permdock 0.7.0 → 0.9.0

package/dist/{index-BTkwrK7v.d.ts → index-vYjMrXyK.d.ts}

@@ -1,13 +1,13 @@
-import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-B-F-qAZk.js";
-import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
-import { a as RoleTree, r as Role } from "./vocabulary-Bg3eeT2H.js";
-import { a as PermDock, o as PermDockOptions } from "./permdock-Dco6dyCK.js";
-import { o as PolicyDocument } from "./hosted-BmjzxQhp.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
-import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-Cp_Eot9W.js";
+import { Ar as SqlFunctionCondition, C as MembershipFixture, D as PolicyDelegation, G as CustomRoleSource, I as SeparationConflict, Kn as DenialReason, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, T as Policy, Tr as OpaqueCondition, Un as Decision, Ut as InstanceHandle, V as VocabularyFromInput, Wn as Denial, Wt as Instant, Y as EntitlementSource, Yt as LocalSnapshotManifest, Z as JwtClaims, Zt as Snapshot, _n as PolicyScopesInput, c as BreakGlassOptions, cn as DeliveryEvent, ct as SnapshotSource, fr as Membership, ft as TenantSettings, g as GrantCondition, h as Grant, hr as Subject, i as ApprovalOption, it as RelationGroup, j as PolicyVocabulary, k as PolicyOptions, kr as SqlFunctionArg, lr as Delegation, mt as TokenSigner, nn as AccessEvent, nt as MembershipSource, on as DecisionEvent, ot as RelationSource, pn as SinkEvent, pr as Principal, s as AssuranceRequirement, sr as CustomRole, st as SettingsSource, vn as Scope, xr as ConditionRef, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, r as Role } from "./vocabulary-DEJ5j4mR.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { o as PolicyDocument } from "./hosted-DVxlLZMe.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-B5zoUW_O.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
 type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
@@ -25,7 +25,10 @@ declare function claim(path: string): SubjectRef;
 //#endregion
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
-/** Why part of a custom role was left out: a permission, or an undeclared include. */
+/**
+ * Why part of a custom role was left out: a permission, or an undeclared
+ * include.
+ */
 type CustomRoleDrop = {
   readonly permission: string;
   readonly reason: CustomRoleDropReason;
@@ -44,10 +47,16 @@ type CustomRoleRename = {
   readonly to: string;
 };
 type ResolvedCustomRole = {
-  /** Declared grants re-targeted to the custom role; conditions and approvals kept. */
+  /**
+   * Declared grants re-targeted to the custom role; conditions and approvals
+   * kept.
+   */
   readonly grants: readonly Grant[];
   readonly dropped: readonly CustomRoleDrop[];
-  /** Grants stored under a former key (`definePermissions` `renamed`), resolved to the current one. */
+  /**
+   * Grants stored under a former key (`definePermissions` `renamed`), resolved
+   * to the current one.
+   */
   readonly renamed: readonly CustomRoleRename[];
 };
 type CustomRoleValidation = {
@@ -68,7 +77,10 @@ type CustomRoleValidation = {
  */
 declare function resolveCustomRole(policy: Policy, role: CustomRole): ResolvedCustomRole;
 type ValidateCustomRoleOptions = {
-  /** The shared custom roles: a tenant role with one of their names is dropped as `name-taken`. */
+  /**
+   * The shared custom roles: a tenant role with one of their names is dropped
+   * as `name-taken`.
+   */
   readonly shared?: readonly CustomRole[];
 };
 declare function validateCustomRole(policy: Policy, role: CustomRole, options?: ValidateCustomRoleOptions): CustomRoleValidation;
@@ -91,10 +103,10 @@ declare function parseCustomRoleEntry(policy: Policy, entry: string, options?: {
   readonly scope?: string;
 }): CustomRoleEntry;
 /**
- * The compact JWT form of custom roles for the `memberships[].grants` claim
- * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
- * denies and `@role` includes. Put a team custom role on its team membership.
- * Pass `policy` to write keys stored under a former name as the current key.
+ * The compact JWT form of custom roles for the `memberships[].grants` claim RLS
+ * reads in `jwt` mode: role name to entries, where `key` allows, `-key` denies
+ * and `@role` includes. Put a team custom role on its team membership. Pass
+ * `policy` to write keys stored under a former name as the current key.
  */
 declare function customRoleClaim(roles: readonly CustomRole[], policy?: Policy): Readonly<Record<string, readonly string[]>>;
 //#endregion
@@ -112,18 +124,21 @@ declare function emptySnapshot(): Snapshot;
 declare function requiresApproval(approval: Grant["approval"] | undefined): boolean;
 //#endregion
 //#region src/core/policy.d.ts
-declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
-/** The role names a policy declares: the keys of its `defineRoles` vocabulary, else `string`. */
+declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>, S>;
+/**
+ * The role names a policy declares: the keys of its `defineRoles` vocabulary,
+ * else `string`.
+ */
 type RoleNameOf<P> = P extends {
   readonly vocabulary: infer V;
 } ? V extends {
   readonly roles: infer R extends RoleTree;
 } ? R[keyof R]["key"] : string : string;
 /**
- * Whether `value` names a role the policy declares, for a role read as a
- * string from a database or a token. A name it rejects is an unknown role,
- * which grants nothing (`unknown-role`). A tenant's custom roles are not
- * declared; `CustomRoleSource` resolves them.
+ * Whether `value` names a role the policy declares, for a role read as a string
+ * from a database or a token. A name it rejects is an unknown role, which
+ * grants nothing (`unknown-role`). A tenant's custom roles are not declared;
+ * `CustomRoleSource` resolves them.
  */
 declare function isRoleName<P extends Policy<never>>(policy: P, value: unknown): value is RoleNameOf<P>;
 declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
@@ -158,18 +173,73 @@ declare function sqlFunction(name: string, options: {
 //#region src/core/memory-sources.d.ts
 declare function memoryEntitlementSource(entries: Readonly<Record<string, readonly string[]>>): EntitlementSource;
 declare function memorySettingsSource(settings: Readonly<Record<string, TenantSettings>>): SettingsSource;
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+/**
+ * Memberships keyed by principal id; `tenant` is not a filter, as for a
+ * database source.
+ */
 declare function memoryMembershipSource(entries: Readonly<Record<string, readonly Membership[]>>): MembershipSource;
 /** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
 declare function memorySnapshotSource(initial: Snapshot | string): SnapshotSource & {
-  set(snapshot: Snapshot | string): void;
+  set: (snapshot: Snapshot | string) => void;
 };
 declare function memoryCustomRoleSource(customRoles: readonly CustomRole[]): CustomRoleSource;
 //#endregion
 //#region src/core/approval-state.d.ts
-/** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
+/**
+ * The denial detail when an `ApprovalPolicySource` threw or returned an invalid
+ * entry.
+ */
 declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
 //#endregion
+//#region src/core/version-cache.d.ts
+type VersionCacheStats = {
+  /** Version reads the cache started. */
+  readonly reads: number;
+  /** Calls answered by a read already in flight. */
+  readonly shared: number;
+  /** Calls answered from an entry or a token claim, with no read. */
+  readonly hits: number;
+  readonly evictions: number;
+  readonly size: number;
+};
+/**
+ * Current authorization versions shared by every instance in a process:
+ * `claimsFirst(source, { versions })` reads through it.
+ */
+type VersionCache = {
+  readonly name?: string;
+  /** How old an entry may be when an instance with intent `read` uses it. */
+  readonly maxStaleMs: number;
+  /**
+   * The current version of `principal`. With `live: false`, an entry at most
+   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
+   * newer than the entry raises it; with `live: true`, `read` runs.
+   */
+  current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
+    readonly live: boolean;
+  }) => number | undefined | Promise<number | undefined>;
+  /** Drops `principal`'s entry, so the next instance reads the version. */
+  evict: (principal: string) => void;
+  stats: () => VersionCacheStats;
+};
+type MemoryVersionCacheOptions = {
+  /**
+   * How stale a read may be, in milliseconds: the entry lifetime and the
+   * longest a removed member keeps read access. Clamped to 0 to 60,000.
+   */
+  readonly maxStaleMs: number;
+  /** Principals kept; the least recently used goes first. Default 10,000. */
+  readonly maxEntries?: number;
+  /** The clock, read only when an instance asks for a version. */
+  readonly now?: () => Instant;
+};
+/**
+ * An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+ * resolved versions and shares reads in flight. Create it once at module
+ * scope.
+ */
+declare function memoryVersionCache(options: MemoryVersionCacheOptions): VersionCache;
+//#endregion
 //#region src/core/memberships.d.ts
 /**
  * One `MembershipSource` over several: memberships are merged and
@@ -179,23 +249,30 @@ declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
  */
 declare function composeMemberships(sources: readonly MembershipSource[]): MembershipSource;
 /**
- * Trust the memberships the verified token carries, and read `source` only
- * when the token marks them truncated. With `version`, a token minted before
- * the latest membership change is stale for the policy's `fresh` permissions,
- * or with `onStale: 'reread'` has its memberships read from `source` instead.
+ * Trust the memberships the verified token carries, and read `source` only when
+ * the token marks them truncated. With `version`, a token minted before the
+ * latest membership change is stale for the policy's `fresh` permissions, or
+ * with `onStale: 'reread'` has its memberships read from `source` instead. With
+ * `versions`, an instance with intent `read` takes the version from that
+ * process-wide cache, so concurrent instances share one read and a token issued
+ * within its `maxStaleMs` needs none; intent `write` always reads.
  */
 declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
   readonly version?: MembershipSource["version"];
   readonly onStale?: "deny" | "reread";
+  readonly versions?: VersionCache;
 }): MembershipSource;
-/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+/**
+ * Whether the identity provider owns `membership`: the application must not
+ * add, change or remove it.
+ */
 declare function isExternallyManaged(membership: Membership): boolean;
 /**
- * How many principals hold `role` in one scope instance now, from the
- * source's member list (`MembershipSource.list`): live memberships of exactly
- * that scope and instance, each principal counted once. The `holders` a
- * `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
- * when the source cannot list or the read fails, which that check denies.
+ * How many principals hold `role` in one scope instance now, from the source's
+ * member list (`MembershipSource.list`): live memberships of exactly that scope
+ * and instance, each principal counted once. The `holders` a `decideRoleChange`
+ * with `min`, `max` or `transferOnly` needs. `undefined` when the source cannot
+ * list or the read fails, which that check denies.
  */
 declare function countHolders(source: MembershipSource | readonly MembershipSource[], query: {
   readonly scope: string;
@@ -206,15 +283,18 @@ declare function countHolders(source: MembershipSource | readonly MembershipSour
 }): Promise<number | undefined>;
 //#endregion
 //#region src/core/stripe-entitlements.d.ts
-/** The part of the Stripe Node SDK this source calls: `stripe.entitlements.activeEntitlements.list`. */
+/**
+ * The part of the Stripe Node SDK this source calls:
+ * `stripe.entitlements.activeEntitlements.list`.
+ */
 type StripeEntitlementsClient = {
   readonly entitlements: {
     readonly activeEntitlements: {
-      list(params: {
+      list: (params: {
         readonly customer: string;
         readonly limit?: number;
         readonly starting_after?: string;
-      }): PromiseLike<{
+      }) => PromiseLike<{
         readonly data: readonly {
           readonly id: string;
           readonly lookup_key: string;
@@ -246,14 +326,17 @@ type MemoryEdge = {
   readonly expiresAt?: number;
 };
 type MemoryRelationSourceData = {
-  /** Rows per resource: parent pointers, links, restricted flags and relation columns are read from them. */
+  /**
+   * Rows per resource: parent pointers, links, restricted flags and relation
+   * columns are read from them.
+   */
   readonly rows?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
   /** Edge-table rows per resource and relation. */
   readonly edges?: Readonly<Record<string, Readonly<Record<string, readonly MemoryEdge[]>>>>;
   /**
-   * Edge tables as the database holds them, keyed by `edge` name: each row
-   * is read through the relation's `object`, `subject`, `expiresAt`, `match`
-   * and `groups` columns. A relation whose table is here ignores `edges`.
+   * Edge tables as the database holds them, keyed by `edge` name: each row is
+   * read through the relation's `object`, `subject`, `expiresAt`, `match` and
+   * `groups` columns. A relation whose table is here ignores `edges`.
    */
   readonly tables?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
 };
@@ -273,7 +356,10 @@ type HoldingVia = {
   readonly kind: "relation";
   readonly resource: string;
   readonly relation: string;
-  /** The instance the relation is held on: the object or one of its ancestors. */
+  /**
+   * The instance the relation is held on: the object or one of its
+   * ancestors.
+   */
   readonly id: string;
 } | {
   readonly kind: "share";
@@ -281,7 +367,10 @@ type HoldingVia = {
   readonly relation: string;
   readonly id: string;
   readonly expiresAt?: number;
-  /** The group the share names, when the principal holds it as one of its members. */
+  /**
+   * The group the share names, when the principal holds it as one of its
+   * members.
+   */
   readonly group?: RelationGroup;
 };
 type Holder = {
@@ -291,10 +380,10 @@ type Holder = {
   readonly via: readonly HoldingVia[];
 };
 /**
- * Who holds a permission on one object, for share dialogs and access
- * reviews. It lists and never grants. `complete: false` means some grantee
- * could not be enumerated (a global role, a plan, a source without `list`,
- * an unavailable relation): holders may be missing, so check with `decide`.
+ * Who holds a permission on one object, for share dialogs and access reviews.
+ * It lists and never grants. `complete: false` means some grantee could not be
+ * enumerated (a global role, a plan, a source without `list`, an unavailable
+ * relation): holders may be missing, so check with `decide`.
  */
 type WhoCan = {
   readonly permission: string;
@@ -302,11 +391,11 @@ type WhoCan = {
   readonly complete: boolean;
 };
 /**
- * Who holds `permission` on `resource` for the instance's policy and how
- * (role, relation or share), from `MembershipSource.list` and
- * `RelationSource.related`. It lists and never grants; `complete: false`
- * means some holders could not be listed. An instance built from a
- * snapshot answers an empty, incomplete list.
+ * Who holds `permission` on `resource` for the instance's policy and how (role,
+ * relation or share), from `MembershipSource.list` and
+ * `RelationSource.related`. It lists and never grants; `complete: false` means
+ * some holders could not be listed. An instance built from a snapshot answers
+ * an empty, incomplete list.
  */
 declare function whoCan(permdock: InstanceHandle, permission: Permission<string, unknown, "instance">, resource: unknown): Promise<WhoCan>;
 //#endregion
@@ -314,7 +403,10 @@ declare function whoCan(permdock: InstanceHandle, permission: Permission<string,
 type SignPolicyDocumentOptions = {
   /** `aud`: the environment URL `cloud().policies` checks it against. */
   readonly audience: string | readonly string[];
-  /** `exp`, a NumericDate; the signer's default (one hour after `iat`) when absent. */
+  /**
+   * `exp`, a NumericDate; the signer's default (one hour after `iat`) when
+   * absent.
+   */
   readonly expiresAt?: number;
 };
 /**
@@ -329,14 +421,20 @@ type SignSnapshotOptions = {
   /** `aud`; a signer with no default audience refuses to sign without one. */
   readonly audience?: string | readonly string[];
 };
-/** The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and `jti`. */
+/**
+ * The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and
+ * `jti`.
+ */
 type SnapshotClaims = {
   readonly snapshot: Omit<Snapshot, "issuedAt" | "expiresAt">;
   /** The principal's id; absent for an anonymous snapshot. */
   readonly sub?: string;
   /** `issuedAt` in NumericDate seconds; absent when it is not after the epoch. */
   readonly iat?: number;
-  /** `expiresAt` in NumericDate seconds; absent when the snapshot has none, and the signer then sets its default. */
+  /**
+   * `expiresAt` in NumericDate seconds; absent when the snapshot has none, and
+   * the signer then sets its default.
+   */
   readonly exp?: number;
 };
 /**
@@ -345,7 +443,10 @@ type SnapshotClaims = {
  * claims are the only times a verifier reads.
  */
 declare function snapshotClaims(snapshot: Snapshot): SnapshotClaims;
-/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
+/**
+ * Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims
+ * `snapshotClaims` answers.
+ */
 declare function signSnapshot(snapshot: Snapshot, signer: TokenSigner, options?: SignSnapshotOptions): Promise<string>;
 /**
  * The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
@@ -390,10 +491,9 @@ type ArazzoFinding = {
 };
 declare function arazzoFindings(input: ArazzoSimulateInput, tree: PermissionTree | undefined): readonly ArazzoFinding[];
 /**
- * Walks an Arazzo workflow against `permdock`: each step's operation is
- * decided as `permdock.simulate` would, and a server instance emits one
- * simulate event for the whole plan. Works on an instance built from a
- * snapshot too.
+ * Walks an Arazzo workflow against `permdock`: each step's operation is decided
+ * as `permdock.simulate` would, and a server instance emits one simulate event
+ * for the whole plan. Works on an instance built from a snapshot too.
  */
 declare function simulateArazzo(permdock: PermDock, input: ArazzoSimulateInput): ArazzoPlan;
 //#endregion
@@ -407,16 +507,17 @@ declare function localSnapshotManifest(policy: Policy): LocalSnapshotManifest;
 //#endregion
 //#region src/core/app.d.ts
 /**
- * How strict `defineApp` is about the services the policy needs. `dev`
- * fills in in-process defaults (a memory approval store and a memory limit
- * store) so a new app runs before any infrastructure exists. `prod` throws at startup when a grant needs a
- * service the app does not configure, instead of denying at run time.
+ * How strict `defineApp` is about the services the policy needs. `dev` fills in
+ * in-process defaults (a memory approval store and a memory limit store) so a
+ * new app runs before any infrastructure exists. `prod` throws at startup when
+ * a grant needs a service the app does not configure, instead of denying at run
+ * time.
  */
 type AppProfile = "dev" | "prod";
 /**
- * Everything an app wires once and every adapter reads: the data sources,
- * the opt-in features and the services. An adapter's own options win over
- * these, key by key.
+ * Everything an app wires once and every adapter reads: the data sources, the
+ * opt-in features and the services. An adapter's own options win over these,
+ * key by key.
  */
 type AppOptions = InstanceOptions & Pick<PermDockOptions, "settings"> & {
   /** Where approval requests open and resume, for every adapter. */
@@ -426,10 +527,10 @@ type AppOptions = InstanceOptions & Pick<PermDockOptions, "settings"> & {
 //#endregion
 //#region src/app/define-app.d.ts
 /**
- * Binds the app's sources, features and services to `policy`. The result
- * is a policy: pass it wherever a policy goes (`createPermDock`, every
- * adapter, the CLI) and each picks up the app definition, with its own
- * options taking precedence. The profile defaults to `prod`.
+ * Binds the app's sources, features and services to `policy`. The result is a
+ * policy: pass it wherever a policy goes (`createPermDock`, every adapter, the
+ * CLI) and each picks up the app definition, with its own options taking
+ * precedence. The profile defaults to `prod`.
  */
 declare function defineApp<TUser, TPrincipal extends Principal, V extends PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options?: AppOptions): Policy<TUser, TPrincipal, V>;
 //#endregion
@@ -453,20 +554,20 @@ type ShadowMismatch = {
 type ShadowOptions = {
   readonly legacy: LegacyCheck;
   /**
-   * Permissions PermDock decides; every other check returns the legacy
-   * answer. `"all"` once every mismatch is resolved; default none.
+   * Permissions PermDock decides; every other check returns the legacy answer.
+   * `"all"` once every mismatch is resolved; default none.
    */
   readonly enforce?: readonly Permission[] | "all";
   /** Called for each disagreement; a throw here is ignored. */
   readonly onMismatch?: (mismatch: ShadowMismatch) => void;
 };
 /**
- * Runs PermDock beside the application's existing checks while adopting
- * it. Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both;
- * the legacy answer is returned unless the permission is in `enforce`, and
- * every disagreement reaches `onMismatch`. Promote permissions one by one
- * as their mismatches are resolved, then remove the wrap. Pass it as an
- * adapter's `wrap` option, or call it on a core instance.
+ * Runs PermDock beside the application's existing checks while adopting it.
+ * Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both; the
+ * legacy answer is returned unless the permission is in `enforce`, and every
+ * disagreement reaches `onMismatch`. Promote permissions one by one as their
+ * mismatches are resolved, then remove the wrap. Pass it as an adapter's `wrap`
+ * option, or call it on a core instance.
  */
 declare function shadowMode(options: ShadowOptions): PermDockWrap;
 //#endregion
@@ -483,28 +584,41 @@ declare function mayAccess(policy: Policy, user: unknown, permission: Permission
 }): boolean;
 //#endregion
 //#region src/core/custom-role-source.d.ts
-/** Reads custom roles from the application's store, as `customRoleSource` takes them. */
+/**
+ * Reads custom roles from the application's store, as `customRoleSource` takes
+ * them.
+ */
 type CustomRoleReader = {
-  /** Every custom role of `tenant`, whether or not anyone in the request holds it. */
-  rolesFor(tenant: string): CustomRole[] | Promise<CustomRole[]>;
-  assignable?(tenant: string): string[] | Promise<string[]>;
+  /**
+   * Every custom role of `tenant`, whether or not anyone in the request holds
+   * it.
+   */
+  rolesFor: (tenant: string) => CustomRole[] | Promise<CustomRole[]>;
+  assignable?: (tenant: string) => string[] | Promise<string[]>;
   /** Platform custom roles (`scope: 'global'`). */
-  globalRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  globalRoles?: () => CustomRole[] | Promise<CustomRole[]>;
   /** Shared custom roles (`shared: true`), the same for every tenant. */
-  sharedRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  sharedRoles?: () => CustomRole[] | Promise<CustomRole[]>;
 };
 type CustomRoleSourceOptions = {
-  /** `'all'` (default): read every custom role of each tenant, so `assignableRoles` and `decideRoleChange` see them all. */
+  /**
+   * `'all'` (default): read every custom role of each tenant, so
+   * `assignableRoles` and `decideRoleChange` see them all.
+   */
   readonly read?: "all";
 } | {
-  /** `'held'`: skip a tenant's read, and the platform read, when every role the subject holds there is declared in `policy`. For requests that never manage roles. */
+  /**
+   * `'held'`: skip a tenant's read, and the platform read, when every role
+   * the subject holds there is declared in `policy`. For requests that
+   * never manage roles.
+   */
   readonly read: "held";
   readonly policy: Policy;
 };
 /**
- * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
- * It keeps only the roles of the requested tenant. With `read: 'held'` it
- * skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+ * A `CustomRoleSource` over a reader that returns every custom role of a
+ * tenant. It keeps only the roles of the requested tenant. With `read: 'held'`
+ * it skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
  * subject holds only declared roles there.
  */
 declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): CustomRoleSource;
@@ -522,7 +636,10 @@ type SnapshotForOptions = {
   readonly memberships?: readonly Membership[];
   /** The tenant's custom roles, typically from a shared, tagged cache. */
   readonly customRoles?: readonly CustomRole[];
-  /** Per tenant, the role names `CustomRoleSource.assignable` returns; narrows `assignable`. */
+  /**
+   * Per tenant, the role names `CustomRoleSource.assignable` returns; narrows
+   * `assignable`.
+   */
   readonly assignable?: Readonly<Record<string, readonly string[]>>;
   /** Plans of the active tenant; replaces `principal.plans`. */
   readonly plans?: readonly string[];
@@ -532,10 +649,10 @@ type SnapshotForOptions = {
   readonly now?: Instant;
 };
 /**
- * Builds the serializable access snapshot for a subject without a request,
- * a network call or a cache directive: call it inside the app's own
- * `'use cache: private'` function. Synchronous; the policy's `subject` and
- * `context` mappers must be synchronous too.
+ * Builds the serializable access snapshot for a subject without a request, a
+ * network call or a cache directive: call it inside the app's own `'use cache:
+ * private'` function. Synchronous; the policy's `subject` and `context` mappers
+ * must be synchronous too.
  */
 declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
 //#endregion
@@ -548,8 +665,12 @@ declare function definePermissions<const Input, PX = never, RX = never>(input: I
  * renames and for one that crossed a serialisation boundary.
  */
 declare function formerKeys(permission: object): readonly string[];
-declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly []>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C>): ResourceInit<T, A, C>;
-declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly []>(options: ResourceOptions<A, C>): ResourceInit<unknown, A, C>;
+declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly [], const N extends string = never>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C> & {
+  readonly name?: N;
+}): ResourceInit<T, A, C, N>;
+declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly [], const N extends string = never>(options: ResourceOptions<A, C> & {
+  readonly name?: N;
+}): ResourceInit<unknown, A, C, N>;
 //#endregion
 //#region src/core/presets.d.ts
 type ReadOnlyMeta = {
@@ -612,7 +733,10 @@ declare function writable<const A extends ActionList | undefined = undefined, co
 //#endregion
 //#region src/core/role-builder.d.ts
 type RoleGrants = readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[])[];
-/** A role held at a named scope: `on` is checked against `definePolicy({ scopes })`. */
+/**
+ * A role held at a named scope: `on` is checked against `definePolicy({ scopes
+ * })`.
+ */
 declare function role<const S extends string>(name: string | Role, grants: RoleGrants, options: RoleOptions<S> & {
   readonly on: S;
 }): RoleBinding<S>;
@@ -625,13 +749,16 @@ declare function normalizeAssurance(input: AssuranceRequirement | undefined): As
 //#region src/core/grant-builders.d.ts
 declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 /**
- * Every action of a resource (`permissions.post`), of several, or of the
- * whole tree, unconditionally. Each grant is listed in the policy as if
- * written out, and an action added to the resource later is granted too.
+ * Every action of a resource (`permissions.post`), of several, or of the whole
+ * tree, unconditionally. Each grant is listed in the policy as if written out,
+ * and an action added to the resource later is granted too.
  */
 declare function allow(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
-/** Every action of a resource, of several, or of the whole tree, unconditionally. */
+/**
+ * Every action of a resource, of several, or of the whole tree,
+ * unconditionally.
+ */
 declare function deny(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 //#endregion
 //#region src/core/approval-normalize.d.ts
@@ -657,7 +784,10 @@ declare function supportAccess<const S extends string>(options: SupportAccessOpt
 declare function supportAccess(options: SupportAccessOptions<never>): RoleBinding<"tenant">;
 type ActivateInput = {
   readonly role: string | Role;
-  /** The scope the activation applies in (a declared name or the `tenant` / `team` alias). */
+  /**
+   * The scope the activation applies in (a declared name or the `tenant` /
+   * `team` alias).
+   */
   readonly scope: string;
   readonly id: string;
   /** Ancestor scope ids, keyed by scope name, for a nested-scope activation. */
@@ -667,30 +797,32 @@ type ActivateInput = {
   readonly reason?: string;
 };
 /**
- * Requests a just-in-time role activation. It never writes: a granted
- * decision carries the elevated membership under `elevation` for the app to
- * write. `approval-required` comes back first when the role's `activation`
- * sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
- * missing justification or stale authentication all deny.
+ * Requests a just-in-time role activation. It never writes: a granted decision
+ * carries the elevated membership under `elevation` for the app to write.
+ * `approval-required` comes back first when the role's `activation` sets
+ * `approval`. Fail-closed: an unknown role, an ineligible subject, a missing
+ * justification or stale authentication all deny.
  */
 /**
  * Requests a just-in-time activation of an eligible role for the subject of
  * `permdock`. It never writes: a granted decision carries the elevated
- * membership under `elevation` for the app to write, and
- * `approval-required` comes back first when the role's `activation` sets
- * `approval`. An instance built from a snapshot denies with `unsupported`.
+ * membership under `elevation` for the app to write, and `approval-required`
+ * comes back first when the role's `activation` sets `approval`. An instance
+ * built from a snapshot denies with `unsupported`.
  */
 declare function activate(permdock: InstanceHandle, input: ActivateInput): Decision;
 //#endregion
 //#region src/core/scope-helpers.d.ts
 /**
- * The canonical form PermDock evaluates one membership in, or `undefined`
- * when it is malformed and grants nothing. `scopes` is the policy's or the
- * catalog's scope list; absent or empty means the implicit `tenant` and
- * `team` pair.
+ * The canonical form PermDock evaluates one membership in, or `undefined` when
+ * it is malformed and grants nothing. `scopes` is the policy's or the catalog's
+ * scope list; absent or empty means the implicit `tenant` and `team` pair.
  */
 declare function normalizeMembership(input: unknown, scopes?: readonly Scope[]): Membership | undefined;
-/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+/**
+ * Every well-formed membership of `input` in canonical form; malformed entries
+ * are dropped.
+ */
 declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[]): readonly Membership[];
 /**
  * The declared scope `name` stands for: the name itself, or the scope the
@@ -699,14 +831,23 @@ declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[])
 declare function resolveScope(scopes: readonly Scope[] | undefined, name: unknown): string | undefined;
 //#endregion
 //#region src/core/ownership.d.ts
-/** Who a role change is about: their principal id and their membership in the scope instance. */
+/**
+ * Who a role change is about: their principal id and their membership in the
+ * scope instance.
+ */
 type RoleChangeTarget = {
   readonly id: string;
-  /** The kind of the target's membership in the instance (`staff`, `contact`, ...). */
+  /**
+   * The kind of the target's membership in the instance (`staff`, `contact`,
+   * ...).
+   */
   readonly via?: string;
   /** The roles the target holds in the instance now. */
   readonly roles?: readonly string[];
-  /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
+  /**
+   * `idp` when the identity provider owns the target's membership: the
+   * application cannot change it.
+   */
   readonly managedBy?: "idp";
 };
 type RoleChangeBase = {
@@ -716,16 +857,15 @@ type RoleChangeBase = {
   readonly within?: Readonly<Record<string, string>>;
   readonly target: RoleChangeTarget;
   /**
-   * How many principals hold `role` in the instance now, from the
-   * application's store. Without it a role with `min`, `max` or
-   * `transferOnly` is denied.
+   * How many principals hold `role` in the instance now, from the application's
+   * store. Without it a role with `min`, `max` or `transferOnly` is denied.
    */
   readonly holders?: number;
 };
 /**
  * A role held at a named scope instance (`scope` is a declared name or alias
- * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
- * A global change has no tenant, so `within` and `holders` do not apply to it.
+ * and `id` the instance), or a global role: `scope: 'global'` with no `id`. A
+ * global change has no tenant, so `within` and `holders` do not apply to it.
  */
 type RoleChange = RoleChangeBase & ({
   /** The scope the role is held at (a declared name or alias). */
@@ -750,7 +890,10 @@ type RoleChangeDecision = {
   readonly change: RoleChange;
   readonly denials: readonly Denial[];
 };
-/** The holder-count, membership-kind, exclusivity and `assigns` rules of one role, as the catalog lists them (`CatalogRole`). */
+/**
+ * The holder-count, membership-kind, exclusivity and `assigns` rules of one
+ * role, as the catalog lists them (`CatalogRole`).
+ */
 type RoleRules = {
   readonly key: string;
   readonly min?: number;
@@ -765,14 +908,26 @@ type RoleChangeCheckInput = {
     readonly kind: "assign" | "revoke" | "transfer";
     readonly target: Pick<RoleChangeTarget, "via" | "roles">;
   };
-  /** How many principals hold the role in the instance now; without it a role with `min`, `max` or `transferOnly` is denied. */
+  /**
+   * How many principals hold the role in the instance now; without it a role
+   * with `min`, `max` or `transferOnly` is denied.
+   */
   readonly holders?: number;
-  /** Every declared role: adds the `exclusiveWith` other roles declare against this one, and with `actorRoles` the `assigns` rule. */
+  /**
+   * Every declared role: adds the `exclusiveWith` other roles declare against
+   * this one, and with `actorRoles` the `assigns` rule.
+   */
   readonly roles?: readonly RoleRules[];
-  /** The roles the actor holds at the instance, highest rank first. With `roles` naming any `assigns`, one of them must assign this role. */
+  /**
+   * The roles the actor holds at the instance, highest rank first. With `roles`
+   * naming any `assigns`, one of them must assign this role.
+   */
   readonly actorRoles?: readonly string[];
 };
-/** `by` names the actor role whose `assigns` allowed the change, `null` when the rule did not apply. */
+/**
+ * `by` names the actor role whose `assigns` allowed the change, `null` when the
+ * rule did not apply.
+ */
 type RoleChangeCheck = {
   readonly ok: true;
   readonly by: string | null;
@@ -782,18 +937,18 @@ type RoleChangeCheck = {
 };
 /**
  * The rules of a role change that need no subject: `assigns`, `for`,
- * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
- * the target's roles alone. `decideRoleChange` runs the same function after
- * its actor, tenant and ceiling checks; a service that holds only the
- * catalog calls it with the `CatalogRole` entries.
+ * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and the
+ * target's roles alone. `decideRoleChange` runs the same function after its
+ * actor, tenant and ceiling checks; a service that holds only the catalog calls
+ * it with the `CatalogRole` entries.
  */
 declare function checkRoleChange(role: RoleRules, input: RoleChangeCheckInput): RoleChangeCheck;
 type RoleChangeOptions = {
   /**
-   * `true` when the application loaded `change.within` from its own store
-   * (the instance's stored parent), not from the request. Without it, a
-   * nested instance's tenant comes only from a live membership the actor
-   * holds on that instance or under it.
+   * `true` when the application loaded `change.within` from its own store (the
+   * instance's stored parent), not from the request. Without it, a nested
+   * instance's tenant comes only from a live membership the actor holds on that
+   * instance or under it.
    */
   readonly trusted?: boolean;
 };
@@ -802,12 +957,12 @@ type RoleChangeOptions = {
  * the instance's own principal; nothing in `change` can stand in for it.
  */
 /**
- * Whether the subject of `permdock` may assign, revoke or transfer a role
- * in one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`,
- * `min`, `max` and `transferOnly`. It never writes; the application does,
- * and generated RLS triggers re-check the holder counts at commit. A nested
- * instance's tenant comes from a live membership the subject holds on it,
- * or from `change.within` only with `{ trusted: true }`; otherwise
+ * Whether the subject of `permdock` may assign, revoke or transfer a role in
+ * one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`,
+ * `max` and `transferOnly`. It never writes; the application does, and
+ * generated RLS triggers re-check the holder counts at commit. A nested
+ * instance's tenant comes from a live membership the subject holds on it, or
+ * from `change.within` only with `{ trusted: true }`; otherwise
  * `no-membership`. An instance built from a snapshot denies with
  * `unsupported`.
  */
@@ -815,17 +970,20 @@ declare function decideRoleChange(permdock: InstanceHandle, change: RoleChange,
 //#endregion
 //#region src/core/parse-sink-events.d.ts
 /**
- * Validates one untrusted sink event against its family's schema and returns
- * a frozen copy, or `null` for anything else. Never throws.
+ * Validates one untrusted sink event against its family's schema and returns a
+ * frozen copy, or `null` for anything else. Never throws.
  */
 declare function parseSinkEvent(value: unknown): SinkEvent | null;
 /**
  * Validates an untrusted list of sink events, such as a request body a sink
- * receiver read. Each event that fails its schema is dropped, and a value
- * that is not an array yields no events. Never throws.
+ * receiver read. Each event that fails its schema is dropped, and a value that
+ * is not an array yields no events. Never throws.
  */
 declare function parseSinkEvents(value: unknown): readonly SinkEvent[];
-/** Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it does not match. */
+/**
+ * Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it
+ * does not match.
+ */
 declare function parseCatalogEventData(value: unknown): CatalogEventData | null;
 /**
  * Validates one CloudEvent against the closed type list, its `dataschema` and
@@ -840,7 +998,10 @@ declare function parseCloudEvent(value: unknown): CloudEvent | null;
 declare function parseCloudEventBatch(value: unknown): readonly CloudEvent[] | null;
 //#endregion
 //#region src/core/event-schemas.d.ts
-/** The URL each event family's schema is published at, and its CloudEvents `dataschema`. */
+/**
+ * The URL each event family's schema is published at, and its CloudEvents
+ * `dataschema`.
+ */
 declare const EVENT_SCHEMA_IDS: {
   readonly decision: "https://permdock.com/schemas/decision-event-v1.json";
   readonly directory: "https://permdock.com/schemas/directory-event-v1.json";
@@ -874,9 +1035,9 @@ declare const SINK_EVENT_SCHEMAS: {
 /** The OCSF schema version `toOcsf` emits. */
 declare const OCSF_VERSION = "1.9.0";
 /**
- * An OCSF Authorize Session (class 3003, category Identity and Access Management) event.
- * API Activity (6003) would fit a per-request decision, but it requires `api` and
- * `src_endpoint`, which a decision event does not carry.
+ * An OCSF Authorize Session (class 3003, category Identity and Access
+ * Management) event. API Activity (6003) would fit a per-request decision, but
+ * it requires `api` and `src_endpoint`, which a decision event does not carry.
  */
 type OcsfAuthorizeSession = {
   readonly class_uid: 3003;
@@ -934,15 +1095,16 @@ type OcsfAuthorizeSession = {
   };
 };
 /**
- * Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged.
- * An event whose `at` does not parse has no OCSF `time` and projects to `undefined`.
+ * Projects a decision or approval event onto OCSF Authorize Session; the event
+ * itself is unchanged. An event whose `at` does not parse has no OCSF `time`
+ * and projects to `undefined`.
  */
 declare function toOcsf(event: DecisionEvent): OcsfAuthorizeSession | undefined;
 /**
  * An OCSF User Management (class 3007) event for a support-access lifecycle
  * event: `started` enables the session, `ended` and `revoked` disable it.
- * Support access is high severity, so a SIEM can alert on vendor access.
- * OCSF 1.9.0 deprecates Account Change (3001) in favour of this class.
+ * Support access is high severity, so a SIEM can alert on vendor access. OCSF
+ * 1.9.0 deprecates Account Change (3001) in favour of this class.
  */
 type OcsfUserManagement = {
   readonly class_uid: 3007;
@@ -987,16 +1149,17 @@ declare function accessToOcsf(event: AccessEvent): OcsfUserManagement | undefine
 /** The CSV export columns, in order; the header row of every CSV file. */
 declare const CSV_COLUMNS: readonly ["time", "principal", "actor", "tenant", "permission", "outcome", "matched.role", "via", "denials.reason", "token"];
 /**
- * One RFC 4180 row for a decision or approval event, without a line
- * terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+ * One RFC 4180 row for a decision or approval event, without a line terminator;
+ * join rows with CRLF under a `CSV_COLUMNS` header.
  */
 declare function toCsvRow(event: DecisionEvent): string;
 //#endregion
 //#region src/core/catalog-fingerprint.d.ts
 /**
- * The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON without `generatedAt`, `generator`, `fingerprint`
- * and every `permissions[].usages`, so neither the CLI version, the clock nor
- * call sites change it.
+ * The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON
+ * without `generatedAt`, `generator`, `fingerprint` and every
+ * `permissions[].usages`, so neither the CLI version, the clock nor call sites
+ * change it.
  */
 declare function catalogFingerprint(catalog: unknown): string;
 //#endregion
@@ -1012,8 +1175,8 @@ declare function canonicalJson(value: unknown): string;
 //#endregion
 //#region src/core/sha256.d.ts
 /**
- * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
- * of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+ * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256 of
+ * `text`. An RFC 9651 sf-token, so it fits a structured header as is.
  */
 declare function sha256Digest(text: string): string;
 //#endregion
@@ -1021,18 +1184,18 @@ declare function sha256Digest(text: string): string;
 type DelegatedPermission = Pick<Permission, "scope" | "resource" | "action">;
 /**
  * Whether a delegated caller may use a permission its principal holds, through
- * OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
- * `undefined` means covered; otherwise the denial reason `decide` would add.
+ * OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`. `undefined`
+ * means covered; otherwise the denial reason `decide` would add.
  */
 declare function coveredByDelegation(permission: DelegatedPermission, delegation: Delegation | undefined, resourceId?: string, hasActor?: boolean): DenialReason | undefined;
 /**
  * The permission keys the policy's delegations let `subject.actor` use for
  * `subject.principal` right now: the union over every active delegation whose
- * `to` matches the actor and whose `from` the principal holds. `undefined`
- * when none applies, so the call falls back to the token delegation alone.
- * An actor with `readOnly: true` gets only each delegation's read-only keys.
- * Attenuation only: a key here still needs a matching allow and no deny.
+ * `to` matches the actor and whose `from` the principal holds. `undefined` when
+ * none applies, so the call falls back to the token delegation alone. An actor
+ * with `readOnly: true` gets only each delegation's read-only keys. Attenuation
+ * only: a key here still needs a matching allow and no deny.
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { resource as $, listPermissions as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryMembershipSource as Gt, breakGlass as H, APPROVAL_POLICY_UNAVAILABLE as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, sqlFunction as Jt, deny as K, memorySettingsSource as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, isPermission as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, principal as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, snapshotClaims as Tt, supportAccess as U, memoryCustomRoleSource as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, memoryEntitlementSource as Wt, readable as X, findPermission as Xt, crud as Y, opaque as Yt, writable as Z, getResource as Zt, DECISION_EVENT_SCHEMA as _, parseCustomRoleEntry as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, requiresApproval as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, claim as bn, simulateArazzo as bt, OCSF_VERSION as c, parseSnapshot as cn, ShadowMismatch as ct, accessToOcsf as d, CustomRoleEntry as dn, defineApp as dt, mergePermissions as en, definePermissions as et, toOcsf as f, CustomRoleRename as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, customRoleClaim as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, ValidateCustomRoleOptions as hn, ArazzoFinding as ht, canonicalJson as i, separationConflicts as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, CustomRoleDrop as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, ResolvedCustomRole as mn, localSnapshotManifest as mt, delegatedPermissions as n, definePolicy as nn, snapshotFor as nt, CSV_COLUMNS as o, emptySnapshot as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleValidation as pn, AppProfile as pt, normalizeAssurance as q, memorySnapshotSource as qt, sha256Digest as r, isRoleName as rn, CustomRoleReader as rt, toCsvRow as s, fromSnapshot as sn, LegacyCheck as st, coveredByDelegation as t, RoleNameOf as tn, SnapshotForOptions as tt, OcsfUserManagement as u, CustomRoleDropReason as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, resolveCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, context as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, validateCustomRole as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };
+export { resource as $, opaque as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, validateCustomRole as Cn, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, principal as En, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryVersionCache as Gt, breakGlass as H, MemoryVersionCacheOptions as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, memoryEntitlementSource as Jt, deny as K, APPROVAL_POLICY_UNAVAILABLE as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, sqlFunction as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, resolveCustomRole as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, context as Tn, snapshotClaims as Tt, supportAccess as U, VersionCache as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, VersionCacheStats as Wt, readable as X, memorySettingsSource as Xt, crud as Y, memoryMembershipSource as Yt, writable as Z, memorySnapshotSource as Zt, DECISION_EVENT_SCHEMA as _, CustomRoleValidation as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, RoleNameOf as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, customRoleClaim as bn, simulateArazzo as bt, OCSF_VERSION as c, separationConflicts as cn, ShadowMismatch as ct, accessToOcsf as d, fromSnapshot as dn, defineApp as dt, findPermission as en, definePermissions as et, toOcsf as f, parseSnapshot as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, CustomRoleRename as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, CustomRoleEntry as hn, ArazzoFinding as ht, canonicalJson as i, mergePermissions as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, requiresApproval as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, CustomRoleDropReason as mn, localSnapshotManifest as mt, delegatedPermissions as n, isPermission as nn, snapshotFor as nt, CSV_COLUMNS as o, definePolicy as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleDrop as pn, AppProfile as pt, normalizeAssurance as q, memoryCustomRoleSource as qt, sha256Digest as r, listPermissions as rn, CustomRoleReader as rt, toCsvRow as s, isRoleName as sn, LegacyCheck as st, coveredByDelegation as t, getResource as tn, SnapshotForOptions as tt, OcsfUserManagement as u, emptySnapshot as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, ResolvedCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, claim as wn, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, parseCustomRoleEntry as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, ValidateCustomRoleOptions as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };