;
+  readonly through: "parent" | readonly string[];
 };
+type Grantee = RoleGrantee | InheritGrantee | AnyoneGrantee | AuthenticatedGrantee | RelationGrantee | PlanGrantee | ActorGrantee | AssuranceGrantee;
+type GranteeInput = Grantee | Role | Plan | string | readonly GranteeInput[];
+declare function anyone(): AnyoneGrantee;
+declare function authenticated(): AuthenticatedGrantee;
+declare function relation(resource: Permission | PermissionTree, name: string, options?: {
+  readonly through?: "parent" | readonly string[];
+  readonly depth?: number;
+}): RelationGrantee;
+declare function inherit(permission: Permission, options: {
+  readonly through: "parent" | readonly string[];
+}): InheritGrantee;
+declare function plan(name: Plan | string): PlanGrantee;
+declare function actor(kind: string): ActorGrantee;
+declare function assurance(options: {
+  readonly acr?: string | readonly string[];
+  readonly amr?: string | readonly string[];
+  readonly maxAge?: number;
+}): AssuranceGrantee;
 //#endregion
-//#region src/core/ownership.d.ts
-/** Who a role change is about: their principal id and their membership in the scope instance. */
-type RoleChangeTarget = {
+//#region src/core/approvers.d.ts
+/** One named approver, by principal id. */
+type UserApprover = {
+  readonly kind: "user";
   readonly id: string;
-  /** The kind of the target's membership in the instance (`staff`, `contact`, ...). */
-  readonly via?: string;
-  /** The roles the target holds in the instance now. */
-  readonly roles?: readonly string[];
-  /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
-  readonly managedBy?: "idp";
-};
-type RoleChangeBase = {
-  readonly kind: "assign" | "revoke" | "transfer";
-  readonly role: string | Role;
-  /** Ids of the instance's ancestor scopes; a holder there may assign here. */
-  readonly within?: Readonly<Record<string, string>>;
-  readonly target: RoleChangeTarget;
-  /**
-   * How many principals hold `role` in the instance now, from the
-   * application's store. Without it a role with `min`, `max` or
-   * `transferOnly` is denied.
-   */
-  readonly holders?: number;
 };
 /**
- * A role held at a named scope instance (`scope` is a declared name or alias
- * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
- * A global change has no tenant, so `within` and `holders` do not apply to it.
+ * Whoever holds `permission` in the request's tenant, through any role,
+ * custom roles included. Checked only through verdict facts
+ * (`ApprovalVerdict.permissions`) that the handler computes from the
+ * approver's own instance.
  */
-type RoleChange = RoleChangeBase & ({
-  /** The scope the role is held at (a declared name or alias). */
-  readonly scope: string;
-  /** The scope instance. */
-  readonly id: string;
-} | {
-  readonly scope: "global";
-  readonly id?: undefined;
-});
+type PermissionApprover = {
+  readonly kind: "permission";
+  readonly permission: string;
+};
+/** An approver who matches at least one item; an item that is a list matches when every entry does. */
+type AnyOfApprover = {
+  readonly kind: "any-of";
+  readonly of: readonly (Approver | readonly Approver[])[];
+};
 /**
- * `granted` names the role that authorised the change (`null` when a
- * `meta.manageRoles` holder or the declared-role ceiling did); `denied` lists
- * every rule the change breaks.
+ * Who may approve: a subject-only grantee, a `relation()` the approver holds
+ * on the requested row (checked when the verdict is given), `user(id)`,
+ * `holder(permission)`, or `anyOf(...)`. A list (or `allOf(...)`) matches an
+ * approver who satisfies every item.
  */
-type RoleChangeDecision = {
-  readonly outcome: "granted";
-  readonly change: RoleChange;
-  readonly role: string | null;
-} | {
-  readonly outcome: "denied";
-  readonly change: RoleChange;
-  readonly denials: readonly Denial[];
+type Approver = Grantee | UserApprover | PermissionApprover | AnyOfApprover;
+type ApproverInput = GranteeInput | UserApprover | PermissionApprover | {
+  readonly kind: "any-of";
+  readonly of: readonly ApproverInput[];
+} | readonly ApproverInput[];
+/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+declare function holder(permission: Permission): PermissionApprover;
+/** Approves when the approver matches any one of `items`. */
+declare function anyOf(...items: readonly ApproverInput[]): {
+  readonly kind: "any-of";
+  readonly of: readonly ApproverInput[];
 };
-type RoleChangeOptions = {
-  /**
-   * `true` when the application loaded `change.within` from its own store
-   * (the instance's stored parent), not from the request. Without it, a
-   * nested instance's tenant comes only from a live membership the actor
-   * holds on that instance or under it.
-   */
-  readonly trusted?: boolean;
+/** Approves when the approver matches every one of `items`; the same as a list. */
+declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInput[];
+/** A named approver for `approval.by`, matched on the approver's principal id. */
+declare function user(id: string): UserApprover;
+//#endregion
+//#region src/core/scopes.d.ts
+/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
+type ScopeDeclaration = {
+  readonly key: string;
+  readonly within?: string;
+};
+type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
+/**
+ * A declared scope, in declaration order. `key` is absent only on the
+ * implicit `tenant` / `team` pair of a policy that declares no scopes.
+ */
+type Scope = {
+  readonly name: string;
+  readonly key?: string;
+  readonly within?: string;
 };
+/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
+type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
 //#endregion
-//#region src/core/validation.d.ts
-type Boundary = "http-body" | "mcp-args" | "tool-args" | "decision-endpoint" | "manual";
+//#region src/core/wire-delegation.d.ts
+/**
+ * A delegation as every PermDock wire form carries it: OAuth `scope`
+ * (RFC 6749, space-separated) and RFC 9396 `authorization_details`. An empty
+ * `scope` is an empty scope list, which delegates nothing.
+ */
+type WireDelegation = {
+  readonly scope?: string;
+  readonly authorization_details?: readonly AuthorizationDetail[];
+  readonly access?: readonly GnapAccess[];
+};
 //#endregion
-//#region src/core/who-can.d.ts
-/** One way a principal holds a permission on an object. */
-type HoldingVia = {
-  readonly kind: "role";
-  readonly role: string;
-  readonly membership: Membership;
-} | {
-  readonly kind: "relation";
-  readonly resource: string;
-  readonly relation: string;
-  /** The instance the relation is held on: the object or one of its ancestors. */
-  readonly id: string;
-} | {
-  readonly kind: "share";
-  readonly resource: string;
-  readonly relation: string;
-  readonly id: string;
-  readonly expiresAt?: number;
-  /** The group the share names, when the principal holds it as one of its members. */
-  readonly group?: RelationGroup;
+//#region src/core/wire-denial.d.ts
+/**
+ * A denial as it leaves the process: in a decision event, a Problem Details
+ * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a
+ * JSON value (a string, or `LimitDetail` on `limit`); what a closure threw
+ * and a validation error stay in process.
+ */
+type WireDenial = {
+  readonly role: string | null;
+  readonly reason: DenialReason;
+  readonly to?: Grantee | readonly Grantee[];
+  readonly detail?: unknown;
+};
+/** A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends it. */
+type WireDecision = GrantedDecision | ApprovalRequiredDecision | (Omit<DeniedDecision, "denials"> & {
+  readonly denials: readonly WireDenial[];
+});
+//#endregion
+//#region src/core/event-types.d.ts
+type DirectoryEvent = {
+  readonly type: "directory";
+  readonly at: string;
+  /** `scim`, or an integrator's own directory sync. */
+  readonly source: OpenUnion<"scim">;
+  readonly operation: "create" | "replace" | "patch" | "delete";
+  readonly tenant: string;
+  readonly resource: {
+    readonly type: "User" | "Group";
+    readonly id: string;
+  };
+  readonly credential: {
+    readonly kind: "token";
+  } | {
+    readonly kind: "jwt";
+    readonly iss?: string;
+  };
+  readonly active?: boolean;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
-type Holder = {
+type MembershipEvent = {
+  readonly type: "membership";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "added" | "removed" | "changed";
   readonly principal: {
     readonly id: string;
   };
-  readonly via: readonly HoldingVia[];
+  /** A declared scope name, or the `tenant` / `team` alias; absent for a global role change. */
+  readonly scope?: string;
+  /** The scope instance; present exactly when `scope` is. */
+  readonly id?: string;
+  /** The id of every ancestor scope, keyed by scope name. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly via?: MembershipVia;
+  /** When the membership lapses, an RFC 3339 instant. */
+  readonly expiresAt?: string;
+  readonly roles: {
+    readonly added: readonly string[];
+    readonly removed: readonly string[];
+  };
+  readonly by?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 /**
- * Who holds a permission on one object, for share dialogs and access
- * reviews. It lists and never grants. `complete: false` means some grantee
- * could not be enumerated (a global role, a plan, a source without `list`,
- * an unavailable relation): holders may be missing, so check with `decide`.
+ * An API key's lifecycle: `created`, `rotated` and `revoked` from the
+ * application or a credential store, `used` from `subjectFromApiKey`. A
+ * `used` event carries `sample`, the fraction of uses reported.
  */
-type WhoCan = {
+type CredentialEvent = {
+  readonly type: "credential";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "created" | "used" | "rotated" | "revoked";
+  readonly credential: {
+    readonly id: string;
+    readonly kind: CredentialKind;
+  };
+  readonly principal: {
+    readonly id: string;
+  };
+  readonly tenant?: string;
+  /** When the key expires, an RFC 3339 instant. */
+  readonly expiresAt?: string;
+  readonly by?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+  readonly sample?: number;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+/**
+ * An automation's lifecycle: `published`, `changed` (a new version) and
+ * `revoked` from the application, `run` when a run starts. It records the
+ * delegation for access review; it never decides.
+ */
+type AutomationEvent = {
+  readonly type: "automation";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "published" | "changed" | "revoked" | "run";
+  readonly automation: {
+    readonly id: string;
+    readonly version: number | string;
+    readonly mode: "publisher" | "service";
+    readonly name?: string;
+  };
+  /** The principal each run acts as. */
+  readonly principal: {
+    readonly id: string;
+  };
+  readonly publishedBy: string;
+  readonly tenant?: string;
+  readonly roles?: readonly string[];
+  /** The delegated permission keys. */
+  readonly permissions: readonly string[];
+  /** Set on `run` events only. */
+  readonly run?: {
+    readonly id: string;
+  };
+  readonly by?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent | AutomationEvent | DeliveryEvent;
+/** A delivery channel: an email, a chat message or an outbound webhook. */
+type DeliveryChannel = "email" | "chat" | "webhook";
+/** What an email is for; only `notification` mail carries `List-Unsubscribe`. */
+type EmailCategory = "transactional" | "notification" | "security" | "approval";
+/**
+ * Why a delivery failed. `denied` and `unlinked` are the router's refusals of
+ * a recipient; the rest come from a transport or a provider webhook.
+ */
+type DeliveryFailureCause = "denied" | "unlinked" | "no-transport" | "no-message" | "invalid-recipient" | "invalid-message" | "rate-limited" | "quota-exceeded" | "unauthorized" | "unavailable" | "suppressed" | "rejected";
+/**
+ * One recipient's delivery: `sent` when a transport accepted it, then
+ * `delivered`, `bounced` or `complained` from the provider, or `failed`.
+ * It carries no address, only the principal the router checked.
+ */
+type DeliveryEvent = {
+  readonly type: "delivery";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "sent" | "delivered" | "bounced" | "complained" | "failed";
+  readonly channel: DeliveryChannel;
+  /** The delivery's id and this recipient's key, sent as the `Idempotency-Key`. */
+  readonly delivery: {
+    readonly id: string;
+    readonly key: string;
+  };
+  /** The checked principal, or `trusted` for an address the server loaded itself. */
+  readonly recipient?: {
+    readonly principal?: {
+      readonly id: string;
+    };
+    readonly trusted?: true;
+  };
+  /** The permission the recipient was checked for. */
+  readonly permission?: string;
+  readonly tenant?: string;
+  readonly category?: EmailCategory;
+  /** The approval request a prompt was delivered for. */
+  readonly approval?: string;
+  /** The transport or provider, and its message id. */
+  readonly provider?: {
+    readonly name: string;
+    readonly id?: string;
+  };
+  /** Set on `failed` only. */
+  readonly cause?: DeliveryFailureCause;
+  /** Set on `failed` only: whether a retry with the same key may succeed. */
+  readonly retryable?: boolean;
+  /** The denial reason when `cause` is `denied`. */
+  readonly reason?: string;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+/**
+ * A support-access session lifecycle event: a tenant consented to vendor
+ * support (`started`), the session lapsed (`ended`), or the tenant pulled
+ * consent early (`revoked`). It never decides; it records what happened for
+ * audit and revocation.
+ */
+type AccessEvent = {
+  readonly type: "access";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "started" | "ended" | "revoked";
+  readonly tenant: string;
+  readonly principal: {
+    readonly id: string;
+  };
+  /** The membership kind the session runs under (`support`). */
+  readonly via: MembershipVia;
+  readonly roles: readonly string[];
+  readonly member?: {
+    readonly group: string;
+  };
+  /** When the session lapses, an RFC 3339 instant. */
+  readonly expiresAt?: string;
+  /** The tenant principal that consented. */
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly actor?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+  /** A `SupportSession`: its id and the principal the staff member views as. */
+  readonly session?: {
+    readonly id: string;
+    readonly principal: string;
+  };
+  /** A `SupportSession`'s permission keys. */
+  readonly permissions?: readonly string[];
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+type DecisionEvent = {
+  readonly type: "decision";
+  /** An RFC 3339 instant. */
+  readonly at: string;
+  readonly outcome: "granted" | "denied" | "approval-required";
   readonly permission: string;
-  readonly holders: readonly Holder[];
-  readonly complete: boolean;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly subject: {
+    readonly principal: {
+      readonly id: string;
+      readonly roles: readonly string[];
+      readonly tenant?: string;
+    } | null;
+    readonly actor?: {
+      readonly id: string;
+      readonly kind: string;
+    };
+    /** OAuth `scope` and RFC 9396 `authorization_details`, as every wire form carries a delegation. */
+    readonly delegation?: WireDelegation;
+    /** The API key the subject came from. */
+    readonly credential?: {
+      readonly id: string;
+      readonly kind: CredentialKind;
+    };
+    /** The support session the subject came from: the `id` its `access` events carry as `session.id`. */
+    readonly supportSession?: {
+      readonly id: string;
+    };
+  };
+  readonly tenant?: string;
+  /** The membership that answered, with `expiresAt` as an RFC 3339 instant. */
+  readonly membership?: Omit<Membership, "expiresAt"> & {
+    readonly expiresAt?: string;
+  };
+  readonly via?: string | null;
+  readonly matched?: {
+    readonly role: string | null;
+    readonly permission: string;
+    /** The grant's declared `name`. */
+    readonly name?: string;
+    /** The grant's declared `meta`; PermDock never reads it. */
+    readonly meta?: GrantMeta;
+    readonly to?: Grantee | readonly Grantee[];
+    readonly hosted?: HostedGrantRef;
+    readonly breakGlass?: true;
+  };
+  /** What a granted decision owes, as on `GrantedDecision.obligations`. */
+  readonly obligations?: readonly Obligation[];
+  /** Purposes of use the caller asserted (`context.purpose`); present when any was. */
+  readonly purpose?: readonly string[];
+  /** The justification the caller supplied (`context.reason`); present when set. */
+  readonly reason?: string;
+  readonly denials?: readonly WireDenial[];
+  readonly alternatives?: readonly string[];
+  readonly token?: string;
+  readonly trusted: boolean;
+  /** The call that produced the decision. */
+  readonly call: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
+  readonly adapter?: AdapterId;
+  /** The model id the agent model gate decided, or the model that drove the call. */
+  readonly model?: string;
+  /** Set on an approval lifecycle event (`com.permdock.approval.<phase>`). */
+  readonly phase?: "requested" | "resolved" | "expired" | "cancelled";
+  readonly counts?: {
+    readonly granted: number;
+    readonly denied: number;
+    readonly approvalRequired: number;
+  };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+type AuthEvent = {
+  readonly reason: "invalid-token" | "schema" | "unknown-role" | "groups-overflow" | "source-threw";
+  readonly cause?: string;
+  readonly source: string;
+  /** The `name` of the source that threw, when it has one. */
+  readonly name?: string;
+  readonly kid?: string;
+  readonly alg?: string;
+  readonly typ?: string;
+  readonly issuer?: string;
+  readonly requestId?: string;
 };
 //#endregion
-//#region src/core/hosted.d.ts
-/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
-type HostedGrant = {
-  readonly id: string;
+//#region src/core/snapshot-types.d.ts
+type Snapshot = {
+  readonly v: 1;
+  /** RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the token's `iat`. */
+  readonly issuedAt: string;
+  readonly subject: {
+    readonly principal: {
+      readonly id: string;
+      readonly roles: readonly string[];
+      readonly plans?: readonly string[];
+      readonly tenant?: string;
+      readonly memberships?: readonly Membership[];
+    } | null;
+    /** OAuth `scope` and RFC 9396 `authorization_details`, as the token carried them. */
+    readonly delegation?: WireDelegation;
+    readonly context: Readonly<Record<string, unknown>>;
+  };
+  /** Roles held in the active tenant, in rank order. */
+  readonly roles: readonly string[];
+  /** The distinct `meta.audience` values of `roles`, in rank order; absent when none has one. */
+  readonly audiences?: readonly string[];
+  readonly grants: readonly SnapshotGrant[];
+  readonly tenants: readonly string[];
+  readonly include?: readonly string[];
+  readonly simulated?: true;
+  /** RFC 3339. Signed, it is the token's `exp`. */
+  readonly expiresAt?: string;
+  readonly vocabulary?: {
+    readonly roles?: Readonly<Record<string, Role>>;
+    readonly plans?: Readonly<Record<string, Plan>>;
+  };
+  /** The policy's scopes in order, so a client checks the row against each membership's instance. */
+  readonly scopes?: readonly SnapshotScope[];
+  /** One entry per tenant in `tenants`: what the subject may hand out there. Absent without tenants. */
+  readonly assignable?: readonly SnapshotAssignable[];
+  /**
+   * Allow grants of held roles that only a plan the subject lacks keeps
+   * from applying; they grant nothing and name the plan a denial asks for.
+   */
+  readonly notEntitled?: readonly SnapshotNotEntitled[];
+  /**
+   * The row id field per resource whose `id` option is not `id`, for the
+   * grants in `grants`. Absent when every one reads `id`.
+   */
+  readonly ids?: Readonly<Record<string, string>>;
+  /**
+   * The permission keys the policy's delegations let the actor use for the
+   * principal, sorted; present only when one applies. Outside it a check is
+   * `not-delegated`; inside it a token delegation, when there is one, must
+   * still cover.
+   */
+  readonly delegated?: readonly string[];
+};
+/** A grant the subject would hold on another plan: its permission, role and `to`. */
+type SnapshotNotEntitled = {
   readonly permission: string;
-  readonly effect?: "allow" | "deny";
+  readonly role: string | null;
+  readonly to: Grantee | readonly Grantee[];
+};
+/** One declared scope as a snapshot carries it. */
+type SnapshotScope = {
+  readonly name: string;
+  readonly key: string;
+  readonly within?: string;
+  /** Resources whose rows this scope's key partitions, from their `memberOf` relations. */
+  readonly resources?: readonly string[];
+  /** Resource name to the field holding this scope's id, for a resource whose field is not `key` (its own `id`). */
+  readonly fields?: Readonly<Record<string, string>>;
+};
+/** The declared roles and the custom-role ceiling the subject may assign in one tenant. */
+type SnapshotAssignable = {
+  readonly tenant: string;
+  readonly roles: readonly string[];
+  readonly permissions: readonly Permission[];
+  /** Permission key to the levels the subject may hand out; only permissions whose resource declares levels. */
+  readonly levels?: Readonly<Record<string, readonly string[]>>;
+};
+type SnapshotGrant = {
+  readonly permission: string;
+  readonly effect: "allow" | "deny";
+  readonly role: string | null;
   readonly to: Grantee | readonly Grantee[];
   readonly where?: Condition;
   readonly check?: Condition;
   readonly approval?: "human" | ApprovalRequirement;
+  /** A scope name or one resource; absent for a global grant. */
+  readonly scope?: string | {
+    readonly resource: string;
+  };
+  readonly membership?: Membership;
+  readonly portable?: false;
   readonly fields?: readonly string[];
+  /** When the grant applies (RFC 3339, `from` inclusive, `until` exclusive); absent means always. */
+  readonly validity?: WireValidity;
+  /** The grant's declared `name`. */
+  readonly name?: string;
+  /** The grant's declared `meta`; visible to the client that holds the snapshot. */
+  readonly meta?: GrantMeta;
+  /** The app obligations an allow declares, emitted on a granted decision. */
+  readonly obligations?: readonly AppObligation[];
 };
-/** PolicyDocument v1: the payload of a `permdock-policy+jwt` under the `policy` claim. */
-type PolicyDocument = {
+/**
+ * What a policy grants, as JSON a client builds snapshots from without the
+ * policy: `localSnapshotManifest(policy)` writes it, `localSnapshot` in
+ * `permdock/react-native` reads it.
+ */
+type LocalSnapshotManifest = {
   readonly v: 1;
-  readonly id: string;
-  readonly fingerprint: string;
-  /** The catalog fingerprint the document was authored against. */
-  readonly catalog: string;
-  readonly issuedAt: number;
-  readonly grants: readonly HostedGrant[];
+  readonly scopes?: readonly SnapshotScope[];
+  readonly vocabulary?: Snapshot["vocabulary"];
+  /** Declared role names; a custom role cannot take one. */
+  readonly roles: readonly string[];
+  /** Declared role names in rank order, when an `assigns` graph ranks them. */
+  readonly rank?: readonly string[];
+  /** Every declared grant, without a membership. */
+  readonly grants: readonly SnapshotGrant[];
+  /** Per custom-role scope (`global` for platform roles): the grants each entry resolves to. */
+  readonly custom: Readonly<Record<string, LocalCustomRoleTable>>;
 };
+/** Grants a custom role entry resolves to, held by a placeholder role the client renames. */
+type LocalCustomRoleTable = {
+  /** `{ permission }` per permission key, and `{ permission, level }` per declared level. */
+  readonly permissions: Readonly<Record<string, {
+    readonly all: readonly SnapshotGrant[];
+    readonly levels?: Readonly<Record<string, readonly SnapshotGrant[]>>;
+  }>>;
+  /** `includes: [role]` per declared role. */
+  readonly includes: Readonly<Record<string, readonly SnapshotGrant[]>>;
+};
+//#endregion
+//#region src/core/time.d.ts
 /**
- * The channel for hosted grants. `createPermDock` reads `current()` once;
- * the application calls `refresh()` on its own schedule, never a check.
+ * The one time rule: NumericDate (whole seconds) for JWT registered claims
+ * and the claims SQL reads, RFC 3339 for every other JSON field, integer
+ * seconds for durations, and an `Instant` for every runtime `now`.
  */
-type PolicySource = {
-  current(): PolicyDocument | null;
-  refresh(): Promise<void>;
-};
-type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
-/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
-type HostedGrantDropped = {
-  readonly kind: "hosted-grant-dropped";
-  readonly document: string;
-  readonly grant: string;
-  readonly reason: HostedGrantDropReason;
-};
-declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
-/** Validates the document envelope; per-grant checks happen at merge time. */
-declare function parsePolicyDocument(json: unknown): PolicyDocument;
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
-declare function isPortableCondition(value: unknown): value is Condition;
 /**
- * The code policy plus the hosted grants that pass every rule. Hosted
- * allows OR with code allows and any deny still wins, so a hosted grant can
- * never override a code deny; one that fails a rule is dropped, not thrown.
+ * The part of a `Temporal.Instant` PermDock reads. Public options take it
+ * structurally so their declarations compile under a TypeScript lib without
+ * `Temporal` (5.9); every `Temporal.Instant` satisfies it.
  */
-declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
-  readonly policy: Policy;
-  readonly dropped: readonly HostedGrantDropped[];
+type Instant = {
+  readonly epochMilliseconds: number;
 };
 //#endregion
-//#region src/core/permdock.d.ts
-type DecideOptions = {
-  /** `true` skips schema validation for a row the server loaded itself. Otherwise `data` is validated against the resource schema first (`validate: 'boundary'`), and a failure denies with reason `validation`. */
-  readonly trusted?: boolean;
-  /** Where untrusted data came from, reported on validation errors. Defaults to `'manual'`. */
-  readonly boundary?: Boundary;
-  /** Decision clock in Unix seconds, for expiries and limits. Defaults to the current time. */
-  readonly now?: number;
-  /** The call that produced the decision, reported on the decision event. Defaults to `'decide'`. */
-  readonly source?: DecisionEvent["source"];
-  /** The adapter that made the call, reported on the decision event. */
-  readonly adapter?: string;
-  /** Per-call unauthorized handler for `assert`; runs before instance and policy handlers. */
-  readonly onDenied?: (decision: Decision) => never | void;
-  /** The field being read or written; only grants whose `fields` cover it match. */
-  readonly field?: string;
-  /** `true` attaches a `trace` to the decision: the grants evaluated, matched and skipped. Off by default and free when off. */
-  readonly explain?: boolean;
-  /**
-   * A declared scope name: only memberships of that scope answer the check.
-   * Naming the first scope keeps nested memberships out of a tenant-level
-   * guard on a collection action. Global roles still apply; resource roles
-   * and memberships of other scopes are skipped with reason `scope`.
-   */
-  readonly scope?: string;
-};
-type SimulateOptions = {
-  /** Decision clock in Unix seconds for the whole batch: grant validity, membership expiry and limits are read as of this instant. Defaults to the current time. */
-  readonly now?: number;
-};
-type RowPair<T> = {
-  readonly current: T;
-  readonly next: T;
-};
-type WhereResult = {
-  readonly condition: Condition | {
-    readonly op: "or";
-    readonly conditions: readonly [];
-  };
-  readonly partial: boolean;
-  /**
-   * The subject `where()` was built for. `toWhere` reads its memberships for
-   * `memberOf` when no `subject` option is passed. Not enumerable, so it never
-   * serialises with the result.
-   */
-  readonly subject?: Subject;
-  /** The policy's scopes, for `memberOf`; not enumerable either. */
-  readonly scopes?: readonly Scope[];
-  /** The policy's resource graph, for `related`; not enumerable either. */
-  readonly resources?: ReadonlyMap<string, ResourceNode>;
-};
-type SnapshotOptions = {
-  readonly include?: readonly (Permission | {
-    readonly [key: string]: unknown;
-  })[];
-  readonly tenants?: "all";
-  readonly signer?: TokenSigner;
-  readonly audience?: string | readonly string[];
-};
-type PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly can: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): boolean;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): boolean;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): boolean;
-  };
-  readonly decide: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): Decision;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): Decision;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): Decision;
-  };
-  readonly assert: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-  };
-  /**
-   * `decide` with `explain: true`: the same decision, with a `trace` that
-   * names the grants evaluated, the allows and denies that matched (so a
-   * `denied` says which deny won) and the grants passed over. Local
-   * computation only; the trace never reaches a `DecisionSink`.
-   */
-  readonly explain: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-    (permission: Permission, data: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-  };
-  readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => T[];
-  readonly pick: <T>(permission: Permission<string, T, "instance">, row: T, options?: DecideOptions) => Partial<T>;
-  readonly where: (permission: Permission) => WhereResult;
-  readonly actions: (resource: Permission | {
-    readonly [key: string]: unknown;
-  }, data: unknown, options?: DecideOptions) => Permission[];
-  readonly simulate: {
-    (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Decision[];
-    (preview: {
-      readonly roles?: readonly (string | Role)[];
-      readonly memberships?: readonly Membership[];
-      readonly tenant?: string;
-    }): PermDock<V>;
-    (plan: ArazzoSimulateInput): ArazzoPlan;
-  };
-  readonly snapshot: {
-    (options?: SnapshotOptions & {
-      readonly signer?: undefined;
-    }): Snapshot;
-    (options: SnapshotOptions & {
-      readonly signer: TokenSigner;
-    }): Promise<string>;
-    (options?: SnapshotOptions): Snapshot | Promise<string>;
-  };
-  readonly on: (event: "decision" | "denied" | "approval" | "auth" | "error", handler: (payload: unknown) => void) => () => void;
-  readonly tenant: (id: string) => PermDock<V>;
-  readonly team: (id: string) => PermDock<V>;
-  readonly memberships: () => readonly Membership[];
-  readonly tenants: () => readonly string[];
-  /**
-   * Roles held in a tenant (the active one by default), or only on the
-   * memberships of one `scope` (and instance `id`). Ordered by rank: a role
-   * comes before the roles its `assigns` lists.
-   */
-  readonly heldRoles: (options?: {
-    readonly tenant?: string;
-    readonly scope?: string;
-    readonly id?: string;
-  }) => readonly Role[];
-  /** The distinct `meta.audience` values of the roles held in the active tenant, in rank order. */
-  readonly audiences: () => readonly string[];
-  /**
-   * The roles the subject may hand out in a tenant (the active one by
-   * default), or with `scope: 'global'` the global roles it may hand out. A
-   * snapshot answers only the tenant form.
-   */
-  readonly assignableRoles: (options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly Role[];
-  /**
-   * The custom-role ceiling the subject may hand out: in a tenant (empty
-   * without one), or with `scope: 'global'` for platform custom roles, the
-   * allows of assignable global roles the subject holds. A snapshot answers
-   * only the tenant form.
-   */
-  readonly assignablePermissions: (options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly Permission[];
-  /**
-   * The levels of `permission` (`resource(…, { levels })`) the subject may
-   * hand out in a custom role: those it holds, or every level with
-   * `meta.manageRoles`. Empty when the permission is not assignable.
-   */
-  readonly assignableLevels: (permission: Permission, options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly string[];
-  /**
-   * Whether the subject may assign, revoke or transfer a role in one scope
-   * instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`, `max`
-   * and `transferOnly`. It never writes; the application does, and generated
-   * RLS triggers re-check the holder counts at commit. A nested instance's
-   * tenant comes from a live membership the subject holds on it, or from
-   * `change.within` only with `{ trusted: true }`; otherwise `no-membership`.
-   */
-  readonly decideRoleChange: (change: RoleChange, options?: RoleChangeOptions) => RoleChangeDecision;
-  /**
-   * Loads the relation facts `permission` needs for `rows` into this
-   * instance's cache, so `can`, `decide` and `filter` answer synchronously
-   * over an async `RelationSource`. It never grants; a failed load leaves
-   * the checks denied with `relation-unavailable`.
-   */
-  readonly loadRelations: (permission: Permission, rows: readonly unknown[]) => Promise<void>;
-  /**
-   * Who holds `permission` on `resource` and how (role, relation or share),
-   * from `MembershipSource.list` and `RelationSource.related`. It lists and
-   * never grants; `complete: false` means some holders could not be listed.
-   */
-  readonly whoCan: (permission: Permission<string, unknown, "instance">, resource: unknown) => Promise<WhoCan>;
-  /**
-   * Requests a just-in-time activation of an eligible role. It never writes:
-   * a granted decision carries the elevated membership under `elevation` for
-   * the app to write, and `approval-required` comes back first when the
-   * role's `activation` sets `approval`.
-   */
-  readonly activate: (input: ActivateInput) => Decision;
-  readonly roles: V["roles"] extends RoleTree ? V["roles"] : RoleTree;
-  readonly plans: V["plans"] extends PlanTree ? V["plans"] : PlanTree;
-  readonly permissions: V["permissions"] extends Policy["permissions"] ? V["permissions"] : Policy["permissions"];
+//#region src/core/internals.d.ts
+/**
+ * Any instance a feature function accepts: a server `PermDock`, one built
+ * from a snapshot, or an adapter's wrapper such as `PdpPermDock`.
+ */
+type InstanceHandle = {
   readonly subject: Subject;
-  /**
-   * The same subject, tenant, team, actor, delegation, sink and limits with
-   * other sources: `customRoles`, `approvalPolicies` or `relations`. The
-   * sources it names are read again for the subject's tenants; the others
-   * keep what this instance loaded. Returns a promise when a source it names
-   * answers asynchronously.
-   */
-  readonly derive: (options: DeriveOptions) => PermDock<V> | Promise<PermDock<V>>;
 };
-/** What `permdock.derive` may replace: the sources read after the subject is resolved. */
-type DeriveOptions = Pick<PermDockOptions, "customRoles" | "approvalPolicies" | "relations">;
-type PermDockOptions = {
-  readonly tenant?: string;
-  /** One source, or several composed with `composeMemberships`. */
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  readonly customRoles?: RoleSource | RoleSourceFactory;
-  /** Plans and seats from billing, merged into `principal.plans` for the active tenant. */
-  readonly entitlements?: EntitlementSource;
-  readonly actor?: Actor;
-  readonly delegation?: Delegation;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly session?: string;
-  readonly expiresAt?: number;
-  /** Hosted grants; `current()` is read once, when the instance is created. */
-  readonly policies?: PolicySource;
-  /** The object graph for `through` and edge-table relations; without it they deny with `relation-unavailable`. */
-  readonly relations?: RelationSource;
-  /** Approval requirements kept as data; they add to the code's and never remove one. A throw denies. */
-  readonly approvalPolicies?: ApprovalPolicySource;
-};
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: PermDockOptions): PermDock<V> | Promise<PermDock<V>>;
 //#endregion
 //#region src/core/credential.d.ts
-type CredentialKind = "user" | "service";
+type CredentialKind = "user" | "service" | "feed";
+/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+declare function isFeedId(value: string): boolean;
 /** One permission (a key) a credential may use: on every instance, or only on `ids`. */
 type CredentialPermission = {
   readonly permission: string;
@@ -1043,17 +1143,22 @@ type Credential = {
    * credential, where it keeps only the owner's memberships inside it.
    */
   readonly tenant?: string;
-  /** Service only: the roles it holds in `tenant`. */
+  /** Service: the roles it holds in `tenant`. Feed: the resource roles it holds on `on`. */
   readonly roles?: readonly string[];
+  /** Feed only: the resource instance the roles are held on. */
+  readonly on?: {
+    readonly resource: string;
+    readonly id: string;
+  };
   readonly permissions: readonly CredentialPermission[];
   readonly createdBy: string;
-  /** Seconds since the epoch. */
-  readonly createdAt: number;
-  /** Seconds since the epoch; absent only where a credential policy allows it. */
-  readonly expiresAt?: number;
+  /** RFC 3339. */
+  readonly createdAt: string;
+  /** RFC 3339; absent only where a credential policy allows it. */
+  readonly expiresAt?: string;
   readonly name?: string;
 };
-type CredentialPrincipal = Principal & {
+type ApiKeyPrincipal = Principal & {
   readonly credential: Credential;
 };
 /**
@@ -1078,7 +1183,8 @@ type CredentialPermissionInput = Permission | {
 type CredentialRequestBase = {
   readonly id: string;
   readonly permissions: readonly CredentialPermissionInput[];
-  readonly expiresAt?: number;
+  /** RFC 3339; must be after `now`. */
+  readonly expiresAt?: string;
   readonly name?: string;
 };
 type CredentialRequest = (CredentialRequestBase & {
@@ -1091,6 +1197,15 @@ type CredentialRequest = (CredentialRequestBase & {
   readonly principal?: string;
   readonly tenant: string;
   readonly roles: readonly string[];
+}) | (CredentialRequestBase & {
+  readonly kind: "feed";
+  readonly on: {
+    readonly resource: Permission | PermissionTree;
+    readonly id: string;
+  };
+  readonly roles: readonly string[];
+  /** A row the server loaded. Each permission must be granted on it. */
+  readonly row: unknown;
 });
 type CredentialDecision = {
   readonly outcome: "granted";
@@ -1109,8 +1224,8 @@ type DecideCredentialOptions = {
   readonly settings?: SettingsSource;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
-  /** Seconds since the epoch. */
-  readonly now?: number;
+  /** The creation time; defaults to the clock. */
+  readonly now?: Instant;
 };
 /**
  * The first rule of `policy` the credential breaks, or `undefined`. A key
@@ -1132,20 +1247,6 @@ declare function parseCredential(input: unknown): Credential | undefined;
  * key is gone delegates nothing and every check is denied.
  */
 declare function credentialDelegation(credential: Credential, permissions: PermissionTree): Delegation;
-/**
- * The subject a verified credential acts as. A `user` credential is its
- * owner, passed live as `owner` (roles and memberships as of this request),
- * with the credential's delegation: every check is the owner's rights
- * intersected with the key's. One that names a `tenant` makes it the active
- * tenant, and `createPermDock` then keeps only the owner's memberships
- * inside it and no global role. A `service` credential is a `service`
- * principal whose only membership is `roles` in `tenant`. An owner whose id
- * is not the credential's `principal`, or who is not a user, is anonymous.
- */
-declare function credentialSubject(credential: Credential, options: {
-  readonly permissions: PermissionTree;
-  readonly owner?: Principal;
-}): Subject<CredentialPrincipal> | Subject;
 /**
  * Decides whether the subject of `permdock` may create the credential in
  * `request`. The creator must be a signed-in user or service that is not
@@ -1160,25 +1261,113 @@ declare function credentialSubject(credential: Credential, options: {
  * its token. PermDock never stores the credential; the application does,
  * after a `granted` result.
  */
-declare function decideCredential(permdock: PermDock, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
+/**
+ * Decides whether the subject of `permdock` may create the credential in
+ * `request`: the creator's own reach, the `credentials` policy of the key's
+ * tenant (the call's `settings`, else the instance's), and `approval`.
+ * PermDock never stores the credential; the application does, after a
+ * `granted` result. An instance built from a snapshot denies with
+ * `unsupported`.
+ */
+declare function decideCredential(permdock: InstanceHandle, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
 //#endregion
-//#region src/core/wire-denial.d.ts
+//#region src/core/support-session.d.ts
 /**
- * A denial as it leaves the process: in a decision event, a Problem Details
- * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a
- * JSON value (a string, or `LimitDetail` on `limit`); what a closure threw
- * and a validation error stay in process.
+ * SupportSession v1: a support staff member (`actor`, kind `support`)
+ * viewing the app as `principal` in `tenant`, for a stated `reason`. Each
+ * request in the session acts as `principal` with their live rights,
+ * narrowed to `permissions`.
  */
-type WireDenial = {
-  readonly role: string | null;
-  readonly reason: DenialReason;
-  readonly to?: Grantee | readonly Grantee[];
-  readonly detail?: unknown;
+type SupportSession = {
+  readonly v: 1;
+  readonly id: string;
+  /** The person the session views the app as. */
+  readonly principal: string;
+  /** The support staff member running the session. */
+  readonly actor: string;
+  readonly tenant: string;
+  readonly reason: string;
+  /** The delegation: permission keys, read-only unless listed on purpose. */
+  readonly permissions: readonly string[];
+  /** RFC 3339. */
+  readonly startedAt: string;
+  /** RFC 3339. */
+  readonly expiresAt: string;
+  /** Who approved the session; never `actor`. */
+  readonly approvedBy?: string;
+  /** The application's ticket or case id. */
+  readonly reference?: string;
+};
+/** A tenant's rules for support sessions. Every field only tightens. */
+type SupportSessionPolicy = {
+  /** No session may start in this tenant. */
+  readonly disabled?: boolean;
+  /** Longest a session may last, in seconds. */
+  readonly maxTtl?: number;
+  /** Only `readOnlyHint` permissions, whatever the request lists. */
+  readonly readOnly?: boolean;
 };
-/** A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends it. */
-type WireDecision = GrantedDecision | ApprovalRequiredDecision | (Omit<DeniedDecision, "denials"> & {
-  readonly denials: readonly WireDenial[];
-});
+type SupportSessionRequest = {
+  readonly id: string;
+  /** The person to view the app as. */
+  readonly principal: string;
+  /** Defaults to the actor's active tenant. */
+  readonly tenant?: string;
+  /** Required: why the session is needed. */
+  readonly reason: string;
+  /** Defaults to every `readOnlyHint` permission the actor can use. */
+  readonly permissions?: readonly Permission[];
+  /** Seconds the session lasts. Defaults to 3600; at most 86400. */
+  readonly expiresIn?: number;
+  readonly reference?: string;
+};
+type SupportSessionDecision = {
+  readonly outcome: "granted";
+  readonly session: SupportSession;
+} | {
+  readonly outcome: "approval-required";
+  readonly session: SupportSession;
+  /** Bound to the request and the actor; pass it as `approved` to resume. */
+  readonly token: string;
+} | {
+  readonly outcome: "denied";
+  readonly denials: readonly Denial[];
+};
+type DecideSupportSessionOptions = {
+  /** Where the tenant's `supportSessions` policy comes from. */
+  readonly settings?: SettingsSource;
+  /** Approval is required unless this is `false`. */
+  readonly approval?: boolean;
+  /** The `token` of an approval the application consumed for this request. */
+  readonly approved?: string;
+  /** The principal id that approved; required with `approved` and never the actor. */
+  readonly approvedBy?: string;
+  /** The start time; defaults to the clock. */
+  readonly now?: Instant;
+};
+/**
+ * Validates an untrusted support-session record and returns a frozen copy
+ * with only the v1 fields, or `undefined`.
+ */
+declare function parseSupportSession(input: unknown): SupportSession | undefined;
+/**
+ * Decides whether the subject of `permdock` may start the support session
+ * in `request`. The actor must be a signed-in person acting for themselves
+ * (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
+ * member of the tenant (`tenant-mismatch`) and be able to use every
+ * permission (`exceeds-creator`). Without `permissions` the session gets the
+ * actor's read-only permissions. The tenant's `supportSessions` policy then
+ * applies, and the result is `approval-required` until `approved` carries
+ * its token and `approvedBy` names someone other than the actor.
+ */
+/**
+ * Decides whether the subject of `permdock` may start the support session
+ * in `request` and returns the record to sign: a stated reason, membership
+ * of the tenant, the actor's own reach, the tenant's `supportSessions`
+ * policy and approval by someone else. An instance built from a snapshot
+ * denies with `unsupported`.
+ */
+declare function decideSupportSession(permdock: InstanceHandle, request: SupportSessionRequest, options?: DecideSupportSessionOptions): Promise<SupportSessionDecision>;
 //#endregion
 //#region src/core/interfaces.d.ts
 type DecisionProvider = {
@@ -1200,9 +1389,11 @@ type DecisionProvider = {
     readonly subject: Subject;
   }): Promise<readonly string[] | null | undefined>;
 };
-type RoleSource = {
+type CustomRoleSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   /**
-   * The custom roles of one tenant. `createPermDock` passes `held`, the role
+   * The custom roles of one tenant. `getPermDock` passes `held`, the role
    * names the subject's live memberships hold there, declared or not, so a
    * source can skip its read when none of them is a custom role.
    */
@@ -1220,12 +1411,12 @@ type RoleSource = {
   }): CustomRole[] | Promise<CustomRole[]>;
 };
 /**
- * A `RoleSource` built for the subject the instance serves, for an adapter
+ * A `CustomRoleSource` built for the subject the instance serves, for an adapter
  * option shared by every request: it gets the resolved subject (principal,
  * actor and delegation) and returns that subject's source, or `undefined`
  * for none. A throw reads no custom roles and reports `source-threw`.
  */
-type RoleSourceFactory = (subject: Subject) => RoleSource | undefined;
+type CustomRoleSourceFactory = (subject: Subject) => CustomRoleSource | undefined;
 /** One member of a scope instance, as `MembershipSource.list` returns it. */
 type MemberEntry = {
   readonly principal: {
@@ -1234,6 +1425,8 @@ type MemberEntry = {
   readonly membership: Membership;
 };
 type MembershipSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   membershipsFor(principal: {
     readonly id: string;
     readonly kind?: string;
@@ -1306,6 +1499,8 @@ type RelationHolder = HolderPeriod & ({
  * `relation-unavailable`.
  */
 type RelationSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   /**
    * With `through: 'parent'`, the parent chain; with a link name, the one
    * instance that link points to (`depth` is then 1).
@@ -1328,13 +1523,14 @@ type RelationSource = {
 };
 /** Plan and seat names a principal holds in a tenant, from billing (Stripe Entitlements, a table). */
 type EntitlementSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   entitlementsFor(principal: {
     readonly id: string;
   }, options: {
     readonly tenant?: string;
   }): string[] | Promise<string[]>;
 };
-declare function memoryEntitlementSource(entries: Readonly<Record<string, readonly string[]>>): EntitlementSource;
 type JwtClaims = {
   readonly iss?: string;
   readonly sub?: string;
@@ -1360,6 +1556,8 @@ type VerificationFailure = {
   readonly cause: TokenFailureCause;
 };
 type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   verify(token: string, expectations: {
     readonly typ?: string | readonly string[];
     readonly audience?: string | readonly string[];
@@ -1368,139 +1566,30 @@ type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
   }): Promise<VerifiedToken<TClaims> | VerificationFailure>;
 };
 type TokenSigner = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   sign(payload: Readonly<Record<string, unknown>>, options: {
-    readonly typ: "permdock-snapshot+jwt" | "permdock-approval+jwt" | "permdock-decisions+jwt" | "permdock-policy+jwt" | "permdock-capability+jwt";
+    readonly typ: "vnd.permdock.snapshot+jwt" | "vnd.permdock.approval+jwt" | "vnd.permdock.policy+jwt" | "vnd.permdock.capability+jwt" | "vnd.permdock.run+jwt" | "vnd.permdock.support-session+jwt" | "vnd.permdock.evidence+jwt" | "at+jwt" | "secevent+jwt";
+    /** `aud`; a signer with no default audience refuses to sign without one. */
     readonly audience?: string | readonly string[];
+    /** `exp`, a NumericDate; one hour after `iat` when absent. */
     readonly expiresAt?: number;
-  }): Promise<string>;
-  readonly kid?: string;
-  jwks?(): Promise<{
-    readonly keys: readonly JsonWebKeyLike[];
-  }>;
-};
-type SubjectResolver<TInput, TPrincipal extends Principal = Principal> = (input: TInput, options?: {
-  readonly tenant?: string;
-}) => Subject<TPrincipal> | Promise<Subject<TPrincipal>>;
-type Snapshot = {
-  readonly v: 1;
-  readonly issuedAt: number;
-  readonly subject: {
-    readonly principal: {
-      readonly id: string;
-      readonly roles: readonly string[];
-      readonly plans?: readonly string[];
-      readonly tenant?: string;
-      readonly memberships?: readonly Membership[];
-    } | null;
-    readonly delegation?: Subject["delegation"];
-    readonly context: Readonly<Record<string, unknown>>;
-  };
-  /** Roles held in the active tenant, in rank order. */
-  readonly roles: readonly string[];
-  /** The distinct `meta.audience` values of `roles`, in rank order; absent when none has one. */
-  readonly audiences?: readonly string[];
-  readonly grants: readonly SnapshotGrant[];
-  readonly tenants: readonly string[];
-  readonly include?: readonly string[];
-  readonly simulated?: true;
-  readonly expiresAt?: number;
-  readonly vocabulary?: {
-    readonly roles?: Readonly<Record<string, Role>>;
-    readonly plans?: Readonly<Record<string, Plan>>;
-  };
-  /** The policy's scopes in order, so a client checks the row against each membership's instance. */
-  readonly scopes?: readonly SnapshotScope[];
-  /** One entry per tenant in `tenants`: what the subject may hand out there. Absent without tenants. */
-  readonly assignable?: readonly SnapshotAssignable[];
-  /**
-   * Allow grants of held roles that only a plan the subject lacks keeps
-   * from applying; they grant nothing and name the plan a denial asks for.
-   */
-  readonly notEntitled?: readonly SnapshotNotEntitled[];
-  /**
-   * The row id field per resource whose `id` option is not `id`, for the
-   * grants in `grants`. Absent when every one reads `id`.
-   */
-  readonly ids?: Readonly<Record<string, string>>;
-  /**
-   * The permission keys the policy's delegations let the actor use for the
-   * principal, sorted; present only when one applies. Outside it a check is
-   * `not-delegated`; inside it a token delegation, when there is one, must
-   * still cover.
-   */
-  readonly delegated?: readonly string[];
-};
-/** A grant the subject would hold on another plan: its permission, role and `to`. */
-type SnapshotNotEntitled = {
-  readonly permission: string;
-  readonly role: string | null;
-  readonly to: Grantee | readonly Grantee[];
-};
-/** One declared scope as a snapshot carries it. */
-type SnapshotScope = {
-  readonly name: string;
-  readonly key: string;
-  readonly within?: string;
-  /** Resources whose rows this scope's key partitions, from their `memberOf` relations. */
-  readonly resources?: readonly string[];
-  /** Resource name to the field holding this scope's id, for a resource whose field is not `key` (its own `id`). */
-  readonly fields?: Readonly<Record<string, string>>;
-};
-/** The declared roles and the custom-role ceiling the subject may assign in one tenant. */
-type SnapshotAssignable = {
-  readonly tenant: string;
-  readonly roles: readonly string[];
-  readonly permissions: readonly Permission[];
-  /** Permission key to the levels the subject may hand out; only permissions whose resource declares levels. */
-  readonly levels?: Readonly<Record<string, readonly string[]>>;
-};
-type SnapshotGrant = {
-  readonly permission: string;
-  readonly effect: "allow" | "deny";
-  readonly role: string | null;
-  readonly to: Grantee | readonly Grantee[];
-  readonly where?: Condition;
-  readonly check?: Condition;
-  readonly approval?: "human" | ApprovalRequirement;
-  /** A scope name or one resource; absent for a global grant. */
-  readonly scope?: string | {
-    readonly resource: string;
-  };
-  readonly membership?: Membership;
-  readonly portable?: false;
-  readonly fields?: readonly string[];
-  /** When the grant applies (Unix seconds, `from` inclusive, `until` exclusive); absent means always. */
-  readonly validity?: GrantValidity;
-};
-/**
- * What a policy grants, as JSON a client builds snapshots from without the
- * policy: `localSnapshotManifest(policy)` writes it, `localSnapshot` in
- * `permdock/react-native` reads it.
- */
-type LocalSnapshotManifest = {
-  readonly v: 1;
-  readonly scopes?: readonly SnapshotScope[];
-  readonly vocabulary?: Snapshot["vocabulary"];
-  /** Declared role names; a custom role cannot take one. */
-  readonly roles: readonly string[];
-  /** Declared role names in rank order, when an `assigns` graph ranks them. */
-  readonly rank?: readonly string[];
-  /** Every declared grant, without a membership. */
-  readonly grants: readonly SnapshotGrant[];
-  /** Per custom-role scope (`global` for platform roles): the grants each entry resolves to. */
-  readonly custom: Readonly<Record<string, LocalCustomRoleTable>>;
-};
-/** Grants a custom role entry resolves to, held by a placeholder role the client renames. */
-type LocalCustomRoleTable = {
-  /** `{ permission }` per permission key, and `{ permission, level }` per declared level. */
-  readonly permissions: Readonly<Record<string, {
-    readonly all: readonly SnapshotGrant[];
-    readonly levels?: Readonly<Record<string, readonly SnapshotGrant[]>>;
-  }>>;
-  /** `includes: [role]` per declared role. */
-  readonly includes: Readonly<Record<string, readonly SnapshotGrant[]>>;
+    /** `iat`, a NumericDate: the artefact's issue time. The signer's clock when absent. */
+    readonly issuedAt?: number;
+    /** `jti`: the artefact's id. A fresh UUID when absent. */
+    readonly jti?: string;
+  }): Promise<string>;
+  readonly kid?: string;
+  jwks?(): Promise<{
+    readonly keys: readonly JsonWebKeyLike[];
+  }>;
 };
+type SubjectResolver<TInput, TPrincipal extends Principal = Principal> = (input: TInput, options?: {
+  readonly tenant?: string;
+}) => Subject<TPrincipal> | Promise<Subject<TPrincipal>>;
 type SnapshotSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   get(): Promise<Snapshot | string> | Snapshot | string;
   subscribe?(listener: () => void): () => void;
 };
@@ -1509,8 +1598,10 @@ type LimitConsumeInput = {
   readonly key: string;
   readonly subjectId: string;
   readonly count: number;
-  readonly per: string;
-  readonly now?: number;
+  /** The window in seconds; windows are aligned to the epoch. */
+  readonly per: number;
+  /** The decision clock; the store reads the clock when absent. */
+  readonly now?: Instant;
   /** The active tenant; a quota counts per subject and tenant. */
   readonly tenant?: string;
 };
@@ -1518,113 +1609,17 @@ type LimitRemaining = {
   readonly remaining: number;
 };
 type LimitStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   consume(input: LimitConsumeInput): Promise<LimitRemaining> | LimitRemaining;
   remaining(input: LimitConsumeInput): LimitRemaining | undefined;
 };
 type DecisionSink = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   write(events: readonly SinkEvent[]): Promise<void> | void;
   flush?(): Promise<void>;
 };
-type DirectoryEvent = {
-  readonly type: "directory";
-  readonly at: string;
-  readonly source: "scim";
-  readonly operation: "create" | "replace" | "patch" | "delete";
-  readonly tenant: string;
-  readonly resource: {
-    readonly type: "User" | "Group";
-    readonly id: string;
-  };
-  readonly credential: {
-    readonly kind: "token";
-  } | {
-    readonly kind: "jwt";
-    readonly iss?: string;
-  };
-  readonly active?: boolean;
-};
-type MembershipEvent = {
-  readonly type: "membership";
-  readonly at: string;
-  readonly source: string;
-  readonly operation: "added" | "removed" | "changed";
-  readonly principal: {
-    readonly id: string;
-  };
-  /** A declared scope name, or the `tenant` / `team` alias; absent for a global role change. */
-  readonly scope?: string;
-  /** The scope instance; present exactly when `scope` is. */
-  readonly id?: string;
-  /** The id of every ancestor scope, keyed by scope name. */
-  readonly within?: Readonly<Record<string, string>>;
-  readonly via?: string;
-  /** When the membership lapses, in seconds since the epoch. */
-  readonly expiresAt?: number;
-  readonly roles: {
-    readonly added: readonly string[];
-    readonly removed: readonly string[];
-  };
-  readonly by?: {
-    readonly id: string;
-    readonly kind: string;
-  };
-};
-/**
- * An API key's lifecycle: `created`, `rotated` and `revoked` from the
- * application or a credential store, `used` from `subjectFromApiKey`. A
- * `used` event carries `sample`, the fraction of uses reported.
- */
-type CredentialEvent = {
-  readonly type: "credential";
-  readonly at: string;
-  readonly source: string;
-  readonly operation: "created" | "used" | "rotated" | "revoked";
-  readonly credential: {
-    readonly id: string;
-    readonly kind: CredentialKind;
-  };
-  readonly principal: {
-    readonly id: string;
-  };
-  readonly tenant?: string;
-  readonly expiresAt?: number;
-  readonly by?: {
-    readonly id: string;
-    readonly kind: string;
-  };
-  readonly sample?: number;
-};
-type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent;
-/**
- * A support-access session lifecycle event: a tenant consented to vendor
- * support (`started`), the session lapsed (`ended`), or the tenant pulled
- * consent early (`revoked`). It never decides; it records what happened for
- * audit and revocation.
- */
-type AccessEvent = {
-  readonly type: "access";
-  readonly at: string;
-  readonly source: string;
-  readonly operation: "started" | "ended" | "revoked";
-  readonly tenant: string;
-  readonly principal: {
-    readonly id: string;
-  };
-  /** The membership kind the session runs under (`support`). */
-  readonly via: string;
-  readonly roles: readonly string[];
-  readonly member?: {
-    readonly group: string;
-  };
-  readonly expiresAt?: number;
-  /** The tenant principal that consented. */
-  readonly grantedBy?: string;
-  readonly reason?: string;
-  readonly actor?: {
-    readonly id: string;
-    readonly kind: string;
-  };
-};
 /**
  * Looks up the credential an API key stands for. `null` for a key that is
  * malformed, unknown, revoked or whose secret does not match; never throws
@@ -1632,179 +1627,37 @@ type AccessEvent = {
  * never core's.
  */
 type CredentialVerifier = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   verify(secret: string): Credential | null | Promise<Credential | null>;
   /**
-   * Records a successful use at `at` (Unix seconds), for a `lastUsedAt`
-   * column. Called after a key resolved and not awaited; a throw or a
-   * rejection is ignored, so it never changes the subject.
+   * Records a successful use at `at`, for a `lastUsedAt` column. Called
+   * after a key resolved and not awaited; a throw or a rejection is
+   * ignored, so it never changes the subject.
    */
-  touch?(id: string, at: number): void | Promise<void>;
-};
-type DecisionEvent = {
-  readonly type: "decision";
-  readonly at: string;
-  readonly outcome: "granted" | "denied" | "approval-required";
-  readonly permission: string;
-  readonly scope: string;
-  readonly resource: {
-    readonly type: string;
-    readonly id?: string;
-  };
-  readonly subject: {
-    readonly principal: {
-      readonly id: string;
-      readonly roles: readonly string[];
-      readonly tenant?: string;
-    } | null;
-    readonly actor?: {
-      readonly id: string;
-      readonly kind: string;
-    };
-    readonly delegation?: {
-      readonly scopes?: readonly string[];
-      readonly authorizationDetails?: readonly unknown[];
-    };
-    /** The API key the subject came from. */
-    readonly credential?: {
-      readonly id: string;
-      readonly kind: CredentialKind;
-    };
-  };
-  readonly tenant?: string;
-  readonly membership?: Membership;
-  readonly via?: string | null;
-  readonly matched?: {
-    readonly role: string | null;
-    readonly permission: string;
-    readonly to?: Grantee | readonly Grantee[];
-    readonly hosted?: HostedGrantRef;
-    readonly breakGlass?: true;
-  };
-  /** Purposes of use the caller asserted (`context.purpose`); present when any was. */
-  readonly purpose?: readonly string[];
-  /** The justification the caller supplied (`context.reason`); present when set. */
-  readonly reason?: string;
-  readonly denials?: readonly WireDenial[];
-  readonly alternatives?: readonly string[];
-  readonly token?: string;
-  readonly trusted: boolean;
-  readonly source: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
-  readonly adapter?: string;
-  readonly phase?: "requested" | "resolved";
-  readonly counts?: {
-    readonly granted: number;
-    readonly denied: number;
-    readonly approvalRequired: number;
-  };
-};
-type AuthEvent = {
-  readonly reason: "invalid-token" | "schema" | "unknown-role" | "groups-overflow" | "source-threw";
-  readonly cause?: string;
-  readonly source: string;
-  readonly kid?: string;
-  readonly alg?: string;
-  readonly typ?: string;
-  readonly issuer?: string;
-  readonly requestId?: string;
+  touch?(id: string, at: Instant): void | Promise<void>;
 };
 /** What one tenant configures for itself. Every field only tightens. */
 type TenantSettings = {
   /** Rules for API keys created in, or used against, this tenant. */
   readonly credentials?: CredentialPolicy;
+  /** Rules for support sessions started in this tenant. */
+  readonly supportSessions?: SupportSessionPolicy;
 };
 /**
- * Per-tenant settings, a subject input like `RoleSource`: they tighten what
+ * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten what
  * a key may be and never grant. A throw denies.
  */
 type SettingsSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   settingsFor(tenant: string): TenantSettings | undefined | Promise<TenantSettings | undefined>;
 };
-declare function memorySettings(settings: Readonly<Record<string, TenantSettings>>): SettingsSource;
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
-declare function memoryMembershipSource(entries: Readonly<Record<string, readonly Membership[]>>): MembershipSource;
-/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
-declare function memorySnapshotSource(initial: Snapshot | string): SnapshotSource & {
-  set(snapshot: Snapshot | string): void;
-};
-declare function memoryRoleSource(customRoles: readonly CustomRole[]): RoleSource;
-//#endregion
-//#region src/conditions/normalize.d.ts
-type FieldOperator = {
-  readonly eq?: unknown;
-  readonly ne?: unknown;
-  readonly gt?: unknown;
-  readonly gte?: unknown;
-  readonly lt?: unknown;
-  readonly lte?: unknown;
-  readonly contains?: unknown;
-  readonly in?: unknown;
-  readonly notIn?: unknown;
-  readonly isNull?: boolean;
-};
-type WhereShorthand<T = Record<string, unknown>> = {
-  readonly and?: readonly WhereShorthand<T>[];
-  readonly or?: readonly WhereShorthand<T>[];
-  readonly not?: WhereShorthand<T>;
-} & ("subject" extends keyof T ? { readonly [K in keyof T as Exclude<K, "subject">]?: FieldWhere<T[K]>; } & {
-  readonly subject?: SubjectWhere | FieldWhere<T["subject"]>;
-} : { readonly [K in keyof T]?: FieldWhere<T[K]>; } & {
-  /** Holds only when the resolver checked the session live (`liveSession: true`). */
-  readonly subject?: SubjectWhere;
-});
-type SubjectWhere = {
-  readonly session: {
-    readonly live: true;
-  };
-};
-type FieldWhere<V> = V | FieldOperator | {
-  readonly ref: string;
-};
 //#endregion
-//#region src/core/approvers.d.ts
-/** One named approver, by principal id. */
-type UserApprover = {
-  readonly kind: "user";
-  readonly id: string;
-};
-/**
- * Whoever holds `permission` in the request's tenant, through any role,
- * custom roles included. Checked only through verdict facts
- * (`ApprovalVerdict.permissions`) that the handler computes from the
- * approver's own instance.
- */
-type PermissionApprover = {
-  readonly kind: "permission";
-  readonly permission: string;
-};
-/** An approver who matches at least one item; an item that is a list matches when every entry does. */
-type AnyOfApprover = {
-  readonly kind: "any-of";
-  readonly of: readonly (Approver | readonly Approver[])[];
-};
-/**
- * Who may approve: a subject-only grantee, a `relation()` the approver holds
- * on the requested row (checked when the verdict is given), `user(id)`,
- * `holder(permission)`, or `anyOf(...)`. A list (or `allOf(...)`) matches an
- * approver who satisfies every item.
- */
-type Approver = Grantee | UserApprover | PermissionApprover | AnyOfApprover;
-type ApproverInput = GranteeInput | UserApprover | PermissionApprover | {
-  readonly kind: "any-of";
-  readonly of: readonly ApproverInput[];
-} | readonly ApproverInput[];
-/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
-declare function holder(permission: Permission): PermissionApprover;
-/** Approves when the approver matches any one of `items`. */
-declare function anyOf(...items: readonly ApproverInput[]): {
-  readonly kind: "any-of";
-  readonly of: readonly ApproverInput[];
-};
-/** Approves when the approver matches every one of `items`; the same as a list. */
-declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInput[];
-/** A named approver for `approval.by`, matched on the approver's principal id. */
-declare function user(id: string): UserApprover;
+//#region src/core/policy-fingerprint.d.ts
+declare const POLICY_X: unique symbol;
 //#endregion
-//#region src/core/policy.d.ts
+//#region src/core/policy-types.d.ts
 type ClosureContext = {
   readonly subject: {
     readonly principal: Principal | null;
@@ -1819,8 +1672,8 @@ type ClosureContext = {
 type ClosureGrantFn<T = unknown> = (data: T, ctx: ClosureContext) => boolean;
 /** Who else may approve once a request has waited `after`. */
 type ApprovalEscalation = {
-  /** A duration (`'4h'`) from the request's creation. */
-  readonly after: string;
+  /** Seconds from the request's creation. */
+  readonly after: number;
   readonly to: Approver | readonly Approver[];
 };
 /** One group of approvers; `quorum` distinct approvers of `by` complete it. */
@@ -1850,8 +1703,8 @@ type ApprovalRequirement = {
   readonly staleOn?: "resource-change";
   /** Distinct approvers a request needs before it is approved under `by`; absent means 1. */
   readonly quorum?: number;
-  /** How long a request stays open (`'30m'`); the store's default when absent, and never longer than it. */
-  readonly ttl?: string;
+  /** Seconds a request stays open; the store's default when absent, and never longer than it. */
+  readonly ttl?: number;
   readonly escalation?: ApprovalEscalation;
 };
 type ApprovalOption = "human" | {
@@ -1861,9 +1714,9 @@ type ApprovalOption = "human" | {
   readonly stages?: readonly {
     readonly by: ApproverInput;
     readonly quorum?: number;
-    /** After `after`, `to` may approve this stage as well as `by`. */
+    /** After `after` seconds, `to` may approve this stage as well as `by`. */
     readonly escalation?: {
-      readonly after: string;
+      readonly after: number;
       readonly to: ApproverInput;
     };
   }[];
@@ -1877,11 +1730,11 @@ type ApprovalOption = "human" | {
   readonly staleOn?: "resource-change";
   /** Distinct approvers needed (an integer of at least 1); the same approver counts once. Absent means 1. */
   readonly quorum?: number;
-  /** How long the request stays open (`'30m'`, `'2d'`); caps the approval store's default. */
-  readonly ttl?: string;
-  /** After `after` (`'4h'`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
+  /** Seconds the request stays open (`1800`); caps the approval store's default. */
+  readonly ttl?: number;
+  /** After `after` seconds (`14_400`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
   readonly escalation?: {
-    readonly after: string;
+    readonly after: number;
     readonly to: ApproverInput;
   };
 };
@@ -1892,7 +1745,8 @@ type ApprovalOption = "human" | {
  */
 type GrantLimit = {
   readonly count: number;
-  readonly per: string;
+  /** The window in seconds (`3600` for an hour), aligned to the epoch. */
+  readonly per: number;
   readonly mode?: "hard" | "soft";
   readonly alertAt?: number;
 };
@@ -1911,8 +1765,8 @@ type AssuranceRequirement = {
  * mints the elevated membership to write.
  */
 type ActivationOption = {
-  /** The longest an activation may last, as a duration (`'4h'`, `'30m'`). */
-  readonly maxDuration?: string;
+  /** The longest an activation may last, in seconds (`14_400`). */
+  readonly maxDuration?: number;
   /** `'required'` denies an activation without a reason. */
   readonly justification?: "required" | "optional";
   /** When set, `activate` returns `approval-required` before the membership can be written. */
@@ -1921,7 +1775,7 @@ type ActivationOption = {
   readonly assurance?: AssuranceRequirement;
 };
 type ActivationSpec = {
-  readonly maxDuration?: string;
+  readonly maxDuration?: number;
   readonly justification: "required" | "optional";
   readonly approval?: "human" | ApprovalRequirement;
   readonly assurance?: AssuranceRequirement;
@@ -1938,8 +1792,8 @@ type BreakGlassOptions = {
   /** Names of the deny grants this override lifts; every other deny still wins. */
   readonly overrides?: readonly string[];
   readonly requires?: BreakGlassRequirements;
-  /** The longest a break-glass session may last, as a duration. */
-  readonly maxDuration?: string;
+  /** The longest a break-glass session may last, in seconds. */
+  readonly maxDuration?: number;
   /** Follow-ups the grant owes: each becomes an obligation on the decision. */
   readonly obligations?: readonly ("notify" | "review")[];
 };
@@ -1949,14 +1803,14 @@ type BreakGlassSpec = {
   readonly purpose?: readonly string[];
   readonly reason: boolean;
   readonly assurance?: AssuranceRequirement;
-  readonly maxDuration?: string;
+  readonly maxDuration?: number;
   readonly obligations: readonly ("notify" | "review")[];
 };
 /** How a tenant consents to support access, and for how long. */
 type SupportConsent = {
   readonly by: GranteeInput;
-  /** The durations a tenant owner may pick, as duration strings. */
-  readonly durations: readonly string[];
+  /** The durations a tenant owner may pick, in seconds. */
+  readonly durations: readonly number[];
 };
 type SupportAccessOptions<S extends string = string> = {
   /** The role a consented support membership holds. */
@@ -1976,7 +1830,7 @@ type SupportSpec = {
   readonly actorRequired: boolean;
   readonly consent: {
     readonly by: Grantee | readonly Grantee[];
-    readonly durations: readonly string[];
+    readonly durations: readonly number[];
   };
   readonly group: string;
 };
@@ -1988,15 +1842,26 @@ type GrantOptions<T = Record<string, unknown>> = {
   readonly limit?: GrantLimit;
   readonly reason?: string;
   readonly fields?: readonly (keyof T & string)[];
-  /** A name a `breakGlass` override may lift; only meaningful on a deny. */
+  /**
+   * A stable name for the grant. On a deny, a `breakGlass` override may lift
+   * it; on any grant, it is reported on `decision.matched.name` and on
+   * decision events.
+   */
   readonly name?: string;
   readonly group?: string;
+  /** Display text and app data for the grant, reported on `decision.matched.meta`; never read in evaluation. */
+  readonly meta?: GrantMeta;
+  /**
+   * Follow-ups the application owes when this allow grants: each becomes a
+   * `{ kind: 'app', name, detail? }` obligation on the decision. Allows only.
+   */
+  readonly obligations?: readonly ObligationInput[];
   /** Purposes of use (`context.purpose`) that make the grant apply; non-portable. */
   readonly purpose?: readonly string[];
-  /** The grant applies from this instant on (RFC 3339 string or Unix seconds); before it an allow denies with `inactive-grant` and a deny does not apply. */
-  readonly validFrom?: string | number;
-  /** The grant stops applying at this instant (exclusive; RFC 3339 string or Unix seconds). */
-  readonly validUntil?: string | number;
+  /** The grant applies from this instant on (RFC 3339 or an `Instant`); before it an allow denies with `inactive-grant` and a deny does not apply. */
+  readonly validFrom?: string | Instant;
+  /** The grant stops applying at this instant (exclusive; RFC 3339 or an `Instant`). */
+  readonly validUntil?: string | Instant;
   /**
    * An allow on an instance action counts only on rows whose scope instance
    * (or the whole app, globally) is one where the subject also holds this
@@ -2004,6 +1869,17 @@ type GrantOptions<T = Record<string, unknown>> = {
    */
   readonly requires?: Permission | readonly Permission[];
 };
+/** A grant's metadata. PermDock carries it to decisions, events, snapshots and the catalog and never reads `x`. */
+type GrantMeta = {
+  readonly description?: string;
+  /** Data the application owns. Plain JSON, checked by `definePolicy(…, { x: { grant } })`. */
+  readonly x?: AppData;
+};
+/** An app obligation as declared on an allow: its name, or its name and detail. */
+type ObligationInput = string | {
+  readonly name: string;
+  readonly detail?: MetaValue;
+};
 /**
  * When a grant applies, in Unix seconds. `from` is inclusive, `until`
  * exclusive; either may be absent. Portable: `where()` drops an inactive
@@ -2013,13 +1889,18 @@ type GrantValidity = {
   readonly from?: number;
   readonly until?: number;
 };
+/** A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details): RFC 3339 bounds. */
+type WireValidity = {
+  readonly from?: string;
+  readonly until?: string;
+};
 /**
  * The actor a policy delegation is for: an actor kind, narrowed to one id
  * when `id` is set, or to one named client when `client` is set (the name
  * the subject resolver gives a verified client id through `clients`).
  */
 type DelegationTarget = {
-  readonly kind: string;
+  readonly kind: ActorKind;
   readonly id?: string;
   readonly client?: string;
 };
@@ -2043,8 +1924,8 @@ type DelegationInput = {
   readonly to: ActorGrantee | string | DelegationTarget;
   /** The leaves or subtrees the actor may use; a deny grant still applies. */
   readonly permissions: readonly (Permission | PermissionTree)[];
-  readonly validFrom?: string | number;
-  readonly validUntil?: string | number;
+  readonly validFrom?: string | Instant;
+  readonly validUntil?: string | Instant;
 };
 /** A declared scope name (or the `tenant` / `team` alias), or the resource a role is held on. */
 type RoleScope<S extends string = string> = S | Permission | PermissionTree | readonly (Permission | PermissionTree)[];
@@ -2091,15 +1972,18 @@ type Grant = {
   readonly limit?: GrantLimit;
   readonly fields?: readonly string[];
   readonly scope: GrantScope;
-  /** A name a `breakGlass` override may lift; only meaningful on a deny. */
+  /** The grant's stable name: a `breakGlass` override lifts a named deny, and `decision.matched.name` reports it. */
   readonly name?: string;
   readonly group?: string;
+  readonly meta?: GrantMeta;
+  /** App obligations an allow adds to its granted decision. */
+  readonly obligations?: readonly AppObligation[];
   /** Purposes of use that make the grant apply (`context.purpose`); non-portable. */
   readonly purpose?: readonly string[];
   /** Set on a break-glass allow: it overrides named denies and carries obligations. */
   readonly breakGlass?: BreakGlassSpec;
   /** The membership kind (`via`) this grant applies under; others never match it. */
-  readonly viaOnly?: string;
+  readonly viaOnly?: MembershipVia;
   /** Set only on a grant merged from a hosted policy document. */
   readonly hosted?: HostedGrantRef;
   /** When the grant applies; absent means always. */
@@ -2158,6 +2042,8 @@ type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends
   readonly onDenied?: (decision: unknown) => never | void;
   readonly fingerprint: string;
   readonly resources: ReadonlyMap<string, ResourceNode>;
+  /** The app data schemas `definePolicy` was given; symbol-keyed so freezing the policy leaves the schemas alone. */
+  readonly [POLICY_X]?: PolicyAppDataSchemas;
   readonly providers?: readonly DecisionProvider[];
   /** Permission keys a hosted policy document may grant or deny; empty by default. */
   readonly hostable: readonly string[];
@@ -2187,23 +2073,21 @@ type PolicyIndex = {
   /** The grants `grantList` returns, by permission key, in the same order. */
   readonly grantsByKey: ReadonlyMap<string, readonly Grant[]>;
 };
-declare function normalizeApproval(approval: ApprovalOption | undefined, permission?: string): Grant["approval"];
 type GrantCondition<T, K extends PermissionKind> = K extends "collection" ? Omit<GrantOptions<T>, "where" | "fields"> | ClosureGrantFn<T> : GrantOptions<T> | ClosureGrantFn<T>;
-declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
-declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
-type RoleGrants = readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[])[];
-/** A role held at a named scope: `on` is checked against `definePolicy({ scopes })`. */
-declare function role<const S extends string>(name: string | Role, grants: RoleGrants, options: RoleOptions<S> & {
-  readonly on: S;
-}): RoleBinding<S>;
-/** A global role, or one held on a resource. */
-declare function role(name: string | Role, grants: RoleGrants, options?: RoleOptions<never>): RoleBinding<never>;
-/** Options built at runtime: the scope name is only checked by `definePolicy`. */
-declare function role(name: string | Role, grants: RoleGrants, options?: RoleOptions): RoleBinding;
-declare function normalizeAssurance(input: AssuranceRequirement | undefined): AssuranceRequirement | undefined;
 /** Resource name to level name to its normalised condition. */
 type PolicyLevels = Readonly<Record<string, Readonly<Record<string, Condition>>>>;
-type DefinePolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesInput = PolicyScopesInput> = {
+/**
+ * Standard Schemas for the app data a policy carries. `grant` checks every
+ * grant's `meta.x` at `definePolicy` and throws on invalid data; `membership`
+ * checks `Membership.x` as each subject resolves, dropping an invalid `x`
+ * (never the membership) with an `on('auth')` event of reason `schema`.
+ */
+type PolicyAppDataSchemas = {
+  readonly grant?: AppDataSchema<unknown>;
+  readonly membership?: AppDataSchema<unknown>;
+};
+type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesInput = PolicyScopesInput> = {
+  readonly x?: PolicyAppDataSchemas;
   readonly roles?: readonly RoleBinding<ScopeNames<S>>[];
   readonly grants?: readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[] | Grant)[];
   /**
@@ -2212,8 +2096,8 @@ type DefinePolicyOptions<TUser, TPrincipal extends Principal, S extends PolicySc
    * the first and second scope.
    */
   readonly scopes?: S;
-  readonly principal?: (user: TUser) => TPrincipal | null;
-  readonly subject?: (user: TUser) => TPrincipal | null;
+  /** Maps the application's user to the principal PermDock decides for; `null` is anonymous. */
+  readonly subject: (user: TUser) => TPrincipal | null;
   readonly context?: (user: TUser) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
   readonly validate?: ValidateMode;
   readonly onDenied?: (decision: unknown) => never | void;
@@ -2243,7 +2127,6 @@ type DefinePolicyOptions<TUser, TPrincipal extends Principal, S extends PolicySc
    */
   readonly oauthScopes?: Readonly<Record<string, readonly (Permission | PermissionTree)[]>>;
 };
-declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: DefinePolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
 type MembershipFixture = {
   readonly principal?: string;
   readonly tenant?: string;
@@ -2254,7 +2137,6 @@ type SeparationConflict = {
   readonly tenant?: string;
   readonly roles: readonly [string, string];
 };
-declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
 type PrincipalOf<P> = P extends Policy<unknown, infer TPrincipal> ? TPrincipal : Principal;
 type SubjectOf<P> = {
   readonly principal: PrincipalOf<P> | null;
@@ -2265,4 +2147,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { AccessEvent as $, ExplainedDecision as $n, CredentialPrincipal as $t, RoleOptions as A, RoleChangeOptions as An, GnapAccess as Ar, SnapshotSource as At, normalizeApproval as B, simulateArazzo as Bn, MemberOfParent as Br, memoryMembershipSource as Bt, Policy as C, mergeHostedGrants as Cn, Actor as Cr, SettingsSource as Ct, PolicyVocabulary as D, WhoCan as Dn, CustomRole as Dr, SnapshotGrant as Dt, PolicyScopes as E, HoldingVia as En, Binding as Er, SnapshotAssignable as Et, SupportConsent as F, ArazzoFinding as Fn, VerifiedClaims as Fr, TokenVerifier as Ft, Approver as G, ApprovalPolicyValidation as Gn, SqlFunctionArg as Gr, WireDenial as Gt, role as H, ApprovalPolicy as Hn, RelatedCondition as Hr, memorySettings as Ht, ValidateMode as I, ArazzoPlan as In, Condition as Ir, VerificationFailure as It, UserApprover as J, ApprovalRequiredDecision as Jn, isCondition as Jr, CredentialKind as Jt, ApproverInput as K, memoryApprovalPolicies as Kn, SqlFunctionCondition as Kr, Credential as Kt, allow as L, ArazzoSimulateInput as Ln, ConditionRef as Lr, VerifiedToken as Lt, SeparationConflict as M, ActivateInput as Mn, Membership as Mr, TenantSettings as Mt, SubjectOf as N, breakGlass as Nn, Principal as Nr, TokenFailureCause as Nt, PrincipalOf as O, RoleChange as On, CustomRoleGrant as Or, SnapshotNotEntitled as Ot, SupportAccessOptions as P, supportAccess as Pn, Subject as Pr, TokenSigner as Pt, user as Q, DeniedDecision as Qn, CredentialPolicyViolation as Qt, definePolicy as R, ArazzoStepResult as Rn, ConditionValue as Rr, WhereCompiler as Rt, MembershipFixture as S, memoryPolicySource as Sn, ScopeNames as Sr, RoleSourceFactory as St, PolicyOAuthScope as T, Holder as Tn, AuthorizationDetail as Tr, Snapshot as Tt, separationConflicts as U, ApprovalPolicyProblem as Un, RelatedHop as Ur, memorySnapshotSource as Ut, normalizeAssurance as V, APPROVAL_POLICY_UNAVAILABLE as Vn, OpaqueCondition as Vr, memoryRoleSource as Vt, AnyOfApprover as W, ApprovalPolicySource as Wn, RestrictedAncestors as Wr, WireDecision as Wt, anyOf as X, Denial as Xn, isConditionRef as Xr, CredentialPermissionInput as Xt, allOf as Y, Decision as Yn, isConditionDate as Yr, CredentialPermission as Yt, holder as Z, DenialReason as Zn, isSqlFunctionField as Zr, CredentialPolicy as Zt, GrantLimit as _, HostedGrantDropReason as _n, plan as _r, RelationChain as _t, ApprovalRequirement as a, decideCredential as an, Trace as ar, DecisionSink as at, GrantValidity as b, PolicySource as bn, Scope as br, RelationSource as bt, BreakGlassOptions as c, DeriveOptions as cn, Grantee as cr, JwtClaims as ct, ClosureContext as d, RowPair as dn, RelationGrantee as dr, LimitStore as dt, CredentialRequest as en, GrantedDecision as er, AuthEvent as et, ClosureGrantFn as f, SimulateOptions as fn, actor as fr, LocalCustomRoleTable as ft, GrantCondition as g, HostedGrant as gn, inherit as gr, MembershipSource as gt, Grant as h, createPermDock as hn, authenticated as hr, MembershipEvent as ht, ApprovalOption as i, credentialSubject as in, Quota as ir, DecisionProvider as it, RoleScope as j, RoleChangeTarget as jn, JsonWebKeyLike as jr, SubjectResolver as jt, RoleBinding as k, RoleChangeDecision as kn, Delegation as kr, SnapshotScope as kt, BreakGlassRequirements as l, PermDock as ln, GranteeInput as lr, LimitConsumeInput as lt, DelegationTarget as m, WhereResult as mn, assurance as mr, MemberEntry as mt, ApprovalEscalation as n, credentialDelegation as nn, MatchedGrant as nr, CredentialVerifier as nt, ApprovalStage as o, parseCredential as on, TraceSkip as or, DirectoryEvent as ot, DelegationInput as p, SnapshotOptions as pn, anyone as pr, LocalSnapshotManifest as pt, PermissionApprover as q, validateApprovalPolicy as qn, hasConditionOp as qr, CredentialDecision as qt, ApprovalMode as r, credentialPolicyViolation as rn, Obligation as rr, DecisionEvent as rt, AssuranceRequirement as s, DecideOptions as sn, TraceSkipReason as sr, EntitlementSource as st, ActivationOption as t, DecideCredentialOptions as tn, LimitDetail as tr, CredentialEvent as tt, BreakGlassSpec as u, PermDockOptions as un, InheritGrantee as ur, LimitRemaining as ut, GrantOptions as v, HostedGrantDropped as vn, relation as vr, RelationGroup as vt, PolicyDelegation as w, parsePolicyDocument as wn, Assurance as wr, SinkEvent as wt, HostedGrantRef as x, isPortableCondition as xn, ScopeDeclaration as xr, RoleSource as xt, GrantScope as y, PolicyDocument as yn, PolicyScopesInput as yr, RelationHolder as yt, deny as z, arazzoFindings as zn, MemberOfCondition as zr, memoryEntitlementSource as zt };
+export { MemberEntry as $, Delegation as $n, DeliveryFailureCause as $t, PolicyScopes as A, relation as An, CredentialRequest as At, ValidateMode as B, LimitDetail as Bn, LocalSnapshotManifest as Bt, MembershipFixture as C, RelationGrantee as Cn, isConditionRef as Cr, Credential as Ct, PolicyDelegation as D, authenticated as Dn, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, assurance as En, CredentialPermission as Et, RoleScope as F, DenialDetails as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, TraceSkip as Gn, SnapshotScope as Gt, WireValidity as H, Obligation as Hn, SnapshotAssignable as Ht, SeparationConflict as I, DenialReason as In, parseCredential as It, EntitlementSource as J, Assurance as Jn, AutomationEvent as Jt, DecisionProvider as K, TraceSkipReason as Kn, AccessEvent as Kt, SubjectOf as L, DeniedDecision as Ln, InstanceHandle as Lt, PrincipalOf as M, ApprovalRequiredDecision as Mn, credentialDelegation as Mt, RoleBinding as N, Decision as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, inherit as On, CredentialPolicy as Ot, RoleOptions as P, Denial as Pn, decideCredential as Pt, LimitStore as Q, CustomRoleGrant as Qn, DeliveryEvent as Qt, SupportAccessOptions as R, ExplainedDecision as Rn, Instant as Rt, HostedGrantRef as S, InheritGrantee as Sn, isConditionDate as Sr, ApiKeyPrincipal as St, Policy as T, anyone as Tn, CredentialKind as Tt, CredentialVerifier as U, Quota as Un, SnapshotGrant as Ut, VocabularyFromInput as V, MatchedGrant as Vn, Snapshot as Vt, CustomRoleSource as W, Trace as Wn, SnapshotNotEntitled as Wt, LimitConsumeInput as X, Binding as Xn, DecisionEvent as Xt, JwtClaims as Y, AuthorizationDetail as Yn, CredentialEvent as Yt, LimitRemaining as Z, CustomRole as Zn, DeliveryChannel as Zt, GrantLimit as _, anyOf as _n, RestrictedAncestors as _r, SupportSessionDecision as _t, ApprovalRequirement as a, WireDenial as an, VerifiedClaims as ar, SettingsSource as at, GrantScope as b, Grantee as bn, hasConditionOp as br, decideSupportSession as bt, BreakGlassOptions as c, Scope as cn, MembershipVia as cr, TenantSettings as ct, ClosureContext as d, AnyOfApprover as dn, ConditionValue as dr, TokenVerifier as dt, DirectoryEvent as en, GnapAccess as er, MembershipSource as et, ClosureGrantFn as f, Approver as fn, MemberOfCondition as fr, VerificationFailure as ft, GrantCondition as g, allOf as gn, RelatedHop as gr, SupportSession as gt, Grant as h, UserApprover as hn, RelatedCondition as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, WireDecision as in, Subject as ir, RelationSource as it, PolicyVocabulary as j, AppObligation as jn, DecideCredentialOptions as jt, PolicyOptions as k, plan as kn, CredentialPolicyViolation as kt, BreakGlassRequirements as l, ScopeDeclaration as ln, Condition as lr, TokenFailureCause as lt, DelegationTarget as m, PermissionApprover as mn, OpaqueCondition as mr, WhereCompiler as mt, ApprovalEscalation as n, MembershipEvent as nn, Membership as nr, RelationGroup as nt, ApprovalStage as o, WireDelegation as on, ActorKind as or, SnapshotSource as ot, DelegationInput as p, ApproverInput as pn, MemberOfParent as pr, VerifiedToken as pt, DecisionSink as q, Actor as qn, AuthEvent as qt, ApprovalMode as r, SinkEvent as rn, Principal as rr, RelationHolder as rt, AssuranceRequirement as s, PolicyScopesInput as sn, AdapterId as sr, SubjectResolver as st, ActivationOption as t, EmailCategory as tn, JsonWebKeyLike as tr, RelationChain as tt, BreakGlassSpec as u, ScopeNames as un, ConditionRef as ur, TokenSigner as ut, GrantMeta as v, holder as vn, SqlFunctionArg as vr, SupportSessionPolicy as vt, ObligationInput as w, actor as wn, isSqlFunctionField as wr, CredentialDecision as wt, GrantValidity as x, GranteeInput as xn, isCondition as xr, parseSupportSession as xt, GrantOptions as y, user as yn, SqlFunctionCondition as yr, SupportSessionRequest as yt, SupportConsent as z, GrantedDecision as zn, LocalCustomRoleTable as zt };