permdock 0.7.0 → 0.9.0

package/dist/{policy-types-B-F-qAZk.d.ts → policy-types-DGIO_gxq.d.ts}

@@ -1,5 +1,5 @@
-import { A as MetaValue, O as AppData, b as ResourceNode, d as PermissionKind, f as PermissionTree, k as AppDataSchema, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-Bg3eeT2H.js";
+import { M as AppData, N as AppDataSchema, P as MetaValue, b as ResourceNode, d as PermissionKind, f as PermissionTree, k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-DEJ5j4mR.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -64,27 +64,34 @@ type RelatedCondition = {
   readonly op: "related";
   readonly resource: string;
   readonly relation: string;
-  /** The row's own id field, or (with `parent` or `hops`) the field holding the next instance's id. */
+  /**
+   * The row's own id field, or (with `parent` or `hops`) the field holding the
+   * next instance's id.
+   */
   readonly field: string;
-  /** Parent hops walked above the first `resource` instance; `0` reads only that instance. */
+  /**
+   * Parent hops walked above the first `resource` instance; `0` reads only that
+   * instance.
+   */
   readonly depth: number;
   /** The row is a child of `resource`, reached through `field`. */
   readonly parent?: true;
   /**
-   * To-one links from the row to `resource`: `field` points at the first
-   * hop's resource, each later hop follows `link` on the resource before it,
-   * and the last hop's resource is `resource`.
+   * To-one links from the row to `resource`: `field` points at the first hop's
+   * resource, each later hop follows `link` on the resource before it, and the
+   * last hop's resource is `resource`.
    */
   readonly hops?: readonly RelatedHop[];
   /**
-   * The `resource` instances the subject holds a resource role on; replaces
-   * the `relation` lookup (`relation` is then empty).
+   * The `resource` instances the subject holds a resource role on; replaces the
+   * `relation` lookup (`relation` is then empty).
    */
   readonly ids?: readonly string[];
   readonly permission?: string;
   /**
    * The row's boolean column that keeps ancestor grants out: with `parent` or
-   * `hops`, a restricted row matches nothing; without, the walk stops at the row.
+   * `hops`, a restricted row matches nothing; without, the walk stops at the
+   * row.
    */
   readonly restricted?: string;
   readonly restrictedAncestors?: RestrictedAncestors;
@@ -117,10 +124,10 @@ type SqlFunctionCondition = {
   readonly twin: Condition;
 };
 /**
- * The request's session was checked against the Auth server while the
- * subject was resolved (`liveSession: true`), not only verified from the
- * token: a revoked session still verifies until `exp`. Written
- * `{ subject: { session: { live: true } } }`.
+ * The request's session was checked against the Auth server while the subject
+ * was resolved (`liveSession: true`), not only verified from the token: a
+ * revoked session still verifies until `exp`. Written `{ subject: { session: {
+ * live: true } } }`.
  */
 type LiveSessionCondition = {
   readonly op: "liveSession";
@@ -145,14 +152,18 @@ type FieldOperator = {
   readonly notIn?: unknown;
   readonly isNull?: boolean;
 };
-type WhereShorthand<T = Record<string, unknown>> = {
+type WhereShorthand<T = Record<string, unknown>> = unknown extends T ? RowWhere<Record<string, unknown>> : RowWhere<T>;
+type RowWhere<T> = {
   readonly and?: readonly WhereShorthand<T>[];
   readonly or?: readonly WhereShorthand<T>[];
   readonly not?: WhereShorthand<T>;
 } & ("subject" extends keyof T ? { readonly [K in keyof T as Exclude<K, "subject">]?: FieldWhere<T[K]>; } & {
   readonly subject?: SubjectWhere | FieldWhere<T["subject"]>;
 } : { readonly [K in keyof T]?: FieldWhere<T[K]>; } & {
-  /** Holds only when the resolver checked the session live (`liveSession: true`). */
+  /**
+   * Holds only when the resolver checked the session live (`liveSession:
+   * true`).
+   */
   readonly subject?: SubjectWhere;
 });
 type SubjectWhere = {
@@ -173,11 +184,20 @@ type FieldWhere<V> = V | FieldOperator | {
  * credential kinds, delivery channels) stays closed.
  */
 type OpenUnion<T extends string> = T | (string & NonNullable<unknown>);
-/** `actor.kind`: the values PermDock's adapters set, or an integrator's own; a policy delegation matches it by equality. */
+/**
+ * `actor.kind`: the values PermDock's adapters set, or an integrator's own; a
+ * policy delegation matches it by equality.
+ */
 type ActorKind = OpenUnion<"mcp-client" | "oauth-client" | "support" | "impersonation" | "ai-sdk" | "claude-agent" | "openai-agent" | "eve" | "terminal" | "web-bot-auth" | "a2a-agent" | "automation" | "job" | "caller" | "workload">;
-/** The adapter a decision event names: a PermDock entry, or an integrator's own adapter. */
+/**
+ * The adapter a decision event names: a PermDock entry, or an integrator's own
+ * adapter.
+ */
 type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
-/** How a membership was obtained (`membership.via`); `viaOnly` and support rules match it by equality. */
+/**
+ * How a membership was obtained (`membership.via`); `viaOnly` and support rules
+ * match it by equality.
+ */
 type MembershipVia = OpenUnion<"direct" | "contact" | "credential" | "elevated" | "feed" | "link" | "share" | "support" | "support-session" | "scim">;
 //#endregion
 //#region src/core/subject.d.ts
@@ -210,8 +230,8 @@ type Assurance = {
 /**
  * Roles held in one scope instance (`scope` + `id`, with the id of every
  * ancestor scope in `within`) or on one resource (`on`). Evaluation only sees
- * the canonical form; `tenant` / `team` are accepted as input for the first
- * and second declared scope and normalised away.
+ * the canonical form; `tenant` / `team` are accepted as input for the first and
+ * second declared scope and normalised away.
  */
 type Membership = {
   readonly scope?: string;
@@ -222,26 +242,44 @@ type Membership = {
     readonly id: string;
   };
   readonly roles: readonly string[];
-  /** Roles the holder may activate here but does not hold; `permdock.activate` writes an elevated membership. */
+  /**
+   * Roles the holder may activate here but does not hold; `permdock.activate`
+   * writes an elevated membership.
+   */
   readonly eligible?: readonly string[];
   readonly via?: MembershipVia;
   readonly expiresAt?: number;
-  /** The principal id that wrote this membership: who elevated, consented to or granted the access. */
+  /**
+   * The principal id that wrote this membership: who elevated, consented to or
+   * granted the access.
+   */
   readonly grantedBy?: string;
-  /** Free text recording why the membership was written: the activation or consent justification. */
+  /**
+   * Free text recording why the membership was written: the activation or
+   * consent justification.
+   */
   readonly reason?: string;
-  /** A subgroup the holder belongs to inside the instance (`vendor-support`); a `junctionMembershipSource` group column fills it. */
+  /**
+   * A subgroup the holder belongs to inside the instance (`vendor-support`); a
+   * `junctionMembershipSource` group column fills it.
+   */
   readonly member?: {
     readonly group: string;
   };
-  /** `idp`: the identity provider (SCIM) owns this membership; the application must not edit it. */
+  /**
+   * `idp`: the identity provider (SCIM) owns this membership; the application
+   * must not edit it.
+   */
   readonly managedBy?: "idp";
-  /** Seats this membership holds (`dev-mode`, `editor`); `plan()` grantees match them inside the active tenant. */
+  /**
+   * Seats this membership holds (`dev-mode`, `editor`); `plan()` grantees match
+   * them inside the active tenant.
+   */
   readonly entitlements?: readonly string[];
   /**
-   * Set when the instance or an ancestor instance is suspended: the
-   * permission keys the membership still grants (`suspension.scopes.<scope>.keep`).
-   * Every other grant, allow or deny, ignores it, and so do role listings.
+   * Set when the instance or an ancestor instance is suspended: the permission
+   * keys the membership still grants (`suspension.scopes.<scope>.keep`). Every
+   * other grant, allow or deny, ignores it, and so do role listings.
    */
   readonly keep?: readonly string[];
   /**
@@ -257,13 +295,16 @@ type Membership = {
   readonly team?: string;
 };
 /**
- * One permission a custom role adds or removes. It names a declared
- * permission key and carries no condition, approval or limit of its own.
+ * One permission a custom role adds or removes. It names a declared permission
+ * key and carries no condition, approval or limit of its own.
  */
 type CustomRoleGrant = {
   readonly permission: string;
   readonly effect?: "allow" | "deny";
-  /** A level the permission's resource declares (`resource(…, { levels })`); allows only. */
+  /**
+   * A level the permission's resource declares (`resource(…, { levels })`);
+   * allows only.
+   */
   readonly level?: string;
 };
 type CustomRoleBody = {
@@ -271,9 +312,9 @@ type CustomRoleBody = {
   readonly includes?: readonly string[];
   readonly grants?: readonly CustomRoleGrant[];
   /**
-   * Display text and app data, carried onto the role leaf
-   * `assignableRoles()` returns. `x` is checked by the role tree's
-   * `defineRoles(…, { x })` schema; an invalid `x` is dropped, not the role.
+   * Display text and app data, carried onto the role leaf `assignableRoles()`
+   * returns. `x` is checked by the role tree's `defineRoles(…, { x })` schema;
+   * an invalid `x` is dropped, not the role.
    */
   readonly meta?: RoleMeta;
 };
@@ -281,7 +322,10 @@ type CustomRoleBody = {
 type TenantCustomRole = CustomRoleBody & {
   /** The instance of the first scope that owns the role. */
   readonly tenant: string;
-  /** The scope the role is held at; defaults to the first scope. Its ceiling is that scope's assignable roles. */
+  /**
+   * The scope the role is held at; defaults to the first scope. Its ceiling is
+   * that scope's assignable roles.
+   */
   readonly scope?: string;
   /** Pins the role to one instance of `scope`. */
   readonly id?: string;
@@ -302,14 +346,17 @@ type GlobalCustomRole = CustomRoleBody & {
   readonly shared?: undefined;
 };
 /**
- * A role the platform defines once for every tenant, held on memberships of
- * its scope in any tenant. Tenant admins assign it but never edit it. Its
- * ceiling is the assignable declared roles of its scope; its name wins over
- * a tenant custom role of the same name.
+ * A role the platform defines once for every tenant, held on memberships of its
+ * scope in any tenant. Tenant admins assign it but never edit it. Its ceiling
+ * is the assignable declared roles of its scope; its name wins over a tenant
+ * custom role of the same name.
  */
 type SharedCustomRole = CustomRoleBody & {
   readonly shared: true;
-  /** The scope the role is held at, never `'global'`; defaults to the first scope. */
+  /**
+   * The scope the role is held at, never `'global'`; defaults to the first
+   * scope.
+   */
   readonly scope?: string;
   readonly tenant?: undefined;
   readonly id?: undefined;
@@ -320,21 +367,27 @@ type Principal = {
   readonly id: string;
   readonly issuer?: string;
   /**
-   * `contact`: an external person (a customer contact, a portal user). Only
-   * its `{ on }` memberships count; it never approves, creates keys or
-   * publishes, and is read-only unless a role whose `for` lists `contact`
-   * grants the write.
+   * `contact`: an external person (a customer contact, a portal user). Only its
+   * `{ on }` memberships count; it never approves, creates keys or publishes,
+   * and is read-only unless a role whose `for` lists `contact` grants the
+   * write.
    */
   readonly kind?: "user" | "service" | "workload" | "link" | "feed" | "contact";
   readonly roles?: readonly string[];
   readonly plans?: readonly string[];
   readonly memberships?: readonly Membership[];
-  /** The token dropped memberships to stay under its size budget; a `claimsFirst` source reads the rest. */
+  /**
+   * The token dropped memberships to stay under its size budget; a
+   * `claimsFirst` source reads the rest.
+   */
   readonly membershipsTruncated?: boolean;
   /** The authorization version the token was minted at (`authz_ver`). */
   readonly authzVersion?: number;
   readonly tenant?: string;
-  /** Set by core when a requested tenant is not one the subject holds: the denial is then `no-membership`, not `no-tenant`. Never read from a token. */
+  /**
+   * Set by core when a requested tenant is not one the subject holds: the
+   * denial is then `no-membership`, not `no-tenant`. Never read from a token.
+   */
   readonly unheldTenant?: string;
   readonly assurance?: Assurance;
   readonly binding?: Binding;
@@ -344,9 +397,16 @@ type Actor = {
   readonly id: string;
   readonly kind: ActorKind;
   readonly binding?: Binding;
-  /** `true` denies every permission without `readOnlyHint` (`not-delegated`), with or without a policy delegation. */
+  /**
+   * `true` denies every permission without `readOnlyHint` (`not-delegated`),
+   * with or without a policy delegation.
+   */
   readonly readOnly?: boolean;
-  /** The stable name the application gives this OAuth client (`ClientNames`), set by the subject resolver from the verified client id; policy delegations match it with `to: { kind, client }`. */
+  /**
+   * The stable name the application gives this OAuth client (`ClientNames`),
+   * set by the subject resolver from the verified client id; policy delegations
+   * match it with `to: { kind, client }`.
+   */
   readonly client?: string;
   readonly [key: string]: unknown;
 };
@@ -369,7 +429,16 @@ type Subject<TPrincipal extends Principal = Principal> = {
   readonly context: Readonly<Record<string, unknown>>;
   readonly session?: string;
   readonly expiresAt?: number;
-  /** The token's memberships are behind the source's authorization version: `fresh` permissions deny. */
+  /**
+   * When the verified token was issued (`iat`), in seconds since the epoch. A
+   * `VersionCache` trusts the token's `authzVersion` for its `maxStaleMs` after
+   * it.
+   */
+  readonly issuedAt?: number;
+  /**
+   * The token's memberships are behind the source's authorization version:
+   * `fresh` permissions deny.
+   */
   readonly stale?: true;
   /**
    * The resolver checked the session against the Auth server for this request
@@ -381,7 +450,10 @@ type Subject<TPrincipal extends Principal = Principal> = {
 //#endregion
 //#region src/core/decision.d.ts
 type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "no-tenant" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
-/** The `detail` each denial reason carries, where PermDock sets a structured one. */
+/**
+ * The `detail` each denial reason carries, where PermDock sets a structured
+ * one.
+ */
 type DenialDetails = {
   readonly limit: LimitDetail;
   /** The window the inactive allow applies in. */
@@ -413,18 +485,21 @@ type MatchedGrant = {
   readonly check?: Grant["check"];
   readonly approval?: "human" | ApprovalRequirement;
   readonly provider?: string;
-  /** The hosted policy document fingerprint and grant id, when a hosted grant matched. */
+  /**
+   * The hosted policy document fingerprint and grant id, when a hosted grant
+   * matched.
+   */
   readonly hosted?: HostedGrantRef;
   /** A break-glass grant overrode a matching deny. */
   readonly breakGlass?: true;
 };
 /**
  * Something the caller owes alongside a granted action. `over-limit`: a soft
- * `limit` was past its count; `near-limit`: usage reached `alertAt`.
- * `notify` / `review`: a break-glass grant's declared follow-ups.
- * `justify`: the break-glass reason, carried so audit records why.
- * `app`: a follow-up the application declared on the grant
- * (`allow(p, { obligations })`); PermDock carries it and never acts on it.
+ * `limit` was past its count; `near-limit`: usage reached `alertAt`. `notify` /
+ * `review`: a break-glass grant's declared follow-ups. `justify`: the
+ * break-glass reason, carried so audit records why. `app`: a follow-up the
+ * application declared on the grant (`allow(p, { obligations })`); PermDock
+ * carries it and never acts on it.
  */
 type Obligation = {
   readonly kind: "over-limit" | "near-limit" | "notify" | "review";
@@ -445,8 +520,8 @@ type Quota = {
   readonly resetsAt: string;
 };
 /**
- * The `detail` of a `limit` denial: the grant's `count`, its `per` window
- * in seconds and when the window resets (RFC 3339).
+ * The `detail` of a `limit` denial: the grant's `count`, its `per` window in
+ * seconds and when the window resets (RFC 3339).
  */
 type LimitDetail = {
   readonly count: number;
@@ -454,14 +529,13 @@ type LimitDetail = {
   readonly resetsAt: string;
 };
 /**
- * Why a candidate grant for the permission was passed over before its
- * condition ran: `via-only` (the subject holds no membership of its kind),
- * `purpose` (no asserted purpose it lists), `field` (its `fields` do not
- * cover the requested field), `grantee` (its `to` did not match and added no
- * denial), `role` (a role it names is not held), `validity` (a deny outside
- * its `validFrom` / `validUntil`; an inactive allow adds an `inactive-grant`
- * denial instead), `break-glass-inactive` (a break-glass grant with no
- * asserted purpose).
+ * Why a candidate grant for the permission was passed over before its condition
+ * ran: `via-only` (the subject holds no membership of its kind), `purpose` (no
+ * asserted purpose it lists), `field` (its `fields` do not cover the requested
+ * field), `grantee` (its `to` did not match and added no denial), `role` (a
+ * role it names is not held), `validity` (a deny outside its `validFrom` /
+ * `validUntil`; an inactive allow adds an `inactive-grant` denial instead),
+ * `break-glass-inactive` (a break-glass grant with no asserted purpose).
  */
 type TraceSkipReason = "via-only" | "purpose" | "field" | "grantee" | "role" | "validity" | "unknown-level" | "break-glass-inactive";
 type TraceSkip = {
@@ -469,15 +543,18 @@ type TraceSkip = {
   readonly permission: string;
   readonly effect: "allow" | "deny";
   readonly why: TraceSkipReason;
-  /** The level a custom role names that its resource does not declare, for `unknown-level`. */
+  /**
+   * The level a custom role names that its resource does not declare, for
+   * `unknown-level`.
+   */
   readonly level?: string;
 };
 /**
- * What `explain` saw: how many candidate grants it examined before the
- * outcome, which allows matched (including the ones a deny overrode), which
- * denies matched, and which grants it passed over. `denies[0]` is the deny
- * that produced a `deny` outcome, or the deny a break-glass grant lifted.
- * Pure local computation; never on a decision event.
+ * What `explain` saw: how many candidate grants it examined before the outcome,
+ * which allows matched (including the ones a deny overrode), which denies
+ * matched, and which grants it passed over. `denies[0]` is the deny that
+ * produced a `deny` outcome, or the deny a break-glass grant lifted. Pure local
+ * computation; never on a decision event.
  */
 type Trace = {
   readonly evaluated: number;
@@ -504,8 +581,8 @@ type GrantedDecision = {
 type DeniedDecision = {
   readonly outcome: "denied";
   /**
-   * The key of the permission that was checked. Absent on a denial for a
-   * check that named no declared permission.
+   * The key of the permission that was checked. Absent on a denial for a check
+   * that named no declared permission.
    */
   readonly permission?: string;
   readonly denials: readonly Denial[];
@@ -552,7 +629,10 @@ type RelationGrantee = {
    * to `resource`, then walk its parents only when `depth` is set.
    */
   readonly through?: "parent" | readonly string[];
-  /** Parent hops walked above the first `resource` instance; absent means `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links. */
+  /**
+   * Parent hops walked above the first `resource` instance; absent means
+   * `DEFAULT_RELATION_DEPTH` for `'parent'` and `0` for links.
+   */
   readonly depth?: number;
 };
 type PlanGrantee = {
@@ -601,23 +681,26 @@ type UserApprover = {
   readonly id: string;
 };
 /**
- * Whoever holds `permission` in the request's tenant, through any role,
- * custom roles included. Checked only through verdict facts
- * (`ApprovalVerdict.permissions`) that the handler computes from the
- * approver's own instance.
+ * Whoever holds `permission` in the request's tenant, through any role, custom
+ * roles included. Checked only through verdict facts
+ * (`ApprovalVerdict.permissions`) that the handler computes from the approver's
+ * own instance.
  */
 type PermissionApprover = {
   readonly kind: "permission";
   readonly permission: string;
 };
-/** An approver who matches at least one item; an item that is a list matches when every entry does. */
+/**
+ * An approver who matches at least one item; an item that is a list matches
+ * when every entry does.
+ */
 type AnyOfApprover = {
   readonly kind: "any-of";
   readonly of: readonly (Approver | readonly Approver[])[];
 };
 /**
- * Who may approve: a subject-only grantee, a `relation()` the approver holds
- * on the requested row (checked when the verdict is given), `user(id)`,
+ * Who may approve: a subject-only grantee, a `relation()` the approver holds on
+ * the requested row (checked when the verdict is given), `user(id)`,
  * `holder(permission)`, or `anyOf(...)`. A list (or `allOf(...)`) matches an
  * approver who satisfies every item.
  */
@@ -626,7 +709,10 @@ type ApproverInput = GranteeInput | UserApprover | PermissionApprover | {
   readonly kind: "any-of";
   readonly of: readonly ApproverInput[];
 } | readonly ApproverInput[];
-/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+/**
+ * Approves when the approver holds `permission` in the request's tenant (any
+ * role, custom roles included).
+ */
 declare function holder(permission: Permission): PermissionApprover;
 /** Approves when the approver matches any one of `items`. */
 declare function anyOf(...items: readonly ApproverInput[]): {
@@ -639,29 +725,35 @@ declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInp
 declare function user(id: string): UserApprover;
 //#endregion
 //#region src/core/scopes.d.ts
-/** One entry of `definePolicy({ scopes })`: the row field holding the scope id, and its parent scope. */
+/**
+ * One entry of `definePolicy({ scopes })`: the row field holding the scope id,
+ * and its parent scope.
+ */
 type ScopeDeclaration = {
   readonly key: string;
   readonly within?: string;
 };
 type PolicyScopesInput = Readonly<Record<string, ScopeDeclaration>>;
 /**
- * A declared scope, in declaration order. `key` is absent only on the
- * implicit `tenant` / `team` pair of a policy that declares no scopes.
+ * A declared scope, in declaration order. `key` is absent only on the implicit
+ * `tenant` / `team` pair of a policy that declares no scopes.
  */
 type Scope = {
   readonly name: string;
   readonly key?: string;
   readonly within?: string;
 };
-/** The names `role(..., { on })`, `memberOf` and memberships may use: declared names plus the aliases. */
+/**
+ * The names `role(..., { on })`, `memberOf` and memberships may use: declared
+ * names plus the aliases.
+ */
 type ScopeNames<S> = [S] extends [PolicyScopesInput] ? string extends keyof S ? string : (keyof S & string) | "tenant" | "team" : string;
 //#endregion
 //#region src/core/wire-delegation.d.ts
 /**
- * A delegation as every PermDock wire form carries it: OAuth `scope`
- * (RFC 6749, space-separated) and RFC 9396 `authorization_details`. An empty
- * `scope` is an empty scope list, which delegates nothing.
+ * A delegation as every PermDock wire form carries it: OAuth `scope` (RFC 6749,
+ * space-separated) and RFC 9396 `authorization_details`. An empty `scope` is an
+ * empty scope list, which delegates nothing.
  */
 type WireDelegation = {
   readonly scope?: string;
@@ -672,9 +764,9 @@ type WireDelegation = {
 //#region src/core/wire-denial.d.ts
 /**
  * A denial as it leaves the process: in a decision event, a Problem Details
- * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a
- * JSON value (a string, or `LimitDetail` on `limit`); what a closure threw
- * and a validation error stay in process.
+ * body, an MCP or WebMCP refusal and the decision endpoint. `detail` is a JSON
+ * value (a string, or `LimitDetail` on `limit`); what a closure threw and a
+ * validation error stay in process.
  */
 type WireDenial = {
   readonly role: string | null;
@@ -682,7 +774,10 @@ type WireDenial = {
   readonly to?: Grantee | readonly Grantee[];
   readonly detail?: unknown;
 };
-/** A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends it. */
+/**
+ * A `Decision` whose denials are `WireDenial`s, as the decision endpoint sends
+ * it.
+ */
 type WireDecision = GrantedDecision | ApprovalRequiredDecision | (Omit<DeniedDecision, "denials"> & {
   readonly denials: readonly WireDenial[];
 });
@@ -706,7 +801,10 @@ type DirectoryEvent = {
     readonly iss?: string;
   };
   readonly active?: boolean;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type MembershipEvent = {
@@ -717,7 +815,10 @@ type MembershipEvent = {
   readonly principal: {
     readonly id: string;
   };
-  /** A declared scope name, or the `tenant` / `team` alias; absent for a global role change. */
+  /**
+   * A declared scope name, or the `tenant` / `team` alias; absent for a global
+   * role change.
+   */
   readonly scope?: string;
   /** The scope instance; present exactly when `scope` is. */
   readonly id?: string;
@@ -734,13 +835,16 @@ type MembershipEvent = {
     readonly id: string;
     readonly kind: string;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
  * An API key's lifecycle: `created`, `rotated` and `revoked` from the
- * application or a credential store, `used` from `subjectFromApiKey`. A
- * `used` event carries `sample`, the fraction of uses reported.
+ * application or a credential store, `used` from `subjectFromApiKey`. A `used`
+ * event carries `sample`, the fraction of uses reported.
  */
 type CredentialEvent = {
   readonly type: "credential";
@@ -762,7 +866,10 @@ type CredentialEvent = {
     readonly kind: string;
   };
   readonly sample?: number;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
@@ -798,7 +905,10 @@ type AutomationEvent = {
     readonly id: string;
     readonly kind: string;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type SinkEvent = DecisionEvent | DirectoryEvent | MembershipEvent | CredentialEvent | AccessEvent | AutomationEvent | DeliveryEvent;
@@ -807,14 +917,14 @@ type DeliveryChannel = "email" | "chat" | "webhook";
 /** What an email is for; only `notification` mail carries `List-Unsubscribe`. */
 type EmailCategory = "transactional" | "notification" | "security" | "approval";
 /**
- * Why a delivery failed. `denied` and `unlinked` are the router's refusals of
- * a recipient; the rest come from a transport or a provider webhook.
+ * Why a delivery failed. `denied` and `unlinked` are the router's refusals of a
+ * recipient; the rest come from a transport or a provider webhook.
  */
 type DeliveryFailureCause = "denied" | "unlinked" | "no-transport" | "no-message" | "invalid-recipient" | "invalid-message" | "rate-limited" | "quota-exceeded" | "unauthorized" | "unavailable" | "suppressed" | "rejected";
 /**
  * One recipient's delivery: `sent` when a transport accepted it, then
- * `delivered`, `bounced` or `complained` from the provider, or `failed`.
- * It carries no address, only the principal the router checked.
+ * `delivered`, `bounced` or `complained` from the provider, or `failed`. It
+ * carries no address, only the principal the router checked.
  */
 type DeliveryEvent = {
   readonly type: "delivery";
@@ -827,7 +937,10 @@ type DeliveryEvent = {
     readonly id: string;
     readonly key: string;
   };
-  /** The checked principal, or `trusted` for an address the server loaded itself. */
+  /**
+   * The checked principal, or `trusted` for an address the server loaded
+   * itself.
+   */
   readonly recipient?: {
     readonly principal?: {
       readonly id: string;
@@ -851,7 +964,10 @@ type DeliveryEvent = {
   readonly retryable?: boolean;
   /** The denial reason when `cause` is `denied`. */
   readonly reason?: string;
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 /**
@@ -891,7 +1007,10 @@ type AccessEvent = {
   };
   /** A `SupportSession`'s permission keys. */
   readonly permissions?: readonly string[];
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type DecisionEvent = {
@@ -915,14 +1034,20 @@ type DecisionEvent = {
       readonly id: string;
       readonly kind: string;
     };
-    /** OAuth `scope` and RFC 9396 `authorization_details`, as every wire form carries a delegation. */
+    /**
+     * OAuth `scope` and RFC 9396 `authorization_details`, as every wire form
+     * carries a delegation.
+     */
     readonly delegation?: WireDelegation;
     /** The API key the subject came from. */
     readonly credential?: {
       readonly id: string;
       readonly kind: CredentialKind;
     };
-    /** The support session the subject came from: the `id` its `access` events carry as `session.id`. */
+    /**
+     * The support session the subject came from: the `id` its `access` events
+     * carry as `session.id`.
+     */
     readonly supportSession?: {
       readonly id: string;
     };
@@ -946,7 +1071,10 @@ type DecisionEvent = {
   };
   /** What a granted decision owes, as on `GrantedDecision.obligations`. */
   readonly obligations?: readonly Obligation[];
-  /** Purposes of use the caller asserted (`context.purpose`); present when any was. */
+  /**
+   * Purposes of use the caller asserted (`context.purpose`); present when any
+   * was.
+   */
   readonly purpose?: readonly string[];
   /** The justification the caller supplied (`context.reason`); present when set. */
   readonly reason?: string;
@@ -957,7 +1085,10 @@ type DecisionEvent = {
   /** The call that produced the decision. */
   readonly call: "can" | "decide" | "assert" | "filter" | "endpoint" | "adapter" | "approval" | "simulate" | "explain";
   readonly adapter?: AdapterId;
-  /** The model id the agent model gate decided, or the model that drove the call. */
+  /**
+   * The model id the agent model gate decided, or the model that drove the
+   * call.
+   */
   readonly model?: string;
   /** Set on an approval lifecycle event (`com.permdock.approval.<phase>`). */
   readonly phase?: "requested" | "resolved" | "expired" | "cancelled";
@@ -966,7 +1097,10 @@ type DecisionEvent = {
     readonly denied: number;
     readonly approvalRequired: number;
   };
-  /** The application's own data, set where the event is built; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set where the event is built; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type AuthEvent = {
@@ -985,7 +1119,10 @@ type AuthEvent = {
 //#region src/core/snapshot-types.d.ts
 type Snapshot = {
   readonly v: 1;
-  /** RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the token's `iat`. */
+  /**
+   * RFC 3339. The epoch for a snapshot built without a clock. Signed, it is the
+   * token's `iat`.
+   */
   readonly issuedAt: string;
   readonly subject: {
     readonly principal: {
@@ -995,13 +1132,19 @@ type Snapshot = {
       readonly tenant?: string;
       readonly memberships?: readonly Membership[];
     } | null;
-    /** OAuth `scope` and RFC 9396 `authorization_details`, as the token carried them. */
+    /**
+     * OAuth `scope` and RFC 9396 `authorization_details`, as the token carried
+     * them.
+     */
     readonly delegation?: WireDelegation;
     readonly context: Readonly<Record<string, unknown>>;
   };
   /** Roles held in the active tenant, in rank order. */
   readonly roles: readonly string[];
-  /** The distinct `meta.audience` values of `roles`, in rank order; absent when none has one. */
+  /**
+   * The distinct `meta.audience` values of `roles`, in rank order; absent when
+   * none has one.
+   */
   readonly audiences?: readonly string[];
   readonly grants: readonly SnapshotGrant[];
   readonly tenants: readonly string[];
@@ -1013,18 +1156,24 @@ type Snapshot = {
     readonly roles?: Readonly<Record<string, Role>>;
     readonly plans?: Readonly<Record<string, Plan>>;
   };
-  /** The policy's scopes in order, so a client checks the row against each membership's instance. */
+  /**
+   * The policy's scopes in order, so a client checks the row against each
+   * membership's instance.
+   */
   readonly scopes?: readonly SnapshotScope[];
-  /** One entry per tenant in `tenants`: what the subject may hand out there. Absent without tenants. */
+  /**
+   * One entry per tenant in `tenants`: what the subject may hand out there.
+   * Absent without tenants.
+   */
   readonly assignable?: readonly SnapshotAssignable[];
   /**
-   * Allow grants of held roles that only a plan the subject lacks keeps
-   * from applying; they grant nothing and name the plan a denial asks for.
+   * Allow grants of held roles that only a plan the subject lacks keeps from
+   * applying; they grant nothing and name the plan a denial asks for.
    */
   readonly notEntitled?: readonly SnapshotNotEntitled[];
   /**
-   * The row id field per resource whose `id` option is not `id`, for the
-   * grants in `grants`. Absent when every one reads `id`.
+   * The row id field per resource whose `id` option is not `id`, for the grants
+   * in `grants`. Absent when every one reads `id`.
    */
   readonly ids?: Readonly<Record<string, string>>;
   /**
@@ -1035,7 +1184,10 @@ type Snapshot = {
    */
   readonly delegated?: readonly string[];
 };
-/** A grant the subject would hold on another plan: its permission, role and `to`. */
+/**
+ * A grant the subject would hold on another plan: its permission, role and
+ * `to`.
+ */
 type SnapshotNotEntitled = {
   readonly permission: string;
   readonly role: string | null;
@@ -1046,17 +1198,29 @@ type SnapshotScope = {
   readonly name: string;
   readonly key: string;
   readonly within?: string;
-  /** Resources whose rows this scope's key partitions, from their `memberOf` relations. */
+  /**
+   * Resources whose rows this scope's key partitions, from their `memberOf`
+   * relations.
+   */
   readonly resources?: readonly string[];
-  /** Resource name to the field holding this scope's id, for a resource whose field is not `key` (its own `id`). */
+  /**
+   * Resource name to the field holding this scope's id, for a resource whose
+   * field is not `key` (its own `id`).
+   */
   readonly fields?: Readonly<Record<string, string>>;
 };
-/** The declared roles and the custom-role ceiling the subject may assign in one tenant. */
+/**
+ * The declared roles and the custom-role ceiling the subject may assign in one
+ * tenant.
+ */
 type SnapshotAssignable = {
   readonly tenant: string;
   readonly roles: readonly string[];
   readonly permissions: readonly Permission[];
-  /** Permission key to the levels the subject may hand out; only permissions whose resource declares levels. */
+  /**
+   * Permission key to the levels the subject may hand out; only permissions
+   * whose resource declares levels.
+   */
   readonly levels?: Readonly<Record<string, readonly string[]>>;
 };
 type SnapshotGrant = {
@@ -1074,7 +1238,10 @@ type SnapshotGrant = {
   readonly membership?: Membership;
   readonly portable?: false;
   readonly fields?: readonly string[];
-  /** When the grant applies (RFC 3339, `from` inclusive, `until` exclusive); absent means always. */
+  /**
+   * When the grant applies (RFC 3339, `from` inclusive, `until` exclusive);
+   * absent means always.
+   */
   readonly validity?: WireValidity;
   /** The grant's declared `name`. */
   readonly name?: string;
@@ -1098,10 +1265,52 @@ type LocalSnapshotManifest = {
   readonly rank?: readonly string[];
   /** Every declared grant, without a membership. */
   readonly grants: readonly SnapshotGrant[];
-  /** Per custom-role scope (`global` for platform roles): the grants each entry resolves to. */
+  /**
+   * Per custom-role scope (`global` for platform roles): the grants each entry
+   * resolves to.
+   */
   readonly custom: Readonly<Record<string, LocalCustomRoleTable>>;
-  /** The synced tables a device reads the user's memberships, roles and custom roles from; `permdock powersync generate` adds it. */
+  /**
+   * The synced tables a device reads the user's memberships, roles and custom
+   * roles from; `permdock powersync generate` adds it.
+   */
   readonly rows?: LocalSnapshotRows;
+  /**
+   * What a device needs to compute `Snapshot.assignable` for the active tenant
+   * the way `assignableIn` does on the server.
+   */
+  readonly assignable?: LocalAssignable;
+};
+/**
+ * The hand-out rules of a policy, as a device evaluates them over its synced
+ * memberships and custom roles.
+ */
+type LocalAssignable = {
+  /**
+   * Declared roles a tenant admin may hand out or compose, in rank order, with
+   * the scope each sits on and its allow keys.
+   */
+  readonly roles: readonly {
+    readonly name: string;
+    readonly on: string;
+    readonly allows: readonly string[];
+  }[];
+  /** Declared role names and permission keys with `meta.manageRoles: true`. */
+  readonly manage: {
+    readonly roles: readonly string[];
+    readonly permissions: readonly string[];
+  };
+  /**
+   * Declared role name to the roles it assigns, when any role declares
+   * `assigns`.
+   */
+  readonly assigns?: Readonly<Record<string, readonly string[]>>;
+  /** The first scope's custom-role ceiling, in declaration order. */
+  readonly permissions: readonly Permission[];
+  /** Permission key to its level names, in declaration order. */
+  readonly levels?: Readonly<Record<string, readonly string[]>>;
+  /** Index of an allow in `grants` to the levels a holder of it may hand out. */
+  readonly grants?: Readonly<Record<string, readonly string[]>>;
 };
 /** A column of a synced table, or a value every row has. */
 type LocalRowValue = {
@@ -1110,9 +1319,9 @@ type LocalRowValue = {
   readonly value: string;
 };
 /**
- * A column that holds a role key or user id: the value itself, the `column`
- * of the synced `through` table whose `id` it references, or a value each
- * maps to a role key (`null` for no role).
+ * A column that holds a role key or user id: the value itself, the `column` of
+ * the synced `through` table whose `id` it references, or a value each maps to
+ * a role key (`null` for no role).
  */
 type LocalRowColumn = {
   readonly column: string;
@@ -1133,7 +1342,10 @@ type LocalMembershipRows = {
   readonly user: LocalRowColumn;
   readonly scope: LocalRowValue;
   readonly id: string;
-  /** The role columns (the row holds every non-null key), or the fixed roles every row holds. */
+  /**
+   * The role columns (the row holds every non-null key), or the fixed roles
+   * every row holds.
+   */
   readonly roles: readonly LocalRowColumn[] | {
     readonly value: readonly string[];
   };
@@ -1151,28 +1363,46 @@ type LocalSnapshotRows = {
     /** The role columns; the row holds every non-null key. */
     readonly roles: readonly LocalRowColumn[];
   };
-  /** The custom-role tables (`tenant_id`, `scope`, `scope_id`, `role`, and `permission`, `effect`, `level` or `include_role`). */
+  /**
+   * The custom-role tables (`tenant_id`, `scope`, `scope_id`, `role`, and
+   * `permission`, `effect`, `level` or `include_role`).
+   */
   readonly customRoles?: {
     readonly permissions: string;
     readonly includes: string;
   };
 };
-/** Grants a custom role entry resolves to, held by a placeholder role the client renames. */
+/**
+ * Grants a custom role entry resolves to, held by a placeholder role the client
+ * renames.
+ */
 type LocalCustomRoleTable = {
-  /** `{ permission }` per permission key, and `{ permission, level }` per declared level. */
+  /**
+   * `{ permission }` per permission key, and `{ permission, level }` per
+   * declared level.
+   */
   readonly permissions: Readonly<Record<string, {
     readonly all: readonly SnapshotGrant[];
     readonly levels?: Readonly<Record<string, readonly SnapshotGrant[]>>;
+    /** The levels a holder of `all` may hand out. */
+    readonly reach?: readonly string[];
+    /** Level to the levels a holder of `levels[level]` may hand out. */
+    readonly levelReach?: Readonly<Record<string, readonly string[]>>;
   }>>;
   /** `includes: [role]` per declared role. */
   readonly includes: Readonly<Record<string, readonly SnapshotGrant[]>>;
+  /**
+   * Declared role to permission key to the levels a holder of its included
+   * grants may hand out.
+   */
+  readonly includeReach?: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>;
 };
 //#endregion
 //#region src/core/time.d.ts
 /**
- * The one time rule: NumericDate (whole seconds) for JWT registered claims
- * and the claims SQL reads, RFC 3339 for every other JSON field, integer
- * seconds for durations, and an `Instant` for every runtime `now`.
+ * The one time rule: NumericDate (whole seconds) for JWT registered claims and
+ * the claims SQL reads, RFC 3339 for every other JSON field, integer seconds
+ * for durations, and an `Instant` for every runtime `now`.
  */
 /**
  * The part of a `Temporal.Instant` PermDock reads. Public options take it
@@ -1185,8 +1415,8 @@ type Instant = {
 //#endregion
 //#region src/core/internals.d.ts
 /**
- * Any instance a feature function accepts: a server `PermDock`, one built
- * from a snapshot, or an adapter's wrapper such as `PdpPermDock`.
+ * Any instance a feature function accepts: a server `PermDock`, one built from
+ * a snapshot, or an adapter's wrapper such as `PdpPermDock`.
  */
 type InstanceHandle = {
   readonly subject: Subject;
@@ -1194,19 +1424,26 @@ type InstanceHandle = {
 //#endregion
 //#region src/core/credential.d.ts
 type CredentialKind = "user" | "service" | "feed";
-/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+/**
+ * A feed id: lowercase, so a mail system that lowercases a local part still
+ * matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local
+ * part.
+ */
 declare function isFeedId(value: string): boolean;
-/** One permission (a key) a credential may use: on every instance, or only on `ids`. */
+/**
+ * One permission (a key) a credential may use: on every instance, or only on
+ * `ids`.
+ */
 type CredentialPermission = {
   readonly permission: string;
   readonly ids?: readonly string[];
 };
 /**
- * Credential v1: what a verified API key stands for, never the secret. A
- * `user` credential acts as its owner (`principal`) narrowed to
- * `permissions`, and to the memberships inside `tenant` when it names one;
- * a `service` credential is its own `service` principal holding `roles` in
- * `tenant`, narrowed the same way.
+ * Credential v1: what a verified API key stands for, never the secret. A `user`
+ * credential acts as its owner (`principal`) narrowed to `permissions`, and to
+ * the memberships inside `tenant` when it names one; a `service` credential is
+ * its own `service` principal holding `roles` in `tenant`, narrowed the same
+ * way.
  */
 type Credential = {
   readonly v: 1;
@@ -1215,12 +1452,15 @@ type Credential = {
   /** The owner of a `user` credential, or the id of the service principal. */
   readonly principal: string;
   /**
-   * The instance of the first scope the key is held to. Required on a
-   * service credential, where its roles are held; optional on a user
-   * credential, where it keeps only the owner's memberships inside it.
+   * The instance of the first scope the key is held to. Required on a service
+   * credential, where its roles are held; optional on a user credential, where
+   * it keeps only the owner's memberships inside it.
    */
   readonly tenant?: string;
-  /** Service: the roles it holds in `tenant`. Feed: the resource roles it holds on `on`. */
+  /**
+   * Service: the roles it holds in `tenant`. Feed: the resource roles it holds
+   * on `on`.
+   */
   readonly roles?: readonly string[];
   /** Feed only: the resource instance the roles are held on. */
   readonly on?: {
@@ -1290,14 +1530,20 @@ type CredentialDecision = {
 } | {
   readonly outcome: "approval-required";
   readonly credential: Credential;
-  /** Bound to the credential's content and its creator; pass it as `approved` to resume. */
+  /**
+   * Bound to the credential's content and its creator; pass it as
+   * `approved` to resume.
+   */
   readonly token: string;
 } | {
   readonly outcome: "denied";
   readonly denials: readonly Denial[];
 };
 type DecideCredentialOptions = {
-  /** Where the tenant's `credentials` policy comes from. Without it, only the no-expiry rule applies. */
+  /**
+   * Where the tenant's `credentials` policy comes from. Without it, only the
+   * no-expiry rule applies.
+   */
   readonly settings?: SettingsSource;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
@@ -1311,49 +1557,48 @@ type DecideCredentialOptions = {
  */
 declare function credentialPolicyViolation(credential: Credential, policy: CredentialPolicy | readonly CredentialPolicy[]): CredentialPolicyViolation | undefined;
 /**
- * Validates an untrusted credential record and returns a frozen copy with
- * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
- * type in a known field, a service credential without `tenant` and `roles`,
- * or a user credential with `roles`, rejects the whole record.
+ * Validates an untrusted credential record and returns a frozen copy with only
+ * the v1 fields, or `undefined`. Unknown fields are dropped; a wrong type in a
+ * known field, a service credential without `tenant` and `roles`, or a user
+ * credential with `roles`, rejects the whole record.
  */
 declare function parseCredential(input: unknown): Credential | undefined;
 /**
  * The delegation a credential narrows its principal to: OAuth scopes for
- * permissions on every instance, one RFC 9396 entry per id otherwise. A key
- * the definitions no longer declare is dropped, so a credential whose every
- * key is gone delegates nothing and every check is denied.
+ * permissions on every instance, one RFC 9396 entry per id otherwise. A key the
+ * definitions no longer declare is dropped, so a credential whose every key is
+ * gone delegates nothing and every check is denied.
  */
 declare function credentialDelegation(credential: Credential, permissions: PermissionTree): Delegation;
 /**
  * Decides whether the subject of `permdock` may create the credential in
- * `request`. The creator must be a signed-in user or service that is not
- * itself a link or a credential; a delegated creator hands out only what its
- * delegation covers. A key's tenant must be one the creator is a member of;
- * a service key's roles among the creator's `assignableRoles` there and its
+ * `request`. The creator must be a signed-in user or service that is not itself
+ * a link or a credential; a delegated creator hands out only what its
+ * delegation covers. A key's tenant must be one the creator is a member of; a
+ * service key's roles among the creator's `assignableRoles` there and its
  * permissions within `assignablePermissions` there (`exceeds-creator`). The
- * `credentials` policy of the key's tenant (its own, or for a user key
- * without one the creator's active tenant) then applies (`credential-policy`; a
+ * `credentials` policy of the key's tenant (its own, or for a user key without
+ * one the creator's active tenant) then applies (`credential-policy`; a
  * settings source that throws denies with `rule: 'unavailable'`), and
- * `approval` makes the result `approval-required` until `approved` carries
- * its token. PermDock never stores the credential; the application does,
- * after a `granted` result.
+ * `approval` makes the result `approval-required` until `approved` carries its
+ * token. PermDock never stores the credential; the application does, after a
+ * `granted` result.
  */
 /**
  * Decides whether the subject of `permdock` may create the credential in
  * `request`: the creator's own reach, the `credentials` policy of the key's
- * tenant (the call's `settings`, else the instance's), and `approval`.
- * PermDock never stores the credential; the application does, after a
- * `granted` result. An instance built from a snapshot denies with
- * `unsupported`.
+ * tenant (the call's `settings`, else the instance's), and `approval`. PermDock
+ * never stores the credential; the application does, after a `granted` result.
+ * An instance built from a snapshot denies with `unsupported`.
  */
 declare function decideCredential(permdock: InstanceHandle, request: CredentialRequest, options?: DecideCredentialOptions): Promise<CredentialDecision>;
 //#endregion
 //#region src/core/support-session.d.ts
 /**
- * SupportSession v1: a support staff member (`actor`, kind `support`)
- * viewing the app as `principal` in `tenant`, for a stated `reason`. Each
- * request in the session acts as `principal` with their live rights,
- * narrowed to `permissions`.
+ * SupportSession v1: a support staff member (`actor`, kind `support`) viewing
+ * the app as `principal` in `tenant`, for a stated `reason`. Each request in
+ * the session acts as `principal` with their live rights, narrowed to
+ * `permissions`.
  */
 type SupportSession = {
   readonly v: 1;
@@ -1417,92 +1662,129 @@ type DecideSupportSessionOptions = {
   readonly approval?: boolean;
   /** The `token` of an approval the application consumed for this request. */
   readonly approved?: string;
-  /** The principal id that approved; required with `approved` and never the actor. */
+  /**
+   * The principal id that approved; required with `approved` and never the
+   * actor.
+   */
   readonly approvedBy?: string;
   /** The start time; defaults to the clock. */
   readonly now?: Instant;
 };
 /**
- * Validates an untrusted support-session record and returns a frozen copy
- * with only the v1 fields, or `undefined`.
+ * Validates an untrusted support-session record and returns a frozen copy with
+ * only the v1 fields, or `undefined`.
  */
 declare function parseSupportSession(input: unknown): SupportSession | undefined;
 /**
- * Decides whether the subject of `permdock` may start the support session
- * in `request`. The actor must be a signed-in person acting for themselves
+ * Decides whether the subject of `permdock` may start the support session in
+ * `request`. The actor must be a signed-in person acting for themselves
  * (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
- * member of the tenant (`tenant-mismatch`) and be able to use every
- * permission (`exceeds-creator`). Without `permissions` the session gets the
- * actor's read-only permissions. The tenant's `supportSessions` policy then
- * applies, and the result is `approval-required` until `approved` carries
- * its token and `approvedBy` names someone other than the actor.
+ * member of the tenant (`tenant-mismatch`) and be able to use every permission
+ * (`exceeds-creator`). Without `permissions` the session gets the actor's
+ * read-only permissions. The tenant's `supportSessions` policy then applies,
+ * and the result is `approval-required` until `approved` carries its token and
+ * `approvedBy` names someone other than the actor.
  */
 /**
- * Decides whether the subject of `permdock` may start the support session
- * in `request` and returns the record to sign: a stated reason, membership
- * of the tenant, the actor's own reach, the tenant's `supportSessions`
- * policy and approval by someone else. An instance built from a snapshot
- * denies with `unsupported`.
+ * Decides whether the subject of `permdock` may start the support session in
+ * `request` and returns the record to sign: a stated reason, membership of the
+ * tenant, the actor's own reach, the tenant's `supportSessions` policy and
+ * approval by someone else. An instance built from a snapshot denies with
+ * `unsupported`.
  */
 declare function decideSupportSession(permdock: InstanceHandle, request: SupportSessionRequest, options?: DecideSupportSessionOptions): Promise<SupportSessionDecision>;
 //#endregion
 //#region src/core/interfaces.d.ts
 type DecisionProvider = {
   readonly name: string;
-  handles(permission: Permission): boolean;
-  decide(request: {
+  handles: (permission: Permission) => boolean;
+  decide: (request: {
     readonly permission: Permission;
     readonly data?: unknown;
     readonly subject: Subject;
     readonly local: Decision;
-  }): Promise<Decision>;
+  }) => Promise<Decision>;
   /**
    * Ids of the resources of `permission.resource` the subject may act on.
    * `null` means the provider could not answer and every row is denied;
    * `undefined` means it cannot list, and each row is decided on its own.
    */
-  permitted?(request: {
+  permitted?: (request: {
     readonly permission: Permission;
     readonly subject: Subject;
-  }): Promise<readonly string[] | null | undefined>;
+  }) => Promise<readonly string[] | null | undefined>;
+};
+/**
+ * Shares one read per key within one `getPermDock` call: the first call runs
+ * `read`, every later call with the same key gets its answer. A source created
+ * once at module scope uses it so the reads of one instance share a single
+ * query and no answer outlives the instance.
+ */
+type SourceMemo = <T>(key: string, read: () => T) => T;
+/** What `getPermDock` passes to every source call besides its query. */
+type SourceContext = {
+  /** Absent when the source is called outside `getPermDock`. */
+  readonly memo?: SourceMemo;
+};
+/**
+ * Whether an instance answers reads or writes: `read` may judge a token fresh
+ * from a shared `VersionCache` within its `maxStaleMs`; `write` reads the
+ * version live.
+ */
+type Intent = "read" | "write";
+/** The custom-role sources' second argument. */
+type CustomRoleContext = SourceContext & {
+  readonly held: readonly string[];
 };
 type CustomRoleSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
   /**
-   * The custom roles of one tenant. `getPermDock` passes `held`, the role
-   * names the subject's live memberships hold there, declared or not, so a
-   * source can skip its read when none of them is a custom role.
+   * The custom roles of one tenant. `getPermDock` passes `held`, the role names
+   * the subject's live memberships hold there, declared or not, so a source can
+   * skip its read when none of them is a custom role.
    */
-  rolesFor(tenant: string, context?: {
-    readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
-  assignable?(tenant: string): string[] | Promise<string[]>;
+  rolesFor: (tenant: string, context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
+  assignable?: (tenant: string) => string[] | Promise<string[]>;
   /**
-   * Platform custom roles (`scope: 'global'`), read once per signed-in
-   * subject, with `held`, the global role names the subject holds. A role
-   * here with a tenant is ignored.
+   * Platform custom roles (`scope: 'global'`), read once per signed-in subject,
+   * with `held`, the global role names the subject holds. A role here with a
+   * tenant is ignored.
    */
-  globalRoles?(context?: {
-    readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
+  globalRoles?: (context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
   /**
    * Shared custom roles (`shared: true`), defined once for every tenant and
-   * read once per subject with a tenant membership, with `held`, the role
-   * names its live memberships hold in any tenant. A role here without
-   * `shared: true` is ignored.
+   * read once per subject with a tenant membership, with `held`, the role names
+   * its live memberships hold in any tenant. A role here without `shared: true`
+   * is ignored.
    */
-  sharedRoles?(context?: {
-    readonly held: readonly string[];
-  }): CustomRole[] | Promise<CustomRole[]>;
+  sharedRoles?: (context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
 };
 /**
- * A `CustomRoleSource` built for the subject the instance serves, for an adapter
- * option shared by every request: it gets the resolved subject (principal,
- * actor and delegation) and returns that subject's source, or `undefined`
- * for none. A throw reads no custom roles and reports `source-threw`.
+ * A `CustomRoleSource` built for the subject the instance serves, for an
+ * adapter option shared by every request: it gets the resolved subject
+ * (principal, actor and delegation) and returns that subject's source, or
+ * `undefined` for none. A throw reads no custom roles and reports
+ * `source-threw`.
  */
 type CustomRoleSourceFactory = (subject: Subject) => CustomRoleSource | undefined;
+/**
+ * The principal `MembershipSource.version` is asked about: what its token
+ * claims.
+ */
+type VersionQuery = {
+  readonly id: string;
+  readonly roles?: readonly string[];
+  readonly memberships?: readonly Membership[];
+  readonly authzVersion?: number;
+  /** When the token was issued, in seconds since the epoch (`iat`). */
+  readonly issuedAt?: number;
+};
+/** `MembershipSource.version`'s second argument. */
+type VersionContext = SourceContext & {
+  /** Absent outside `getPermDock`, where the read is live. */
+  readonly intent?: Intent;
+};
 /** One member of a scope instance, as `MembershipSource.list` returns it. */
 type MemberEntry = {
   readonly principal: {
@@ -1513,39 +1795,39 @@ type MemberEntry = {
 type MembershipSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  membershipsFor(principal: {
+  membershipsFor: (principal: {
     readonly id: string;
     readonly kind?: string;
-  }, options: {
+  }, options: SourceContext & {
     readonly tenant?: string;
-  }): Membership[] | Promise<Membership[]>;
-  /** Every membership held in one scope instance, for member lists and access reviews. */
-  list?(query: {
+  }) => Membership[] | Promise<Membership[]>;
+  /**
+   * Every membership held in one scope instance, for member lists and access
+   * reviews.
+   */
+  list?: (query: {
     readonly scope: string;
     readonly id: string;
-  }): MemberEntry[] | Promise<MemberEntry[]>;
+  }) => MemberEntry[] | Promise<MemberEntry[]>;
   /**
    * The principal's current authorization version, bumped on every membership
-   * change. A token whose `authzVersion` is behind it is stale for the
-   * policy's `fresh` permissions. `roles` and `memberships` are what the
-   * token claims, so a source can read more than the version in the same
-   * call when the claims show it will be needed.
+   * change. A token whose `authzVersion` is behind it is stale for the policy's
+   * `fresh` permissions. `roles` and `memberships` are what the token claims,
+   * so a source can read more than the version in the same call when the claims
+   * show it will be needed. `authzVersion` and `issuedAt` (seconds) are the
+   * token's, for a `VersionCache`.
    */
-  version?(principal: {
-    readonly id: string;
-    readonly roles?: readonly string[];
-    readonly memberships?: readonly Membership[];
-  }): number | undefined | Promise<number | undefined>;
+  version?: (principal: VersionQuery, context?: VersionContext) => number | undefined | Promise<number | undefined>;
   /**
-   * The global roles the principal holds now. With `onStale: 'reread'`, a
-   * stale token's `principal.roles` is replaced by this answer, so a revoked
-   * platform role is lost with the memberships. A throw or rejection leaves
-   * no global roles. Without it, a reread keeps the token's roles.
+   * The global roles the principal holds now. With `onStale: 'reread'`, a stale
+   * token's `principal.roles` is replaced by this answer, so a revoked platform
+   * role is lost with the memberships. A throw or rejection leaves no global
+   * roles. Without it, a reread keeps the token's roles.
    */
-  globalRolesFor?(principal: {
+  globalRolesFor?: (principal: {
     readonly id: string;
     readonly kind?: string;
-  }): readonly string[] | Promise<readonly string[]>;
+  }, context?: SourceContext) => readonly string[] | Promise<readonly string[]>;
   /**
    * Keep the memberships the verified token carries and read this source only
    * when the token says they were truncated (`claimsFirst`).
@@ -1555,9 +1837,9 @@ type MembershipSource = {
    * What a token behind `version` gets. Only permissions the policy marks
    * `fresh` look at staleness: `'deny'` (the default) denies those with
    * `stale-credentials` and leaves every other permission on the token's
-   * claims; `'reread'` replaces the token's memberships (and global roles,
-   * when the source has `globalRolesFor`) with a live read for the whole
-   * subject, so no decision keeps a revoked grant.
+   * claims; `'reread'` replaces the token's memberships (and global roles, when
+   * the source has `globalRolesFor`) with a live read for the whole subject, so
+   * no decision keeps a revoked grant.
    */
   readonly onStale?: "deny" | "reread";
 };
@@ -1565,7 +1847,10 @@ type MembershipSource = {
 type RelationChain = {
   /** Whether the object itself is restricted: nothing above it reaches it. */
   readonly restricted?: boolean;
-  /** Ancestors nearest first, at most `depth`; a restricted one ends the walk after itself. */
+  /**
+   * Ancestors nearest first, at most `depth`; a restricted one ends the walk
+   * after itself.
+   */
   readonly ancestors: readonly {
     readonly id: string;
     readonly restricted?: boolean;
@@ -1579,7 +1864,10 @@ type HolderPeriod = {
   /** Seconds since the epoch; from it on the relation no longer holds. */
   readonly expiresAt?: number;
 };
-/** A group holding a relation on an object: whoever holds `relation` on the group's instance holds it too. */
+/**
+ * A group holding a relation on an object: whoever holds `relation` on the
+ * group's instance holds it too.
+ */
 type RelationGroup = {
   readonly resource: string;
   readonly id: string;
@@ -1597,10 +1885,9 @@ type RelationHolder = HolderPeriod & ({
   readonly group: RelationGroup;
 });
 /**
- * The object graph: parent chains, links and who holds a relation on an
- * object. A source answers facts and never decides; a thrown or rejected
- * call, or a Promise the instance has not loaded, denies with
- * `relation-unavailable`.
+ * The object graph: parent chains, links and who holds a relation on an object.
+ * A source answers facts and never decides; a thrown or rejected call, or a
+ * Promise the instance has not loaded, denies with `relation-unavailable`.
  */
 type RelationSource = {
   /** Names the implementation in errors and events. */
@@ -1609,31 +1896,34 @@ type RelationSource = {
    * With `through: 'parent'`, the parent chain; with a link name, the one
    * instance that link points to (`depth` is then 1).
    */
-  ancestors(query: {
+  ancestors: (query: {
     readonly resource: string;
     readonly id: string;
     readonly through: string;
     readonly depth: number;
-  }): RelationChain | Promise<RelationChain>;
-  related(query: {
+  }) => RelationChain | Promise<RelationChain>;
+  related: (query: {
     readonly resource: string;
     readonly id: string;
     readonly relation: string;
-  }): RelationHolder[] | Promise<RelationHolder[]>;
-  row?(query: {
+  }) => RelationHolder[] | Promise<RelationHolder[]>;
+  row?: (query: {
     readonly resource: string;
     readonly id: string;
-  }): Readonly<Record<string, unknown>> | null | undefined | Promise<Readonly<Record<string, unknown>> | null | undefined>;
+  }) => Readonly<Record<string, unknown>> | null | undefined | Promise<Readonly<Record<string, unknown>> | null | undefined>;
 };
-/** Plan and seat names a principal holds in a tenant, from billing (Stripe Entitlements, a table). */
+/**
+ * Plan and seat names a principal holds in a tenant, from billing (Stripe
+ * Entitlements, a table).
+ */
 type EntitlementSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  entitlementsFor(principal: {
+  entitlementsFor: (principal: {
     readonly id: string;
   }, options: {
     readonly tenant?: string;
-  }): string[] | Promise<string[]>;
+  }) => string[] | Promise<string[]>;
 };
 type JwtClaims = {
   readonly iss?: string;
@@ -1662,29 +1952,32 @@ type VerificationFailure = {
 type TokenVerifier<TClaims extends JwtClaims = JwtClaims> = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  verify(token: string, expectations: {
+  verify: (token: string, expectations: {
     readonly typ?: string | readonly string[];
     readonly audience?: string | readonly string[];
     readonly issuer?: string;
     readonly clockTolerance?: number;
-  }): Promise<VerifiedToken<TClaims> | VerificationFailure>;
+  }) => Promise<VerifiedToken<TClaims> | VerificationFailure>;
 };
 type TokenSigner = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  sign(payload: Readonly<Record<string, unknown>>, options: {
+  sign: (payload: Readonly<Record<string, unknown>>, options: {
     readonly typ: "vnd.permdock.snapshot+jwt" | "vnd.permdock.approval+jwt" | "vnd.permdock.policy+jwt" | "vnd.permdock.capability+jwt" | "vnd.permdock.run+jwt" | "vnd.permdock.support-session+jwt" | "vnd.permdock.evidence+jwt" | "at+jwt" | "secevent+jwt";
     /** `aud`; a signer with no default audience refuses to sign without one. */
     readonly audience?: string | readonly string[];
     /** `exp`, a NumericDate; one hour after `iat` when absent. */
     readonly expiresAt?: number;
-    /** `iat`, a NumericDate: the artefact's issue time. The signer's clock when absent. */
+    /**
+     * `iat`, a NumericDate: the artefact's issue time. The signer's clock
+     * when absent.
+     */
     readonly issuedAt?: number;
     /** `jti`: the artefact's id. A fresh UUID when absent. */
     readonly jti?: string;
-  }): Promise<string>;
+  }) => Promise<string>;
   readonly kid?: string;
-  jwks?(): Promise<{
+  jwks?: () => Promise<{
     readonly keys: readonly JsonWebKeyLike[];
   }>;
 };
@@ -1694,8 +1987,8 @@ type SubjectResolver<TInput, TPrincipal extends Principal = Principal> = (input:
 type SnapshotSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  get(): Promise<Snapshot | string> | Snapshot | string;
-  subscribe?(listener: () => void): () => void;
+  get: () => Promise<Snapshot | string> | Snapshot | string;
+  subscribe?: (listener: () => void) => () => void;
 };
 type WhereCompiler<TTarget, TOptions = unknown> = (condition: Condition, target: TTarget, options?: TOptions) => unknown;
 type LimitConsumeInput = {
@@ -1715,31 +2008,31 @@ type LimitRemaining = {
 type LimitStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  consume(input: LimitConsumeInput): Promise<LimitRemaining> | LimitRemaining;
-  remaining(input: LimitConsumeInput): LimitRemaining | undefined;
+  consume: (input: LimitConsumeInput) => Promise<LimitRemaining> | LimitRemaining;
+  remaining: (input: LimitConsumeInput) => LimitRemaining | undefined;
 };
 type DecisionSink = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  write(events: readonly SinkEvent[]): Promise<void> | void;
-  flush?(): Promise<void>;
+  write: (events: readonly SinkEvent[]) => Promise<void> | void;
+  flush?: () => Promise<void>;
 };
 /**
  * Looks up the credential an API key stands for. `null` for a key that is
- * malformed, unknown, revoked or whose secret does not match; never throws
- * for bad input. Verification is the application's (or `apiKeyVerifier`'s),
- * never core's.
+ * malformed, unknown, revoked or whose secret does not match; never throws for
+ * bad input. Verification is the application's (or `apiKeyVerifier`'s), never
+ * core's.
  */
 type CredentialVerifier = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  verify(secret: string): Credential | null | Promise<Credential | null>;
+  verify: (secret: string) => Credential | null | Promise<Credential | null>;
   /**
-   * Records a successful use at `at`, for a `lastUsedAt` column. Called
-   * after a key resolved and not awaited; a throw or a rejection is
-   * ignored, so it never changes the subject.
+   * Records a successful use at `at`, for a `lastUsedAt` column. Called after a
+   * key resolved and not awaited; a throw or a rejection is ignored, so it
+   * never changes the subject.
    */
-  touch?(id: string, at: Instant): void | Promise<void>;
+  touch?: (id: string, at: Instant) => void | Promise<void>;
 };
 /** What one tenant configures for itself. Every field only tightens. */
 type TenantSettings = {
@@ -1749,13 +2042,13 @@ type TenantSettings = {
   readonly supportSessions?: SupportSessionPolicy;
 };
 /**
- * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten what
- * a key may be and never grant. A throw denies.
+ * Per-tenant settings, a subject input like `CustomRoleSource`: they tighten
+ * what a key may be and never grant. A throw denies.
  */
 type SettingsSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  settingsFor(tenant: string): TenantSettings | undefined | Promise<TenantSettings | undefined>;
+  settingsFor: (tenant: string) => TenantSettings | undefined | Promise<TenantSettings | undefined>;
 };
 //#endregion
 //#region src/core/policy-fingerprint.d.ts
@@ -1785,13 +2078,16 @@ type ApprovalStage = {
   readonly by: Approver | readonly Approver[];
   /** Absent means 1. */
   readonly quorum?: number;
-  /** After `after`, `to` may approve this stage as well as `by`; other stages are unaffected. */
+  /**
+   * After `after`, `to` may approve this stage as well as `by`; other stages
+   * are unaffected.
+   */
   readonly escalation?: ApprovalEscalation;
 };
 /**
- * `'any'`: `quorum` approvers from `by`. `'all'`: every stage completes, in
- * any order. `'sequential'`: stages complete in order; an approver signs
- * only the first incomplete stage. An approver signs once per request.
+ * `'any'`: `quorum` approvers from `by`. `'all'`: every stage completes, in any
+ * order. `'sequential'`: stages complete in order; an approver signs only the
+ * first incomplete stage. An approver signs once per request.
  */
 type ApprovalMode = "any" | "all" | "sequential";
 type ApprovalRequirement = {
@@ -1805,15 +2101,24 @@ type ApprovalRequirement = {
   readonly distinct?: boolean;
   /** `'resource-change'` binds the approval to the row's `version` field. */
   readonly staleOn?: "resource-change";
-  /** Distinct approvers a request needs before it is approved under `by`; absent means 1. */
+  /**
+   * Distinct approvers a request needs before it is approved under `by`; absent
+   * means 1.
+   */
   readonly quorum?: number;
-  /** Seconds a request stays open; the store's default when absent, and never longer than it. */
+  /**
+   * Seconds a request stays open; the store's default when absent, and never
+   * longer than it.
+   */
   readonly ttl?: number;
   readonly escalation?: ApprovalEscalation;
 };
 type ApprovalOption = "human" | {
   readonly by?: ApproverInput;
-  /** `'all'` or `'sequential'` with `stages`; absent means `'any'` with `by`. */
+  /**
+   * `'all'` or `'sequential'` with `stages`; absent means `'any'` with
+   * `by`.
+   */
   readonly mode?: ApprovalMode;
   readonly stages?: readonly {
     readonly by: ApproverInput;
@@ -1832,11 +2137,20 @@ type ApprovalOption = "human" | {
    * changes, resuming denies with `stale-approval`.
    */
   readonly staleOn?: "resource-change";
-  /** Distinct approvers needed (an integer of at least 1); the same approver counts once. Absent means 1. */
+  /**
+   * Distinct approvers needed (an integer of at least 1); the same approver
+   * counts once. Absent means 1.
+   */
   readonly quorum?: number;
-  /** Seconds the request stays open (`1800`); caps the approval store's default. */
+  /**
+   * Seconds the request stays open (`1800`); caps the approval store's
+   * default.
+   */
   readonly ttl?: number;
-  /** After `after` seconds (`14_400`), `to` may approve as well as `by`, at any open stage; same kinds as `by`. */
+  /**
+   * After `after` seconds (`14_400`), `to` may approve as well as `by`, at
+   * any open stage; same kinds as `by`.
+   */
   readonly escalation?: {
     readonly after: number;
     readonly to: ApproverInput;
@@ -1864,16 +2178,19 @@ type AssuranceRequirement = {
   readonly amr?: readonly string[];
 };
 /**
- * Time-boxed role activation. A role with `activation` is never held
- * directly: a membership lists it under `eligible`, and `permdock.activate`
- * mints the elevated membership to write.
+ * Time-boxed role activation. A role with `activation` is never held directly:
+ * a membership lists it under `eligible`, and `permdock.activate` mints the
+ * elevated membership to write.
  */
 type ActivationOption = {
   /** The longest an activation may last, in seconds (`14_400`). */
   readonly maxDuration?: number;
   /** `'required'` denies an activation without a reason. */
   readonly justification?: "required" | "optional";
-  /** When set, `activate` returns `approval-required` before the membership can be written. */
+  /**
+   * When set, `activate` returns `approval-required` before the membership can
+   * be written.
+   */
   readonly approval?: ApprovalOption;
   /** How fresh the activator's authentication must be. */
   readonly assurance?: AssuranceRequirement;
@@ -1921,10 +2238,16 @@ type SupportAccessOptions<S extends string = string> = {
   readonly role: string;
   /** The scope the support membership sits in; defaults to `tenant`. */
   readonly on?: S;
-  /** Every decision under the support membership denies with `actor-required` without an `act`. */
+  /**
+   * Every decision under the support membership denies with `actor-required`
+   * without an `act`.
+   */
   readonly actorRequired?: boolean;
   readonly consent: SupportConsent;
-  /** Permissions a support session never reaches, compiled to deny grants scoped to `via: 'support'`. */
+  /**
+   * Permissions a support session never reaches, compiled to deny grants scoped
+   * to `via: 'support'`.
+   */
   readonly forbid?: readonly (Permission | PermissionTree)[];
   /** The subgroup a consented membership records under `member.group`. */
   readonly group?: string;
@@ -1945,38 +2268,56 @@ type GrantOptions<T = Record<string, unknown>> = {
   readonly approval?: ApprovalOption;
   readonly limit?: GrantLimit;
   readonly reason?: string;
-  readonly fields?: readonly (keyof T & string)[];
+  readonly fields?: readonly (unknown extends T ? string : keyof T & string)[];
   /**
    * A stable name for the grant. On a deny, a `breakGlass` override may lift
-   * it; on any grant, it is reported on `decision.matched.name` and on
-   * decision events.
+   * it; on any grant, it is reported on `decision.matched.name` and on decision
+   * events.
    */
   readonly name?: string;
   readonly group?: string;
-  /** Display text and app data for the grant, reported on `decision.matched.meta`; never read in evaluation. */
+  /**
+   * Display text and app data for the grant, reported on
+   * `decision.matched.meta`; never read in evaluation.
+   */
   readonly meta?: GrantMeta;
   /**
-   * Follow-ups the application owes when this allow grants: each becomes a
-   * `{ kind: 'app', name, detail? }` obligation on the decision. Allows only.
+   * Follow-ups the application owes when this allow grants: each becomes a `{
+   * kind: 'app', name, detail? }` obligation on the decision. Allows only.
    */
   readonly obligations?: readonly ObligationInput[];
-  /** Purposes of use (`context.purpose`) that make the grant apply; non-portable. */
+  /**
+   * Purposes of use (`context.purpose`) that make the grant apply;
+   * non-portable.
+   */
   readonly purpose?: readonly string[];
-  /** The grant applies from this instant on (RFC 3339 or an `Instant`); before it an allow denies with `inactive-grant` and a deny does not apply. */
+  /**
+   * The grant applies from this instant on (RFC 3339 or an `Instant`); before
+   * it an allow denies with `inactive-grant` and a deny does not apply.
+   */
   readonly validFrom?: string | Instant;
-  /** The grant stops applying at this instant (exclusive; RFC 3339 or an `Instant`). */
+  /**
+   * The grant stops applying at this instant (exclusive; RFC 3339 or an
+   * `Instant`).
+   */
   readonly validUntil?: string | Instant;
   /**
-   * An allow on an instance action counts only on rows whose scope instance
-   * (or the whole app, globally) is one where the subject also holds this
+   * An allow on an instance action counts only on rows whose scope instance (or
+   * the whole app, globally) is one where the subject also holds this
    * permission through a role grant without a row condition.
    */
   readonly requires?: Permission | readonly Permission[];
 };
-/** A grant's metadata. PermDock carries it to decisions, events, snapshots and the catalog and never reads `x`. */
+/**
+ * A grant's metadata. PermDock carries it to decisions, events, snapshots and
+ * the catalog and never reads `x`.
+ */
 type GrantMeta = {
   readonly description?: string;
-  /** Data the application owns. Plain JSON, checked by `definePolicy(…, { x: { grant } })`. */
+  /**
+   * Data the application owns. Plain JSON, checked by `definePolicy(…, { x: {
+   * grant } })`.
+   */
   readonly x?: AppData;
 };
 /** An app obligation as declared on an allow: its name, or its name and detail. */
@@ -1986,22 +2327,25 @@ type ObligationInput = string | {
 };
 /**
  * When a grant applies, in Unix seconds. `from` is inclusive, `until`
- * exclusive; either may be absent. Portable: `where()` drops an inactive
- * grant at the decision clock and generated RLS compares against `now()`.
+ * exclusive; either may be absent. Portable: `where()` drops an inactive grant
+ * at the decision clock and generated RLS compares against `now()`.
  */
 type GrantValidity = {
   readonly from?: number;
   readonly until?: number;
 };
-/** A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details): RFC 3339 bounds. */
+/**
+ * A grant's validity in JSON (snapshots, catalogs, `inactive-grant` details):
+ * RFC 3339 bounds.
+ */
 type WireValidity = {
   readonly from?: string;
   readonly until?: string;
 };
 /**
- * The actor a policy delegation is for: an actor kind, narrowed to one id
- * when `id` is set, or to one named client when `client` is set (the name
- * the subject resolver gives a verified client id through `clients`).
+ * The actor a policy delegation is for: an actor kind, narrowed to one id when
+ * `id` is set, or to one named client when `client` is set (the name the
+ * subject resolver gives a verified client id through `clients`).
  */
 type DelegationTarget = {
   readonly kind: ActorKind;
@@ -2017,42 +2361,66 @@ type PolicyDelegation = {
   readonly from: Grantee | readonly Grantee[];
   readonly to: DelegationTarget;
   readonly permissions: readonly string[];
-  /** The keys of `permissions` whose `readOnlyHint` is true: all a `readOnly` actor may use. */
+  /**
+   * The keys of `permissions` whose `readOnlyHint` is true: all a `readOnly`
+   * actor may use.
+   */
   readonly readOnly: readonly string[];
   readonly validity?: GrantValidity;
 };
 type DelegationInput = {
-  /** Who hands over: the same subject-only selectors as `approval.by` (a role, `authenticated()`, a plan, `assurance()`); not `relation()`. */
+  /**
+   * Who hands over: the same subject-only selectors as `approval.by` (a role,
+   * `authenticated()`, a plan, `assurance()`); not `relation()`.
+   */
   readonly from: GranteeInput;
-  /** Which actor may act: `actor('eve')`, an actor kind, `{ kind, id }` for one agent, or `{ kind, client }` for one named OAuth client. */
+  /**
+   * Which actor may act: `actor('eve')`, an actor kind, `{ kind, id }` for one
+   * agent, or `{ kind, client }` for one named OAuth client.
+   */
   readonly to: ActorGrantee | string | DelegationTarget;
   /** The leaves or subtrees the actor may use; a deny grant still applies. */
   readonly permissions: readonly (Permission | PermissionTree)[];
   readonly validFrom?: string | Instant;
   readonly validUntil?: string | Instant;
 };
-/** A declared scope name (or the `tenant` / `team` alias), or the resource a role is held on. */
+/**
+ * A declared scope name (or the `tenant` / `team` alias), or the resource a
+ * role is held on.
+ */
 type RoleScope<S extends string = string> = S | Permission | PermissionTree | readonly (Permission | PermissionTree)[];
 type RoleOptions<S extends string = string> = {
   readonly on?: RoleScope<S>;
   readonly assignable?: boolean;
   /** Roles nobody may hold together with this one in the same scope instance. */
   readonly exclusiveWith?: readonly string[];
-  /** Fewest holders a scope instance keeps (checked at commit); default 0. Needs a named-scope `on`. */
+  /**
+   * Fewest holders a scope instance keeps (checked at commit); default 0. Needs
+   * a named-scope `on`.
+   */
   readonly min?: number;
   /** Most holders a scope instance may have. Needs a named-scope `on`. */
   readonly max?: number;
-  /** The holder count of a scope instance never changes: the role only moves by transfer. */
+  /**
+   * The holder count of a scope instance never changes: the role only moves by
+   * transfer.
+   */
   readonly transferOnly?: boolean;
   /**
-   * Roles a holder may assign and revoke. Once any role declares `assigns`,
-   * a role nobody lists is assigned only by `meta.manageRoles` holders.
+   * Roles a holder may assign and revoke. Once any role declares `assigns`, a
+   * role nobody lists is assigned only by `meta.manageRoles` holders.
    */
   readonly assigns?: readonly string[];
-  /** Membership kinds (`via`) that may hold the role; others hold it for nothing. */
+  /**
+   * Membership kinds (`via`) that may hold the role; others hold it for
+   * nothing.
+   */
   readonly for?: readonly string[];
   readonly meta?: RoleMeta;
-  /** Time-boxed activation: the role becomes eligible-only and `activate` mints its membership. */
+  /**
+   * Time-boxed activation: the role becomes eligible-only and `activate` mints
+   * its membership.
+   */
   readonly activation?: ActivationOption;
   /** Reserved for restricted credentials; setting it throws until it ships. */
   readonly restricted?: never;
@@ -2070,31 +2438,52 @@ type Grant = {
   readonly check?: Condition;
   readonly approval?: "human" | ApprovalRequirement;
   readonly portable: boolean;
-  /** Set when `portable` is false only because the grant reads the relation graph. */
+  /**
+   * Set when `portable` is false only because the grant reads the relation
+   * graph.
+   */
   readonly graph?: true;
   readonly closure?: ClosureGrantFn;
   readonly limit?: GrantLimit;
   readonly fields?: readonly string[];
   readonly scope: GrantScope;
-  /** The grant's stable name: a `breakGlass` override lifts a named deny, and `decision.matched.name` reports it. */
+  /**
+   * The grant's stable name: a `breakGlass` override lifts a named deny, and
+   * `decision.matched.name` reports it.
+   */
   readonly name?: string;
   readonly group?: string;
   readonly meta?: GrantMeta;
   /** App obligations an allow adds to its granted decision. */
   readonly obligations?: readonly AppObligation[];
-  /** Purposes of use that make the grant apply (`context.purpose`); non-portable. */
+  /**
+   * Purposes of use that make the grant apply (`context.purpose`);
+   * non-portable.
+   */
   readonly purpose?: readonly string[];
-  /** Set on a break-glass allow: it overrides named denies and carries obligations. */
+  /**
+   * Set on a break-glass allow: it overrides named denies and carries
+   * obligations.
+   */
   readonly breakGlass?: BreakGlassSpec;
-  /** The membership kind (`via`) this grant applies under; others never match it. */
+  /**
+   * The membership kind (`via`) this grant applies under; others never match
+   * it.
+   */
   readonly viaOnly?: MembershipVia;
   /** Set only on a grant merged from a hosted policy document. */
   readonly hosted?: HostedGrantRef;
   /** When the grant applies; absent means always. */
   readonly validity?: GrantValidity;
-  /** Set on a custom-role grant narrowed by a resource level (`CustomRoleGrant.level`). */
+  /**
+   * Set on a custom-role grant narrowed by a resource level
+   * (`CustomRoleGrant.level`).
+   */
   readonly level?: string;
-  /** The permission key the subject must also hold, through a role, on the row's scope instance or globally. */
+  /**
+   * The permission key the subject must also hold, through a role, on the row's
+   * scope instance or globally.
+   */
   readonly requires?: readonly string[];
 };
 /** Which hosted policy document and grant a merged grant came from. */
@@ -2114,13 +2503,22 @@ type RoleBinding<S extends string = string> = {
   readonly assigns?: readonly string[];
   readonly for?: readonly string[];
   readonly meta?: RoleMeta;
-  /** Time-boxed activation: the role is eligible-only, and `activate` mints its membership. */
+  /**
+   * Time-boxed activation: the role is eligible-only, and `activate` mints its
+   * membership.
+   */
   readonly activation?: ActivationSpec;
-  /** Support access: consent and `actorRequired` for a vendor-support membership. */
+  /**
+   * Support access: consent and `actorRequired` for a vendor-support
+   * membership.
+   */
   readonly support?: SupportSpec;
 };
 type ValidateMode = "boundary" | "always" | "never";
-/** The declared scopes, in declaration order; empty when the policy declares none. */
+/**
+ * The declared scopes, in declaration order; empty when the policy declares
+ * none.
+ */
 type PolicyScopes = readonly Scope[];
 type PolicyVocabulary = {
   readonly permissions: PermissionTree;
@@ -2132,7 +2530,7 @@ type VocabularyFromInput<Input> = Input extends PolicyVocabulary ? Input : {
   readonly roles?: RoleTree;
   readonly plans?: PlanTree;
 };
-type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary> = {
+type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary, S extends PolicyScopesInput = PolicyScopesInput> = {
   readonly permissions: V["permissions"];
   readonly roles: readonly RoleBinding[];
   readonly rolesByName: ReadonlyMap<string, RoleBinding>;
@@ -2146,18 +2544,39 @@ type Policy<TUser = unknown, TPrincipal extends Principal = Principal, V extends
   readonly onDenied?: (decision: unknown) => never | void;
   readonly fingerprint: string;
   readonly resources: ReadonlyMap<string, ResourceNode>;
-  /** The app data schemas `definePolicy` was given; symbol-keyed so freezing the policy leaves the schemas alone. */
+  /**
+   * The app data schemas `definePolicy` was given; symbol-keyed so freezing the
+   * policy leaves the schemas alone.
+   */
   readonly [POLICY_X]?: PolicyAppDataSchemas;
+  readonly [POLICY_SCOPES]?: S;
   readonly providers?: readonly DecisionProvider[];
-  /** Permission keys a hosted policy document may grant or deny; empty by default. */
+  /**
+   * Permission keys a hosted policy document may grant or deny; empty by
+   * default.
+   */
   readonly hostable: readonly string[];
-  /** Permission keys that deny with `stale-credentials` when the subject's token is behind the source. */
+  /**
+   * Permission keys that deny with `stale-credentials` when the subject's token
+   * is behind the source.
+   */
   readonly fresh?: readonly string[];
-  /** Policy delegations in declaration order; absent or empty when the policy declares none. */
+  /**
+   * Policy delegations in declaration order; absent or empty when the policy
+   * declares none.
+   */
   readonly delegations?: readonly PolicyDelegation[];
-  /** Grant levels by resource (`resource(…, { levels })`), normalised; absent when none are declared. */
+  /**
+   * Grant levels by resource (`resource(…, { levels })`), normalised; absent
+   * when none are declared.
+   */
   readonly levels?: PolicyLevels;
-  /** Coarse OAuth scopes in declaration order; absent when the policy declares none. */
+  /** Resources declared with `orderedLevels: true`, sorted; absent when none. */
+  readonly orderedLevels?: readonly string[];
+  /**
+   * Coarse OAuth scopes in declaration order; absent when the policy declares
+   * none.
+   */
   readonly oauthScopes?: readonly PolicyOAuthScope[];
   readonly index: PolicyIndex;
 };
@@ -2170,7 +2589,10 @@ type PolicyOAuthScope = {
   readonly permissions: readonly string[];
   readonly scopes: readonly string[];
 };
-/** Lookups built once per policy, so a decision does not rescan every role and grant. */
+/**
+ * Lookups built once per policy, so a decision does not rescan every role and
+ * grant.
+ */
 type PolicyIndex = {
   readonly declaredRoles: ReadonlySet<string>;
   readonly supports: readonly SupportSpec[];
@@ -2196,19 +2618,22 @@ type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesIn
   readonly grants?: readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[] | Grant)[];
   /**
    * Named scopes in order, each with the row field holding its id and an
-   * optional parent (`within`, an earlier scope). `tenant` and `team` alias
-   * the first and second scope.
+   * optional parent (`within`, an earlier scope). `tenant` and `team` alias the
+   * first and second scope.
    */
   readonly scopes?: S;
-  /** Maps the application's user to the principal PermDock decides for; `null` is anonymous. */
+  /**
+   * Maps the application's user to the principal PermDock decides for; `null`
+   * is anonymous.
+   */
   readonly subject: (user: TUser) => TPrincipal | null;
   readonly context?: (user: TUser) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
   readonly validate?: ValidateMode;
   readonly onDenied?: (decision: unknown) => never | void;
   readonly providers?: readonly DecisionProvider[];
   /**
-   * Leaves or subtrees a hosted policy document (`PolicySource`) may touch.
-   * The default is none, so a policy without it ignores every hosted grant.
+   * Leaves or subtrees a hosted policy document (`PolicySource`) may touch. The
+   * default is none, so a policy without it ignores every hosted grant.
    */
   readonly hostable?: readonly (Permission | PermissionTree)[];
   /**
@@ -2219,8 +2644,8 @@ type PolicyOptions<TUser, TPrincipal extends Principal, S extends PolicyScopesIn
   readonly fresh?: readonly (Permission | PermissionTree)[];
   /**
    * Standing delegations: holders of `from` let actors matching `to` use
-   * `permissions` for them without a token saying so. A token delegation on
-   * the call still applies as well; both must cover.
+   * `permissions` for them without a token saying so. A token delegation on the
+   * call still applies as well; both must cover.
    */
   readonly delegations?: readonly DelegationInput[];
   /**
@@ -2251,4 +2676,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { MemberEntry as $, AuthorizationDetail as $n, CredentialEvent as $t, PolicyScopes as A, assurance as An, CredentialRequest as At, ValidateMode as B, DenialReason as Bn, LocalMembershipRows as Bt, MembershipFixture as C, user as Cn, SqlFunctionArg as Cr, Credential as Ct, PolicyDelegation as D, RelationGrantee as Dn, isConditionDate as Dr, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, InheritGrantee as En, isCondition as Er, CredentialPermission as Et, RoleScope as F, AppObligation as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, MatchedGrant as Gn, Snapshot as Gt, WireValidity as H, ExplainedDecision as Hn, LocalRowValue as Ht, SeparationConflict as I, ApprovalRequiredDecision as In, parseCredential as It, EntitlementSource as J, Trace as Jn, SnapshotNotEntitled as Jt, DecisionProvider as K, Obligation as Kn, SnapshotAssignable as Kt, SubjectOf as L, Decision as Ln, InstanceHandle as Lt, PrincipalOf as M, inherit as Mn, credentialDelegation as Mt, RoleBinding as N, plan as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, actor as On, isConditionRef as Or, CredentialPolicy as Ot, RoleOptions as P, relation as Pn, decideCredential as Pt, LimitStore as Q, Assurance as Qn, AutomationEvent as Qt, SupportAccessOptions as R, Denial as Rn, Instant as Rt, HostedGrantRef as S, holder as Sn, RestrictedAncestors as Sr, ApiKeyPrincipal as St, Policy as T, GranteeInput as Tn, hasConditionOp as Tr, CredentialKind as Tt, CredentialVerifier as U, GrantedDecision as Un, LocalSnapshotManifest as Ut, VocabularyFromInput as V, DeniedDecision as Vn, LocalRowColumn as Vt, CustomRoleSource as W, LimitDetail as Wn, LocalSnapshotRows as Wt, LimitConsumeInput as X, TraceSkipReason as Xn, AccessEvent as Xt, JwtClaims as Y, TraceSkip as Yn, SnapshotScope as Yt, LimitRemaining as Z, Actor as Zn, AuthEvent as Zt, GrantLimit as _, ApproverInput as _n, MemberOfCondition as _r, SupportSessionDecision as _t, ApprovalRequirement as a, EmailCategory as an, JsonWebKeyLike as ar, SettingsSource as at, GrantScope as b, allOf as bn, RelatedCondition as br, decideSupportSession as bt, BreakGlassOptions as c, WireDecision as cn, SharedCustomRole as cr, TenantSettings as ct, ClosureContext as d, PolicyScopesInput as dn, ActorKind as dr, TokenVerifier as dt, DecisionEvent as en, Binding as er, MembershipSource as et, ClosureGrantFn as f, Scope as fn, AdapterId as fr, VerificationFailure as ft, GrantCondition as g, Approver as gn, ConditionValue as gr, SupportSession as gt, Grant as h, AnyOfApprover as hn, ConditionRef as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, DirectoryEvent as in, GnapAccess as ir, RelationSource as it, PolicyVocabulary as j, authenticated as jn, DecideCredentialOptions as jt, PolicyOptions as k, anyone as kn, isSqlFunctionField as kr, CredentialPolicyViolation as kt, BreakGlassRequirements as l, WireDenial as ln, Subject as lr, TokenFailureCause as lt, DelegationTarget as m, ScopeNames as mn, Condition as mr, WhereCompiler as mt, ApprovalEscalation as n, DeliveryEvent as nn, CustomRoleGrant as nr, RelationGroup as nt, ApprovalStage as o, MembershipEvent as on, Membership as or, SnapshotSource as ot, DelegationInput as p, ScopeDeclaration as pn, MembershipVia as pr, VerifiedToken as pt, DecisionSink as q, Quota as qn, SnapshotGrant as qt, ApprovalMode as r, DeliveryFailureCause as rn, Delegation as rr, RelationHolder as rt, AssuranceRequirement as s, SinkEvent as sn, Principal as sr, SubjectResolver as st, ActivationOption as t, DeliveryChannel as tn, CustomRole as tr, RelationChain as tt, BreakGlassSpec as u, WireDelegation as un, VerifiedClaims as ur, TokenSigner as ut, GrantMeta as v, PermissionApprover as vn, MemberOfParent as vr, SupportSessionPolicy as vt, ObligationInput as w, Grantee as wn, SqlFunctionCondition as wr, CredentialDecision as wt, GrantValidity as x, anyOf as xn, RelatedHop as xr, parseSupportSession as xt, GrantOptions as y, UserApprover as yn, OpaqueCondition as yr, SupportSessionRequest as yt, SupportConsent as z, DenialDetails as zn, LocalCustomRoleTable as zt };
+export { LimitRemaining as $, Quota as $n, SnapshotGrant as $t, PolicyScopes as A, Grantee as An, SqlFunctionCondition as Ar, CredentialDecision as At, ValidateMode as B, relation as Bn, decideCredential as Bt, MembershipFixture as C, ApproverInput as Cn, MemberOfCondition as Cr, SupportSessionDecision as Ct, PolicyDelegation as D, anyOf as Dn, RelatedHop as Dr, parseSupportSession as Dt, PolicyAppDataSchemas as E, allOf as En, RelatedCondition as Er, decideSupportSession as Et, RoleScope as F, anyone as Fn, isSqlFunctionField as Fr, CredentialPolicyViolation as Ft, CustomRoleSource as G, DenialDetails as Gn, LocalCustomRoleTable as Gt, WireValidity as H, ApprovalRequiredDecision as Hn, parseCredential as Ht, SeparationConflict as I, assurance as In, CredentialRequest as It, DecisionSink as J, ExplainedDecision as Jn, LocalRowValue as Jt, CustomRoleSourceFactory as K, DenialReason as Kn, LocalMembershipRows as Kt, SubjectOf as L, authenticated as Ln, DecideCredentialOptions as Lt, PrincipalOf as M, InheritGrantee as Mn, isCondition as Mr, CredentialPermission as Mt, RoleBinding as N, RelationGrantee as Nn, isConditionDate as Nr, CredentialPermissionInput as Nt, PolicyOAuthScope as O, holder as On, RestrictedAncestors as Or, ApiKeyPrincipal as Ot, RoleOptions as P, actor as Pn, isConditionRef as Pr, CredentialPolicy as Pt, LimitConsumeInput as Q, Obligation as Qn, SnapshotAssignable as Qt, SupportAccessOptions as R, inherit as Rn, credentialDelegation as Rt, HostedGrantRef as S, Approver as Sn, ConditionValue as Sr, SupportSession as St, Policy as T, UserApprover as Tn, OpaqueCondition as Tr, SupportSessionRequest as Tt, CredentialVerifier as U, Decision as Un, InstanceHandle as Ut, VocabularyFromInput as V, AppObligation as Vn, isFeedId as Vt, CustomRoleContext as W, Denial as Wn, Instant as Wt, Intent as X, LimitDetail as Xn, LocalSnapshotRows as Xt, EntitlementSource as Y, GrantedDecision as Yn, LocalSnapshotManifest as Yt, JwtClaims as Z, MatchedGrant as Zn, Snapshot as Zt, GrantLimit as _, PolicyScopesInput as _n, ActorKind as _r, VerifiedToken as _t, ApprovalRequirement as a, CredentialEvent as an, AuthorizationDetail as ar, RelationHolder as at, GrantScope as b, ScopeNames as bn, Condition as br, WhereCompiler as bt, BreakGlassOptions as c, DeliveryEvent as cn, CustomRoleGrant as cr, SnapshotSource as ct, ClosureContext as d, EmailCategory as dn, JsonWebKeyLike as dr, SubjectResolver as dt, SnapshotNotEntitled as en, Trace as er, LimitStore as et, ClosureGrantFn as f, MembershipEvent as fn, Membership as fr, TenantSettings as ft, GrantCondition as g, WireDelegation as gn, VerifiedClaims as gr, VerificationFailure as gt, Grant as h, WireDenial as hn, Subject as hr, TokenVerifier as ht, ApprovalOption as i, AutomationEvent as in, Assurance as ir, RelationGroup as it, PolicyVocabulary as j, GranteeInput as jn, hasConditionOp as jr, CredentialKind as jt, PolicyOptions as k, user as kn, SqlFunctionArg as kr, Credential as kt, BreakGlassRequirements as l, DeliveryFailureCause as ln, Delegation as lr, SourceContext as lt, DelegationTarget as m, WireDecision as mn, SharedCustomRole as mr, TokenSigner as mt, ApprovalEscalation as n, AccessEvent as nn, TraceSkipReason as nr, MembershipSource as nt, ApprovalStage as o, DecisionEvent as on, Binding as or, RelationSource as ot, DelegationInput as p, SinkEvent as pn, Principal as pr, TokenFailureCause as pt, DecisionProvider as q, DeniedDecision as qn, LocalRowColumn as qt, ApprovalMode as r, AuthEvent as rn, Actor as rr, RelationChain as rt, AssuranceRequirement as s, DeliveryChannel as sn, CustomRole as sr, SettingsSource as st, ActivationOption as t, SnapshotScope as tn, TraceSkip as tr, MemberEntry as tt, BreakGlassSpec as u, DirectoryEvent as un, GnapAccess as ur, SourceMemo as ut, GrantMeta as v, Scope as vn, AdapterId as vr, VersionContext as vt, ObligationInput as w, PermissionApprover as wn, MemberOfParent as wr, SupportSessionPolicy as wt, GrantValidity as x, AnyOfApprover as xn, ConditionRef as xr, DecideSupportSessionOptions as xt, GrantOptions as y, ScopeDeclaration as yn, MembershipVia as yr, VersionQuery as yt, SupportConsent as z, plan as zn, credentialPolicyViolation as zt };