permdock 0.7.0 → 0.8.0

package/dist/{index-BTkwrK7v.d.ts → index-BW_0MZOS.d.ts}

@@ -1,13 +1,13 @@
-import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-B-F-qAZk.js";
-import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
-import { a as RoleTree, r as Role } from "./vocabulary-Bg3eeT2H.js";
-import { a as PermDock, o as PermDockOptions } from "./permdock-Dco6dyCK.js";
-import { o as PolicyDocument } from "./hosted-BmjzxQhp.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
-import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-Cp_Eot9W.js";
+import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-CCiDRZBH.js";
+import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, r as Role } from "./vocabulary-DEJ5j4mR.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { o as PolicyDocument } from "./hosted-Cmtxogd0.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-Dvi7YZG_.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
 type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
@@ -25,7 +25,10 @@ declare function claim(path: string): SubjectRef;
 //#endregion
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
-/** Why part of a custom role was left out: a permission, or an undeclared include. */
+/**
+ * Why part of a custom role was left out: a permission, or an undeclared
+ * include.
+ */
 type CustomRoleDrop = {
   readonly permission: string;
   readonly reason: CustomRoleDropReason;
@@ -44,10 +47,16 @@ type CustomRoleRename = {
   readonly to: string;
 };
 type ResolvedCustomRole = {
-  /** Declared grants re-targeted to the custom role; conditions and approvals kept. */
+  /**
+   * Declared grants re-targeted to the custom role; conditions and approvals
+   * kept.
+   */
   readonly grants: readonly Grant[];
   readonly dropped: readonly CustomRoleDrop[];
-  /** Grants stored under a former key (`definePermissions` `renamed`), resolved to the current one. */
+  /**
+   * Grants stored under a former key (`definePermissions` `renamed`), resolved
+   * to the current one.
+   */
   readonly renamed: readonly CustomRoleRename[];
 };
 type CustomRoleValidation = {
@@ -68,7 +77,10 @@ type CustomRoleValidation = {
  */
 declare function resolveCustomRole(policy: Policy, role: CustomRole): ResolvedCustomRole;
 type ValidateCustomRoleOptions = {
-  /** The shared custom roles: a tenant role with one of their names is dropped as `name-taken`. */
+  /**
+   * The shared custom roles: a tenant role with one of their names is dropped
+   * as `name-taken`.
+   */
   readonly shared?: readonly CustomRole[];
 };
 declare function validateCustomRole(policy: Policy, role: CustomRole, options?: ValidateCustomRoleOptions): CustomRoleValidation;
@@ -91,10 +103,10 @@ declare function parseCustomRoleEntry(policy: Policy, entry: string, options?: {
   readonly scope?: string;
 }): CustomRoleEntry;
 /**
- * The compact JWT form of custom roles for the `memberships[].grants` claim
- * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
- * denies and `@role` includes. Put a team custom role on its team membership.
- * Pass `policy` to write keys stored under a former name as the current key.
+ * The compact JWT form of custom roles for the `memberships[].grants` claim RLS
+ * reads in `jwt` mode: role name to entries, where `key` allows, `-key` denies
+ * and `@role` includes. Put a team custom role on its team membership. Pass
+ * `policy` to write keys stored under a former name as the current key.
  */
 declare function customRoleClaim(roles: readonly CustomRole[], policy?: Policy): Readonly<Record<string, readonly string[]>>;
 //#endregion
@@ -112,18 +124,21 @@ declare function emptySnapshot(): Snapshot;
 declare function requiresApproval(approval: Grant["approval"] | undefined): boolean;
 //#endregion
 //#region src/core/policy.d.ts
-declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
-/** The role names a policy declares: the keys of its `defineRoles` vocabulary, else `string`. */
+declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>, S>;
+/**
+ * The role names a policy declares: the keys of its `defineRoles` vocabulary,
+ * else `string`.
+ */
 type RoleNameOf<P> = P extends {
   readonly vocabulary: infer V;
 } ? V extends {
   readonly roles: infer R extends RoleTree;
 } ? R[keyof R]["key"] : string : string;
 /**
- * Whether `value` names a role the policy declares, for a role read as a
- * string from a database or a token. A name it rejects is an unknown role,
- * which grants nothing (`unknown-role`). A tenant's custom roles are not
- * declared; `CustomRoleSource` resolves them.
+ * Whether `value` names a role the policy declares, for a role read as a string
+ * from a database or a token. A name it rejects is an unknown role, which
+ * grants nothing (`unknown-role`). A tenant's custom roles are not declared;
+ * `CustomRoleSource` resolves them.
  */
 declare function isRoleName<P extends Policy<never>>(policy: P, value: unknown): value is RoleNameOf<P>;
 declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
@@ -158,16 +173,22 @@ declare function sqlFunction(name: string, options: {
 //#region src/core/memory-sources.d.ts
 declare function memoryEntitlementSource(entries: Readonly<Record<string, readonly string[]>>): EntitlementSource;
 declare function memorySettingsSource(settings: Readonly<Record<string, TenantSettings>>): SettingsSource;
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+/**
+ * Memberships keyed by principal id; `tenant` is not a filter, as for a
+ * database source.
+ */
 declare function memoryMembershipSource(entries: Readonly<Record<string, readonly Membership[]>>): MembershipSource;
 /** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
 declare function memorySnapshotSource(initial: Snapshot | string): SnapshotSource & {
-  set(snapshot: Snapshot | string): void;
+  set: (snapshot: Snapshot | string) => void;
 };
 declare function memoryCustomRoleSource(customRoles: readonly CustomRole[]): CustomRoleSource;
 //#endregion
 //#region src/core/approval-state.d.ts
-/** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
+/**
+ * The denial detail when an `ApprovalPolicySource` threw or returned an invalid
+ * entry.
+ */
 declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
 //#endregion
 //#region src/core/memberships.d.ts
@@ -179,23 +200,26 @@ declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
  */
 declare function composeMemberships(sources: readonly MembershipSource[]): MembershipSource;
 /**
- * Trust the memberships the verified token carries, and read `source` only
- * when the token marks them truncated. With `version`, a token minted before
- * the latest membership change is stale for the policy's `fresh` permissions,
- * or with `onStale: 'reread'` has its memberships read from `source` instead.
+ * Trust the memberships the verified token carries, and read `source` only when
+ * the token marks them truncated. With `version`, a token minted before the
+ * latest membership change is stale for the policy's `fresh` permissions, or
+ * with `onStale: 'reread'` has its memberships read from `source` instead.
  */
 declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
   readonly version?: MembershipSource["version"];
   readonly onStale?: "deny" | "reread";
 }): MembershipSource;
-/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+/**
+ * Whether the identity provider owns `membership`: the application must not
+ * add, change or remove it.
+ */
 declare function isExternallyManaged(membership: Membership): boolean;
 /**
- * How many principals hold `role` in one scope instance now, from the
- * source's member list (`MembershipSource.list`): live memberships of exactly
- * that scope and instance, each principal counted once. The `holders` a
- * `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
- * when the source cannot list or the read fails, which that check denies.
+ * How many principals hold `role` in one scope instance now, from the source's
+ * member list (`MembershipSource.list`): live memberships of exactly that scope
+ * and instance, each principal counted once. The `holders` a `decideRoleChange`
+ * with `min`, `max` or `transferOnly` needs. `undefined` when the source cannot
+ * list or the read fails, which that check denies.
  */
 declare function countHolders(source: MembershipSource | readonly MembershipSource[], query: {
   readonly scope: string;
@@ -206,15 +230,18 @@ declare function countHolders(source: MembershipSource | readonly MembershipSour
 }): Promise<number | undefined>;
 //#endregion
 //#region src/core/stripe-entitlements.d.ts
-/** The part of the Stripe Node SDK this source calls: `stripe.entitlements.activeEntitlements.list`. */
+/**
+ * The part of the Stripe Node SDK this source calls:
+ * `stripe.entitlements.activeEntitlements.list`.
+ */
 type StripeEntitlementsClient = {
   readonly entitlements: {
     readonly activeEntitlements: {
-      list(params: {
+      list: (params: {
         readonly customer: string;
         readonly limit?: number;
         readonly starting_after?: string;
-      }): PromiseLike<{
+      }) => PromiseLike<{
         readonly data: readonly {
           readonly id: string;
           readonly lookup_key: string;
@@ -246,14 +273,17 @@ type MemoryEdge = {
   readonly expiresAt?: number;
 };
 type MemoryRelationSourceData = {
-  /** Rows per resource: parent pointers, links, restricted flags and relation columns are read from them. */
+  /**
+   * Rows per resource: parent pointers, links, restricted flags and relation
+   * columns are read from them.
+   */
   readonly rows?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
   /** Edge-table rows per resource and relation. */
   readonly edges?: Readonly<Record<string, Readonly<Record<string, readonly MemoryEdge[]>>>>;
   /**
-   * Edge tables as the database holds them, keyed by `edge` name: each row
-   * is read through the relation's `object`, `subject`, `expiresAt`, `match`
-   * and `groups` columns. A relation whose table is here ignores `edges`.
+   * Edge tables as the database holds them, keyed by `edge` name: each row is
+   * read through the relation's `object`, `subject`, `expiresAt`, `match` and
+   * `groups` columns. A relation whose table is here ignores `edges`.
    */
   readonly tables?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
 };
@@ -273,7 +303,10 @@ type HoldingVia = {
   readonly kind: "relation";
   readonly resource: string;
   readonly relation: string;
-  /** The instance the relation is held on: the object or one of its ancestors. */
+  /**
+   * The instance the relation is held on: the object or one of its
+   * ancestors.
+   */
   readonly id: string;
 } | {
   readonly kind: "share";
@@ -281,7 +314,10 @@ type HoldingVia = {
   readonly relation: string;
   readonly id: string;
   readonly expiresAt?: number;
-  /** The group the share names, when the principal holds it as one of its members. */
+  /**
+   * The group the share names, when the principal holds it as one of its
+   * members.
+   */
   readonly group?: RelationGroup;
 };
 type Holder = {
@@ -291,10 +327,10 @@ type Holder = {
   readonly via: readonly HoldingVia[];
 };
 /**
- * Who holds a permission on one object, for share dialogs and access
- * reviews. It lists and never grants. `complete: false` means some grantee
- * could not be enumerated (a global role, a plan, a source without `list`,
- * an unavailable relation): holders may be missing, so check with `decide`.
+ * Who holds a permission on one object, for share dialogs and access reviews.
+ * It lists and never grants. `complete: false` means some grantee could not be
+ * enumerated (a global role, a plan, a source without `list`, an unavailable
+ * relation): holders may be missing, so check with `decide`.
  */
 type WhoCan = {
   readonly permission: string;
@@ -302,11 +338,11 @@ type WhoCan = {
   readonly complete: boolean;
 };
 /**
- * Who holds `permission` on `resource` for the instance's policy and how
- * (role, relation or share), from `MembershipSource.list` and
- * `RelationSource.related`. It lists and never grants; `complete: false`
- * means some holders could not be listed. An instance built from a
- * snapshot answers an empty, incomplete list.
+ * Who holds `permission` on `resource` for the instance's policy and how (role,
+ * relation or share), from `MembershipSource.list` and
+ * `RelationSource.related`. It lists and never grants; `complete: false` means
+ * some holders could not be listed. An instance built from a snapshot answers
+ * an empty, incomplete list.
  */
 declare function whoCan(permdock: InstanceHandle, permission: Permission<string, unknown, "instance">, resource: unknown): Promise<WhoCan>;
 //#endregion
@@ -314,7 +350,10 @@ declare function whoCan(permdock: InstanceHandle, permission: Permission<string,
 type SignPolicyDocumentOptions = {
   /** `aud`: the environment URL `cloud().policies` checks it against. */
   readonly audience: string | readonly string[];
-  /** `exp`, a NumericDate; the signer's default (one hour after `iat`) when absent. */
+  /**
+   * `exp`, a NumericDate; the signer's default (one hour after `iat`) when
+   * absent.
+   */
   readonly expiresAt?: number;
 };
 /**
@@ -329,14 +368,20 @@ type SignSnapshotOptions = {
   /** `aud`; a signer with no default audience refuses to sign without one. */
   readonly audience?: string | readonly string[];
 };
-/** The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and `jti`. */
+/**
+ * The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and
+ * `jti`.
+ */
 type SnapshotClaims = {
   readonly snapshot: Omit<Snapshot, "issuedAt" | "expiresAt">;
   /** The principal's id; absent for an anonymous snapshot. */
   readonly sub?: string;
   /** `issuedAt` in NumericDate seconds; absent when it is not after the epoch. */
   readonly iat?: number;
-  /** `expiresAt` in NumericDate seconds; absent when the snapshot has none, and the signer then sets its default. */
+  /**
+   * `expiresAt` in NumericDate seconds; absent when the snapshot has none, and
+   * the signer then sets its default.
+   */
   readonly exp?: number;
 };
 /**
@@ -345,7 +390,10 @@ type SnapshotClaims = {
  * claims are the only times a verifier reads.
  */
 declare function snapshotClaims(snapshot: Snapshot): SnapshotClaims;
-/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
+/**
+ * Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims
+ * `snapshotClaims` answers.
+ */
 declare function signSnapshot(snapshot: Snapshot, signer: TokenSigner, options?: SignSnapshotOptions): Promise<string>;
 /**
  * The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
@@ -390,10 +438,9 @@ type ArazzoFinding = {
 };
 declare function arazzoFindings(input: ArazzoSimulateInput, tree: PermissionTree | undefined): readonly ArazzoFinding[];
 /**
- * Walks an Arazzo workflow against `permdock`: each step's operation is
- * decided as `permdock.simulate` would, and a server instance emits one
- * simulate event for the whole plan. Works on an instance built from a
- * snapshot too.
+ * Walks an Arazzo workflow against `permdock`: each step's operation is decided
+ * as `permdock.simulate` would, and a server instance emits one simulate event
+ * for the whole plan. Works on an instance built from a snapshot too.
  */
 declare function simulateArazzo(permdock: PermDock, input: ArazzoSimulateInput): ArazzoPlan;
 //#endregion
@@ -407,16 +454,17 @@ declare function localSnapshotManifest(policy: Policy): LocalSnapshotManifest;
 //#endregion
 //#region src/core/app.d.ts
 /**
- * How strict `defineApp` is about the services the policy needs. `dev`
- * fills in in-process defaults (a memory approval store and a memory limit
- * store) so a new app runs before any infrastructure exists. `prod` throws at startup when a grant needs a
- * service the app does not configure, instead of denying at run time.
+ * How strict `defineApp` is about the services the policy needs. `dev` fills in
+ * in-process defaults (a memory approval store and a memory limit store) so a
+ * new app runs before any infrastructure exists. `prod` throws at startup when
+ * a grant needs a service the app does not configure, instead of denying at run
+ * time.
  */
 type AppProfile = "dev" | "prod";
 /**
- * Everything an app wires once and every adapter reads: the data sources,
- * the opt-in features and the services. An adapter's own options win over
- * these, key by key.
+ * Everything an app wires once and every adapter reads: the data sources, the
+ * opt-in features and the services. An adapter's own options win over these,
+ * key by key.
  */
 type AppOptions = InstanceOptions & Pick<PermDockOptions, "settings"> & {
   /** Where approval requests open and resume, for every adapter. */
@@ -426,10 +474,10 @@ type AppOptions = InstanceOptions & Pick<PermDockOptions, "settings"> & {
 //#endregion
 //#region src/app/define-app.d.ts
 /**
- * Binds the app's sources, features and services to `policy`. The result
- * is a policy: pass it wherever a policy goes (`createPermDock`, every
- * adapter, the CLI) and each picks up the app definition, with its own
- * options taking precedence. The profile defaults to `prod`.
+ * Binds the app's sources, features and services to `policy`. The result is a
+ * policy: pass it wherever a policy goes (`createPermDock`, every adapter, the
+ * CLI) and each picks up the app definition, with its own options taking
+ * precedence. The profile defaults to `prod`.
  */
 declare function defineApp<TUser, TPrincipal extends Principal, V extends PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options?: AppOptions): Policy<TUser, TPrincipal, V>;
 //#endregion
@@ -453,20 +501,20 @@ type ShadowMismatch = {
 type ShadowOptions = {
   readonly legacy: LegacyCheck;
   /**
-   * Permissions PermDock decides; every other check returns the legacy
-   * answer. `"all"` once every mismatch is resolved; default none.
+   * Permissions PermDock decides; every other check returns the legacy answer.
+   * `"all"` once every mismatch is resolved; default none.
    */
   readonly enforce?: readonly Permission[] | "all";
   /** Called for each disagreement; a throw here is ignored. */
   readonly onMismatch?: (mismatch: ShadowMismatch) => void;
 };
 /**
- * Runs PermDock beside the application's existing checks while adopting
- * it. Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both;
- * the legacy answer is returned unless the permission is in `enforce`, and
- * every disagreement reaches `onMismatch`. Promote permissions one by one
- * as their mismatches are resolved, then remove the wrap. Pass it as an
- * adapter's `wrap` option, or call it on a core instance.
+ * Runs PermDock beside the application's existing checks while adopting it.
+ * Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both; the
+ * legacy answer is returned unless the permission is in `enforce`, and every
+ * disagreement reaches `onMismatch`. Promote permissions one by one as their
+ * mismatches are resolved, then remove the wrap. Pass it as an adapter's `wrap`
+ * option, or call it on a core instance.
  */
 declare function shadowMode(options: ShadowOptions): PermDockWrap;
 //#endregion
@@ -483,28 +531,41 @@ declare function mayAccess(policy: Policy, user: unknown, permission: Permission
 }): boolean;
 //#endregion
 //#region src/core/custom-role-source.d.ts
-/** Reads custom roles from the application's store, as `customRoleSource` takes them. */
+/**
+ * Reads custom roles from the application's store, as `customRoleSource` takes
+ * them.
+ */
 type CustomRoleReader = {
-  /** Every custom role of `tenant`, whether or not anyone in the request holds it. */
-  rolesFor(tenant: string): CustomRole[] | Promise<CustomRole[]>;
-  assignable?(tenant: string): string[] | Promise<string[]>;
+  /**
+   * Every custom role of `tenant`, whether or not anyone in the request holds
+   * it.
+   */
+  rolesFor: (tenant: string) => CustomRole[] | Promise<CustomRole[]>;
+  assignable?: (tenant: string) => string[] | Promise<string[]>;
   /** Platform custom roles (`scope: 'global'`). */
-  globalRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  globalRoles?: () => CustomRole[] | Promise<CustomRole[]>;
   /** Shared custom roles (`shared: true`), the same for every tenant. */
-  sharedRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  sharedRoles?: () => CustomRole[] | Promise<CustomRole[]>;
 };
 type CustomRoleSourceOptions = {
-  /** `'all'` (default): read every custom role of each tenant, so `assignableRoles` and `decideRoleChange` see them all. */
+  /**
+   * `'all'` (default): read every custom role of each tenant, so
+   * `assignableRoles` and `decideRoleChange` see them all.
+   */
   readonly read?: "all";
 } | {
-  /** `'held'`: skip a tenant's read, and the platform read, when every role the subject holds there is declared in `policy`. For requests that never manage roles. */
+  /**
+   * `'held'`: skip a tenant's read, and the platform read, when every role
+   * the subject holds there is declared in `policy`. For requests that
+   * never manage roles.
+   */
   readonly read: "held";
   readonly policy: Policy;
 };
 /**
- * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
- * It keeps only the roles of the requested tenant. With `read: 'held'` it
- * skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+ * A `CustomRoleSource` over a reader that returns every custom role of a
+ * tenant. It keeps only the roles of the requested tenant. With `read: 'held'`
+ * it skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
  * subject holds only declared roles there.
  */
 declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): CustomRoleSource;
@@ -522,7 +583,10 @@ type SnapshotForOptions = {
   readonly memberships?: readonly Membership[];
   /** The tenant's custom roles, typically from a shared, tagged cache. */
   readonly customRoles?: readonly CustomRole[];
-  /** Per tenant, the role names `CustomRoleSource.assignable` returns; narrows `assignable`. */
+  /**
+   * Per tenant, the role names `CustomRoleSource.assignable` returns; narrows
+   * `assignable`.
+   */
   readonly assignable?: Readonly<Record<string, readonly string[]>>;
   /** Plans of the active tenant; replaces `principal.plans`. */
   readonly plans?: readonly string[];
@@ -532,10 +596,10 @@ type SnapshotForOptions = {
   readonly now?: Instant;
 };
 /**
- * Builds the serializable access snapshot for a subject without a request,
- * a network call or a cache directive: call it inside the app's own
- * `'use cache: private'` function. Synchronous; the policy's `subject` and
- * `context` mappers must be synchronous too.
+ * Builds the serializable access snapshot for a subject without a request, a
+ * network call or a cache directive: call it inside the app's own `'use cache:
+ * private'` function. Synchronous; the policy's `subject` and `context` mappers
+ * must be synchronous too.
  */
 declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
 //#endregion
@@ -548,8 +612,12 @@ declare function definePermissions<const Input, PX = never, RX = never>(input: I
  * renames and for one that crossed a serialisation boundary.
  */
 declare function formerKeys(permission: object): readonly string[];
-declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly []>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C>): ResourceInit<T, A, C>;
-declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly []>(options: ResourceOptions<A, C>): ResourceInit<unknown, A, C>;
+declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly [], const N extends string = never>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C> & {
+  readonly name?: N;
+}): ResourceInit<T, A, C, N>;
+declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly [], const N extends string = never>(options: ResourceOptions<A, C> & {
+  readonly name?: N;
+}): ResourceInit<unknown, A, C, N>;
 //#endregion
 //#region src/core/presets.d.ts
 type ReadOnlyMeta = {
@@ -612,7 +680,10 @@ declare function writable<const A extends ActionList | undefined = undefined, co
 //#endregion
 //#region src/core/role-builder.d.ts
 type RoleGrants = readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[])[];
-/** A role held at a named scope: `on` is checked against `definePolicy({ scopes })`. */
+/**
+ * A role held at a named scope: `on` is checked against `definePolicy({ scopes
+ * })`.
+ */
 declare function role<const S extends string>(name: string | Role, grants: RoleGrants, options: RoleOptions<S> & {
   readonly on: S;
 }): RoleBinding<S>;
@@ -625,13 +696,16 @@ declare function normalizeAssurance(input: AssuranceRequirement | undefined): As
 //#region src/core/grant-builders.d.ts
 declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 /**
- * Every action of a resource (`permissions.post`), of several, or of the
- * whole tree, unconditionally. Each grant is listed in the policy as if
- * written out, and an action added to the resource later is granted too.
+ * Every action of a resource (`permissions.post`), of several, or of the whole
+ * tree, unconditionally. Each grant is listed in the policy as if written out,
+ * and an action added to the resource later is granted too.
  */
 declare function allow(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
-/** Every action of a resource, of several, or of the whole tree, unconditionally. */
+/**
+ * Every action of a resource, of several, or of the whole tree,
+ * unconditionally.
+ */
 declare function deny(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 //#endregion
 //#region src/core/approval-normalize.d.ts
@@ -657,7 +731,10 @@ declare function supportAccess<const S extends string>(options: SupportAccessOpt
 declare function supportAccess(options: SupportAccessOptions<never>): RoleBinding<"tenant">;
 type ActivateInput = {
   readonly role: string | Role;
-  /** The scope the activation applies in (a declared name or the `tenant` / `team` alias). */
+  /**
+   * The scope the activation applies in (a declared name or the `tenant` /
+   * `team` alias).
+   */
   readonly scope: string;
   readonly id: string;
   /** Ancestor scope ids, keyed by scope name, for a nested-scope activation. */
@@ -667,30 +744,32 @@ type ActivateInput = {
   readonly reason?: string;
 };
 /**
- * Requests a just-in-time role activation. It never writes: a granted
- * decision carries the elevated membership under `elevation` for the app to
- * write. `approval-required` comes back first when the role's `activation`
- * sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
- * missing justification or stale authentication all deny.
+ * Requests a just-in-time role activation. It never writes: a granted decision
+ * carries the elevated membership under `elevation` for the app to write.
+ * `approval-required` comes back first when the role's `activation` sets
+ * `approval`. Fail-closed: an unknown role, an ineligible subject, a missing
+ * justification or stale authentication all deny.
  */
 /**
  * Requests a just-in-time activation of an eligible role for the subject of
  * `permdock`. It never writes: a granted decision carries the elevated
- * membership under `elevation` for the app to write, and
- * `approval-required` comes back first when the role's `activation` sets
- * `approval`. An instance built from a snapshot denies with `unsupported`.
+ * membership under `elevation` for the app to write, and `approval-required`
+ * comes back first when the role's `activation` sets `approval`. An instance
+ * built from a snapshot denies with `unsupported`.
  */
 declare function activate(permdock: InstanceHandle, input: ActivateInput): Decision;
 //#endregion
 //#region src/core/scope-helpers.d.ts
 /**
- * The canonical form PermDock evaluates one membership in, or `undefined`
- * when it is malformed and grants nothing. `scopes` is the policy's or the
- * catalog's scope list; absent or empty means the implicit `tenant` and
- * `team` pair.
+ * The canonical form PermDock evaluates one membership in, or `undefined` when
+ * it is malformed and grants nothing. `scopes` is the policy's or the catalog's
+ * scope list; absent or empty means the implicit `tenant` and `team` pair.
  */
 declare function normalizeMembership(input: unknown, scopes?: readonly Scope[]): Membership | undefined;
-/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+/**
+ * Every well-formed membership of `input` in canonical form; malformed entries
+ * are dropped.
+ */
 declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[]): readonly Membership[];
 /**
  * The declared scope `name` stands for: the name itself, or the scope the
@@ -699,14 +778,23 @@ declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[])
 declare function resolveScope(scopes: readonly Scope[] | undefined, name: unknown): string | undefined;
 //#endregion
 //#region src/core/ownership.d.ts
-/** Who a role change is about: their principal id and their membership in the scope instance. */
+/**
+ * Who a role change is about: their principal id and their membership in the
+ * scope instance.
+ */
 type RoleChangeTarget = {
   readonly id: string;
-  /** The kind of the target's membership in the instance (`staff`, `contact`, ...). */
+  /**
+   * The kind of the target's membership in the instance (`staff`, `contact`,
+   * ...).
+   */
   readonly via?: string;
   /** The roles the target holds in the instance now. */
   readonly roles?: readonly string[];
-  /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
+  /**
+   * `idp` when the identity provider owns the target's membership: the
+   * application cannot change it.
+   */
   readonly managedBy?: "idp";
 };
 type RoleChangeBase = {
@@ -716,16 +804,15 @@ type RoleChangeBase = {
   readonly within?: Readonly<Record<string, string>>;
   readonly target: RoleChangeTarget;
   /**
-   * How many principals hold `role` in the instance now, from the
-   * application's store. Without it a role with `min`, `max` or
-   * `transferOnly` is denied.
+   * How many principals hold `role` in the instance now, from the application's
+   * store. Without it a role with `min`, `max` or `transferOnly` is denied.
    */
   readonly holders?: number;
 };
 /**
  * A role held at a named scope instance (`scope` is a declared name or alias
- * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
- * A global change has no tenant, so `within` and `holders` do not apply to it.
+ * and `id` the instance), or a global role: `scope: 'global'` with no `id`. A
+ * global change has no tenant, so `within` and `holders` do not apply to it.
  */
 type RoleChange = RoleChangeBase & ({
   /** The scope the role is held at (a declared name or alias). */
@@ -750,7 +837,10 @@ type RoleChangeDecision = {
   readonly change: RoleChange;
   readonly denials: readonly Denial[];
 };
-/** The holder-count, membership-kind, exclusivity and `assigns` rules of one role, as the catalog lists them (`CatalogRole`). */
+/**
+ * The holder-count, membership-kind, exclusivity and `assigns` rules of one
+ * role, as the catalog lists them (`CatalogRole`).
+ */
 type RoleRules = {
   readonly key: string;
   readonly min?: number;
@@ -765,14 +855,26 @@ type RoleChangeCheckInput = {
     readonly kind: "assign" | "revoke" | "transfer";
     readonly target: Pick<RoleChangeTarget, "via" | "roles">;
   };
-  /** How many principals hold the role in the instance now; without it a role with `min`, `max` or `transferOnly` is denied. */
+  /**
+   * How many principals hold the role in the instance now; without it a role
+   * with `min`, `max` or `transferOnly` is denied.
+   */
   readonly holders?: number;
-  /** Every declared role: adds the `exclusiveWith` other roles declare against this one, and with `actorRoles` the `assigns` rule. */
+  /**
+   * Every declared role: adds the `exclusiveWith` other roles declare against
+   * this one, and with `actorRoles` the `assigns` rule.
+   */
   readonly roles?: readonly RoleRules[];
-  /** The roles the actor holds at the instance, highest rank first. With `roles` naming any `assigns`, one of them must assign this role. */
+  /**
+   * The roles the actor holds at the instance, highest rank first. With `roles`
+   * naming any `assigns`, one of them must assign this role.
+   */
   readonly actorRoles?: readonly string[];
 };
-/** `by` names the actor role whose `assigns` allowed the change, `null` when the rule did not apply. */
+/**
+ * `by` names the actor role whose `assigns` allowed the change, `null` when the
+ * rule did not apply.
+ */
 type RoleChangeCheck = {
   readonly ok: true;
   readonly by: string | null;
@@ -782,18 +884,18 @@ type RoleChangeCheck = {
 };
 /**
  * The rules of a role change that need no subject: `assigns`, `for`,
- * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
- * the target's roles alone. `decideRoleChange` runs the same function after
- * its actor, tenant and ceiling checks; a service that holds only the
- * catalog calls it with the `CatalogRole` entries.
+ * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and the
+ * target's roles alone. `decideRoleChange` runs the same function after its
+ * actor, tenant and ceiling checks; a service that holds only the catalog calls
+ * it with the `CatalogRole` entries.
  */
 declare function checkRoleChange(role: RoleRules, input: RoleChangeCheckInput): RoleChangeCheck;
 type RoleChangeOptions = {
   /**
-   * `true` when the application loaded `change.within` from its own store
-   * (the instance's stored parent), not from the request. Without it, a
-   * nested instance's tenant comes only from a live membership the actor
-   * holds on that instance or under it.
+   * `true` when the application loaded `change.within` from its own store (the
+   * instance's stored parent), not from the request. Without it, a nested
+   * instance's tenant comes only from a live membership the actor holds on that
+   * instance or under it.
    */
   readonly trusted?: boolean;
 };
@@ -802,12 +904,12 @@ type RoleChangeOptions = {
  * the instance's own principal; nothing in `change` can stand in for it.
  */
 /**
- * Whether the subject of `permdock` may assign, revoke or transfer a role
- * in one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`,
- * `min`, `max` and `transferOnly`. It never writes; the application does,
- * and generated RLS triggers re-check the holder counts at commit. A nested
- * instance's tenant comes from a live membership the subject holds on it,
- * or from `change.within` only with `{ trusted: true }`; otherwise
+ * Whether the subject of `permdock` may assign, revoke or transfer a role in
+ * one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`,
+ * `max` and `transferOnly`. It never writes; the application does, and
+ * generated RLS triggers re-check the holder counts at commit. A nested
+ * instance's tenant comes from a live membership the subject holds on it, or
+ * from `change.within` only with `{ trusted: true }`; otherwise
  * `no-membership`. An instance built from a snapshot denies with
  * `unsupported`.
  */
@@ -815,17 +917,20 @@ declare function decideRoleChange(permdock: InstanceHandle, change: RoleChange,
 //#endregion
 //#region src/core/parse-sink-events.d.ts
 /**
- * Validates one untrusted sink event against its family's schema and returns
- * a frozen copy, or `null` for anything else. Never throws.
+ * Validates one untrusted sink event against its family's schema and returns a
+ * frozen copy, or `null` for anything else. Never throws.
  */
 declare function parseSinkEvent(value: unknown): SinkEvent | null;
 /**
  * Validates an untrusted list of sink events, such as a request body a sink
- * receiver read. Each event that fails its schema is dropped, and a value
- * that is not an array yields no events. Never throws.
+ * receiver read. Each event that fails its schema is dropped, and a value that
+ * is not an array yields no events. Never throws.
  */
 declare function parseSinkEvents(value: unknown): readonly SinkEvent[];
-/** Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it does not match. */
+/**
+ * Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it
+ * does not match.
+ */
 declare function parseCatalogEventData(value: unknown): CatalogEventData | null;
 /**
  * Validates one CloudEvent against the closed type list, its `dataschema` and
@@ -840,7 +945,10 @@ declare function parseCloudEvent(value: unknown): CloudEvent | null;
 declare function parseCloudEventBatch(value: unknown): readonly CloudEvent[] | null;
 //#endregion
 //#region src/core/event-schemas.d.ts
-/** The URL each event family's schema is published at, and its CloudEvents `dataschema`. */
+/**
+ * The URL each event family's schema is published at, and its CloudEvents
+ * `dataschema`.
+ */
 declare const EVENT_SCHEMA_IDS: {
   readonly decision: "https://permdock.com/schemas/decision-event-v1.json";
   readonly directory: "https://permdock.com/schemas/directory-event-v1.json";
@@ -874,9 +982,9 @@ declare const SINK_EVENT_SCHEMAS: {
 /** The OCSF schema version `toOcsf` emits. */
 declare const OCSF_VERSION = "1.9.0";
 /**
- * An OCSF Authorize Session (class 3003, category Identity and Access Management) event.
- * API Activity (6003) would fit a per-request decision, but it requires `api` and
- * `src_endpoint`, which a decision event does not carry.
+ * An OCSF Authorize Session (class 3003, category Identity and Access
+ * Management) event. API Activity (6003) would fit a per-request decision, but
+ * it requires `api` and `src_endpoint`, which a decision event does not carry.
  */
 type OcsfAuthorizeSession = {
   readonly class_uid: 3003;
@@ -934,15 +1042,16 @@ type OcsfAuthorizeSession = {
   };
 };
 /**
- * Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged.
- * An event whose `at` does not parse has no OCSF `time` and projects to `undefined`.
+ * Projects a decision or approval event onto OCSF Authorize Session; the event
+ * itself is unchanged. An event whose `at` does not parse has no OCSF `time`
+ * and projects to `undefined`.
  */
 declare function toOcsf(event: DecisionEvent): OcsfAuthorizeSession | undefined;
 /**
  * An OCSF User Management (class 3007) event for a support-access lifecycle
  * event: `started` enables the session, `ended` and `revoked` disable it.
- * Support access is high severity, so a SIEM can alert on vendor access.
- * OCSF 1.9.0 deprecates Account Change (3001) in favour of this class.
+ * Support access is high severity, so a SIEM can alert on vendor access. OCSF
+ * 1.9.0 deprecates Account Change (3001) in favour of this class.
  */
 type OcsfUserManagement = {
   readonly class_uid: 3007;
@@ -987,16 +1096,17 @@ declare function accessToOcsf(event: AccessEvent): OcsfUserManagement | undefine
 /** The CSV export columns, in order; the header row of every CSV file. */
 declare const CSV_COLUMNS: readonly ["time", "principal", "actor", "tenant", "permission", "outcome", "matched.role", "via", "denials.reason", "token"];
 /**
- * One RFC 4180 row for a decision or approval event, without a line
- * terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+ * One RFC 4180 row for a decision or approval event, without a line terminator;
+ * join rows with CRLF under a `CSV_COLUMNS` header.
  */
 declare function toCsvRow(event: DecisionEvent): string;
 //#endregion
 //#region src/core/catalog-fingerprint.d.ts
 /**
- * The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON without `generatedAt`, `generator`, `fingerprint`
- * and every `permissions[].usages`, so neither the CLI version, the clock nor
- * call sites change it.
+ * The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON
+ * without `generatedAt`, `generator`, `fingerprint` and every
+ * `permissions[].usages`, so neither the CLI version, the clock nor call sites
+ * change it.
  */
 declare function catalogFingerprint(catalog: unknown): string;
 //#endregion
@@ -1012,8 +1122,8 @@ declare function canonicalJson(value: unknown): string;
 //#endregion
 //#region src/core/sha256.d.ts
 /**
- * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
- * of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+ * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256 of
+ * `text`. An RFC 9651 sf-token, so it fits a structured header as is.
  */
 declare function sha256Digest(text: string): string;
 //#endregion
@@ -1021,17 +1131,17 @@ declare function sha256Digest(text: string): string;
 type DelegatedPermission = Pick<Permission, "scope" | "resource" | "action">;
 /**
  * Whether a delegated caller may use a permission its principal holds, through
- * OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
- * `undefined` means covered; otherwise the denial reason `decide` would add.
+ * OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`. `undefined`
+ * means covered; otherwise the denial reason `decide` would add.
  */
 declare function coveredByDelegation(permission: DelegatedPermission, delegation: Delegation | undefined, resourceId?: string, hasActor?: boolean): DenialReason | undefined;
 /**
  * The permission keys the policy's delegations let `subject.actor` use for
  * `subject.principal` right now: the union over every active delegation whose
- * `to` matches the actor and whose `from` the principal holds. `undefined`
- * when none applies, so the call falls back to the token delegation alone.
- * An actor with `readOnly: true` gets only each delegation's read-only keys.
- * Attenuation only: a key here still needs a matching allow and no deny.
+ * `to` matches the actor and whose `from` the principal holds. `undefined` when
+ * none applies, so the call falls back to the token delegation alone. An actor
+ * with `readOnly: true` gets only each delegation's read-only keys. Attenuation
+ * only: a key here still needs a matching allow and no deny.
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion