permdock 0.7.0 → 0.8.0

package/dist/{policy-types-B-F-qAZk.d.ts → policy-types-CCiDRZBH.d.ts}

@@ -1,5 +1,5 @@
-import { A as MetaValue, O as AppData, b as ResourceNode, d as PermissionKind, f as PermissionTree, k as AppDataSchema, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-Bg3eeT2H.js";
+import { M as AppData, N as AppDataSchema, P as MetaValue, b as ResourceNode, d as PermissionKind, f as PermissionTree, k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-DEJ5j4mR.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -64,27 +64,34 @@ type RelatedCondition = {
   readonly op: "related";
   readonly resource: string;
   readonly relation: string;
-  /** The row's own id field, or (with `parent` or `hops`) the field holding the next instance's id. */
+  /**
+   * The row's own id field, or (with `parent` or `hops`) the field holding the
+   * next instance's id.
+   */
   readonly field: string;
-  /** Parent hops walked above the first `resource` instance; `0` reads only that instance. */
+  /**
+   * Parent hops walked above the first `resource` instance; `0` reads only that
+   * instance.
+   */
   readonly depth: number;
   /** The row is a child of `resource`, reached through `field`. */
   readonly parent?: true;
   /**
-   * To-one links from the row to `resource`: `field` points at the first
-   * hop's resource, each later hop follows `link` on the resource before it,
-   * and the last hop's resource is `resource`.
+   * To-one links from the row to `resource`: `field` points at the first hop's
+   * resource, each later hop follows `link` on the resource before it, and the
+   * last hop's resource is `resource`.
    */
   readonly hops?: readonly RelatedHop[];
   /**
-   * The `resource` instances the subject holds a resource role on; replaces
-   * the `relation` lookup (`relation` is then empty).
+   * The `resource` instances the subject holds a resource role on; replaces the
+   * `relation` lookup (`relation` is then empty).
    */
   readonly ids?: readonly string[];
   readonly permission?: string;
   /**
    * The row's boolean column that keeps ancestor grants out: with `parent` or
-   * `hops`, a restricted row matches nothing; without, the walk stops at the row.
+   * `hops`, a restricted row matches nothing; without, the walk stops at the
+   * row.
    */
   readonly restricted?: string;
   readonly restrictedAncestors?: RestrictedAncestors;
@@ -117,10 +124,10 @@ type SqlFunctionCondition = {
   readonly twin: Condition;
 };
 /**
- * The request's session was checked against the Auth server while the
- * subject was resolved (`liveSession: true`), not only verified from the
- * token: a revoked session still verifies until `exp`. Written
- * `{ subject: { session: { live: true } } }`.
+ * The request's session was checked against the Auth server while the subject
+ * was resolved (`liveSession: true`), not only verified from the token: a
+ * revoked session still verifies until `exp`. Written `{ subject: { session: {
+ * live: true } } }`.
  */
 type LiveSessionCondition = {
   readonly op: "liveSession";
@@ -145,14 +152,18 @@ type FieldOperator = {
   readonly notIn?: unknown;
   readonly isNull?: boolean;
 };
-type WhereShorthand<T = Record<string, unknown>> = {
+type WhereShorthand<T = Record<string, unknown>> = unknown extends T ? RowWhere<Record<string, unknown>> : RowWhere<T>;
+type RowWhere<T> = {
   readonly and?: readonly WhereShorthand<T>[];
   readonly or?: readonly WhereShorthand<T>[];
   readonly not?: WhereShorthand<T>;
 } & ("subject" extends keyof T ? { readonly [K in keyof T as Exclude<K, "subject">]?: FieldWhere<T[K]>; } & {
   readonly subject?: SubjectWhere | FieldWhere<T["subject"]>;
 } : { readonly [K in keyof T]?: FieldWhere<T[K]>; } & {
-  /** Holds only when the resolver checked the session live (`liveSession: true`). */
+  /**
+   * Holds only when the resolver checked the session live (`liveSession:
+   * true`).
+   */
   readonly subject?: SubjectWhere;
 });
 type SubjectWhere = {
@@ -173,11 +184,20 @@ type FieldWhere<V> = V | FieldOperator | {
  * credential kinds, delivery channels) stays closed.
  */
 type OpenUnion<T extends string> = T | (string & NonNullable<unknown>);
-/** `actor.kind`: the values PermDock's adapters set, or an integrator's own; a policy delegation matches it by equality. */
+/**
+ * `actor.kind`: the values PermDock's adapters set, or an integrator's own; a
+ * policy delegation matches it by equality.
+ */
 type ActorKind = OpenUnion<"mcp-client" | "oauth-client" | "support" | "impersonation" | "ai-sdk" | "claude-agent" | "openai-agent" | "eve" | "terminal" | "web-bot-auth" | "a2a-agent" | "automation" | "job" | "caller" | "workload">;
-/** The adapter a decision event names: a PermDock entry, or an integrator's own adapter. */
+/**
+ * The adapter a decision event names: a PermDock entry, or an integrator's own
+ * adapter.
+ */
 type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
-/** How a membership was obtained (`membership.via`); `viaOnly` and support rules match it by equality. */
+/**
+ * How a membership was obtained (`membership.via`); `viaOnly` and support rules
+ * match it by equality.
+ */
 type MembershipVia = OpenUnion<"direct" | "contact" | "credential" | "elevated" | "feed" | "link" | "share" | "support" | "support-session" | "scim">;
 //#endregion
 //#region src/core/subject.d.ts
@@ -210,8 +230,8 @@ type Assurance = {
 /**
  * Roles held in one scope instance (`scope` + `id`, with the id of every
  * ancestor scope in `within`) or on one resource (`on`). Evaluation only sees
- * the canonical form; `tenant` / `team` are accepted as input for the first
- * and second declared scope and normalised away.
+ * the canonical form; `tenant` / `team` are accepted as input for the first and
+ * second declared scope and normalised away.
  */
 type Membership = {
   readonly scope?: string;
@@ -222,26 +242,44 @@ type Membership = {
     readonly id: string;
   };
   readonly roles: readonly string[];
-  /** Roles the holder may activate here but does not hold; `permdock.activate` writes an elevated membership. */
+  /**
+   * Roles the holder may activate here but does not hold; `permdock.activate`
+   * writes an elevated membership.
+   */
   readonly eligible?: readonly string[];
   readonly via?: MembershipVia;
   readonly expiresAt?: number;
-  /** The principal id that wrote this membership: who elevated, consented to or granted the access. */
+  /**
+   * The principal id that wrote this membership: who elevated, consented to or
+   * granted the access.
+   */
   readonly grantedBy?: string;
-  /** Free text recording why the membership was written: the activation or consent justification. */
+  /**
+   * Free text recording why the membership was written: the activation or
+   * consent justification.
+   */
   readonly reason?: string;
-  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `junctionMembershipSource` group column fills it. */
+  /**
+   * A subgroup the holder belongs to inside the instance (`vendor-support`); a
+   * `junctionMembershipSource` group column fills it.
+   */
   readonly member?: {
     readonly group: string;
   };
-  /** `idp`: the identity provider (SCIM) owns this membership; the application must not edit it. */
+  /**
+   * `idp`: the identity provider (SCIM) owns this membership; the application
+   * must not edit it.
+   */
   readonly managedBy?: "idp";
-  /** Seats this membership holds (`dev-mode`, `editor`); `plan()` grantees match them inside the active tenant. */
+  /**
+   * Seats this membership holds (`dev-mode`, `editor`); `plan()` grantees match
+   * them inside the active tenant.
+   */
   readonly entitlements?: readonly string[];
   /**
-   * Set when the instance or an ancestor instance is suspended: the
-   * permission keys the membership still grants (`suspension.scopes.<scope>.keep`).
-   * Every other grant, allow or deny, ignores it, and so do role listings.
+   * Set when the instance or an ancestor instance is suspended: the permission
+   * keys the membership still grants (`suspension.scopes.<scope>.keep`). Every
+   * other grant, allow or deny, ignores it, and so do role listings.
    */
   readonly keep?: readonly string[];
   /**
@@ -257,13 +295,16 @@ type Membership = {
   readonly team?: string;
 };
 /**
- * One permission a custom role adds or removes. It names a declared
- * permission key and carries no condition, approval or limit of its own.
+ * One permission a custom role adds or removes. It names a declared permission
+ * key and carries no condition, approval or limit of its own.
  */
 type CustomRoleGrant = {
   readonly permission: string;
   readonly effect?: "allow" | "deny";
-  /** A level the permission's resource declares (`resource(…, { levels })`); allows only. */
+  /**
+   * A level the permission's resource declares (`resource(…, { levels })`);
+   * allows only.
+   */
   readonly level?: string;
 };
 type CustomRoleBody = {
@@ -271,9 +312,9 @@ type CustomRoleBody = {
   readonly includes?: readonly string[];
   readonly grants?: readonly CustomRoleGrant[];
   /**
-   * Display text and app data, carried onto the role leaf
-   * `assignableRoles()` returns. `x` is checked by the role tree's
-   * `defineRoles(…, { x })` schema; an invalid `x` is dropped, not the role.
+   * Display text and app data, carried onto the role leaf `assignableRoles()`
+   * returns. `x` is checked by the role tree's `defineRoles(…, { x })` schema;
+   * an invalid `x` is dropped, not the role.
    */
   readonly meta?: RoleMeta;
 };
@@ -281,7 +322,10 @@ type CustomRoleBody = {
 type TenantCustomRole = CustomRoleBody & {
   /** The instance of the first scope that owns the role. */
   readonly tenant: string;
-  /** The scope the role is held at; defaults to the first scope. Its ceiling is that scope's assignable roles. */
+  /**
+   * The scope the role is held at; defaults to the first scope. Its ceiling is
+   * that scope's assignable roles.
+   */
   readonly scope?: string;
   /** Pins the role to one instance of `scope`. */
   readonly id?: string;
@@ -302,14 +346,17 @@ type GlobalCustomRole = CustomRoleBody & {
   readonly shared?: undefined;
 };
 /**
- * A role the platform defines once for every tenant, held on memberships of
- * its scope in any tenant. Tenant admins assign it but never edit it. Its
- * ceiling is the assignable declared roles of its scope; its name wins over
- * a tenant custom role of the same name.
+ * A role the platform defines once for every tenant, held on memberships of its
+ * scope in any tenant. Tenant admins assign it but never edit it. Its ceiling
+ * is the assignable declared roles of its scope; its name wins over a tenant
+ * custom role of the same name.
  */
 type SharedCustomRole = CustomRoleBody & {
   readonly shared: true;
-  /** The scope the role is held at, never `'global'`; defaults to the first scope. */
+  /**
+   * The scope the role is held at, never `'global'`; defaults to the first
+   * scope.
+   */
   readonly scope?: string;
   readonly tenant?: undefined;
   readonly id?: undefined;
@@ -320,21 +367,27 @@ type Principal = {
   readonly id: string;
   readonly issuer?: string;
   /**
-   * `contact`: an external person (a customer contact, a portal user). Only
-   * its `{ on }` memberships count; it never approves, creates keys or
-   * publishes, and is read-only unless a role whose `for` lists `contact`
-   * grants the write.
+   * `contact`: an external person (a customer contact, a portal user). Only its
+   * `{ on }` memberships count; it never approves, creates keys or publishes,
+   * and is read-only unless a role whose `for` lists `contact` grants the
+   * write.
    */
   readonly kind?: "user" | "service" | "workload" | "link" | "feed" | "contact";
   readonly roles?: readonly string[];
   readonly plans?: readonly string[];
   readonly memberships?: readonly Membership[];
-  /** The token dropped memberships to stay under its size budget; a `claimsFirst` source reads the rest. */
+  /**
+   * The token dropped memberships to stay under its size budget; a
+   * `claimsFirst` source reads the rest.
+   */
   readonly membershipsTruncated?: boolean;
   /** The authorization version the token was minted at (`authz_ver`). */
   readonly authzVersion?: number;
   readonly tenant?: string;
-  /** Set by core when a requested tenant is not one the subject holds: the denial is then `no-membership`, not `no-tenant`. Never read from a token. */
+  /**
+   * Set by core when a requested tenant is not one the subject holds: the
+   * denial is then `no-membership`, not `no-tenant`. Never read from a token.
+   */
   readonly unheldTenant?: string;
   readonly assurance?: Assurance;
   readonly binding?: Binding;
@@ -344,9 +397,16 @@ type Actor = {
   readonly id: string;
   readonly kind: ActorKind;
   readonly binding?: Binding;
-  /** `true` denies every permission without `readOnlyHint` (`not-delegated`), with or without a policy delegation. */
+  /**
+   * `true` denies every permission without `readOnlyHint` (`not-delegated`),
+   * with or without a policy delegation.
+   */
   readonly readOnly?: boolean;
-  /** The stable name the application gives this OAuth client (`ClientNames`), set by the subject resolver from the verified client id; policy delegations match it with `to: { kind, client }`. */
+  /**
+   * The stable name the application gives this OAuth client (`ClientNames`),
+   * set by the subject resolver from the verified client id; policy delegations
+   * match it with `to: { kind, client }`.
+   */
   readonly client?: string;
   readonly [key: string]: unknown;
 };
@@ -369,7 +429,10 @@ type Subject<TPrincipal extends Principal = Principal> = {
   readonly context: Readonly<Record<string, unknown>>;
   readonly session?: string;
   readonly expiresAt?: number;
-  /** The token's memberships are behind the source's authorization version: `fresh` permissions deny. */
+  /**
+   * The token's memberships are behind the source's authorization version:
+   * `fresh` permissions deny.
+   */
   readonly stale?: true;
   /**
    * The resolver checked the session against the Auth server for this request
@@ -381,7 +444,10 @@ type Subject<TPrincipal extends Principal = Principal> = {
 //#endregion
 //#region src/core/decision.d.ts
 type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "no-tenant" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
-/** The `detail` each denial reason carries, where PermDock sets a structured one. */
+/**
+ * The `detail` each denial reason carries, where PermDock sets a structured
+ * one.
+ */
 type DenialDetails = {
   readonly limit: LimitDetail;
   /** The window the inactive allow applies in. */
@@ -413,18 +479,21 @@ type MatchedGrant = {
   readonly check?: Grant["check"];
   readonly approval?: "human" | ApprovalRequirement;
   readonly provider?: string;
-  /** The hosted policy document fingerprint and grant id, when a hosted grant matched. */
+  /**
+   * The hosted policy document fingerprint and grant id, when a hosted grant
+   * matched.
+   */
   readonly hosted?: HostedGrantRef;
   /** A break-glass grant overrode a matching deny. */
   readonly breakGlass?: true;
 };
 /**
  * Something the caller owes alongside a granted action. `over-limit`: a soft
- * `limit` was past its count; `near-limit`: usage reached `alertAt`.
- * `notify` / `review`: a break-glass grant's declared follow-ups.
- * `justify`: the break-glass reason, carried so audit records why.
- * `app`: a follow-up the application declared on the grant
- * (`allow(p, { obligations })`); PermDock carries it and never acts on it.
+ * `limit` was past its count; `near-limit`: usage reached `alertAt`. `notify` /
+ * `review`: a break-glass grant's declared follow-ups. `justify`: the
+ * break-glass reason, carried so audit records why. `app`: a follow-up the
+ * application declared on the grant (`allow(p, { obligations })`); PermDock
+ * carries it and never acts on it.
  */
 type Obligation = {
   readonly kind: "over-limit" | "near-limit" | "notify" | "review";
@@ -445,8 +514,8 @@ type Quota = {
   readonly resetsAt: string;
 };
 /**
- * The `detail` of a `limit` denial: the grant's `count`, its `per` window
- * in seconds and when the window resets (RFC 3339).
+ * The `detail` of a `limit` denial: the grant's `count`, its `per` window in
+ * seconds and when the window resets (RFC 3339).
  */
 type LimitDetail = {
   readonly count: number;
@@ -454,14 +523,13 @@ type LimitDetail = {
   readonly resetsAt: string;
 };
 /**
- * Why a candidate grant for the permission was passed over before its
- * condition ran: `via-only` (the subject holds no membership of its kind),
- * `purpose` (no asserted purpose it lists), `field` (its `fields` do not
- * cover the requested field), `grantee` (its `to` did not match and added no
- * denial), `role` (a role it names is not held), `validity` (a deny outside
- * its `validFrom` / `validUntil`; an inactive allow adds an `inactive-grant`
- * denial instead), `break-glass-inactive` (a break-glass grant with no
- * asserted purpose).
+ * Why a candidate grant for the permission was passed over before its condition
+ * ran: `via-only` (the subject holds no membership of its kind), `purpose` (no
+ * asserted purpose it lists), `field` (its `fields` do not cover the requested
+ * field), `grantee` (its `to` did not match and added no denial), `role` (a
+ * role it names is not held), `validity` (a deny outside its `validFrom` /
+ * `validUntil`; an inactive allow adds an `inactive-grant` denial instead),
+ * `break-glass-inactive` (a break-glass grant with no asserted purpose).
  */
 type TraceSkipReason = "via-only" | "purpose" | "field" | "grantee" | "role" | "validity" | "unknown-level" | "break-glass-inactive";
 type TraceSkip = {
@@ -469,15 +537,18 @@ type TraceSkip = {
   readonly permission: string;
   readonly effect: "allow" | "deny";
   readonly why: TraceSkipReason;
-  /** The level a custom role names that its resource does not declare, for `unknown-level`. */
+  /**
+   * The level a custom role names that its resource does not declare, for
+   * `unknown-level`.
+   */
   readonly level?: string;
 };
 /**
- * What `explain` saw: how many candidate grants it examined before the
- * outcome, which allows matched (including the ones a deny overrode), which
- * denies matched, and which grants it passed over. `denies[0]` is the deny
- * that produced a `deny` outcome, or the deny a break-glass grant lifted.
- * Pure local computation; never on a decision event.
+ * What `explain` saw: how many candidate grants it examined before the outcome,
+ * which allows matched (including the ones a deny overrode), which denies
+ * matched, and which grants it passed over. `denies[0]` is the deny that
+ * produced a `deny` outcome, or the deny a break-glass grant lifted. Pure local
+ * computation; never on a decision event.
  */
 type Trace = {
   readonly evaluated: number;
@@ -504,8 +575,8 @@ type GrantedDecision = {
 type DeniedDecision = {
   readonly outcome: "denied";
   /**
-   * The key of the permission that was checked. Absent on a denial for a
-   * check that named no declared permission.
+   * The key of the permission that was checked. Absent on a denial for a check
+   * that named no declared permission.
    */
   readonly permission?: string;
   readonly denials: readonly Denial[];
@@ -552,7 +623,10 @@ type RelationGrantee = {
    * to `resource`, then walk its parents only when `depth` is set.
    */
   readonly through?: "parent" | readonly string[];
-  /** Parent hops walked above the first `resource` instance; absent means `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links. */
+  /**
+   * Parent hops walked above the first `resource` instance; absent means
+   * `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links.
+   */
   readonly depth?: number;
 };
 type PlanGrantee = {
@@ -601,23 +675,26 @@ type UserApprover = {
   readonly id: string;
 };
 /**
- * Whoever holds `permission` in the request's tenant, through any role,
- * custom roles included. Checked only through verdict facts
- * (`ApprovalVerdict.permissions`) that the handler computes from the
- * approver's own instance.
+ * Whoever holds `permission` in the request's tenant, through any role, custom
+ * roles included. Checked only through verdict facts
+ * (`ApprovalVerdict.permissions`) that the handler computes from the approver's
+ * own instance.
  */
 type PermissionApprover = {
   readonly kind: "permission";
   readonly permission: string;
 };
-/** An approver who matches at least one item; an item that is a list matches when every entry does. */
+/**
+ * An approver who matches at least one item; an item that is a list matches
+ * when every entry does.
+ */
 type AnyOfApprover = {
   readonly kind: "any-of";
   readonly of: readonly (Approver | readonly Approver[])[];
 };
 /**
- * Who may approve: a subject-only grantee, a `relation()` the approver holds
- * on the requested row (checked when the verdict is given), `user(id)`,
+ * Who may approve: a subject-only grantee, a `relation()` the approver holds on
+ * the requested row (checked when the verdict is given), `user(id)`,
  * `holder(permission)`, or `anyOf(...)`. A list (or `allOf(...)`) matches an
  * approver who satisfies every item.
  */
@@ -626,7 +703,10 @@ type ApproverInput = GranteeInput | UserApprover | PermissionApprover | {
   readonly kind: "any-of";
   readonly of: readonly ApproverInput[];
 } | readonly ApproverInput[];
-/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+/**
+ * Approves when the approver holds `permission` in the request's tenant (any
+ * role, custom roles included).
+ */
 declare function holder(permission: Permission): PermissionApprover;
 /** Approves when the approver matches any one of `items`. */
 declare function anyOf(...items: readonly ApproverInput[]): {
@@ -639,29 +719,35 @@ declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInp
 declare function user(id: string): UserApprover;
 //#endregion
 //#region src/core/scopes.d.ts
-/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
+/**
+ * One entry of `definePolicy({ scopes })`: the row field holding the scope id,
+ * and its parent scope.
+ */
 type ScopeDeclaration = {
   readonly key: string;
   readonly within?: string;
 };
 type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
 /**
- * A declared scope, in declaration order. `key` is absent only on the
- * implicit `tenant` / `team` pair of a policy that declares no scopes.
+ * A declared scope, in declaration order. `key` is absent only on the implicit
+ * `tenant` / `team` pair of a policy that declares no scopes.
  */
 type Scope = {
   readonly name: string;
   readonly key?: string;
   readonly within?: string;
 };
-/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
+/**
+ * The names `role(..., { on })`, `memberOf` and memberships may use: declared
+ * names plus the aliases.
+ */
 type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
 //#endregion
 //#region src/core/wire-delegation.d.ts
 /**
- * A delegation as every PermDock wire form carries it: OAuth `scope`
- * (RFC 6749, space-separated) and RFC 9396 `authorization_details`. An empty
- * `scope` is an empty scope list, which delegates nothing.
+ * A delegation as every PermDock wire form carries it: OAuth `scope` (RFC 6749,
+ * space-separated) and RFC 9396 `authorization_details`. An empty `scope` is an
+ * empty scope list, which delegates nothing.
  */
 type WireDelegation = {
   readonly scope?: string;
@@ -672,9 +758,9 @@ type WireDelegation = {
 //#region src/core/wire-denial.d.ts
 /**
  * A denial as it leaves the process: in a decision event, a Problem Details
- * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a
- * JSON value (a string, or `LimitDetail` on `limit`); what a closure threw
- * and a validation error stay in process.
+ * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a JSON
+ * value (a string, or `LimitDetail` on `limit`); what a closure threw and a
+ * validation error stay in process.
  */
 type WireDenial = {
   readonly role: string | null;
@@ -682,7 +768,10 @@ type WireDenial = {
   readonly to?: Grantee | readonly Grantee[];
   readonly detail?: unknown;
 };
-/** A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends it. */
+/**
+ * A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends
+ * it.
+ */
 type WireDecision = GrantedDecision | ApprovalRequiredDecision | (Omit<DeniedDecision, "denials"> & {
   readonly denials: readonly WireDenial[];
 });
@@ -706,7 +795,10 @@ type DirectoryEvent = {
     readonly iss?: string;
   };
   readonly active?: boolean;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type MembershipEvent = {
@@ -717,7 +809,10 @@ type MembershipEvent = {
   readonly principal: {
     readonly id: string;
   };
-  /** A declared scope name, or the `tenant` / `team` alias; absent for a global role change. */
+  /**
+   * A declared scope name, or the `tenant` / `team` alias; absent for a global
+   * role change.
+   */
   readonly scope?: string;
   /** The scope instance; present exactly when `scope` is. */
   readonly id?: string;
@@ -734,13 +829,16 @@ type MembershipEvent = {
     readonly id: string;
     readonly kind: string;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
  * An API key's lifecycle: `created`, `rotated` and `revoked` from the
- * application or a credential store, `used` from `subjectFromApiKey`. A
- * `used` event carries `sample`, the fraction of uses reported.
+ * application or a credential store, `used` from `subjectFromApiKey`. A `used`
+ * event carries `sample`, the fraction of uses reported.
  */
 type CredentialEvent = {
   readonly type: "credential";
@@ -762,7 +860,10 @@ type CredentialEvent = {
     readonly kind: string;
   };
   readonly sample?: number;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
@@ -798,7 +899,10 @@ type AutomationEvent = {
     readonly id: string;
     readonly kind: string;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent | AutomationEvent | DeliveryEvent;
@@ -807,14 +911,14 @@ type DeliveryChannel = "email" | "chat" | "webhook";
 /** What an email is for; only `notification` mail carries `List-Unsubscribe`. */
 type EmailCategory = "transactional" | "notification" | "security" | "approval";
 /**
- * Why a delivery failed. `denied` and `unlinked` are the router's refusals of
- * a recipient; the rest come from a transport or a provider webhook.
+ * Why a delivery failed. `denied` and `unlinked` are the router's refusals of a
+ * recipient; the rest come from a transport or a provider webhook.
  */
 type DeliveryFailureCause = "denied" | "unlinked" | "no-transport" | "no-message" | "invalid-recipient" | "invalid-message" | "rate-limited" | "quota-exceeded" | "unauthorized" | "unavailable" | "suppressed" | "rejected";
 /**
  * One recipient's delivery: `sent` when a transport accepted it, then
- * `delivered`, `bounced` or `complained` from the provider, or `failed`.
- * It carries no address, only the principal the router checked.
+ * `delivered`, `bounced` or `complained` from the provider, or `failed`. It
+ * carries no address, only the principal the router checked.
  */
 type DeliveryEvent = {
   readonly type: "delivery";
@@ -827,7 +931,10 @@ type DeliveryEvent = {
     readonly id: string;
     readonly key: string;
   };
-  /** The checked principal, or `trusted` for an address the server loaded itself. */
+  /**
+   * The checked principal, or `trusted` for an address the server loaded
+   * itself.
+   */
   readonly recipient?: {
     readonly principal?: {
       readonly id: string;
@@ -851,7 +958,10 @@ type DeliveryEvent = {
   readonly retryable?: boolean;
   /** The denial reason when `cause` is `denied`. */
   readonly reason?: string;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
@@ -891,7 +1001,10 @@ type AccessEvent = {
   };
   /** A `SupportSession`'s permission keys. */
   readonly permissions?: readonly string[];
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type DecisionEvent = {
@@ -915,14 +1028,20 @@ type DecisionEvent = {
       readonly id: string;
       readonly kind: string;
     };
-    /** OAuth `scope` and RFC 9396 `authorization_details`, as every wire form carries a delegation. */
+    /**
+     * OAuth `scope` and RFC 9396 `authorization_details`, as every wire form
+     * carries a delegation.
+     */
     readonly delegation?: WireDelegation;
     /** The API key the subject came from. */
     readonly credential?: {
       readonly id: string;
       readonly kind: CredentialKind;
     };
-    /** The support session the subject came from: the `id` its `access` events carry as `session.id`. */
+    /**
+     * The support session the subject came from: the `id` its `access` events
+     * carry as `session.id`.
+     */
     readonly supportSession?: {
       readonly id: string;
     };
@@ -946,7 +1065,10 @@ type DecisionEvent = {
   };
   /** What a granted decision owes, as on `GrantedDecision.obligations`. */
   readonly obligations?: readonly Obligation[];
-  /** Purposes of use the caller asserted (`context.purpose`); present when any was. */
+  /**
+   * Purposes of use the caller asserted (`context.purpose`); present when any
+   * was.
+   */
   readonly purpose?: readonly string[];
   /** The justification the caller supplied (`context.reason`); present when set. */
   readonly reason?: string;
@@ -957,7 +1079,10 @@ type DecisionEvent = {
   /** The call that produced the decision. */
   readonly call: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
   readonly adapter?: AdapterId;
-  /** The model id the agent model gate decided, or the model that drove the call. */
+  /**
+   * The model id the agent model gate decided, or the model that drove the
+   * call.
+   */
   readonly model?: string;
   /** Set on an approval lifecycle event (`com.permdock.approval.<phase>`). */
   readonly phase?: "requested" | "resolved" | "expired" | "cancelled";
@@ -966,7 +1091,10 @@ type DecisionEvent = {
     readonly denied: number;
     readonly approvalRequired: number;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type AuthEvent = {
@@ -985,7 +1113,10 @@ type AuthEvent = {
 //#region src/core/snapshot-types.d.ts
 type Snapshot = {
   readonly v: 1;
-  /** RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the token's `iat`. */
+  /**
+   * RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the
+   * token's `iat`.
+   */
   readonly issuedAt: string;
   readonly subject: {
     readonly principal: {
@@ -995,13 +1126,19 @@ type Snapshot = {
       readonly tenant?: string;
       readonly memberships?: readonly Membership[];
     } | null;
-    /** OAuth `scope` and RFC 9396 `authorization_details`, as the token carried them. */
+    /**
+     * OAuth `scope` and RFC 9396 `authorization_details`, as the token carried
+     * them.
+     */
     readonly delegation?: WireDelegation;
     readonly context: Readonly<Record<string, unknown>>;
   };
   /** Roles held in the active tenant, in rank order. */
   readonly roles: readonly string[];
-  /** The distinct `meta.audience` values of `roles`, in rank order; absent when none has one. */
+  /**
+   * The distinct `meta.audience` values of `roles`, in rank order; absent when
+   * none has one.
+   */
   readonly audiences?: readonly string[];
   readonly grants: readonly SnapshotGrant[];
   readonly tenants: readonly string[];
@@ -1013,18 +1150,24 @@ type Snapshot = {
     readonly roles?: Readonly<Record<string, Role>>;
     readonly plans?: Readonly<Record<string, Plan>>;
   };
-  /** The policy's scopes in order, so a client checks the row against each membership's instance. */
+  /**
+   * The policy's scopes in order, so a client checks the row against each
+   * membership's instance.
+   */
   readonly scopes?: readonly SnapshotScope[];
-  /** One entry per tenant in `tenants`: what the subject may hand out there. Absent without tenants. */
+  /**
+   * One entry per tenant in `tenants`: what the subject may hand out there.
+   * Absent without tenants.
+   */
   readonly assignable?: readonly SnapshotAssignable[];
   /**
-   * Allow grants of held roles that only a plan the subject lacks keeps
-   * from applying; they grant nothing and name the plan a denial asks for.
+   * Allow grants of held roles that only a plan the subject lacks keeps from
+   * applying; they grant nothing and name the plan a denial asks for.
    */
   readonly notEntitled?: readonly SnapshotNotEntitled[];
   /**
-   * The row id field per resource whose `id` option is not `id`, for the
-   * grants in `grants`. Absent when every one reads `id`.
+   * The row id field per resource whose `id` option is not `id`, for the grants
+   * in `grants`. Absent when every one reads `id`.
    */
   readonly ids?: Readonly<Record<string, string>>;
   /**
@@ -1035,7 +1178,10 @@ type Snapshot = {
    */
   readonly delegated?: readonly string[];
 };
-/** A grant the subject would hold on another plan: its permission, role and `to`. */
+/**
+ * A grant the subject would hold on another plan: its permission, role and
+ * `to`.
+ */
 type SnapshotNotEntitled = {
   readonly permission: string;
   readonly role: string | null;
@@ -1046,17 +1192,29 @@ type SnapshotScope = {
   readonly name: string;
   readonly key: string;
   readonly within?: string;
-  /** Resources whose rows this scope's key partitions, from their `memberOf` relations. */
+  /**
+   * Resources whose rows this scope's key partitions, from their `memberOf`
+   * relations.
+   */
   readonly resources?: readonly string[];
-  /** Resource name to the field holding this scope's id, for a resource whose field is not `key` (its own `id`). */
+  /**
+   * Resource name to the field holding this scope's id, for a resource whose
+   * field is not `key` (its own `id`).
+   */
   readonly fields?: Readonly<Record<string, string>>;
 };
-/** The declared roles and the custom-role ceiling the subject may assign in one tenant. */
+/**
+ * The declared roles and the custom-role ceiling the subject may assign in one
+ * tenant.
+ */
 type SnapshotAssignable = {
   readonly tenant: string;
   readonly roles: readonly string[];
   readonly permissions: readonly Permission[];
-  /** Permission key to the levels the subject may hand out; only permissions whose resource declares levels. */
+  /**
+   * Permission key to the levels the subject may hand out; only permissions
+   * whose resource declares levels.
+   */
   readonly levels?: Readonly<Record<string, readonly string[]>>;
 };
 type SnapshotGrant = {
@@ -1074,7 +1232,10 @@ type SnapshotGrant = {
   readonly membership?: Membership;
   readonly portable?: false;
   readonly fields?: readonly string[];
-  /** When the grant applies (RFC 3339, `from` inclusive, `until` exclusive); absent means always. */
+  /**
+   * When the grant applies (RFC 3339, `from` inclusive, `until` exclusive);
+   * absent means always.
+   */
   readonly validity?: WireValidity;
   /** The grant's declared `name`. */
   readonly name?: string;
@@ -1098,10 +1259,52 @@ type LocalSnapshotManifest = {
   readonly rank?: readonly string[];
   /** Every declared grant, without a membership. */
   readonly grants: readonly SnapshotGrant[];
-  /** Per custom-role scope (`global` for platform roles): the grants each entry resolves to. */
+  /**
+   * Per custom-role scope (`global` for platform roles): the grants each entry
+   * resolves to.
+   */
   readonly custom: Readonly<Record<string, LocalCustomRoleTable>>;
-  /** The synced tables a device reads the user's memberships, roles and custom roles from; `permdock powersync generate` adds it. */
+  /**
+   * The synced tables a device reads the user's memberships, roles and custom
+   * roles from; `permdock powersync generate` adds it.
+   */
   readonly rows?: LocalSnapshotRows;
+  /**
+   * What a device needs to compute `Snapshot.assignable` for the active tenant
+   * the way `assignableIn` does on the server.
+   */
+  readonly assignable?: LocalAssignable;
+};
+/**
+ * The hand-out rules of a policy, as a device evaluates them over its synced
+ * memberships and custom roles.
+ */
+type LocalAssignable = {
+  /**
+   * Declared roles a tenant admin may hand out or compose, in rank order, with
+   * the scope each sits on and its allow keys.
+   */
+  readonly roles: readonly {
+    readonly name: string;
+    readonly on: string;
+    readonly allows: readonly string[];
+  }[];
+  /** Declared role names and permission keys with `meta.manageRoles: true`. */
+  readonly manage: {
+    readonly roles: readonly string[];
+    readonly permissions: readonly string[];
+  };
+  /**
+   * Declared role name to the roles it assigns, when any role declares
+   * `assigns`.
+   */
+  readonly assigns?: Readonly<Record<string, readonly string[]>>;
+  /** The first scope's custom-role ceiling, in declaration order. */
+  readonly permissions: readonly Permission[];
+  /** Permission key to its level names, in declaration order. */
+  readonly levels?: Readonly<Record<string, readonly string[]>>;
+  /** Index of an allow in `grants` to the levels a holder of it may hand out. */
+  readonly grants?: Readonly<Record<string, readonly string[]>>;
 };
 /** A column of a synced table, or a value every row has. */
 type LocalRowValue = {
@@ -1110,9 +1313,9 @@ type LocalRowValue = {
   readonly value: string;
 };
 /**
- * A column that holds a role key or user id: the value itself, the `column`
- * of the synced `through` table whose `id` it references, or a value each
- * maps to a role key (`null` for no role).
+ * A column that holds a role key or user id: the value itself, the `column` of
+ * the synced `through` table whose `id` it references, or a value each maps to
+ * a role key (`null` for no role).
  */
 type LocalRowColumn = {
   readonly column: string;
@@ -1133,7 +1336,10 @@ type LocalMembershipRows = {
   readonly user: LocalRowColumn;
   readonly scope: LocalRowValue;
   readonly id: string;
-  /** The role columns (the row holds every non-null key), or the fixed roles every row holds. */
+  /**
+   * The role columns (the row holds every non-null key), or the fixed roles
+   * every row holds.
+   */
   readonly roles: readonly LocalRowColumn[] | {
     readonly value: readonly string[];
   };
@@ -1151,28 +1357,46 @@ type LocalSnapshotRows = {
     /** The role columns; the row holds every non-null key. */
     readonly roles: readonly LocalRowColumn[];
   };
-  /** The custom-role tables (`tenant_id`, `scope`, `scope_id`, `role`, and `permission`, `effect`, `level` or `include_role`). */
+  /**
+   * The custom-role tables (`tenant_id`, `scope`, `scope_id`, `role`, and
+   * `permission`, `effect`, `level` or `include_role`).
+   */
   readonly customRoles?: {
     readonly permissions: string;
     readonly includes: string;
   };
 };
-/** Grants a custom role entry resolves to, held by a placeholder role the client renames. */
+/**
+ * Grants a custom role entry resolves to, held by a placeholder role the client
+ * renames.
+ */
 type LocalCustomRoleTable = {
-  /** `{ permission }` per permission key, and `{ permission, level }` per declared level. */
+  /**
+   * `{ permission }` per permission key, and `{ permission, level }` per
+   * declared level.
+   */
   readonly permissions: Readonly<Record<string, {
     readonly all: readonly SnapshotGrant[];
     readonly levels?: Readonly<Record<string, readonly SnapshotGrant[]>>;
+    /** The levels a holder of `all` may hand out. */
+    readonly reach?: readonly string[];
+    /** Level to the levels a holder of `levels[level]` may hand out. */
+    readonly levelReach?: Readonly<Record<string, readonly string[]>>;
   }>>;
   /** `includes: [role]` per declared role. */
   readonly includes: Readonly<Record<string, readonly SnapshotGrant[]>>;
+  /**
+   * Declared role to permission key to the levels a holder of its included
+   * grants may hand out.
+   */
+  readonly includeReach?: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>;
 };
 //#endregion
 //#region src/core/time.d.ts
 /**
- * The one time rule: NumericDate (whole seconds) for JWT registered claims
- * and the claims SQL reads, RFC 3339 for every other JSON field, integer
- * seconds for durations, and an `Instant` for every runtime `now`.
+ * The one time rule: NumericDate (whole seconds) for JWT registered claims and
+ * the claims SQL reads, RFC 3339 for every other JSON field, integer seconds
+ * for durations, and an `Instant` for every runtime `now`.
  */
 /**
  * The part of a `Temporal.Instant` PermDock reads. Public options take it
@@ -1185,8 +1409,8 @@ type Instant = {
 //#endregion
 //#region src/core/internals.d.ts
 /**
- * Any instance a feature function accepts: a server `PermDock`, one built
- * from a snapshot, or an adapter's wrapper such as `PdpPermDock`.
+ * Any instance a feature function accepts: a server `PermDock`, one built from
+ * a snapshot, or an adapter's wrapper such as `PdpPermDock`.
  */
 type InstanceHandle = {
   readonly subject: Subject;
@@ -1194,19 +1418,26 @@ type InstanceHandle = {
 //#endregion
 //#region src/core/credential.d.ts
 type CredentialKind = "user" | "service" | "feed";
-/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+/**
+ * A feed id: lowercase, so a mail system that lowercases a local part still
+ * matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local
+ * part.
+ */
 declare function isFeedId(value: string): boolean;
-/** One permission (a key) a credential may use: on every instance, or only on `ids`. */
+/**
+ * One permission (a key) a credential may use: on every instance, or only on
+ * `ids`.
+ */
 type CredentialPermission = {
   readonly permission: string;
   readonly ids?: readonly string[];
 };
 /**
- * Credential v1: what a verified API key stands for, never the secret. A
- * `user` credential acts as its owner (`principal`) narrowed to
- * `permissions`, and to the memberships inside `tenant` when it names one;
- * a `service` credential is its own `service` principal holding `roles` in
- * `tenant`, narrowed the same way.
+ * Credential v1: what a verified API key stands for, never the secret. A `user`
+ * credential acts as its owner (`principal`) narrowed to `permissions`, and to
+ * the memberships inside `tenant` when it names one; a `service` credential is
+ * its own `service` principal holding `roles` in `tenant`, narrowed the same
+ * way.
  */
 type Credential = {
   readonly v: 1;
@@ -1215,12 +1446,15 @@ type Credential = {
   /** The owner of a `user` credential, or the id of the service principal. */
   readonly principal: string;
   /**
-   * The instance of the first scope the key is held to. Required on a
-   * service credential, where its roles are held; optional on a user
-   * credential, where it keeps only the owner's memberships inside it.
+   * The instance of the first scope the key is held to. Required on a service
+   * credential, where its roles are held; optional on a user credential, where
+   * it keeps only the owner's memberships inside it.
    */
   readonly tenant?: string;
-  /** Service: the roles it holds in `tenant`. Feed: the resource roles it holds on `on`. */
+  /**
+   * Service: the roles it holds in `tenant`. Feed: the resource roles it holds
+   * on `on`.
+   */
   readonly roles?: readonly string[];
   /** Feed only: the resource instance the roles are held on. */
   readonly on?: {
@@ -1290,14 +1524,20 @@ type CredentialDecision = {
 } | {
   readonly outcome: "approval-required";
   readonly credential: Credential;
-  /** Bound to the credential's content and its creator; pass it as `approved` to resume. */
+  /**
+   * Bound to the credential's content and its creator; pass it as
+   * `approved` to resume.
+   */
   readonly token: string;
 } | {
   readonly outcome: "denied";
   readonly denials: readonly Denial[];
 };
 type DecideCredentialOptions = {
-  /** Where the tenant's `credentials` policy comes from. Without it, only the no-expiry rule applies. */
+  /**
+   * Where the tenant's `credentials` policy comes from. Without it, only the
+   * no-expiry rule applies.
+   */
   readonly settings?: SettingsSource;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
@@ -1311,49 +1551,48 @@ type DecideCredentialOptions = {
  */
 declare function credentialPolicyViolation(credential: Credential, policy: CredentialPolicy | readonly CredentialPolicy[]): CredentialPolicyViolation | undefined;
 /**
- * Validates an untrusted credential record and returns a frozen copy with
- * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
- * type in a known field, a service credential without `tenant` and `roles`,
- * or a user credential with `roles`, rejects the whole record.
+ * Validates an untrusted credential record and returns a frozen copy with only
+ * the v1 fields, or `undefined`. Unknown fields are dropped; a wrong type in a
+ * known field, a service credential without `tenant` and `roles`, or a user
+ * credential with `roles`, rejects the whole record.
  */
 declare function parseCredential(input: unknown): Credential | undefined;
 /**
  * The delegation a credential narrows its principal to: OAuth scopes for
- * permissions on every instance, one RFC 9396 entry per id otherwise. A key
- * the definitions no longer declare is dropped, so a credential whose every
- * key is gone delegates nothing and every check is denied.
+ * permissions on every instance, one RFC 9396 entry per id otherwise. A key the
+ * definitions no longer declare is dropped, so a credential whose every key is
+ * gone delegates nothing and every check is denied.
  */
 declare function credentialDelegation(credential: Credential, permissions: PermissionTree): Delegation;
 /**
  * Decides whether the subject of `permdock` may create the credential in
- * `request`. The creator must be a signed-in user or service that is not
- * itself a link or a credential; a delegated creator hands out only what its
- * delegation covers. A key's tenant must be one the creator is a member of;
- * a service key's roles among the creator's `assignableRoles` there and its
+ * `request`. The creator must be a signed-in user or service that is not itself
+ * a link or a credential; a delegated creator hands out only what its
+ * delegation covers. A key's tenant must be one the creator is a member of; a
+ * service key's roles among the creator's `assignableRoles` there and its
  * permissions within `assignablePermissions` there (`exceeds-creator`). The
- * `credentials` policy of the key's tenant (its own, or for a user key
- * without one the creator's active tenant) then applies (`credential-policy`; a
+ * `credentials` policy of the key's tenant (its own, or for a user key without
+ * one the creator's active tenant) then applies (`credential-policy`; a
  * settings source that throws denies with `rule: 'unavailable'`), and
- * `approval` makes the result `approval-required` until `approved` carries
- * its token. PermDock never stores the credential; the application does,
- * after a `granted` result.
+ * `approval` makes the result `approval-required` until `approved` carries its
+ * token. PermDock never stores the credential; the application does, after a
+ * `granted` result.
  */
 /**
  * Decides whether the subject of `permdock` may create the credential in
  * `request`: the creator's own reach, the `credentials` policy of the key's
- * tenant (the call's `settings`, else the instance's), and `approval`.
- * PermDock never stores the credential; the application does, after a
- * `granted` result. An instance built from a snapshot denies with
- * `unsupported`.
+ * tenant (the call's `settings`, else the instance's), and `approval`. PermDock
+ * never stores the credential; the application does, after a `granted` result.
+ * An instance built from a snapshot denies with `unsupported`.
  */
 declare function decideCredential(permdock: InstanceHandle, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
 //#endregion
 //#region src/core/support-session.d.ts
 /**
- * SupportSession v1: a support staff member (`actor`, kind `support`)
- * viewing the app as `principal` in `tenant`, for a stated `reason`. Each
- * request in the session acts as `principal` with their live rights,
- * narrowed to `permissions`.
+ * SupportSession v1: a support staff member (`actor`, kind `support`) viewing
+ * the app as `principal` in `tenant`, for a stated `reason`. Each request in
+ * the session acts as `principal` with their live rights, narrowed to
+ * `permissions`.
  */
 type SupportSession = {
   readonly v: 1;
@@ -1417,90 +1656,94 @@ type DecideSupportSessionOptions = {
   readonly approval?: boolean;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
-  /** The principal id that approved; required with `approved` and never the actor. */
+  /**
+   * The principal id that approved; required with `approved` and never the
+   * actor.
+   */
   readonly approvedBy?: string;
   /** The start time; defaults to the clock. */
   readonly now?: Instant;
 };
 /**
- * Validates an untrusted support-session record and returns a frozen copy
- * with only the v1 fields, or `undefined`.
+ * Validates an untrusted support-session record and returns a frozen copy with
+ * only the v1 fields, or `undefined`.
  */
 declare function parseSupportSession(input: unknown): SupportSession | undefined;
 /**
- * Decides whether the subject of `permdock` may start the support session
- * in `request`. The actor must be a signed-in person acting for themselves
+ * Decides whether the subject of `permdock` may start the support session in
+ * `request`. The actor must be a signed-in person acting for themselves
  * (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
- * member of the tenant (`tenant-mismatch`) and be able to use every
- * permission (`exceeds-creator`). Without `permissions` the session gets the
- * actor's read-only permissions. The tenant's `supportSessions` policy then
- * applies, and the result is `approval-required` until `approved` carries
- * its token and `approvedBy` names someone other than the actor.
+ * member of the tenant (`tenant-mismatch`) and be able to use every permission
+ * (`exceeds-creator`). Without `permissions` the session gets the actor's
+ * read-only permissions. The tenant's `supportSessions` policy then applies,
+ * and the result is `approval-required` until `approved` carries its token and
+ * `approvedBy` names someone other than the actor.
  */
 /**
- * Decides whether the subject of `permdock` may start the support session
- * in `request` and returns the record to sign: a stated reason, membership
- * of the tenant, the actor's own reach, the tenant's `supportSessions`
- * policy and approval by someone else. An instance built from a snapshot
- * denies with `unsupported`.
+ * Decides whether the subject of `permdock` may start the support session in
+ * `request` and returns the record to sign: a stated reason, membership of the
+ * tenant, the actor's own reach, the tenant's `supportSessions` policy and
+ * approval by someone else. An instance built from a snapshot denies with
+ * `unsupported`.
  */
 declare function decideSupportSession(permdock: InstanceHandle, request: SupportSessionRequest, options?: DecideSupportSessionOptions): Promise<SupportSessionDecision>;
 //#endregion
 //#region src/core/interfaces.d.ts
 type DecisionProvider = {
   readonly name: string;
-  handles(permission: Permission): boolean;
-  decide(request: {
+  handles: (permission: Permission) => boolean;
+  decide: (request: {
     readonly permission: Permission;
     readonly data?: unknown;
     readonly subject: Subject;
     readonly local: Decision;
-  }): Promise<Decision>;
+  }) => Promise<Decision>;
   /**
    * Ids of the resources of `permission.resource` the subject may act on.
    * `null` means the provider could not answer and every row is denied;
    * `undefined` means it cannot list, and each row is decided on its own.
    */
-  permitted?(request: {
+  permitted?: (request: {
     readonly permission: Permission;
     readonly subject: Subject;
-  }): Promise<readonly string[] | null | undefined>;
+  }) => Promise<readonly string[] | null | undefined>;
 };
 type CustomRoleSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
   /**
-   * The custom roles of one tenant. `getPermDock` passes `held`, the role
-   * names the subject's live memberships hold there, declared or not, so a
-   * source can skip its read when none of them is a custom role.
+   * The custom roles of one tenant. `getPermDock` passes `held`, the role names
+   * the subject's live memberships hold there, declared or not, so a source can
+   * skip its read when none of them is a custom role.
    */
-  rolesFor(tenant: string, context?: {
+  rolesFor: (tenant: string, context?: {
     readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
-  assignable?(tenant: string): string[] | Promise<string[]>;
+  }) => CustomRole[] | Promise<CustomRole[]>;
+  assignable?: (tenant: string) => string[] | Promise<string[]>;
   /**
-   * Platform custom roles (`scope: 'global'`), read once per signed-in
-   * subject, with `held`, the global role names the subject holds. A role
-   * here with a tenant is ignored.
+   * Platform custom roles (`scope: 'global'`), read once per signed-in subject,
+   * with `held`, the global role names the subject holds. A role here with a
+   * tenant is ignored.
    */
-  globalRoles?(context?: {
+  globalRoles?: (context?: {
     readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
+  }) => CustomRole[] | Promise<CustomRole[]>;
   /**
    * Shared custom roles (`shared: true`), defined once for every tenant and
-   * read once per subject with a tenant membership, with `held`, the role
-   * names its live memberships hold in any tenant. A role here without
-   * `shared: true` is ignored.
+   * read once per subject with a tenant membership, with `held`, the role names
+   * its live memberships hold in any tenant. A role here without `shared: true`
+   * is ignored.
    */
-  sharedRoles?(context?: {
+  sharedRoles?: (context?: {
     readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
+  }) => CustomRole[] | Promise<CustomRole[]>;
 };
 /**
- * A `CustomRoleSource` built for the subject the instance serves, for an adapter
- * option shared by every request: it gets the resolved subject (principal,
- * actor and delegation) and returns that subject's source, or `undefined`
- * for none. A throw reads no custom roles and reports `source-threw`.
+ * A `CustomRoleSource` built for the subject the instance serves, for an
+ * adapter option shared by every request: it gets the resolved subject
+ * (principal, actor and delegation) and returns that subject's source, or
+ * `undefined` for none. A throw reads no custom roles and reports
+ * `source-threw`.
  */
 type CustomRoleSourceFactory = (subject: Subject) => CustomRoleSource | undefined;
 /** One member of a scope instance, as `MembershipSource.list` returns it. */
@@ -1513,39 +1756,42 @@ type MemberEntry = {
 type MembershipSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  membershipsFor(principal: {
+  membershipsFor: (principal: {
     readonly id: string;
     readonly kind?: string;
   }, options: {
     readonly tenant?: string;
-  }): Membership[] | Promise<Membership[]>;
-  /** Every membership held in one scope instance, for member lists and access reviews. */
-  list?(query: {
+  }) => Membership[] | Promise<Membership[]>;
+  /**
+   * Every membership held in one scope instance, for member lists and access
+   * reviews.
+   */
+  list?: (query: {
     readonly scope: string;
     readonly id: string;
-  }): MemberEntry[] | Promise<MemberEntry[]>;
+  }) => MemberEntry[] | Promise<MemberEntry[]>;
   /**
    * The principal's current authorization version, bumped on every membership
-   * change. A token whose `authzVersion` is behind it is stale for the
-   * policy's `fresh` permissions. `roles` and `memberships` are what the
-   * token claims, so a source can read more than the version in the same
-   * call when the claims show it will be needed.
+   * change. A token whose `authzVersion` is behind it is stale for the policy's
+   * `fresh` permissions. `roles` and `memberships` are what the token claims,
+   * so a source can read more than the version in the same call when the claims
+   * show it will be needed.
    */
-  version?(principal: {
+  version?: (principal: {
     readonly id: string;
     readonly roles?: readonly string[];
     readonly memberships?: readonly Membership[];
-  }): number | undefined | Promise<number | undefined>;
+  }) => number | undefined | Promise<number | undefined>;
   /**
-   * The global roles the principal holds now. With `onStale: 'reread'`, a
-   * stale token's `principal.roles` is replaced by this answer, so a revoked
-   * platform role is lost with the memberships. A throw or rejection leaves
-   * no global roles. Without it, a reread keeps the token's roles.
+   * The global roles the principal holds now. With `onStale: 'reread'`, a stale
+   * token's `principal.roles` is replaced by this answer, so a revoked platform
+   * role is lost with the memberships. A throw or rejection leaves no global
+   * roles. Without it, a reread keeps the token's roles.
    */
-  globalRolesFor?(principal: {
+  globalRolesFor?: (principal: {
     readonly id: string;
     readonly kind?: string;
-  }): readonly string[] | Promise<readonly string[]>;
+  }) => readonly string[] | Promise<readonly string[]>;
   /**
    * Keep the memberships the verified token carries and read this source only
    * when the token says they were truncated (`claimsFirst`).
@@ -1555,9 +1801,9 @@ type MembershipSource = {
    * What a token behind `version` gets. Only permissions the policy marks
    * `fresh` look at staleness: `'deny'` (the default) denies those with
    * `stale-credentials` and leaves every other permission on the token's
-   * claims; `'reread'` replaces the token's memberships (and global roles,
-   * when the source has `globalRolesFor`) with a live read for the whole
-   * subject, so no decision keeps a revoked grant.
+   * claims; `'reread'` replaces the token's memberships (and global roles, when
+   * the source has `globalRolesFor`) with a live read for the whole subject, so
+   * no decision keeps a revoked grant.
    */
   readonly onStale?: "deny" | "reread";
 };
@@ -1565,7 +1811,10 @@ type MembershipSource = {
 type RelationChain = {
   /** Whether the object itself is restricted: nothing above it reaches it. */
   readonly restricted?: boolean;
-  /** Ancestors nearest first, at most `depth`; a restricted one ends the walk after itself. */
+  /**
+   * Ancestors nearest first, at most `depth`; a restricted one ends the walk
+   * after itself.
+   */
   readonly ancestors: readonly {
     readonly id: string;
     readonly restricted?: boolean;
@@ -1579,7 +1828,10 @@ type HolderPeriod = {
   /** Seconds since the epoch; from it on the relation no longer holds. */
   readonly expiresAt?: number;
 };
-/** A group holding a relation on an object: whoever holds `relation` on the group's instance holds it too. */
+/**
+ * A group holding a relation on an object: whoever holds `relation` on the
+ * group's instance holds it too.
+ */
 type RelationGroup = {
   readonly resource: string;
   readonly id: string;
@@ -1597,10 +1849,9 @@ type RelationHolder = HolderPeriod & ({
   readonly group: RelationGroup;
 });
 /**
- * The object graph: parent chains, links and who holds a relation on an
- * object. A source answers facts and never decides; a thrown or rejected
- * call, or a Promise the instance has not loaded, denies with
- * `relation-unavailable`.
+ * The object graph: parent chains, links and who holds a relation on an object.
+ * A source answers facts and never decides; a thrown or rejected call, or a
+ * Promise the instance has not loaded, denies with `relation-unavailable`.
  */
 type RelationSource = {
   /** Names the implementation in errors and events. */
@@ -1609,31 +1860,34 @@ type RelationSource = {
    * With `through: 'parent'`, the parent chain; with a link name, the one
    * instance that link points to (`depth` is then 1).
    */
-  ancestors(query: {
+  ancestors: (query: {
     readonly resource: string;
     readonly id: string;
     readonly through: string;
     readonly depth: number;
-  }): RelationChain | Promise<RelationChain>;
-  related(query: {
+  }) => RelationChain | Promise<RelationChain>;
+  related: (query: {
     readonly resource: string;
     readonly id: string;
     readonly relation: string;
-  }): RelationHolder[] | Promise<RelationHolder[]>;
-  row?(query: {
+  }) => RelationHolder[] | Promise<RelationHolder[]>;
+  row?: (query: {
     readonly resource: string;
     readonly id: string;
-  }): Readonly<Record<string, unknown>> | null | undefined | Promise<Readonly<Record<string, unknown>> | null | undefined>;
+  }) => Readonly<Record<string, unknown>> | null | undefined | Promise<Readonly<Record<string, unknown>> | null | undefined>;
 };
-/** Plan and seat names a principal holds in a tenant, from billing (Stripe Entitlements, a table). */
+/**
+ * Plan and seat names a principal holds in a tenant, from billing (Stripe
+ * Entitlements, a table).
+ */
 type EntitlementSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  entitlementsFor(principal: {
+  entitlementsFor: (principal: {
     readonly id: string;
   }, options: {
     readonly tenant?: string;
-  }): string[] | Promise<string[]>;
+  }) => string[] | Promise<string[]>;
 };
 type JwtClaims = {
   readonly iss?: string;
@@ -1662,29 +1916,32 @@ type VerificationFailure = {
 type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  verify(token: string, expectations: {
+  verify: (token: string, expectations: {
     readonly typ?: string | readonly string[];
     readonly audience?: string | readonly string[];
     readonly issuer?: string;
     readonly clockTolerance?: number;
-  }): Promise<VerifiedToken<TClaims> | VerificationFailure>;
+  }) => Promise<VerifiedToken<TClaims> | VerificationFailure>;
 };
 type TokenSigner = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  sign(payload: Readonly<Record<string, unknown>>, options: {
+  sign: (payload: Readonly<Record<string, unknown>>, options: {
     readonly typ: "vnd.permdock.snapshot+jwt" | "vnd.permdock.approval+jwt" | "vnd.permdock.policy+jwt" | "vnd.permdock.capability+jwt" | "vnd.permdock.run+jwt" | "vnd.permdock.support-session+jwt" | "vnd.permdock.evidence+jwt" | "at+jwt" | "secevent+jwt";
     /** `aud`; a signer with no default audience refuses to sign without one. */
     readonly audience?: string | readonly string[];
     /** `exp`, a NumericDate; one hour after `iat` when absent. */
     readonly expiresAt?: number;
-    /** `iat`, a NumericDate: the artefact's issue time. The signer's clock when absent. */
+    /**
+     * `iat`, a NumericDate: the artefact's issue time. The signer's clock
+     * when absent.
+     */
     readonly issuedAt?: number;
     /** `jti`: the artefact's id. A fresh UUID when absent. */
     readonly jti?: string;
-  }): Promise<string>;
+  }) => Promise<string>;
   readonly kid?: string;
-  jwks?(): Promise<{
+  jwks?: () => Promise<{
     readonly keys: readonly JsonWebKeyLike[];
   }>;
 };
@@ -1694,8 +1951,8 @@ type SubjectResolver<TInput, TPrincipal extends Principal = Principal> = (input:
 type SnapshotSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  get(): Promise<Snapshot | string> | Snapshot | string;
-  subscribe?(listener: () => void): () => void;
+  get: () => Promise<Snapshot | string> | Snapshot | string;
+  subscribe?: (listener: () => void) => () => void;
 };
 type WhereCompiler<TTarget, TOptions = unknown> = (condition: Condition, target: TTarget, options?: TOptions) => unknown;
 type LimitConsumeInput = {
@@ -1715,31 +1972,31 @@ type LimitRemaining = {
 type LimitStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  consume(input: LimitConsumeInput): Promise<LimitRemaining> | LimitRemaining;
-  remaining(input: LimitConsumeInput): LimitRemaining | undefined;
+  consume: (input: LimitConsumeInput) => Promise<LimitRemaining> | LimitRemaining;
+  remaining: (input: LimitConsumeInput) => LimitRemaining | undefined;
 };
 type DecisionSink = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  write(events: readonly SinkEvent[]): Promise<void> | void;
-  flush?(): Promise<void>;
+  write: (events: readonly SinkEvent[]) => Promise<void> | void;
+  flush?: () => Promise<void>;
 };
 /**
  * Looks up the credential an API key stands for. `null` for a key that is
- * malformed, unknown, revoked or whose secret does not match; never throws
- * for bad input. Verification is the application's (or `apiKeyVerifier`'s),
- * never core's.
+ * malformed, unknown, revoked or whose secret does not match; never throws for
+ * bad input. Verification is the application's (or `apiKeyVerifier`'s), never
+ * core's.
  */
 type CredentialVerifier = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  verify(secret: string): Credential | null | Promise<Credential | null>;
+  verify: (secret: string) => Credential | null | Promise<Credential | null>;
   /**
-   * Records a successful use at `at`, for a `lastUsedAt` column. Called
-   * after a key resolved and not awaited; a throw or a rejection is
-   * ignored, so it never changes the subject.
+   * Records a successful use at `at`, for a `lastUsedAt` column. Called after a
+   * key resolved and not awaited; a throw or a rejection is ignored, so it
+   * never changes the subject.
    */
-  touch?(id: string, at: Instant): void | Promise<void>;
+  touch?: (id: string, at: Instant) => void | Promise<void>;
 };
 /** What one tenant configures for itself. Every field only tightens. */
 type TenantSettings = {
@@ -1749,13 +2006,13 @@ type TenantSettings = {
   readonly supportSessions?: SupportSessionPolicy;
 };
 /**
- * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten what
- * a key may be and never grant. A throw denies.
+ * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten
+ * what a key may be and never grant. A throw denies.
  */
 type SettingsSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  settingsFor(tenant: string): TenantSettings | undefined | Promise<TenantSettings | undefined>;
+  settingsFor: (tenant: string) => TenantSettings | undefined | Promise<TenantSettings | undefined>;
 };
 //#endregion
 //#region src/core/policy-fingerprint.d.ts
@@ -1785,13 +2042,16 @@ type ApprovalStage = {
   readonly by: Approver | readonly Approver[];
   /** Absent means 1. */
   readonly quorum?: number;
-  /** After `after`, `to` may approve this stage as well as `by`; other stages are unaffected. */
+  /**
+   * After `after`, `to` may approve this stage as well as `by`; other stages
+   * are unaffected.
+   */
   readonly escalation?: ApprovalEscalation;
 };
 /**
- * `'any'`: `quorum` approvers from `by`. `'all'`: every stage completes, in
- * any order. `'sequential'`: stages complete in order; an approver signs
- * only the first incomplete stage. An approver signs once per request.
+ * `'any'`: `quorum` approvers from `by`. `'all'`: every stage completes, in any
+ * order. `'sequential'`: stages complete in order; an approver signs only the
+ * first incomplete stage. An approver signs once per request.
  */
 type ApprovalMode = "any" | "all" | "sequential";
 type ApprovalRequirement = {
@@ -1805,15 +2065,24 @@ type ApprovalRequirement = {
   readonly distinct?: boolean;
   /** `'resource-change'` binds the approval to the row's `version` field. */
   readonly staleOn?: "resource-change";
-  /** Distinct approvers a request needs before it is approved under `by`; absent means 1. */
+  /**
+   * Distinct approvers a request needs before it is approved under `by`; absent
+   * means 1.
+   */
   readonly quorum?: number;
-  /** Seconds a request stays open; the store's default when absent, and never longer than it. */
+  /**
+   * Seconds a request stays open; the store's default when absent, and never
+   * longer than it.
+   */
   readonly ttl?: number;
   readonly escalation?: ApprovalEscalation;
 };
 type ApprovalOption = "human" | {
   readonly by?: ApproverInput;
-  /** `'all'` or `'sequential'` with `stages`; absent means `'any'` with `by`. */
+  /**
+   * `'all'` or `'sequential'` with `stages`; absent means `'any'` with
+   * `by`.
+   */
   readonly mode?: ApprovalMode;
   readonly stages?: readonly {
     readonly by: ApproverInput;
@@ -1832,11 +2101,20 @@ type ApprovalOption = "human" | {
    * changes, resuming denies with `stale-approval`.
    */
   readonly staleOn?: "resource-change";
-  /** Distinct approvers needed (an integer of at least 1); the same approver counts once. Absent means 1. */
+  /**
+   * Distinct approvers needed (an integer of at least 1); the same approver
+   * counts once. Absent means 1.
+   */
   readonly quorum?: number;
-  /** Seconds the request stays open (`1800`); caps the approval store's default. */
+  /**
+   * Seconds the request stays open (`1800`); caps the approval store's
+   * default.
+   */
   readonly ttl?: number;
-  /** After `after` seconds (`14_400`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
+  /**
+   * After `after` seconds (`14_400`), `to` may approve as well as `by`, at
+   * any open stage; same kinds as `by`.
+   */
   readonly escalation?: {
     readonly after: number;
     readonly to: ApproverInput;
@@ -1864,16 +2142,19 @@ type AssuranceRequirement = {
   readonly amr?: readonly string[];
 };
 /**
- * Time-boxed role activation. A role with `activation` is never held
- * directly: a membership lists it under `eligible`, and `permdock.activate`
- * mints the elevated membership to write.
+ * Time-boxed role activation. A role with `activation` is never held directly:
+ * a membership lists it under `eligible`, and `permdock.activate` mints the
+ * elevated membership to write.
  */
 type ActivationOption = {
   /** The longest an activation may last, in seconds (`14_400`). */
   readonly maxDuration?: number;
   /** `'required'` denies an activation without a reason. */
   readonly justification?: "required" | "optional";
-  /** When set, `activate` returns `approval-required` before the membership can be written. */
+  /**
+   * When set, `activate` returns `approval-required` before the membership can
+   * be written.
+   */
   readonly approval?: ApprovalOption;
   /** How fresh the activator's authentication must be. */
   readonly assurance?: AssuranceRequirement;
@@ -1921,10 +2202,16 @@ type SupportAccessOptions<S extends string = string> = {
   readonly role: string;
   /** The scope the support membership sits in; defaults to `tenant`. */
   readonly on?: S;
-  /** Every decision under the support membership denies with `actor-required` without an `act`. */
+  /**
+   * Every decision under the support membership denies with `actor-required`
+   * without an `act`.
+   */
   readonly actorRequired?: boolean;
   readonly consent: SupportConsent;
-  /** Permissions a support session never reaches, compiled to deny grants scoped to `via: 'support'`. */
+  /**
+   * Permissions a support session never reaches, compiled to deny grants scoped
+   * to `via: 'support'`.
+   */
   readonly forbid?: readonly (Permission | PermissionTree)[];
   /** The subgroup a consented membership records under `member.group`. */
   readonly group?: string;
@@ -1945,38 +2232,56 @@ type GrantOptions<T = Record<string, unknown>> = {
   readonly approval?: ApprovalOption;
   readonly limit?: GrantLimit;
   readonly reason?: string;
-  readonly fields?: readonly (keyof T & string)[];
+  readonly fields?: readonly (unknown extends T ? string : keyof T & string)[];
   /**
    * A stable name for the grant. On a deny, a `breakGlass` override may lift
-   * it; on any grant, it is reported on `decision.matched.name` and on
-   * decision events.
+   * it; on any grant, it is reported on `decision.matched.name` and on decision
+   * events.
    */
   readonly name?: string;
   readonly group?: string;
-  /** Display text and app data for the grant, reported on `decision.matched.meta`; never read in evaluation. */
+  /**
+   * Display text and app data for the grant, reported on
+   * `decision.matched.meta`; never read in evaluation.
+   */
   readonly meta?: GrantMeta;
   /**
-   * Follow-ups the application owes when this allow grants: each becomes a
-   * `{ kind: 'app', name, detail? }` obligation on the decision. Allows only.
+   * Follow-ups the application owes when this allow grants: each becomes a `{
+   * kind: 'app', name, detail? }` obligation on the decision. Allows only.
    */
   readonly obligations?: readonly ObligationInput[];
-  /** Purposes of use (`context.purpose`) that make the grant apply; non-portable. */
+  /**
+   * Purposes of use (`context.purpose`) that make the grant apply;
+   * non-portable.
+   */
   readonly purpose?: readonly string[];
-  /** The grant applies from this instant on (RFC 3339 or an `Instant`); before it an allow denies with `inactive-grant` and a deny does not apply. */
+  /**
+   * The grant applies from this instant on (RFC 3339 or an `Instant`); before
+   * it an allow denies with `inactive-grant` and a deny does not apply.
+   */
   readonly validFrom?: string | Instant;
-  /** The grant stops applying at this instant (exclusive; RFC 3339 or an `Instant`). */
+  /**
+   * The grant stops applying at this instant (exclusive; RFC 3339 or an
+   * `Instant`).
+   */
   readonly validUntil?: string | Instant;
   /**
-   * An allow on an instance action counts only on rows whose scope instance
-   * (or the whole app, globally) is one where the subject also holds this
+   * An allow on an instance action counts only on rows whose scope instance (or
+   * the whole app, globally) is one where the subject also holds this
    * permission through a role grant without a row condition.
    */
   readonly requires?: Permission | readonly Permission[];
 };
-/** A grant's metadata. PermDock carries it to decisions, events, snapshots and the catalog and never reads `x`. */
+/**
+ * A grant's metadata. PermDock carries it to decisions, events, snapshots and
+ * the catalog and never reads `x`.
+ */
 type GrantMeta = {
   readonly description?: string;
-  /** Data the application owns. Plain JSON, checked by `definePolicy(…, { x: { grant } })`. */
+  /**
+   * Data the application owns. Plain JSON, checked by `definePolicy(…, { x: {
+   * grant } })`.
+   */
   readonly x?: AppData;
 };
 /** An app obligation as declared on an allow: its name, or its name and detail. */
@@ -1986,22 +2291,25 @@ type ObligationInput = string | {
 };
 /**
  * When a grant applies, in Unix seconds. `from` is inclusive, `until`
- * exclusive; either may be absent. Portable: `where()` drops an inactive
- * grant at the decision clock and generated RLS compares against `now()`.
+ * exclusive; either may be absent. Portable: `where()` drops an inactive grant
+ * at the decision clock and generated RLS compares against `now()`.
  */
 type GrantValidity = {
   readonly from?: number;
   readonly until?: number;
 };
-/** A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details): RFC 3339 bounds. */
+/**
+ * A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details):
+ * RFC 3339 bounds.
+ */
 type WireValidity = {
   readonly from?: string;
   readonly until?: string;
 };
 /**
- * The actor a policy delegation is for: an actor kind, narrowed to one id
- * when `id` is set, or to one named client when `client` is set (the name
- * the subject resolver gives a verified client id through `clients`).
+ * The actor a policy delegation is for: an actor kind, narrowed to one id when
+ * `id` is set, or to one named client when `client` is set (the name the
+ * subject resolver gives a verified client id through `clients`).
  */
 type DelegationTarget = {
   readonly kind: ActorKind;
@@ -2017,42 +2325,66 @@ type PolicyDelegation = {
   readonly from: Grantee | readonly Grantee[];
   readonly to: DelegationTarget;
   readonly permissions: readonly string[];
-  /** The keys of `permissions` whose `readOnlyHint` is true: all a `readOnly` actor may use. */
+  /**
+   * The keys of `permissions` whose `readOnlyHint` is true: all a `readOnly`
+   * actor may use.
+   */
   readonly readOnly: readonly string[];
   readonly validity?: GrantValidity;
 };
 type DelegationInput = {
-  /** Who hands over: the same subject-only selectors as `approval.by` (a role, `authenticated()`, a plan, `assurance()`); not `relation()`. */
+  /**
+   * Who hands over: the same subject-only selectors as `approval.by` (a role,
+   * `authenticated()`, a plan, `assurance()`); not `relation()`.
+   */
   readonly from: GranteeInput;
-  /** Which actor may act: `actor('eve')`, an actor kind, `{ kind, id }` for one agent, or `{ kind, client }` for one named OAuth client. */
+  /**
+   * Which actor may act: `actor('eve')`, an actor kind, `{ kind, id }` for one
+   * agent, or `{ kind, client }` for one named OAuth client.
+   */
   readonly to: ActorGrantee | string | DelegationTarget;
   /** The leaves or subtrees the actor may use; a deny grant still applies. */
   readonly permissions: readonly (Permission | PermissionTree)[];
   readonly validFrom?: string | Instant;
   readonly validUntil?: string | Instant;
 };
-/** A declared scope name (or the `tenant` / `team` alias), or the resource a role is held on. */
+/**
+ * A declared scope name (or the `tenant` / `team` alias), or the resource a
+ * role is held on.
+ */
 type RoleScope<S extends string = string> = S | Permission | PermissionTree | readonly (Permission | PermissionTree)[];
 type RoleOptions<S extends string = string> = {
   readonly on?: RoleScope<S>;
   readonly assignable?: boolean;
   /** Roles nobody may hold together with this one in the same scope instance. */
   readonly exclusiveWith?: readonly string[];
-  /** Fewest holders a scope instance keeps (checked at commit); default 0. Needs a named-scope `on`. */
+  /**
+   * Fewest holders a scope instance keeps (checked at commit); default 0. Needs
+   * a named-scope `on`.
+   */
   readonly min?: number;
   /** Most holders a scope instance may have. Needs a named-scope `on`. */
   readonly max?: number;
-  /** The holder count of a scope instance never changes: the role only moves by transfer. */
+  /**
+   * The holder count of a scope instance never changes: the role only moves by
+   * transfer.
+   */
   readonly transferOnly?: boolean;
   /**
-   * Roles a holder may assign and revoke. Once any role declares `assigns`,
-   * a role nobody lists is assigned only by `meta.manageRoles` holders.
+   * Roles a holder may assign and revoke. Once any role declares `assigns`, a
+   * role nobody lists is assigned only by `meta.manageRoles` holders.
    */
   readonly assigns?: readonly string[];
-  /** Membership kinds (`via`) that may hold the role; others hold it for nothing. */
+  /**
+   * Membership kinds (`via`) that may hold the role; others hold it for
+   * nothing.
+   */
   readonly for?: readonly string[];
   readonly meta?: RoleMeta;
-  /** Time-boxed activation: the role becomes eligible-only and `activate` mints its membership. */
+  /**
+   * Time-boxed activation: the role becomes eligible-only and `activate` mints
+   * its membership.
+   */
   readonly activation?: ActivationOption;
   /** Reserved for restricted credentials; setting it throws until it ships. */
   readonly restricted?: never;
@@ -2070,31 +2402,52 @@ type Grant = {
   readonly check?: Condition;
   readonly approval?: "human" | ApprovalRequirement;
   readonly portable: boolean;
-  /** Set when `portable` is false only because the grant reads the relation graph. */
+  /**
+   * Set when `portable` is false only because the grant reads the relation
+   * graph.
+   */
   readonly graph?: true;
   readonly closure?: ClosureGrantFn;
   readonly limit?: GrantLimit;
   readonly fields?: readonly string[];
   readonly scope: GrantScope;
-  /** The grant's stable name: a `breakGlass` override lifts a named deny, and `decision.matched.name` reports it. */
+  /**
+   * The grant's stable name: a `breakGlass` override lifts a named deny, and
+   * `decision.matched.name` reports it.
+   */
   readonly name?: string;
   readonly group?: string;
   readonly meta?: GrantMeta;
   /** App obligations an allow adds to its granted decision. */
   readonly obligations?: readonly AppObligation[];
-  /** Purposes of use that make the grant apply (`context.purpose`); non-portable. */
+  /**
+   * Purposes of use that make the grant apply (`context.purpose`);
+   * non-portable.
+   */
   readonly purpose?: readonly string[];
-  /** Set on a break-glass allow: it overrides named denies and carries obligations. */
+  /**
+   * Set on a break-glass allow: it overrides named denies and carries
+   * obligations.
+   */
   readonly breakGlass?: BreakGlassSpec;
-  /** The membership kind (`via`) this grant applies under; others never match it. */
+  /**
+   * The membership kind (`via`) this grant applies under; others never match
+   * it.
+   */
   readonly viaOnly?: MembershipVia;
   /** Set only on a grant merged from a hosted policy document. */
   readonly hosted?: HostedGrantRef;
   /** When the grant applies; absent means always. */
   readonly validity?: GrantValidity;
-  /** Set on a custom-role grant narrowed by a resource level (`CustomRoleGrant.level`). */
+  /**
+   * Set on a custom-role grant narrowed by a resource level
+   * (`CustomRoleGrant.level`).
+   */
   readonly level?: string;
-  /** The permission key the subject must also hold, through a role, on the row's scope instance or globally. */
+  /**
+   * The permission key the subject must also hold, through a role, on the row's
+   * scope instance or globally.
+   */
   readonly requires?: readonly string[];
 };
 /** Which hosted policy document and grant a merged grant came from. */
@@ -2114,13 +2467,22 @@ type RoleBinding<S extends string = string> = {
   readonly assigns?: readonly string[];
   readonly for?: readonly string[];
   readonly meta?: RoleMeta;
-  /** Time-boxed activation: the role is eligible-only, and `activate` mints its membership. */
+  /**
+   * Time-boxed activation: the role is eligible-only, and `activate` mints its
+   * membership.
+   */
   readonly activation?: ActivationSpec;
-  /** Support access: consent and `actorRequired` for a vendor-support membership. */
+  /**
+   * Support access: consent and `actorRequired` for a vendor-support
+   * membership.
+   */
   readonly support?: SupportSpec;
 };
 type ValidateMode = "boundary" | "always" | "never";
-/** The declared scopes, in declaration order; empty when the policy declares none. */
+/**
+ * The declared scopes, in declaration order; empty when the policy declares
+ * none.
+ */
 type PolicyScopes = readonly Scope[];
 type PolicyVocabulary = {
   readonly permissions: PermissionTree;
@@ -2132,7 +2494,7 @@ type VocabularyFromInput<Input> = Input extends PolicyVocabulary ? Input : {
   readonly roles?: RoleTree;
   readonly plans?: PlanTree;
 };
-type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary> = {
+type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary, S extends PolicyScopesInput = PolicyScopesInput> = {
   readonly permissions: V["permissions"];
   readonly roles: readonly RoleBinding[];
   readonly rolesByName: ReadonlyMap<string, RoleBinding>;
@@ -2146,18 +2508,39 @@ type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends
   readonly onDenied?: (decision: unknown) => never | void;
   readonly fingerprint: string;
   readonly resources: ReadonlyMap<string, ResourceNode>;
-  /** The app data schemas `definePolicy` was given; symbol-keyed so freezing the policy leaves the schemas alone. */
+  /**
+   * The app data schemas `definePolicy` was given; symbol-keyed so freezing the
+   * policy leaves the schemas alone.
+   */
   readonly [POLICY_X]?: PolicyAppDataSchemas;
+  readonly [POLICY_SCOPES]?: S;
   readonly providers?: readonly DecisionProvider[];
-  /** Permission keys a hosted policy document may grant or deny; empty by default. */
+  /**
+   * Permission keys a hosted policy document may grant or deny; empty by
+   * default.
+   */
   readonly hostable: readonly string[];
-  /** Permission keys that deny with `stale-credentials` when the subject's token is behind the source. */
+  /**
+   * Permission keys that deny with `stale-credentials` when the subject's token
+   * is behind the source.
+   */
   readonly fresh?: readonly string[];
-  /** Policy delegations in declaration order; absent or empty when the policy declares none. */
+  /**
+   * Policy delegations in declaration order; absent or empty when the policy
+   * declares none.
+   */
   readonly delegations?: readonly PolicyDelegation[];
-  /** Grant levels by resource (`resource(…, { levels })`), normalised; absent when none are declared. */
+  /**
+   * Grant levels by resource (`resource(…, { levels })`), normalised; absent
+   * when none are declared.
+   */
   readonly levels?: PolicyLevels;
-  /** Coarse OAuth scopes in declaration order; absent when the policy declares none. */
+  /** Resources declared with `orderedLevels: true`, sorted; absent when none. */
+  readonly orderedLevels?: readonly string[];
+  /**
+   * Coarse OAuth scopes in declaration order; absent when the policy declares
+   * none.
+   */
   readonly oauthScopes?: readonly PolicyOAuthScope[];
   readonly index: PolicyIndex;
 };
@@ -2170,7 +2553,10 @@ type PolicyOAuthScope = {
   readonly permissions: readonly string[];
   readonly scopes: readonly string[];
 };
-/** Lookups built once per policy, so a decision does not rescan every role and grant. */
+/**
+ * Lookups built once per policy, so a decision does not rescan every role and
+ * grant.
+ */
 type PolicyIndex = {
   readonly declaredRoles: ReadonlySet<string>;
   readonly supports: readonly SupportSpec[];
@@ -2196,19 +2582,22 @@ type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesIn
   readonly grants?: readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[] | Grant)[];
   /**
    * Named scopes in order, each with the row field holding its id and an
-   * optional parent (`within`, an earlier scope). `tenant` and `team` alias
-   * the first and second scope.
+   * optional parent (`within`, an earlier scope). `tenant` and `team` alias the
+   * first and second scope.
    */
   readonly scopes?: S;
-  /** Maps the application's user to the principal PermDock decides for; `null` is anonymous. */
+  /**
+   * Maps the application's user to the principal PermDock decides for; `null`
+   * is anonymous.
+   */
   readonly subject: (user: TUser) => TPrincipal | null;
   readonly context?: (user: TUser) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
   readonly validate?: ValidateMode;
   readonly onDenied?: (decision: unknown) => never | void;
   readonly providers?: readonly DecisionProvider[];
   /**
-   * Leaves or subtrees a hosted policy document (`PolicySource`) may touch.
-   * The default is none, so a policy without it ignores every hosted grant.
+   * Leaves or subtrees a hosted policy document (`PolicySource`) may touch. The
+   * default is none, so a policy without it ignores every hosted grant.
    */
   readonly hostable?: readonly (Permission | PermissionTree)[];
   /**
@@ -2219,8 +2608,8 @@ type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesIn
   readonly fresh?: readonly (Permission | PermissionTree)[];
   /**
    * Standing delegations: holders of `from` let actors matching `to` use
-   * `permissions` for them without a token saying so. A token delegation on
-   * the call still applies as well; both must cover.
+   * `permissions` for them without a token saying so. A token delegation on the
+   * call still applies as well; both must cover.
    */
   readonly delegations?: readonly DelegationInput[];
   /**