permdock 0.4.0 → 0.5.0

package/dist/{policy-types-sp9P1iIV.d.ts → policy-types-DzwivBgR.d.ts}

@@ -1,5 +1,4 @@
-import { D as AppData, O as AppDataSchema, d as Permission, f as PermissionKind, k as MetaValue, p as PermissionTree, y as ResourceNode } from "./permission-types-Dg39z9Kv.js";
-import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-hhEFLFoL.js";
+import { E as PermissionTree, H as AppDataSchema, N as ResourceNode, T as PermissionKind, U as MetaValue, V as AppData, a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan, w as Permission } from "./vocabulary-D6lPdb4Z.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -164,6 +163,22 @@ type FieldWhere<V> = V | FieldOperator | {
   readonly ref: string;
 };
 //#endregion
+//#region src/core/open-union.d.ts
+/**
+ * A string union that stays open: the listed values autocomplete, and an
+ * integrator may pass its own. Only for ids that core compares for equality,
+ * where an unknown value can only fail to match. A union whose members core
+ * interprets one by one (denial reasons, approval modes, condition operators,
+ * credential kinds, delivery channels) stays closed.
+ */
+type OpenUnion<T extends string> = T | (string & NonNullable<unknown>);
+/** `actor.kind`: the values PermDock's adapters set, or an integrator's own; a policy delegation matches it by equality. */
+type ActorKind = OpenUnion<"mcp-client" | "oauth-client" | "support" | "impersonation" | "ai-sdk" | "claude-agent" | "openai-agent" | "eve" | "terminal" | "web-bot-auth" | "a2a-agent" | "automation" | "job" | "caller" | "workload">;
+/** The adapter a decision event names: a PermDock entry, or an integrator's own adapter. */
+type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
+/** How a membership was obtained (`membership.via`); `viaOnly` and support rules match it by equality. */
+type MembershipVia = OpenUnion<"direct" | "contact" | "credential" | "elevated" | "feed" | "link" | "share" | "support" | "support-session" | "scim">;
+//#endregion
 //#region src/core/subject.d.ts
 type JsonWebKeyLike = {
   readonly kty?: string;
@@ -208,13 +223,13 @@ type Membership = {
   readonly roles: readonly string[];
   /** Roles the holder may activate here but does not hold; `permdock.activate` writes an elevated membership. */
   readonly eligible?: readonly string[];
-  readonly via?: string;
+  readonly via?: MembershipVia;
   readonly expiresAt?: number;
   /** The principal id that wrote this membership: who elevated, consented to or granted the access. */
   readonly grantedBy?: string;
   /** Free text recording why the membership was written: the activation or consent justification. */
   readonly reason?: string;
-  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `fromJunction` group column fills it. */
+  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `junctionMembershipSource` group column fills it. */
   readonly member?: {
     readonly group: string;
   };
@@ -287,7 +302,13 @@ type CustomRole = TenantCustomRole | GlobalCustomRole;
 type Principal = {
   readonly id: string;
   readonly issuer?: string;
-  readonly kind?: "user" | "service" | "workload" | "link";
+  /**
+   * `contact`: an external person (a customer contact, a portal user). Only
+   * its `{ on }` memberships count; it never approves, creates keys or
+   * publishes, and is read-only unless a role whose `for` lists `contact`
+   * grants the write.
+   */
+  readonly kind?: "user" | "service" | "workload" | "link" | "feed" | "contact";
   readonly roles?: readonly string[];
   readonly plans?: readonly string[];
   readonly memberships?: readonly Membership[];
@@ -302,9 +323,9 @@ type Principal = {
 };
 type Actor = {
   readonly id: string;
-  readonly kind: string;
+  readonly kind: ActorKind;
   readonly binding?: Binding;
-  /** `true` narrows every policy delegation to this actor to its read-only permissions (`readOnlyHint`). */
+  /** `true` denies every permission without `readOnlyHint` (`not-delegated`), with or without a policy delegation. */
   readonly readOnly?: boolean;
   /** The stable name the application gives this OAuth client (`ClientNames`), set by the subject resolver from the verified client id; policy delegations match it with `to: { kind, client }`. */
   readonly client?: string;
@@ -340,12 +361,12 @@ type Subject<TPrincipal extends Principal = Principal> = {
 };
 //#endregion
 //#region src/core/decision.d.ts
-type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
+type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
 /** The `detail` each denial reason carries, where PermDock sets a structured one. */
 type DenialDetails = {
   readonly limit: LimitDetail;
   /** The window the inactive allow applies in. */
-  readonly "inactive-grant": GrantValidity;
+  readonly "inactive-grant": WireValidity;
   /** The matching deny's declared `name`. */
   readonly deny: {
     readonly name?: string;
@@ -399,19 +420,19 @@ type AppObligation = {
   readonly name: string;
   readonly detail?: MetaValue;
 };
-/** What is left of the `limit` that applied; `resetsAt` is Unix seconds. */
+/** What is left of the `limit` that applied; `resetsAt` is RFC 3339. */
 type Quota = {
   readonly remaining: number;
-  readonly resetsAt: number;
+  readonly resetsAt: string;
 };
 /**
- * The `detail` of a `limit` denial: the grant's `count`, its window in
- * seconds and when the window resets (Unix seconds).
+ * The `detail` of a `limit` denial: the grant's `count`, its `per` window
+ * in seconds and when the window resets (RFC 3339).
  */
 type LimitDetail = {
   readonly count: number;
-  readonly window: number;
-  readonly resetsAt: number;
+  readonly per: number;
+  readonly resetsAt: string;
 };
 /**
  * Why a candidate grant for the permission was passed over before its
@@ -596,65 +617,35 @@ declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInp
 /** A named approver for `approval.by`, matched on the approver's principal id. */
 declare function user(id: string): UserApprover;
 //#endregion
-//#region src/core/arazzo.d.ts
-type ArazzoSimulateInput = {
-  readonly arazzo: unknown;
-  readonly openapi: unknown;
-  readonly workflowId?: string;
-  readonly permissions?: PermissionTree;
-  readonly inputs?: Readonly<Record<string, unknown>>;
-};
-type ArazzoStepResult = {
-  readonly stepId: string;
-  /** The nested workflow that owns the step, when it is not the plan's workflow. */
-  readonly workflowId?: string;
-  readonly operationId?: string;
-  readonly permissions: readonly Permission[];
-  readonly decision: Decision;
-  readonly provisional?: true;
-};
-type ArazzoPlan = {
-  readonly workflowId: string;
-  readonly outcome: Decision["outcome"];
-  readonly steps: readonly ArazzoStepResult[];
-};
-type ArazzoFinding = {
-  readonly stepId: string;
-  readonly workflowId: string;
-  readonly reason: "undocumented" | "unsupported" | "validation" | "unknown-key";
-  readonly detail: string;
-};
-declare function arazzoFindings(input: ArazzoSimulateInput, tree: PermissionTree | undefined): readonly ArazzoFinding[];
-declare function simulateArazzo(input: ArazzoSimulateInput, tree: PermissionTree | undefined, decide: (permission: Permission, data: unknown) => Decision): ArazzoPlan;
-//#endregion
-//#region src/core/elevated.d.ts
+//#region src/core/scopes.d.ts
+/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
+type ScopeDeclaration = {
+  readonly key: string;
+  readonly within?: string;
+};
+type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
 /**
- * The only deny override: a break-glass grant overrides deny grants whose
- * `name` it lists, and nothing else. It is an allow that stays non-portable
- * (RLS never compiles it) and grants only once its `requires` are met.
+ * A declared scope, in declaration order. `key` is absent only on the
+ * implicit `tenant` / `team` pair of a policy that declares no scopes.
  */
-declare function breakGlass<T>(permission: Permission<string, T> | readonly Permission<string, T>[], options?: BreakGlassOptions): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+type Scope = {
+  readonly name: string;
+  readonly key?: string;
+  readonly within?: string;
+};
+/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
+type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
+//#endregion
+//#region src/core/wire-delegation.d.ts
 /**
- * Support access with tenant consent: a role a vendor holds only through a
- * consented, time-bound `via: 'support'` membership. `actorRequired` denies
- * every decision under it without an `act`; `forbid` compiles to deny grants
- * scoped to `via: 'support'`.
+ * A delegation as every PermDock wire form carries it: OAuth `scope`
+ * (RFC 6749, space-separated) and RFC 9396 `authorization_details`. An empty
+ * `scope` is an empty scope list, which delegates nothing.
  */
-declare function supportAccess<const S extends string>(options: SupportAccessOptions<S> & {
-  readonly on: S;
-}): RoleBinding<S>;
-/** Support access held in the `tenant` scope. */
-declare function supportAccess(options: SupportAccessOptions<never>): RoleBinding<"tenant">;
-type ActivateInput = {
-  readonly role: string | Role;
-  /** The scope the activation applies in (a declared name or the `tenant` / `team` alias). */
-  readonly scope: string;
-  readonly id: string;
-  /** Ancestor scope ids, keyed by scope name, for a nested-scope activation. */
-  readonly within?: Readonly<Record<string, string>>;
-  /** How long the elevation lasts; capped at the role's `maxDuration`. */
-  readonly duration?: string;
-  readonly reason?: string;
+type WireDelegation = {
+  readonly scope?: string;
+  readonly authorization_details?: readonly AuthorizationDetail[];
+  readonly access?: readonly GnapAccess[];
 };
 //#endregion
 //#region src/core/wire-denial.d.ts
@@ -679,7 +670,8 @@ type WireDecision = GrantedDecision | ApprovalRequiredDecision | (Omit<DeniedDec
 type DirectoryEvent = {
   readonly type: "directory";
   readonly at: string;
-  readonly source: "scim";
+  /** `scim`, or an integrator's own directory sync. */
+  readonly source: OpenUnion<"scim">;
   readonly operation: "create" | "replace" | "patch" | "delete";
   readonly tenant: string;
   readonly resource: {
@@ -693,6 +685,8 @@ type DirectoryEvent = {
     readonly iss?: string;
   };
   readonly active?: boolean;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 type MembershipEvent = {
   readonly type: "membership";
@@ -708,9 +702,9 @@ type MembershipEvent = {
   readonly id?: string;
   /** The id of every ancestor scope, keyed by scope name. */
   readonly within?: Readonly<Record<string, string>>;
-  readonly via?: string;
-  /** When the membership lapses, in seconds since the epoch. */
-  readonly expiresAt?: number;
+  readonly via?: MembershipVia;
+  /** When the membership lapses, an RFC 3339 instant. */
+  readonly expiresAt?: string;
   readonly roles: {
     readonly added: readonly string[];
     readonly removed: readonly string[];
@@ -719,6 +713,8 @@ type MembershipEvent = {
     readonly id: string;
     readonly kind: string;
   };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 /**
  * An API key's lifecycle: `created`, `rotated` and `revoked` from the
@@ -738,14 +734,105 @@ type CredentialEvent = {
     readonly id: string;
   };
   readonly tenant?: string;
-  readonly expiresAt?: number;
+  /** When the key expires, an RFC 3339 instant. */
+  readonly expiresAt?: string;
   readonly by?: {
     readonly id: string;
     readonly kind: string;
   };
   readonly sample?: number;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+/**
+ * An automation's lifecycle: `published`, `changed` (a new version) and
+ * `revoked` from the application, `run` when a run starts. It records the
+ * delegation for access review; it never decides.
+ */
+type AutomationEvent = {
+  readonly type: "automation";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "published" | "changed" | "revoked" | "run";
+  readonly automation: {
+    readonly id: string;
+    readonly version: number | string;
+    readonly mode: "publisher" | "service";
+    readonly name?: string;
+  };
+  /** The principal each run acts as. */
+  readonly principal: {
+    readonly id: string;
+  };
+  readonly publishedBy: string;
+  readonly tenant?: string;
+  readonly roles?: readonly string[];
+  /** The delegated permission keys. */
+  readonly permissions: readonly string[];
+  /** Set on `run` events only. */
+  readonly run?: {
+    readonly id: string;
+  };
+  readonly by?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
+};
+type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent | AutomationEvent | DeliveryEvent;
+/** A delivery channel: an email, a chat message or an outbound webhook. */
+type DeliveryChannel = "email" | "chat" | "webhook";
+/** What an email is for; only `notification` mail carries `List-Unsubscribe`. */
+type EmailCategory = "transactional" | "notification" | "security" | "approval";
+/**
+ * Why a delivery failed. `denied` and `unlinked` are the router's refusals of
+ * a recipient; the rest come from a transport or a provider webhook.
+ */
+type DeliveryFailureCause = "denied" | "unlinked" | "no-transport" | "no-message" | "invalid-recipient" | "invalid-message" | "rate-limited" | "quota-exceeded" | "unauthorized" | "unavailable" | "suppressed" | "rejected";
+/**
+ * One recipient's delivery: `sent` when a transport accepted it, then
+ * `delivered`, `bounced` or `complained` from the provider, or `failed`.
+ * It carries no address, only the principal the router checked.
+ */
+type DeliveryEvent = {
+  readonly type: "delivery";
+  readonly at: string;
+  readonly source: string;
+  readonly operation: "sent" | "delivered" | "bounced" | "complained" | "failed";
+  readonly channel: DeliveryChannel;
+  /** The delivery's id and this recipient's key, sent as the `Idempotency-Key`. */
+  readonly delivery: {
+    readonly id: string;
+    readonly key: string;
+  };
+  /** The checked principal, or `trusted` for an address the server loaded itself. */
+  readonly recipient?: {
+    readonly principal?: {
+      readonly id: string;
+    };
+    readonly trusted?: true;
+  };
+  /** The permission the recipient was checked for. */
+  readonly permission?: string;
+  readonly tenant?: string;
+  readonly category?: EmailCategory;
+  /** The approval request a prompt was delivered for. */
+  readonly approval?: string;
+  /** The transport or provider, and its message id. */
+  readonly provider?: {
+    readonly name: string;
+    readonly id?: string;
+  };
+  /** Set on `failed` only. */
+  readonly cause?: DeliveryFailureCause;
+  /** Set on `failed` only: whether a retry with the same key may succeed. */
+  readonly retryable?: boolean;
+  /** The denial reason when `cause` is `denied`. */
+  readonly reason?: string;
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
-type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent;
 /**
  * A support-access session lifecycle event: a tenant consented to vendor
  * support (`started`), the session lapsed (`ended`), or the tenant pulled
@@ -762,12 +849,13 @@ type AccessEvent = {
     readonly id: string;
   };
   /** The membership kind the session runs under (`support`). */
-  readonly via: string;
+  readonly via: MembershipVia;
   readonly roles: readonly string[];
   readonly member?: {
     readonly group: string;
   };
-  readonly expiresAt?: number;
+  /** When the session lapses, an RFC 3339 instant. */
+  readonly expiresAt?: string;
   /** The tenant principal that consented. */
   readonly grantedBy?: string;
   readonly reason?: string;
@@ -775,9 +863,19 @@ type AccessEvent = {
     readonly id: string;
     readonly kind: string;
   };
+  /** A `SupportSession`: its id and the principal the staff member views as. */
+  readonly session?: {
+    readonly id: string;
+    readonly principal: string;
+  };
+  /** A `SupportSession`'s permission keys. */
+  readonly permissions?: readonly string[];
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 type DecisionEvent = {
   readonly type: "decision";
+  /** An RFC 3339 instant. */
   readonly at: string;
   readonly outcome: "granted" | "denied" | "approval-required";
   readonly permission: string;
@@ -796,18 +894,23 @@ type DecisionEvent = {
       readonly id: string;
       readonly kind: string;
     };
-    readonly delegation?: {
-      readonly scopes?: readonly string[];
-      readonly authorizationDetails?: readonly unknown[];
-    };
+    /** OAuth `scope` and RFC 9396 `authorization_details`, as every wire form carries a delegation. */
+    readonly delegation?: WireDelegation;
     /** The API key the subject came from. */
     readonly credential?: {
       readonly id: string;
       readonly kind: CredentialKind;
     };
+    /** The support session the subject came from: the `id` its `access` events carry as `session.id`. */
+    readonly supportSession?: {
+      readonly id: string;
+    };
   };
   readonly tenant?: string;
-  readonly membership?: Membership;
+  /** The membership that answered, with `expiresAt` as an RFC 3339 instant. */
+  readonly membership?: Omit<Membership, "expiresAt"> & {
+    readonly expiresAt?: string;
+  };
   readonly via?: string | null;
   readonly matched?: {
     readonly role: string | null;
@@ -830,19 +933,27 @@ type DecisionEvent = {
   readonly alternatives?: readonly string[];
   readonly token?: string;
   readonly trusted: boolean;
-  readonly source: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
-  readonly adapter?: string;
-  readonly phase?: "requested" | "resolved";
+  /** The call that produced the decision. */
+  readonly call: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
+  readonly adapter?: AdapterId;
+  /** The model id the agent model gate decided, or the model that drove the call. */
+  readonly model?: string;
+  /** Set on an approval lifecycle event (`com.permdock.approval.<phase>`). */
+  readonly phase?: "requested" | "resolved" | "expired" | "cancelled";
   readonly counts?: {
     readonly granted: number;
     readonly denied: number;
     readonly approvalRequired: number;
   };
+  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 type AuthEvent = {
   readonly reason: "invalid-token" | "schema" | "unknown-role" | "groups-overflow" | "source-threw";
   readonly cause?: string;
   readonly source: string;
+  /** The `name` of the source that threw, when it has one. */
+  readonly name?: string;
   readonly kid?: string;
   readonly alg?: string;
   readonly typ?: string;
@@ -850,91 +961,11 @@ type AuthEvent = {
   readonly requestId?: string;
 };
 //#endregion
-//#region src/core/scopes.d.ts
-/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
-type ScopeDeclaration = {
-  readonly key: string;
-  readonly within?: string;
-};
-type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
-/**
- * A declared scope, in declaration order. `key` is absent only on the
- * implicit `tenant` / `team` pair of a policy that declares no scopes.
- */
-type Scope = {
-  readonly name: string;
-  readonly key?: string;
-  readonly within?: string;
-};
-/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
-type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
-//#endregion
-//#region src/core/ownership.d.ts
-/** Who a role change is about: their principal id and their membership in the scope instance. */
-type RoleChangeTarget = {
-  readonly id: string;
-  /** The kind of the target's membership in the instance (`staff`, `contact`, ...). */
-  readonly via?: string;
-  /** The roles the target holds in the instance now. */
-  readonly roles?: readonly string[];
-  /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
-  readonly managedBy?: "idp";
-};
-type RoleChangeBase = {
-  readonly kind: "assign" | "revoke" | "transfer";
-  readonly role: string | Role;
-  /** Ids of the instance's ancestor scopes; a holder there may assign here. */
-  readonly within?: Readonly<Record<string, string>>;
-  readonly target: RoleChangeTarget;
-  /**
-   * How many principals hold `role` in the instance now, from the
-   * application's store. Without it a role with `min`, `max` or
-   * `transferOnly` is denied.
-   */
-  readonly holders?: number;
-};
-/**
- * A role held at a named scope instance (`scope` is a declared name or alias
- * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
- * A global change has no tenant, so `within` and `holders` do not apply to it.
- */
-type RoleChange = RoleChangeBase & ({
-  /** The scope the role is held at (a declared name or alias). */
-  readonly scope: string;
-  /** The scope instance. */
-  readonly id: string;
-} | {
-  readonly scope: "global";
-  readonly id?: undefined;
-});
-/**
- * `granted` names the role that authorised the change (`null` when a
- * `meta.manageRoles` holder or the declared-role ceiling did); `denied` lists
- * every rule the change breaks.
- */
-type RoleChangeDecision = {
-  readonly outcome: "granted";
-  readonly change: RoleChange;
-  readonly role: string | null;
-} | {
-  readonly outcome: "denied";
-  readonly change: RoleChange;
-  readonly denials: readonly Denial[];
-};
-type RoleChangeOptions = {
-  /**
-   * `true` when the application loaded `change.within` from its own store
-   * (the instance's stored parent), not from the request. Without it, a
-   * nested instance's tenant comes only from a live membership the actor
-   * holds on that instance or under it.
-   */
-  readonly trusted?: boolean;
-};
-//#endregion
 //#region src/core/snapshot-types.d.ts
 type Snapshot = {
   readonly v: 1;
-  readonly issuedAt: number;
+  /** RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the token's `iat`. */
+  readonly issuedAt: string;
   readonly subject: {
     readonly principal: {
       readonly id: string;
@@ -943,7 +974,8 @@ type Snapshot = {
       readonly tenant?: string;
       readonly memberships?: readonly Membership[];
     } | null;
-    readonly delegation?: Subject["delegation"];
+    /** OAuth `scope` and RFC 9396 `authorization_details`, as the token carried them. */
+    readonly delegation?: WireDelegation;
     readonly context: Readonly<Record<string, unknown>>;
   };
   /** Roles held in the active tenant, in rank order. */
@@ -954,7 +986,8 @@ type Snapshot = {
   readonly tenants: readonly string[];
   readonly include?: readonly string[];
   readonly simulated?: true;
-  readonly expiresAt?: number;
+  /** RFC 3339. Signed, it is the token's `exp`. */
+  readonly expiresAt?: string;
   readonly vocabulary?: {
     readonly roles?: Readonly<Record<string, Role>>;
     readonly plans?: Readonly<Record<string, Plan>>;
@@ -1020,8 +1053,8 @@ type SnapshotGrant = {
   readonly membership?: Membership;
   readonly portable?: false;
   readonly fields?: readonly string[];
-  /** When the grant applies (Unix seconds, `from` inclusive, `until` exclusive); absent means always. */
-  readonly validity?: GrantValidity;
+  /** When the grant applies (RFC 3339, `from` inclusive, `until` exclusive); absent means always. */
+  readonly validity?: WireValidity;
   /** The grant's declared `name`. */
   readonly name?: string;
   /** The grant's declared `meta`; visible to the client that holds the snapshot. */
@@ -1058,409 +1091,34 @@ type LocalCustomRoleTable = {
   readonly includes: Readonly<Record<string, readonly SnapshotGrant[]>>;
 };
 //#endregion
-//#region src/core/validation.d.ts
-type Boundary = "http-body" | "mcp-args" | "tool-args" | "decision-endpoint" | "manual";
-//#endregion
-//#region src/core/who-can.d.ts
-/** One way a principal holds a permission on an object. */
-type HoldingVia = {
-  readonly kind: "role";
-  readonly role: string;
-  readonly membership: Membership;
-} | {
-  readonly kind: "relation";
-  readonly resource: string;
-  readonly relation: string;
-  /** The instance the relation is held on: the object or one of its ancestors. */
-  readonly id: string;
-} | {
-  readonly kind: "share";
-  readonly resource: string;
-  readonly relation: string;
-  readonly id: string;
-  readonly expiresAt?: number;
-  /** The group the share names, when the principal holds it as one of its members. */
-  readonly group?: RelationGroup;
-};
-type Holder = {
-  readonly principal: {
-    readonly id: string;
-  };
-  readonly via: readonly HoldingVia[];
-};
+//#region src/core/time.d.ts
 /**
- * Who holds a permission on one object, for share dialogs and access
- * reviews. It lists and never grants. `complete: false` means some grantee
- * could not be enumerated (a global role, a plan, a source without `list`,
- * an unavailable relation): holders may be missing, so check with `decide`.
+ * The one time rule: NumericDate (whole seconds) for JWT registered claims
+ * and the claims SQL reads, RFC 3339 for every other JSON field, integer
+ * seconds for durations, and an `Instant` for every runtime `now`.
  */
-type WhoCan = {
-  readonly permission: string;
-  readonly holders: readonly Holder[];
-  readonly complete: boolean;
-};
-//#endregion
-//#region src/core/approval-policies.d.ts
-/**
- * One approval requirement kept as data, for a tenant or the whole platform.
- * It adds to what the code requires and never removes a requirement.
- */
-type ApprovalPolicy = {
-  /** The permission key; a former key from `renamed` resolves. */
-  readonly permission: string;
-  /** Absent: every tenant. */
-  readonly tenant?: string;
-  /** Actor kinds it applies to (`['agent']`); absent: every call. A call without an actor never matches a list. */
-  readonly actors?: readonly string[];
-  /** A portable condition over the row; instance permissions only, since a collection action has no row. */
-  readonly where?: Condition;
-  /** A portable condition over the call's input (the proposed row). */
-  readonly check?: Condition;
-  /**
-   * The same shape as `allow(..., { approval })`. An `escalation` here widens
-   * only this entry's stages, never the code's.
-   */
-  readonly approval: ApprovalOption;
-};
-/**
- * Data-driven approval requirements, a subject input like `RoleSource`:
- * read once per instance for the subject's tenants (entries without a
- * tenant always apply). A throw, a rejected promise or an invalid entry
- * denies every call an allow would otherwise permit.
- */
-type ApprovalPolicySource = {
-  approvalPoliciesFor(query: {
-    readonly tenants: readonly string[];
-  }): readonly ApprovalPolicy[] | Promise<readonly ApprovalPolicy[]>;
-};
-/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
-declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
-declare function memoryApprovalPolicies(policies: readonly ApprovalPolicy[]): ApprovalPolicySource;
 /**
- * Why an `ApprovalPolicy` entry does not load. `unknown-permission`: the
- * policy declares no such key (the entry applies to nothing). `invalid`: a
- * field has the wrong shape or the approval option does not normalise.
- * `where-on-collection`: `where` reads a row, which a collection action
- * never has, so the entry could never match; use `check` over the input.
- * `stale-on-without-version`: `staleOn` needs an instance permission whose
- * resource declares `version`.
+ * The part of a `Temporal.Instant` PermDock reads. Public options take it
+ * structurally so their declarations compile under a TypeScript lib without
+ * `Temporal` (5.9); every `Temporal.Instant` satisfies it.
  */
-type ApprovalPolicyProblem = "unknown-permission" | "invalid" | "where-on-collection" | "stale-on-without-version";
-type ApprovalPolicyValidation = {
-  readonly ok: true;
-} | {
-  readonly ok: false;
-  readonly problem: ApprovalPolicyProblem;
+type Instant = {
+  readonly epochMilliseconds: number;
 };
-/**
- * Checks one entry against the policy the way `approvalPoliciesFor` loads
- * it, for an application to refuse a bad entry when it is saved instead of
- * finding every call denied. Never throws.
- */
-declare function validateApprovalPolicy(policy: Policy, entry: unknown): ApprovalPolicyValidation;
 //#endregion
-//#region src/core/hosted.d.ts
-/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
-type HostedGrant = {
-  readonly id: string;
-  readonly permission: string;
-  readonly effect?: "allow" | "deny";
-  readonly to: Grantee | readonly Grantee[];
-  readonly where?: Condition;
-  readonly check?: Condition;
-  readonly approval?: "human" | ApprovalRequirement;
-  readonly fields?: readonly string[];
-};
-/** PolicyDocument v1: the payload of a `permdock-policy+jwt` under the `policy` claim. */
-type PolicyDocument = {
-  readonly v: 1;
-  readonly id: string;
-  readonly fingerprint: string;
-  /** The catalog fingerprint the document was authored against. */
-  readonly catalog: string;
-  readonly issuedAt: number;
-  readonly grants: readonly HostedGrant[];
-};
+//#region src/core/internals.d.ts
 /**
- * The channel for hosted grants. `createPermDock` reads `current()` once;
- * the application calls `refresh()` on its own schedule, never a check.
+ * Any instance a feature function accepts: a server `PermDock`, one built
+ * from a snapshot, or an adapter's wrapper such as `PdpPermDock`.
  */
-type PolicySource = {
-  current(): PolicyDocument | null;
-  refresh(): Promise<void>;
-};
-type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
-/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
-type HostedGrantDropped = {
-  readonly kind: "hosted-grant-dropped";
-  readonly document: string;
-  readonly grant: string;
-  readonly reason: HostedGrantDropReason;
-};
-declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
-/** Validates the document envelope; per-grant checks happen at merge time. */
-declare function parsePolicyDocument(json: unknown): PolicyDocument;
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
-declare function isPortableCondition(value: unknown): value is Condition;
-/**
- * The code policy plus the hosted grants that pass every rule. Hosted
- * allows OR with code allows and any deny still wins, so a hosted grant can
- * never override a code deny; one that fails a rule is dropped, not thrown.
- */
-declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
-  readonly policy: Policy;
-  readonly dropped: readonly HostedGrantDropped[];
-};
-//#endregion
-//#region src/core/permdock.d.ts
-type DecideOptions = {
-  /** `true` skips schema validation for a row the server loaded itself. Otherwise `data` is validated against the resource schema first (`validate: 'boundary'`), and a failure denies with reason `validation`. */
-  readonly trusted?: boolean;
-  /** Where untrusted data came from, reported on validation errors. Defaults to `'manual'`. */
-  readonly boundary?: Boundary;
-  /** Decision clock in Unix seconds, for expiries and limits. Defaults to the current time. */
-  readonly now?: number;
-  /** The call that produced the decision, reported on the decision event. Defaults to `'decide'`. */
-  readonly source?: DecisionEvent["source"];
-  /** The adapter that made the call, reported on the decision event. */
-  readonly adapter?: string;
-  /** Per-call unauthorized handler for `assert`; runs before instance and policy handlers. */
-  readonly onDenied?: (decision: Decision) => never | void;
-  /** The field being read or written; only grants whose `fields` cover it match. */
-  readonly field?: string;
-  /** `true` attaches a `trace` to the decision: the grants evaluated, matched and skipped. Off by default and free when off. */
-  readonly explain?: boolean;
-  /**
-   * A declared scope name: only memberships of that scope answer the check.
-   * Naming the first scope keeps nested memberships out of a tenant-level
-   * guard on a collection action. Global roles still apply; resource roles
-   * and memberships of other scopes are skipped with reason `scope`.
-   */
-  readonly scope?: string;
-};
-type SimulateOptions = {
-  /** Decision clock in Unix seconds for the whole batch: grant validity, membership expiry and limits are read as of this instant. Defaults to the current time. */
-  readonly now?: number;
-};
-type RowPair<T> = {
-  readonly current: T;
-  readonly next: T;
-};
-type WhereResult = {
-  readonly condition: Condition | {
-    readonly op: "or";
-    readonly conditions: readonly [];
-  };
-  readonly partial: boolean;
-  /**
-   * The subject `where()` was built for. `toWhere` reads its memberships for
-   * `memberOf` when no `subject` option is passed. Not enumerable, so it never
-   * serialises with the result.
-   */
-  readonly subject?: Subject;
-  /** The policy's scopes, for `memberOf`; not enumerable either. */
-  readonly scopes?: readonly Scope[];
-  /** The policy's resource graph, for `related`; not enumerable either. */
-  readonly resources?: ReadonlyMap<string, ResourceNode>;
-};
-type SnapshotOptions = {
-  readonly include?: readonly (Permission | {
-    readonly [key: string]: unknown;
-  })[];
-  readonly tenants?: "all";
-  readonly signer?: TokenSigner;
-  readonly audience?: string | readonly string[];
-};
-type PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly can: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): boolean;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): boolean;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): boolean;
-  };
-  readonly decide: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): Decision;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): Decision;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): Decision;
-  };
-  readonly assert: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-    /**
-     * A permission held as `Permission` at run time (from a list, a catalog
-     * or `findPermission`), whose kind the type does not say: pass `data`,
-     * or `undefined` for a check without a row.
-     */
-    (permission: Permission, data: unknown, options?: DecideOptions): Extract<Decision, {
-      readonly outcome: "granted";
-    }>;
-  };
-  /**
-   * `decide` with `explain: true`: the same decision, with a `trace` that
-   * names the grants evaluated, the allows and denies that matched (so a
-   * `denied` says which deny won) and the grants passed over. Local
-   * computation only; the trace never reaches a `DecisionSink`.
-   */
-  readonly explain: {
-    (permission: Permission<string, unknown, "instance">, data: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-    (permission: Permission<string, unknown, "collection">, data?: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-    (permission: Permission, data: unknown, options?: Omit<DecideOptions, "explain">): ExplainedDecision;
-  };
-  readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => T[];
-  readonly pick: <T>(permission: Permission<string, T, "instance">, row: T, options?: DecideOptions) => Partial<T>;
-  readonly where: (permission: Permission) => WhereResult;
-  readonly actions: (resource: Permission | {
-    readonly [key: string]: unknown;
-  }, data: unknown, options?: DecideOptions) => Permission[];
-  readonly simulate: {
-    (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Decision[];
-    (preview: {
-      readonly roles?: readonly (string | Role)[];
-      readonly memberships?: readonly Membership[];
-      readonly tenant?: string;
-    }): PermDock<V>;
-    (plan: ArazzoSimulateInput): ArazzoPlan;
-  };
-  readonly snapshot: {
-    (options?: SnapshotOptions & {
-      readonly signer?: undefined;
-    }): Snapshot;
-    (options: SnapshotOptions & {
-      readonly signer: TokenSigner;
-    }): Promise<string>;
-    (options?: SnapshotOptions): Snapshot | Promise<string>;
-  };
-  readonly on: (event: "decision" | "denied" | "approval" | "auth" | "error", handler: (payload: unknown) => void) => () => void;
-  readonly tenant: (id: string) => PermDock<V>;
-  readonly team: (id: string) => PermDock<V>;
-  readonly memberships: () => readonly Membership[];
-  readonly tenants: () => readonly string[];
-  /**
-   * Roles held in a tenant (the active one by default), or only on the
-   * memberships of one `scope` (and instance `id`). Ordered by rank: a role
-   * comes before the roles its `assigns` lists.
-   */
-  readonly heldRoles: (options?: {
-    readonly tenant?: string;
-    readonly scope?: string;
-    readonly id?: string;
-  }) => readonly Role[];
-  /** The distinct `meta.audience` values of the roles held in the active tenant, in rank order. */
-  readonly audiences: () => readonly string[];
-  /**
-   * The roles the subject may hand out in a tenant (the active one by
-   * default), or with `scope: 'global'` the global roles it may hand out. A
-   * snapshot answers only the tenant form.
-   */
-  readonly assignableRoles: (options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly Role[];
-  /**
-   * The custom-role ceiling the subject may hand out: in a tenant (empty
-   * without one), or with `scope: 'global'` for platform custom roles, the
-   * allows of assignable global roles the subject holds. A snapshot answers
-   * only the tenant form.
-   */
-  readonly assignablePermissions: (options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly Permission[];
-  /**
-   * The levels of `permission` (`resource(…, { levels })`) the subject may
-   * hand out in a custom role: those it holds, or every level with
-   * `meta.manageRoles`. Empty when the permission is not assignable.
-   */
-  readonly assignableLevels: (permission: Permission, options?: {
-    readonly tenant?: string;
-    readonly scope?: "global";
-  }) => readonly string[];
-  /**
-   * Whether the subject may assign, revoke or transfer a role in one scope
-   * instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`, `max`
-   * and `transferOnly`. It never writes; the application does, and generated
-   * RLS triggers re-check the holder counts at commit. A nested instance's
-   * tenant comes from a live membership the subject holds on it, or from
-   * `change.within` only with `{ trusted: true }`; otherwise `no-membership`.
-   */
-  readonly decideRoleChange: (change: RoleChange, options?: RoleChangeOptions) => RoleChangeDecision;
-  /**
-   * Loads the relation facts `permission` needs for `rows` into this
-   * instance's cache, so `can`, `decide` and `filter` answer synchronously
-   * over an async `RelationSource`. It never grants; a failed load leaves
-   * the checks denied with `relation-unavailable`.
-   */
-  readonly loadRelations: (permission: Permission, rows: readonly unknown[]) => Promise<void>;
-  /**
-   * Who holds `permission` on `resource` and how (role, relation or share),
-   * from `MembershipSource.list` and `RelationSource.related`. It lists and
-   * never grants; `complete: false` means some holders could not be listed.
-   */
-  readonly whoCan: (permission: Permission<string, unknown, "instance">, resource: unknown) => Promise<WhoCan>;
-  /**
-   * Requests a just-in-time activation of an eligible role. It never writes:
-   * a granted decision carries the elevated membership under `elevation` for
-   * the app to write, and `approval-required` comes back first when the
-   * role's `activation` sets `approval`.
-   */
-  readonly activate: (input: ActivateInput) => Decision;
-  readonly roles: V["roles"] extends RoleTree ? V["roles"] : RoleTree;
-  readonly plans: V["plans"] extends PlanTree ? V["plans"] : PlanTree;
-  readonly permissions: V["permissions"] extends Policy["permissions"] ? V["permissions"] : Policy["permissions"];
+type InstanceHandle = {
   readonly subject: Subject;
-  /**
-   * The same subject, tenant, team, actor, delegation, sink and limits with
-   * other sources: `customRoles`, `approvalPolicies` or `relations`. The
-   * sources it names are read again for the subject's tenants; the others
-   * keep what this instance loaded. Returns a promise when a source it names
-   * answers asynchronously.
-   */
-  readonly derive: (options: DeriveOptions) => PermDock<V> | Promise<PermDock<V>>;
 };
-/** What `permdock.derive` may replace: the sources read after the subject is resolved. */
-type DeriveOptions = Pick<PermDockOptions, "customRoles" | "approvalPolicies" | "relations">;
-type PermDockOptions = {
-  readonly tenant?: string;
-  /** One source, or several composed with `composeMemberships`. */
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  readonly customRoles?: RoleSource | RoleSourceFactory;
-  /** Plans and seats from billing, merged into `principal.plans` for the active tenant. */
-  readonly entitlements?: EntitlementSource;
-  readonly actor?: Actor;
-  readonly delegation?: Delegation;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly session?: string;
-  readonly expiresAt?: number;
-  /** Hosted grants; `current()` is read once, when the instance is created. */
-  readonly policies?: PolicySource;
-  /** The object graph for `through` and edge-table relations; without it they deny with `relation-unavailable`. */
-  readonly relations?: RelationSource;
-  /** Approval requirements kept as data; they add to the code's and never remove one. A throw denies. */
-  readonly approvalPolicies?: ApprovalPolicySource;
-  /**
-   * Request values an adapter's `context` hook derived on the server, merged
-   * into `subject.context`; keys from `policy.context` win on a clash.
-   */
-  readonly context?: Readonly<Record<string, unknown>>;
-};
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: PermDockOptions): PermDock<V> | Promise<PermDock<V>>;
 //#endregion
 //#region src/core/credential.d.ts
-type CredentialKind = "user" | "service";
+type CredentialKind = "user" | "service" | "feed";
+/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+declare function isFeedId(value: string): boolean;
 /** One permission (a key) a credential may use: on every instance, or only on `ids`. */
 type CredentialPermission = {
   readonly permission: string;
@@ -1485,17 +1143,22 @@ type Credential = {
    * credential, where it keeps only the owner's memberships inside it.
    */
   readonly tenant?: string;
-  /** Service only: the roles it holds in `tenant`. */
+  /** Service: the roles it holds in `tenant`. Feed: the resource roles it holds on `on`. */
   readonly roles?: readonly string[];
+  /** Feed only: the resource instance the roles are held on. */
+  readonly on?: {
+    readonly resource: string;
+    readonly id: string;
+  };
   readonly permissions: readonly CredentialPermission[];
   readonly createdBy: string;
-  /** Seconds since the epoch. */
-  readonly createdAt: number;
-  /** Seconds since the epoch; absent only where a credential policy allows it. */
-  readonly expiresAt?: number;
+  /** RFC 3339. */
+  readonly createdAt: string;
+  /** RFC 3339; absent only where a credential policy allows it. */
+  readonly expiresAt?: string;
   readonly name?: string;
 };
-type CredentialPrincipal = Principal & {
+type ApiKeyPrincipal = Principal & {
   readonly credential: Credential;
 };
 /**
@@ -1520,7 +1183,8 @@ type CredentialPermissionInput = Permission | {
 type CredentialRequestBase = {
   readonly id: string;
   readonly permissions: readonly CredentialPermissionInput[];
-  readonly expiresAt?: number;
+  /** RFC 3339; must be after `now`. */
+  readonly expiresAt?: string;
   readonly name?: string;
 };
 type CredentialRequest = (CredentialRequestBase & {
@@ -1533,6 +1197,15 @@ type CredentialRequest = (CredentialRequestBase & {
   readonly principal?: string;
   readonly tenant: string;
   readonly roles: readonly string[];
+}) | (CredentialRequestBase & {
+  readonly kind: "feed";
+  readonly on: {
+    readonly resource: Permission | PermissionTree;
+    readonly id: string;
+  };
+  readonly roles: readonly string[];
+  /** A row the server loaded. Each permission must be granted on it. */
+  readonly row: unknown;
 });
 type CredentialDecision = {
   readonly outcome: "granted";
@@ -1551,8 +1224,8 @@ type DecideCredentialOptions = {
   readonly settings?: SettingsSource;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
-  /** Seconds since the epoch. */
-  readonly now?: number;
+  /** The creation time; defaults to the clock. */
+  readonly now?: Instant;
 };
 /**
  * The first rule of `policy` the credential breaks, or `undefined`. A key
@@ -1574,20 +1247,6 @@ declare function parseCredential(input: unknown): Credential | undefined;
  * key is gone delegates nothing and every check is denied.
  */
 declare function credentialDelegation(credential: Credential, permissions: PermissionTree): Delegation;
-/**
- * The subject a verified credential acts as. A `user` credential is its
- * owner, passed live as `owner` (roles and memberships as of this request),
- * with the credential's delegation: every check is the owner's rights
- * intersected with the key's. One that names a `tenant` makes it the active
- * tenant, and `createPermDock` then keeps only the owner's memberships
- * inside it and no global role. A `service` credential is a `service`
- * principal whose only membership is `roles` in `tenant`. An owner whose id
- * is not the credential's `principal`, or who is not a user, is anonymous.
- */
-declare function credentialSubject(credential: Credential, options: {
-  readonly permissions: PermissionTree;
-  readonly owner?: Principal;
-}): Subject<CredentialPrincipal> | Subject;
 /**
  * Decides whether the subject of `permdock` may create the credential in
  * `request`. The creator must be a signed-in user or service that is not
@@ -1602,7 +1261,113 @@ declare function credentialSubject(credential: Credential, options: {
  * its token. PermDock never stores the credential; the application does,
  * after a `granted` result.
  */
-declare function decideCredential(permdock: PermDock, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
+/**
+ * Decides whether the subject of `permdock` may create the credential in
+ * `request`: the creator's own reach, the `credentials` policy of the key's
+ * tenant (the call's `settings`, else the instance's), and `approval`.
+ * PermDock never stores the credential; the application does, after a
+ * `granted` result. An instance built from a snapshot denies with
+ * `unsupported`.
+ */
+declare function decideCredential(permdock: InstanceHandle, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
+//#endregion
+//#region src/core/support-session.d.ts
+/**
+ * SupportSession v1: a support staff member (`actor`, kind `support`)
+ * viewing the app as `principal` in `tenant`, for a stated `reason`. Each
+ * request in the session acts as `principal` with their live rights,
+ * narrowed to `permissions`.
+ */
+type SupportSession = {
+  readonly v: 1;
+  readonly id: string;
+  /** The person the session views the app as. */
+  readonly principal: string;
+  /** The support staff member running the session. */
+  readonly actor: string;
+  readonly tenant: string;
+  readonly reason: string;
+  /** The delegation: permission keys, read-only unless listed on purpose. */
+  readonly permissions: readonly string[];
+  /** RFC 3339. */
+  readonly startedAt: string;
+  /** RFC 3339. */
+  readonly expiresAt: string;
+  /** Who approved the session; never `actor`. */
+  readonly approvedBy?: string;
+  /** The application's ticket or case id. */
+  readonly reference?: string;
+};
+/** A tenant's rules for support sessions. Every field only tightens. */
+type SupportSessionPolicy = {
+  /** No session may start in this tenant. */
+  readonly disabled?: boolean;
+  /** Longest a session may last, in seconds. */
+  readonly maxTtl?: number;
+  /** Only `readOnlyHint` permissions, whatever the request lists. */
+  readonly readOnly?: boolean;
+};
+type SupportSessionRequest = {
+  readonly id: string;
+  /** The person to view the app as. */
+  readonly principal: string;
+  /** Defaults to the actor's active tenant. */
+  readonly tenant?: string;
+  /** Required: why the session is needed. */
+  readonly reason: string;
+  /** Defaults to every `readOnlyHint` permission the actor can use. */
+  readonly permissions?: readonly Permission[];
+  /** Seconds the session lasts. Defaults to 3600; at most 86400. */
+  readonly expiresIn?: number;
+  readonly reference?: string;
+};
+type SupportSessionDecision = {
+  readonly outcome: "granted";
+  readonly session: SupportSession;
+} | {
+  readonly outcome: "approval-required";
+  readonly session: SupportSession;
+  /** Bound to the request and the actor; pass it as `approved` to resume. */
+  readonly token: string;
+} | {
+  readonly outcome: "denied";
+  readonly denials: readonly Denial[];
+};
+type DecideSupportSessionOptions = {
+  /** Where the tenant's `supportSessions` policy comes from. */
+  readonly settings?: SettingsSource;
+  /** Approval is required unless this is `false`. */
+  readonly approval?: boolean;
+  /** The `token` of an approval the application consumed for this request. */
+  readonly approved?: string;
+  /** The principal id that approved; required with `approved` and never the actor. */
+  readonly approvedBy?: string;
+  /** The start time; defaults to the clock. */
+  readonly now?: Instant;
+};
+/**
+ * Validates an untrusted support-session record and returns a frozen copy
+ * with only the v1 fields, or `undefined`.
+ */
+declare function parseSupportSession(input: unknown): SupportSession | undefined;
+/**
+ * Decides whether the subject of `permdock` may start the support session
+ * in `request`. The actor must be a signed-in person acting for themselves
+ * (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
+ * member of the tenant (`tenant-mismatch`) and be able to use every
+ * permission (`exceeds-creator`). Without `permissions` the session gets the
+ * actor's read-only permissions. The tenant's `supportSessions` policy then
+ * applies, and the result is `approval-required` until `approved` carries
+ * its token and `approvedBy` names someone other than the actor.
+ */
+/**
+ * Decides whether the subject of `permdock` may start the support session
+ * in `request` and returns the record to sign: a stated reason, membership
+ * of the tenant, the actor's own reach, the tenant's `supportSessions`
+ * policy and approval by someone else. An instance built from a snapshot
+ * denies with `unsupported`.
+ */
+declare function decideSupportSession(permdock: InstanceHandle, request: SupportSessionRequest, options?: DecideSupportSessionOptions): Promise<SupportSessionDecision>;
 //#endregion
 //#region src/core/interfaces.d.ts
 type DecisionProvider = {
@@ -1624,9 +1389,11 @@ type DecisionProvider = {
     readonly subject: Subject;
   }): Promise<readonly string[] | null | undefined>;
 };
-type RoleSource = {
+type CustomRoleSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   /**
-   * The custom roles of one tenant. `createPermDock` passes `held`, the role
+   * The custom roles of one tenant. `getPermDock` passes `held`, the role
    * names the subject's live memberships hold there, declared or not, so a
    * source can skip its read when none of them is a custom role.
    */
@@ -1644,12 +1411,12 @@ type RoleSource = {
   }): CustomRole[] | Promise<CustomRole[]>;
 };
 /**
- * A `RoleSource` built for the subject the instance serves, for an adapter
+ * A `CustomRoleSource` built for the subject the instance serves, for an adapter
  * option shared by every request: it gets the resolved subject (principal,
  * actor and delegation) and returns that subject's source, or `undefined`
  * for none. A throw reads no custom roles and reports `source-threw`.
  */
-type RoleSourceFactory = (subject: Subject) => RoleSource | undefined;
+type CustomRoleSourceFactory = (subject: Subject) => CustomRoleSource | undefined;
 /** One member of a scope instance, as `MembershipSource.list` returns it. */
 type MemberEntry = {
   readonly principal: {
@@ -1658,6 +1425,8 @@ type MemberEntry = {
   readonly membership: Membership;
 };
 type MembershipSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   membershipsFor(principal: {
     readonly id: string;
     readonly kind?: string;
@@ -1730,6 +1499,8 @@ type RelationHolder = HolderPeriod & ({
  * `relation-unavailable`.
  */
 type RelationSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   /**
    * With `through: 'parent'`, the parent chain; with a link name, the one
    * instance that link points to (`depth` is then 1).
@@ -1752,6 +1523,8 @@ type RelationSource = {
 };
 /** Plan and seat names a principal holds in a tenant, from billing (Stripe Entitlements, a table). */
 type EntitlementSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   entitlementsFor(principal: {
     readonly id: string;
   }, options: {
@@ -1783,6 +1556,8 @@ type VerificationFailure = {
   readonly cause: TokenFailureCause;
 };
 type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   verify(token: string, expectations: {
     readonly typ?: string | readonly string[];
     readonly audience?: string | readonly string[];
@@ -1791,10 +1566,18 @@ type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
   }): Promise<VerifiedToken<TClaims> | VerificationFailure>;
 };
 type TokenSigner = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   sign(payload: Readonly<Record<string, unknown>>, options: {
-    readonly typ: "permdock-snapshot+jwt" | "permdock-approval+jwt" | "permdock-decisions+jwt" | "permdock-policy+jwt" | "permdock-capability+jwt";
+    readonly typ: "vnd.permdock.snapshot+jwt" | "vnd.permdock.approval+jwt" | "vnd.permdock.policy+jwt" | "vnd.permdock.capability+jwt" | "vnd.permdock.run+jwt" | "vnd.permdock.support-session+jwt" | "vnd.permdock.evidence+jwt" | "at+jwt" | "secevent+jwt";
+    /** `aud`; a signer with no default audience refuses to sign without one. */
     readonly audience?: string | readonly string[];
+    /** `exp`, a NumericDate; one hour after `iat` when absent. */
     readonly expiresAt?: number;
+    /** `iat`, a NumericDate: the artefact's issue time. The signer's clock when absent. */
+    readonly issuedAt?: number;
+    /** `jti`: the artefact's id. A fresh UUID when absent. */
+    readonly jti?: string;
   }): Promise<string>;
   readonly kid?: string;
   jwks?(): Promise<{
@@ -1805,6 +1588,8 @@ type SubjectResolver<TInput, TPrincipal extends Principal = Principal> = (input:
   readonly tenant?: string;
 }) => Subject<TPrincipal> | Promise<Subject<TPrincipal>>;
 type SnapshotSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   get(): Promise<Snapshot | string> | Snapshot | string;
   subscribe?(listener: () => void): () => void;
 };
@@ -1813,8 +1598,10 @@ type LimitConsumeInput = {
   readonly key: string;
   readonly subjectId: string;
   readonly count: number;
-  readonly per: string;
-  readonly now?: number;
+  /** The window in seconds; windows are aligned to the epoch. */
+  readonly per: number;
+  /** The decision clock; the store reads the clock when absent. */
+  readonly now?: Instant;
   /** The active tenant; a quota counts per subject and tenant. */
   readonly tenant?: string;
 };
@@ -1822,10 +1609,14 @@ type LimitRemaining = {
   readonly remaining: number;
 };
 type LimitStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   consume(input: LimitConsumeInput): Promise<LimitRemaining> | LimitRemaining;
   remaining(input: LimitConsumeInput): LimitRemaining | undefined;
 };
 type DecisionSink = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   write(events: readonly SinkEvent[]): Promise<void> | void;
   flush?(): Promise<void>;
 };
@@ -1836,24 +1627,30 @@ type DecisionSink = {
  * never core's.
  */
 type CredentialVerifier = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   verify(secret: string): Credential | null | Promise<Credential | null>;
   /**
-   * Records a successful use at `at` (Unix seconds), for a `lastUsedAt`
-   * column. Called after a key resolved and not awaited; a throw or a
-   * rejection is ignored, so it never changes the subject.
+   * Records a successful use at `at`, for a `lastUsedAt` column. Called
+   * after a key resolved and not awaited; a throw or a rejection is
+   * ignored, so it never changes the subject.
    */
-  touch?(id: string, at: number): void | Promise<void>;
+  touch?(id: string, at: Instant): void | Promise<void>;
 };
 /** What one tenant configures for itself. Every field only tightens. */
 type TenantSettings = {
   /** Rules for API keys created in, or used against, this tenant. */
   readonly credentials?: CredentialPolicy;
+  /** Rules for support sessions started in this tenant. */
+  readonly supportSessions?: SupportSessionPolicy;
 };
 /**
- * Per-tenant settings, a subject input like `RoleSource`: they tighten what
+ * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten what
  * a key may be and never grant. A throw denies.
  */
 type SettingsSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   settingsFor(tenant: string): TenantSettings | undefined | Promise<TenantSettings | undefined>;
 };
 //#endregion
@@ -1875,8 +1672,8 @@ type ClosureContext = {
 type ClosureGrantFn<T = unknown> = (data: T, ctx: ClosureContext) => boolean;
 /** Who else may approve once a request has waited `after`. */
 type ApprovalEscalation = {
-  /** A duration (`'4h'`) from the request's creation. */
-  readonly after: string;
+  /** Seconds from the request's creation. */
+  readonly after: number;
   readonly to: Approver | readonly Approver[];
 };
 /** One group of approvers; `quorum` distinct approvers of `by` complete it. */
@@ -1906,8 +1703,8 @@ type ApprovalRequirement = {
   readonly staleOn?: "resource-change";
   /** Distinct approvers a request needs before it is approved under `by`; absent means 1. */
   readonly quorum?: number;
-  /** How long a request stays open (`'30m'`); the store's default when absent, and never longer than it. */
-  readonly ttl?: string;
+  /** Seconds a request stays open; the store's default when absent, and never longer than it. */
+  readonly ttl?: number;
   readonly escalation?: ApprovalEscalation;
 };
 type ApprovalOption = "human" | {
@@ -1917,9 +1714,9 @@ type ApprovalOption = "human" | {
   readonly stages?: readonly {
     readonly by: ApproverInput;
     readonly quorum?: number;
-    /** After `after`, `to` may approve this stage as well as `by`. */
+    /** After `after` seconds, `to` may approve this stage as well as `by`. */
     readonly escalation?: {
-      readonly after: string;
+      readonly after: number;
       readonly to: ApproverInput;
     };
   }[];
@@ -1933,11 +1730,11 @@ type ApprovalOption = "human" | {
   readonly staleOn?: "resource-change";
   /** Distinct approvers needed (an integer of at least 1); the same approver counts once. Absent means 1. */
   readonly quorum?: number;
-  /** How long the request stays open (`'30m'`, `'2d'`); caps the approval store's default. */
-  readonly ttl?: string;
-  /** After `after` (`'4h'`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
+  /** Seconds the request stays open (`1800`); caps the approval store's default. */
+  readonly ttl?: number;
+  /** After `after` seconds (`14_400`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
   readonly escalation?: {
-    readonly after: string;
+    readonly after: number;
     readonly to: ApproverInput;
   };
 };
@@ -1948,7 +1745,8 @@ type ApprovalOption = "human" | {
  */
 type GrantLimit = {
   readonly count: number;
-  readonly per: string;
+  /** The window in seconds (`3600` for an hour), aligned to the epoch. */
+  readonly per: number;
   readonly mode?: "hard" | "soft";
   readonly alertAt?: number;
 };
@@ -1967,8 +1765,8 @@ type AssuranceRequirement = {
  * mints the elevated membership to write.
  */
 type ActivationOption = {
-  /** The longest an activation may last, as a duration (`'4h'`, `'30m'`). */
-  readonly maxDuration?: string;
+  /** The longest an activation may last, in seconds (`14_400`). */
+  readonly maxDuration?: number;
   /** `'required'` denies an activation without a reason. */
   readonly justification?: "required" | "optional";
   /** When set, `activate` returns `approval-required` before the membership can be written. */
@@ -1977,7 +1775,7 @@ type ActivationOption = {
   readonly assurance?: AssuranceRequirement;
 };
 type ActivationSpec = {
-  readonly maxDuration?: string;
+  readonly maxDuration?: number;
   readonly justification: "required" | "optional";
   readonly approval?: "human" | ApprovalRequirement;
   readonly assurance?: AssuranceRequirement;
@@ -1994,8 +1792,8 @@ type BreakGlassOptions = {
   /** Names of the deny grants this override lifts; every other deny still wins. */
   readonly overrides?: readonly string[];
   readonly requires?: BreakGlassRequirements;
-  /** The longest a break-glass session may last, as a duration. */
-  readonly maxDuration?: string;
+  /** The longest a break-glass session may last, in seconds. */
+  readonly maxDuration?: number;
   /** Follow-ups the grant owes: each becomes an obligation on the decision. */
   readonly obligations?: readonly ("notify" | "review")[];
 };
@@ -2005,14 +1803,14 @@ type BreakGlassSpec = {
   readonly purpose?: readonly string[];
   readonly reason: boolean;
   readonly assurance?: AssuranceRequirement;
-  readonly maxDuration?: string;
+  readonly maxDuration?: number;
   readonly obligations: readonly ("notify" | "review")[];
 };
 /** How a tenant consents to support access, and for how long. */
 type SupportConsent = {
   readonly by: GranteeInput;
-  /** The durations a tenant owner may pick, as duration strings. */
-  readonly durations: readonly string[];
+  /** The durations a tenant owner may pick, in seconds. */
+  readonly durations: readonly number[];
 };
 type SupportAccessOptions<S extends string = string> = {
   /** The role a consented support membership holds. */
@@ -2032,7 +1830,7 @@ type SupportSpec = {
   readonly actorRequired: boolean;
   readonly consent: {
     readonly by: Grantee | readonly Grantee[];
-    readonly durations: readonly string[];
+    readonly durations: readonly number[];
   };
   readonly group: string;
 };
@@ -2060,10 +1858,10 @@ type GrantOptions<T = Record<string, unknown>> = {
   readonly obligations?: readonly ObligationInput[];
   /** Purposes of use (`context.purpose`) that make the grant apply; non-portable. */
   readonly purpose?: readonly string[];
-  /** The grant applies from this instant on (RFC 3339 string or Unix seconds); before it an allow denies with `inactive-grant` and a deny does not apply. */
-  readonly validFrom?: string | number;
-  /** The grant stops applying at this instant (exclusive; RFC 3339 string or Unix seconds). */
-  readonly validUntil?: string | number;
+  /** The grant applies from this instant on (RFC 3339 or an `Instant`); before it an allow denies with `inactive-grant` and a deny does not apply. */
+  readonly validFrom?: string | Instant;
+  /** The grant stops applying at this instant (exclusive; RFC 3339 or an `Instant`). */
+  readonly validUntil?: string | Instant;
   /**
    * An allow on an instance action counts only on rows whose scope instance
    * (or the whole app, globally) is one where the subject also holds this
@@ -2091,13 +1889,18 @@ type GrantValidity = {
   readonly from?: number;
   readonly until?: number;
 };
+/** A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details): RFC 3339 bounds. */
+type WireValidity = {
+  readonly from?: string;
+  readonly until?: string;
+};
 /**
  * The actor a policy delegation is for: an actor kind, narrowed to one id
  * when `id` is set, or to one named client when `client` is set (the name
  * the subject resolver gives a verified client id through `clients`).
  */
 type DelegationTarget = {
-  readonly kind: string;
+  readonly kind: ActorKind;
   readonly id?: string;
   readonly client?: string;
 };
@@ -2121,8 +1924,8 @@ type DelegationInput = {
   readonly to: ActorGrantee | string | DelegationTarget;
   /** The leaves or subtrees the actor may use; a deny grant still applies. */
   readonly permissions: readonly (Permission | PermissionTree)[];
-  readonly validFrom?: string | number;
-  readonly validUntil?: string | number;
+  readonly validFrom?: string | Instant;
+  readonly validUntil?: string | Instant;
 };
 /** A declared scope name (or the `tenant` / `team` alias), or the resource a role is held on. */
 type RoleScope<S extends string = string> = S | Permission | PermissionTree | readonly (Permission | PermissionTree)[];
@@ -2180,7 +1983,7 @@ type Grant = {
   /** Set on a break-glass allow: it overrides named denies and carries obligations. */
   readonly breakGlass?: BreakGlassSpec;
   /** The membership kind (`via`) this grant applies under; others never match it. */
-  readonly viaOnly?: string;
+  readonly viaOnly?: MembershipVia;
   /** Set only on a grant merged from a hosted policy document. */
   readonly hosted?: HostedGrantRef;
   /** When the grant applies; absent means always. */
@@ -2283,7 +2086,7 @@ type PolicyAppDataSchemas = {
   readonly grant?: AppDataSchema<unknown>;
   readonly membership?: AppDataSchema<unknown>;
 };
-type DefinePolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesInput = PolicyScopesInput> = {
+type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesInput = PolicyScopesInput> = {
   readonly x?: PolicyAppDataSchemas;
   readonly roles?: readonly RoleBinding<ScopeNames<S>>[];
   readonly grants?: readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[] | Grant)[];
@@ -2293,8 +2096,8 @@ type DefinePolicyOptions<TUser, TPrincipal extends Principal, S extends PolicySc
    * the first and second scope.
    */
   readonly scopes?: S;
-  readonly principal?: (user: TUser) => TPrincipal | null;
-  readonly subject?: (user: TUser) => TPrincipal | null;
+  /** Maps the application's user to the principal PermDock decides for; `null` is anonymous. */
+  readonly subject: (user: TUser) => TPrincipal | null;
   readonly context?: (user: TUser) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
   readonly validate?: ValidateMode;
   readonly onDenied?: (decision: unknown) => never | void;
@@ -2344,4 +2147,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { RelationGroup as $, inherit as $n, validateApprovalPolicy as $t, PolicyScopes as A, ArazzoFinding as An, VerifiedClaims as Ar, DeriveOptions as At, ValidateMode as B, UserApprover as Bn, SqlFunctionArg as Br, HostedGrantDropped as Bt, HostedGrantRef as C, MembershipEvent as Cn, CustomRoleGrant as Cr, DecideCredentialOptions as Ct, PolicyAppDataSchemas as D, ActivateInput as Dn, Membership as Dr, decideCredential as Dt, Policy as E, WireDenial as En, JsonWebKeyLike as Er, credentialSubject as Et, RoleScope as F, simulateArazzo as Fn, MemberOfParent as Fr, SnapshotOptions as Ft, EntitlementSource as G, Grantee as Gn, isConditionRef as Gr, mergeHostedGrants as Gt, CredentialVerifier as H, anyOf as Hn, hasConditionOp as Hr, PolicySource as Ht, SeparationConflict as I, AnyOfApprover as In, OpaqueCondition as Ir, WhereResult as It, LimitRemaining as J, RelationGrantee as Jn, ApprovalPolicy as Jt, JwtClaims as K, GranteeInput as Kn, isSqlFunctionField as Kr, parsePolicyDocument as Kt, SubjectOf as L, Approver as Ln, RelatedCondition as Lr, createPermDock as Lt, PrincipalOf as M, ArazzoSimulateInput as Mn, ConditionRef as Mr, PermDockOptions as Mt, RoleBinding as N, ArazzoStepResult as Nn, ConditionValue as Nr, RowPair as Nt, PolicyDelegation as O, breakGlass as On, Principal as Or, parseCredential as Ot, RoleOptions as P, arazzoFindings as Pn, MemberOfCondition as Pr, SimulateOptions as Pt, RelationChain as Q, authenticated as Qn, memoryApprovalPolicies as Qt, SupportAccessOptions as R, ApproverInput as Rn, RelatedHop as Rr, HostedGrant as Rt, GrantValidity as S, DirectoryEvent as Sn, CustomRole as Sr, CredentialRequest as St, ObligationInput as T, WireDecision as Tn, GnapAccess as Tr, credentialPolicyViolation as Tt, DecisionProvider as U, holder as Un, isCondition as Ur, isPortableCondition as Ut, VocabularyFromInput as V, allOf as Vn, SqlFunctionCondition as Vr, PolicyDocument as Vt, DecisionSink as W, user as Wn, isConditionDate as Wr, memoryPolicySource as Wt, MemberEntry as X, anyone as Xn, ApprovalPolicySource as Xt, LimitStore as Y, actor as Yn, ApprovalPolicyProblem as Yt, MembershipSource as Z, assurance as Zn, ApprovalPolicyValidation as Zt, GrantCondition as _, ScopeNames as _n, TraceSkipReason as _r, CredentialPermission as _t, ApprovalRequirement as a, Snapshot as an, Denial as ar, SnapshotSource as at, GrantOptions as b, CredentialEvent as bn, AuthorizationDetail as br, CredentialPolicyViolation as bt, BreakGlassOptions as c, SnapshotNotEntitled as cn, DeniedDecision as cr, TokenFailureCause as ct, ClosureContext as d, RoleChangeDecision as dn, LimitDetail as dr, VerificationFailure as dt, Holder as en, plan as er, RelationHolder as et, ClosureGrantFn as f, RoleChangeOptions as fn, MatchedGrant as fr, VerifiedToken as ft, Grant as g, ScopeDeclaration as gn, TraceSkip as gr, CredentialKind as gt, DelegationTarget as h, Scope as hn, Trace as hr, CredentialDecision as ht, ApprovalOption as i, LocalSnapshotManifest as in, Decision as ir, SettingsSource as it, PolicyVocabulary as j, ArazzoPlan as jn, Condition as jr, PermDock as jt, PolicyOAuthScope as k, supportAccess as kn, Subject as kr, DecideOptions as kt, BreakGlassRequirements as l, SnapshotScope as ln, ExplainedDecision as lr, TokenSigner as lt, DelegationInput as m, PolicyScopesInput as mn, Quota as mr, Credential as mt, ApprovalEscalation as n, WhoCan as nn, AppObligation as nr, RoleSource as nt, ApprovalStage as o, SnapshotAssignable as on, DenialDetails as or, SubjectResolver as ot, DefinePolicyOptions as p, RoleChangeTarget as pn, Obligation as pr, WhereCompiler as pt, LimitConsumeInput as q, InheritGrantee as qn, APPROVAL_POLICY_UNAVAILABLE as qt, ApprovalMode as r, LocalCustomRoleTable as rn, ApprovalRequiredDecision as rr, RoleSourceFactory as rt, AssuranceRequirement as s, SnapshotGrant as sn, DenialReason as sr, TenantSettings as st, ActivationOption as t, HoldingVia as tn, relation as tr, RelationSource as tt, BreakGlassSpec as u, RoleChange as un, GrantedDecision as ur, TokenVerifier as ut, GrantLimit as v, AccessEvent as vn, Actor as vr, CredentialPermissionInput as vt, MembershipFixture as w, SinkEvent as wn, Delegation as wr, credentialDelegation as wt, GrantScope as x, DecisionEvent as xn, Binding as xr, CredentialPrincipal as xt, GrantMeta as y, AuthEvent as yn, Assurance as yr, CredentialPolicy as yt, SupportConsent as z, PermissionApprover as zn, RestrictedAncestors as zr, HostedGrantDropReason as zt };
+export { MemberEntry as $, Delegation as $n, DeliveryFailureCause as $t, PolicyScopes as A, relation as An, CredentialRequest as At, ValidateMode as B, LimitDetail as Bn, LocalSnapshotManifest as Bt, MembershipFixture as C, RelationGrantee as Cn, isConditionRef as Cr, Credential as Ct, PolicyDelegation as D, authenticated as Dn, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, assurance as En, CredentialPermission as Et, RoleScope as F, DenialDetails as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, TraceSkip as Gn, SnapshotScope as Gt, WireValidity as H, Obligation as Hn, SnapshotAssignable as Ht, SeparationConflict as I, DenialReason as In, parseCredential as It, EntitlementSource as J, Assurance as Jn, AutomationEvent as Jt, DecisionProvider as K, TraceSkipReason as Kn, AccessEvent as Kt, SubjectOf as L, DeniedDecision as Ln, InstanceHandle as Lt, PrincipalOf as M, ApprovalRequiredDecision as Mn, credentialDelegation as Mt, RoleBinding as N, Decision as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, inherit as On, CredentialPolicy as Ot, RoleOptions as P, Denial as Pn, decideCredential as Pt, LimitStore as Q, CustomRoleGrant as Qn, DeliveryEvent as Qt, SupportAccessOptions as R, ExplainedDecision as Rn, Instant as Rt, HostedGrantRef as S, InheritGrantee as Sn, isConditionDate as Sr, ApiKeyPrincipal as St, Policy as T, anyone as Tn, CredentialKind as Tt, CredentialVerifier as U, Quota as Un, SnapshotGrant as Ut, VocabularyFromInput as V, MatchedGrant as Vn, Snapshot as Vt, CustomRoleSource as W, Trace as Wn, SnapshotNotEntitled as Wt, LimitConsumeInput as X, Binding as Xn, DecisionEvent as Xt, JwtClaims as Y, AuthorizationDetail as Yn, CredentialEvent as Yt, LimitRemaining as Z, CustomRole as Zn, DeliveryChannel as Zt, GrantLimit as _, anyOf as _n, RestrictedAncestors as _r, SupportSessionDecision as _t, ApprovalRequirement as a, WireDenial as an, VerifiedClaims as ar, SettingsSource as at, GrantScope as b, Grantee as bn, hasConditionOp as br, decideSupportSession as bt, BreakGlassOptions as c, Scope as cn, MembershipVia as cr, TenantSettings as ct, ClosureContext as d, AnyOfApprover as dn, ConditionValue as dr, TokenVerifier as dt, DirectoryEvent as en, GnapAccess as er, MembershipSource as et, ClosureGrantFn as f, Approver as fn, MemberOfCondition as fr, VerificationFailure as ft, GrantCondition as g, allOf as gn, RelatedHop as gr, SupportSession as gt, Grant as h, UserApprover as hn, RelatedCondition as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, WireDecision as in, Subject as ir, RelationSource as it, PolicyVocabulary as j, AppObligation as jn, DecideCredentialOptions as jt, PolicyOptions as k, plan as kn, CredentialPolicyViolation as kt, BreakGlassRequirements as l, ScopeDeclaration as ln, Condition as lr, TokenFailureCause as lt, DelegationTarget as m, PermissionApprover as mn, OpaqueCondition as mr, WhereCompiler as mt, ApprovalEscalation as n, MembershipEvent as nn, Membership as nr, RelationGroup as nt, ApprovalStage as o, WireDelegation as on, ActorKind as or, SnapshotSource as ot, DelegationInput as p, ApproverInput as pn, MemberOfParent as pr, VerifiedToken as pt, DecisionSink as q, Actor as qn, AuthEvent as qt, ApprovalMode as r, SinkEvent as rn, Principal as rr, RelationHolder as rt, AssuranceRequirement as s, PolicyScopesInput as sn, AdapterId as sr, SubjectResolver as st, ActivationOption as t, EmailCategory as tn, JsonWebKeyLike as tr, RelationChain as tt, BreakGlassSpec as u, ScopeNames as un, ConditionRef as ur, TokenSigner as ut, GrantMeta as v, holder as vn, SqlFunctionArg as vr, SupportSessionPolicy as vt, ObligationInput as w, actor as wn, isSqlFunctionField as wr, CredentialDecision as wt, GrantValidity as x, GranteeInput as xn, isCondition as xr, parseSupportSession as xt, GrantOptions as y, user as yn, SqlFunctionCondition as yr, SupportSessionRequest as yt, SupportConsent as z, GrantedDecision as zn, LocalCustomRoleTable as zt };