permdock 0.7.0 → 0.9.0

package/dist/{types-DC44-hqb.d.ts → types-DLvhVm1r.d.ts}

@@ -1,5 +1,5 @@
-import { Dn as RelationGrantee, Rt as Instant, fr as AdapterId, gn as Approver, lr as Subject, o as ApprovalStage, or as Membership, r as ApprovalMode, un as WireDelegation } from "./policy-types-B-F-qAZk.js";
-import { O as AppData } from "./permission-types-DhNEmoRG.js";
+import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
@@ -12,30 +12,42 @@ type ApprovalApprovers = {
   readonly distinct?: boolean;
   /** Set when the approval no longer applies once the row's `version` changes. */
   readonly staleOn?: "resource-change";
-  /** Distinct approvers of `by` needed before `status` becomes `approved`; absent means 1. */
+  /**
+   * Distinct approvers of `by` needed before `status` becomes `approved`;
+   * absent means 1.
+   */
   readonly quorum?: number;
-  /** Who else may approve once the request has waited `after` seconds since `createdAt`. */
+  /**
+   * Who else may approve once the request has waited `after` seconds since
+   * `createdAt`.
+   */
   readonly escalation?: {
     readonly after: number;
     readonly to: Approver | readonly Approver[];
   };
 };
-/** One recorded approval: who gave it, when, and under `stages` the index of the stage it counts for. */
+/**
+ * One recorded approval: who gave it, when, and under `stages` the index of the
+ * stage it counts for.
+ */
 type ApprovalSignature = {
   readonly by: string;
   readonly at: string;
   readonly stage?: number;
   readonly vouched?: string;
-  /** The principal `by` approved for, when `by` acted under an `ApprovalDelegation`. */
+  /**
+   * The principal `by` approved for, when `by` acted under an
+   * `ApprovalDelegation`.
+   */
   readonly onBehalfOf?: string;
   /** The `ApprovalDelegation` id `onBehalfOf` was read from. */
   readonly delegation?: string;
 };
 /**
- * One out-of-office delegation: `delegate` may approve what `delegator`
- * could approve, from `from` until `until`. Both instants are required, so
- * a delegation cannot be open-ended. `permissions` and `resources` narrow
- * it; absent, it covers every request. `tenant` holds it to one tenant.
+ * One out-of-office delegation: `delegate` may approve what `delegator` could
+ * approve, from `from` until `until`. Both instants are required, so a
+ * delegation cannot be open-ended. `permissions` and `resources` narrow it;
+ * absent, it covers every request. `tenant` holds it to one tenant.
  */
 type ApprovalDelegation = {
   readonly id: string;
@@ -57,12 +69,12 @@ type ApprovalDelegation = {
 type ApprovalDelegationSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  delegationsFor(query: {
+  delegationsFor: (query: {
     readonly delegate: string;
     readonly tenant?: string;
     /** RFC 3339. The source returns delegations active at this instant. */
     readonly at: string;
-  }): readonly ApprovalDelegation[] | Promise<readonly ApprovalDelegation[]>;
+  }) => readonly ApprovalDelegation[] | Promise<readonly ApprovalDelegation[]>;
 };
 type ApprovalSubjectSummary = {
   readonly principal: {
@@ -97,15 +109,24 @@ type ApprovalRequest = {
   readonly createdAt: string;
   readonly expiresAt: string;
   readonly status: ApprovalStatus;
-  /** Approvals given so far, oldest first; the request is `approved` once there are `approvers.quorum` of them. */
+  /**
+   * Approvals given so far, oldest first; the request is `approved` once there
+   * are `approvers.quorum` of them.
+   */
   readonly approvals?: readonly ApprovalSignature[];
   readonly resolvedAt?: string;
-  /** The approver whose verdict resolved the request (the last of `approvals` on a quorum), or `system:<by>` for a cancellation. */
+  /**
+   * The approver whose verdict resolved the request (the last of `approvals` on
+   * a quorum), or `system:<by>` for a cancellation.
+   */
   readonly resolvedBy?: string;
   readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
-  /** The application's own data, set when the request opens; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, set when the request opens; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
 };
 type ApprovalVerdict = {
@@ -120,8 +141,8 @@ type ApprovalVerdict = {
    */
   readonly relations?: readonly string[];
   /**
-   * The `holder(permission)` approvers (by permission key) that `by` holds
-   * in the request's tenant, as `approverPermissions` read them from the
+   * The `holder(permission)` approvers (by permission key) that `by` holds in
+   * the request's tenant, as `approverPermissions` read them from the
    * approver's own instance. Server-side input, never from the request body.
    * Absent means none, so permission approvers match nobody.
    */
@@ -130,8 +151,8 @@ type ApprovalVerdict = {
   /**
    * Set when `by` is not an approver and acts for this principal under an
    * `ApprovalDelegation`. Server-side input: the handler resolves the
-   * delegator, and `applyApprovalVerdict` checks them again. `relations`
-   * and `permissions` are that principal's facts, never the delegate's.
+   * delegator, and `applyApprovalVerdict` checks them again. `relations` and
+   * `permissions` are that principal's facts, never the delegate's.
    */
   readonly onBehalfOf?: {
     readonly subject: Subject;
@@ -169,28 +190,28 @@ type ApprovalStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
   /**
-   * Seconds a request opened against this store stays open when the
-   * caller sets no `ttl`; absent means `DEFAULT_APPROVAL_TTL`. A grant's
-   * `approval.ttl` still caps it.
+   * Seconds a request opened against this store stays open when the caller sets
+   * no `ttl`; absent means `DEFAULT_APPROVAL_TTL`. A grant's `approval.ttl`
+   * still caps it.
    */
   readonly ttl?: number;
-  create(request: ApprovalRequest): Promise<void> | void;
-  get(token: string): Promise<ApprovalRequest | null> | ApprovalRequest | null;
+  create: (request: ApprovalRequest) => Promise<void> | void;
+  get: (token: string) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
   /**
    * The request with this `id`, for `approvalsHandler`, which routes by id.
    * Without it the handler pages through `list` to find the id.
    */
-  getById?(id: string): Promise<ApprovalRequest | null> | ApprovalRequest | null;
-  resolve(token: string, verdict: ApprovalVerdict): Promise<ApprovalRequest> | ApprovalRequest;
-  list(query: ApprovalListQuery): Promise<ApprovalPage> | ApprovalPage;
-  expire(now?: Instant): Promise<number> | number;
+  getById?: (id: string) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
+  resolve: (token: string, verdict: ApprovalVerdict) => Promise<ApprovalRequest> | ApprovalRequest;
+  list: (query: ApprovalListQuery) => Promise<ApprovalPage> | ApprovalPage;
+  expire: (now?: Instant) => Promise<number> | number;
   /**
    * Marks an approved, unexpired, unconsumed request consumed and returns it;
    * returns `null` otherwise. Must be atomic: two concurrent calls for one
    * token never both return the request.
    */
-  consume(token: string, now?: Instant): Promise<ApprovalRequest | null> | ApprovalRequest | null;
-  cancel?(filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number> | number;
+  consume: (token: string, now?: Instant) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
+  cancel?: (filter: ApprovalListFilter, meta: ApprovalCancelMeta) => Promise<number> | number;
 };
 type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
 type ApprovalInspectResult = {
@@ -201,9 +222,15 @@ type ApprovalInspectResult = {
   readonly cause: ApprovalResumeFailureCause;
 };
 declare const APPROVAL_HEADER: "PermDock-Approval";
-/** Seconds a request stays open when neither the store nor the call sets a `ttl`. */
+/**
+ * Seconds a request stays open when neither the store nor the call sets a
+ * `ttl`.
+ */
 declare const DEFAULT_APPROVAL_TTL: number;
-/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
+/**
+ * The approvals a request needs in total: `approvers.quorum` (or 1), or the sum
+ * of its stages' quorums.
+ */
 declare function approvalQuorum(request: ApprovalRequest): number;
 /**
  * The instant from which `approvers.escalation.to` may approve, in epoch

package/dist/{types-D3A19w4A.d.ts → types-DlelvQk4.d.ts}

@@ -1,6 +1,6 @@
-import { Hn as ExplainedDecision, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, or as Membership, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as PermDock, c as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions, u as WhereResult, x as PermissionCheck } from "./permdock-Dco6dyCK.js";
+import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -40,9 +40,9 @@ type RemotePdpOptions = {
   readonly fetch?: typeof fetch;
 };
 /**
- * One tuple callback per delegated permission. The callback receives the
- * row for a check and `undefined` for a listing; returning `null` denies
- * with `pdp-denied`, throwing denies with `pdp-invalid-response`.
+ * One tuple callback per delegated permission. The callback receives the row
+ * for a check and `undefined` for a listing; returning `null` denies with
+ * `pdp-denied`, throwing denies with `pdp-invalid-response`.
  */
 type RelationMap<T> = readonly (readonly [Permission, (subject: Subject, data: unknown) => T | null])[];
 type OpenFgaTuple = {
@@ -90,25 +90,34 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   /** `permdock.derive` with the same providers: the result asks the PDP too. */
   readonly derive: (options: DeriveOptions) => Promise<PdpPermDock<V>>;
   /**
-   * For a delegated permission whose provider lists ids, an `in` over them
-   * (AND the local condition when local grants exist); otherwise the local
-   * `where`, or an always-false `partial` result.
+   * For a delegated permission whose provider lists ids, an `in` over them (AND
+   * the local condition when local grants exist); otherwise the local `where`,
+   * or an always-false `partial` result.
    */
   readonly where: (permission: Permission) => Promise<WhereResult>;
   readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
   readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
-  /** `can` for every check, asking the PDP for each in parallel; `false` for an empty list. */
+  /**
+   * `can` for every check, asking the PDP for each in parallel; `false` for an
+   * empty list.
+   */
   readonly canAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<boolean>;
-  /** `decide` for every check, in check order, asking the PDP for each in parallel. */
+  /**
+   * `decide` for every check, in check order, asking the PDP for each in
+   * parallel.
+   */
   readonly decideAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<readonly Decision[]>;
   /** `decide` for each row, in row order, asking the PDP per row. */
   readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => Promise<readonly Decision[]>;
   readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {
     readonly outcome: "granted";
   }>>;
-  /** `decide` with a trace of the local grants; a decision the remote PDP made carries an empty trace. */
+  /**
+   * `decide` with a trace of the local grants; a decision the remote PDP made
+   * carries an empty trace.
+   */
   readonly explain: (permission: Permission, data?: unknown, options?: Omit<DecideOptions, "explain">) => Promise<ExplainedDecision>;
-  readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
+  readonly filter: <T>(permission: Permission<string, NoInfer<T>, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
   readonly simulate: {
     (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Promise<readonly Decision[]>;
     (preview: {

package/dist/{types-cTos-H7p.d.ts → types-DsHGPtkR.d.ts}

@@ -1,8 +1,8 @@
-import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/types.d.ts
 type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
@@ -24,7 +24,10 @@ type JwksCacheOptions = {
   readonly minTtl?: number;
   readonly maxTtl?: number;
   readonly cooldown?: number;
-  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  /**
+   * Milliseconds a discovery or JWKS request may take before it counts as
+   * failed. Default 5000.
+   */
   readonly timeout?: number;
 };
 type JoseTokenVerifierOptions = {
@@ -47,7 +50,10 @@ type JoseTokenSignerOptions = {
   readonly kid: string;
   /** `iss` of every output; required. */
   readonly issuer: string;
-  /** `aud` for an output whose `sign` call names none; without either, `sign` rejects. */
+  /**
+   * `aud` for an output whose `sign` call names none; without either, `sign`
+   * rejects.
+   */
   readonly audience?: string | readonly string[];
 };
 type JwtDelegationPaths = {
@@ -69,11 +75,17 @@ type JwtSubjectOptions = Omit<JoseTokenVerifierOptions, "audience"> & {
   readonly actor?: {
     readonly from?: "act";
     readonly kind?: string;
-    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    /**
+     * Names for client ids (`ClientNames`): the actor gets `client` set to
+     * the name of `act.sub`.
+     */
     readonly clients?: ClientNames;
   } | ((claims: JwtClaims) => Actor | undefined);
   readonly sender?: "none" | "dpop" | "mtls";
-  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  /**
+   * With `sender: "dpop"`, rejects a proof `jti` already used by the same key
+   * within 60 seconds.
+   */
   readonly replay?: ReplayStore;
   readonly memberships?: MembershipSource;
   readonly verifier?: TokenVerifier;
@@ -101,7 +113,10 @@ type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-
 /** The RISC 1.0 event types PermDock treats as a revocation of every session. */
 type RiscEventName = "account-disabled" | "account-purged" | "credential-compromise";
 type SsfEventName = CaepEventName | RiscEventName;
-/** An SSF 1.0 stream `verification` event: the `state` the receiver asked the transmitter to echo. */
+/**
+ * An SSF 1.0 stream `verification` event: the `state` the receiver asked the
+ * transmitter to echo.
+ */
 type SsfVerification = {
   readonly state?: string;
   readonly jti: string;
@@ -130,7 +145,10 @@ type SsfEventInput = {
 type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
 type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
   readonly "*"?: SsfEventHandler;
-  /** SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a subject. */
+  /**
+   * SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a
+   * subject.
+   */
   readonly verification?: (input: SsfVerification) => void | Promise<void>;
 };
 /**
@@ -141,12 +159,12 @@ type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
 type ReplayStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  seen(key: string): boolean | Promise<boolean>;
-  remember(key: string, expiresAt?: number): void | Promise<void>;
+  seen: (key: string) => boolean | Promise<boolean>;
+  remember: (key: string, expiresAt?: number) => void | Promise<void>;
   /** Records `key` and returns `true` only if it was not already recorded. */
-  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  claim?: (key: string, expiresAt?: number) => boolean | Promise<boolean>;
   /** Forgets a claimed `key` so a failed delivery can be retried. */
-  release?(key: string): void | Promise<void>;
+  release?: (key: string) => void | Promise<void>;
 };
 type SsfAuditEvent = {
   readonly type: string;
@@ -193,22 +211,25 @@ type SsfPermDockOptions = {
   readonly revocations?: RevocationFeed;
   readonly clockTolerance?: number;
   /**
-   * Seconds a SET without `exp` is accepted after its `iat`; default one
-   * day. The replay record is kept at least that long, so a replayed SET
-   * is refused for as long as its signature would verify.
+   * Seconds a SET without `exp` is accepted after its `iat`; default one day.
+   * The replay record is kept at least that long, so a replayed SET is refused
+   * for as long as its signature would verify.
    */
   readonly maxTokenAge?: number;
 };
 type SsfReceiver = {
-  push(request: Request): Promise<Response>;
-  logout(request: Request): Promise<Response>;
-  poll(options: PollOptions): Promise<PollResult> | PollHandle;
-  on(event: "event", handler: SsfEventListener): () => void;
+  push: (request: Request) => Promise<Response>;
+  logout: (request: Request) => Promise<Response>;
+  poll: (options: PollOptions) => Promise<PollResult> | PollHandle;
+  on: (event: "event", handler: SsfEventListener) => () => void;
 };
 type SsfPermDock = {
   readonly receiver: SsfReceiver;
 };
-/** One event of a SET: the event-type URI, the RFC 9493 subject and the event's own claims. */
+/**
+ * One event of a SET: the event-type URI, the RFC 9493 subject and the event's
+ * own claims.
+ */
 type SetEvent = {
   readonly type: string;
   readonly subject: SetSubject;
@@ -237,7 +258,10 @@ type SignSetOptions = {
   /** `iat`, NumericDate seconds; the signer's clock when absent. */
   readonly issuedAt?: number;
 };
-/** Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a transport failure. */
+/**
+ * Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a
+ * transport failure.
+ */
 type SetDeliveryFailureCause = "invalid-request" | "invalid-key" | "invalid-issuer" | "invalid-audience" | "authentication-failed" | "access-denied" | "unavailable";
 type SetDelivery = {
   readonly ok: true;
@@ -245,13 +269,22 @@ type SetDelivery = {
   readonly ok: false;
   readonly cause: SetDeliveryFailureCause;
   readonly description?: string;
-  /** `true` when the same SET may be pushed again: a network failure, a timeout or a `5xx`. */
+  /**
+   * `true` when the same SET may be pushed again: a network failure, a
+   * timeout or a `5xx`.
+   */
   readonly retry: boolean;
 };
 type PushSetOptions = {
-  /** The receiver's RFC 8935 push endpoint, the stream's `delivery.endpoint_url`. */
+  /**
+   * The receiver's RFC 8935 push endpoint, the stream's
+   * `delivery.endpoint_url`.
+   */
   readonly endpoint: string;
-  /** The `Authorization` header value, the stream's `delivery.authorization_header`. */
+  /**
+   * The `Authorization` header value, the stream's
+   * `delivery.authorization_header`.
+   */
   readonly authorization?: string;
   readonly fetch?: typeof fetch;
   readonly signal?: AbortSignal;
@@ -268,21 +301,24 @@ type SetError = {
 type SetQueue = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  enqueue(stream: string, jti: string, set: string): void | Promise<void>;
+  enqueue: (stream: string, jti: string, set: string) => void | Promise<void>;
   /** Up to `max` pending SETs, oldest first. */
-  pending(stream: string, max: number): readonly {
+  pending: (stream: string, max: number) => readonly {
     readonly jti: string;
     readonly set: string;
   }[] | Promise<readonly {
     readonly jti: string;
     readonly set: string;
   }[]>;
-  ack(stream: string, jti: string): void | Promise<void>;
-  fail(stream: string, jti: string, error: SetError): void | Promise<void>;
+  ack: (stream: string, jti: string) => void | Promise<void>;
+  fail: (stream: string, jti: string, error: SetError) => void | Promise<void>;
 };
 type SetPollHandlerOptions = {
   readonly queue: SetQueue;
-  /** The stream id the request's credentials may poll, or `null` to refuse it with `401`. */
+  /**
+   * The stream id the request's credentials may poll, or `null` to refuse it
+   * with `401`.
+   */
   readonly authorize: (request: Request) => string | null | Promise<string | null>;
   /** The largest `maxEvents` honoured; default 100. */
   readonly maxEvents?: number;

package/dist/{types-BXMYB7BY.d.ts → types-ZzRGoViD.d.ts}

@@ -1,5 +1,5 @@
-import { C as ResourceRelation } from "./permission-types-DhNEmoRG.js";
-import { s as OperationMeta } from "./operations-BNLes61x.js";
+import { C as ResourceRelation } from "./permission-types-CAY-GU7e.js";
+import { s as OperationMeta } from "./operations-Ci_rT6Uo.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -14,19 +14,33 @@ type CatalogPermission = {
   readonly arity: "instance" | "collection";
   readonly meta: Readonly<Record<string, unknown>>;
   readonly usages: readonly CatalogUsage[];
-  /** Keys the permission was renamed from (`definePermissions` `renamed`), sorted; absent when none. */
+  /**
+   * Keys the permission was renamed from (`definePermissions` `renamed`),
+   * sorted; absent when none.
+   */
   readonly renamedFrom?: readonly string[];
-  /** Level names a custom role may pick for the permission (`resource(…, { levels })`); absent when none. */
+  /**
+   * Level names a custom role may pick for the permission (`resource(…, {
+   * levels })`); absent when none.
+   */
   readonly levels?: readonly string[];
+  /**
+   * `true` when `levels` run from narrowest to widest (`resource(…, {
+   * orderedLevels: true })`); absent otherwise.
+   */
+  readonly orderedLevels?: true;
   /** Present only when the policy lists the permission in `hostable`. */
   readonly hostable?: true;
   /**
-   * `true` when a code grant for the key has a condition beyond role and
-   * scope, so the SQL helpers alone cannot enforce it, and when the catalog
-   * was built without the policy, which leaves it unknown.
+   * `true` when a code grant for the key has a condition beyond role and scope,
+   * so the SQL helpers alone cannot enforce it, and when the catalog was built
+   * without the policy, which leaves it unknown.
    */
   readonly rowConditions: boolean;
-  /** The approvals code allows on this permission require; a hosted grant must meet each. */
+  /**
+   * The approvals code allows on this permission require; a hosted grant must
+   * meet each.
+   */
   readonly approvals?: readonly CatalogApproval[];
   /** Present when a `breakGlass` override targets this permission. */
   readonly breakGlass?: CatalogBreakGlass;
@@ -72,7 +86,10 @@ type CatalogResource = {
     readonly field: string;
     readonly resource: string;
   }>>;
-  /** `'hide'` answers a denied check on a loaded row as if the row did not exist; absent for `'reveal'`. */
+  /**
+   * `'hide'` answers a denied check on a loaded row as if the row did not
+   * exist; absent for `'reveal'`.
+   */
   readonly disclosure?: "hide";
   readonly relations?: Readonly<Record<string, ResourceRelation>>;
   /** The row field an `approval: { staleOn: 'resource-change' }` binds to. */
@@ -97,7 +114,10 @@ type CatalogRole = {
   readonly for?: readonly string[];
   readonly exclusiveWith?: readonly string[];
   readonly audience?: string;
-  /** Present when the role is eligible-only and activated with `permdock.activate`. */
+  /**
+   * Present when the role is eligible-only and activated with
+   * `permdock.activate`.
+   */
   readonly activation?: CatalogActivation;
   /** Present when the role is a `supportAccess` role. */
   readonly supportAccess?: CatalogSupportAccess;
@@ -133,9 +153,9 @@ type CatalogValidity = {
   readonly until?: string;
 };
 /**
- * One code grant as the catalog carries it: the normalised shape
- * `definePolicy` produced, minus closures. `permdock diff` compares these;
- * a hosted document is authored against them.
+ * One code grant as the catalog carries it: the normalised shape `definePolicy`
+ * produced, minus closures. `permdock diff` compares these; a hosted document
+ * is authored against them.
  */
 type CatalogGrant = {
   readonly permission: string;
@@ -157,7 +177,10 @@ type CatalogGrant = {
   readonly validity?: CatalogValidity;
   readonly name?: string;
   readonly purpose?: readonly string[];
-  /** The permission key the subject must also hold through a role on the row's scope instance (`requires`). */
+  /**
+   * The permission key the subject must also hold through a role on the row's
+   * scope instance (`requires`).
+   */
   readonly requires?: string | readonly string[];
   readonly limit?: {
     readonly count: number;
@@ -165,9 +188,15 @@ type CatalogGrant = {
     readonly per: number;
     readonly mode?: "hard" | "soft";
   };
-  /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
+  /**
+   * Present when the grant is a closure, reads the relation graph or is opaque;
+   * `where` and `check` are then omitted.
+   */
   readonly portable?: false;
-  /** The grant's `meta`: a description plus the app's own `x`; absent when empty. */
+  /**
+   * The grant's `meta`: a description plus the app's own `x`; absent when
+   * empty.
+   */
   readonly meta?: Readonly<Record<string, unknown>>;
 };
 /** `permissions.catalog.json`, validated by `schemas/catalog-v1.json`. */
@@ -176,7 +205,10 @@ type CatalogDocument = {
   readonly version: 1;
   readonly generatedAt: string;
   readonly generator: string;
-  /** `catalogFingerprint` of this document; what hosted documents pin as `catalog`. */
+  /**
+   * `catalogFingerprint` of this document; what hosted documents pin as
+   * `catalog`.
+   */
   readonly fingerprint?: string;
   readonly resources: Readonly<Record<string, CatalogResource>>;
   readonly permissions: readonly CatalogPermission[];
@@ -186,28 +218,49 @@ type CatalogDocument = {
   readonly plans?: readonly {
     readonly key: string;
   }[];
-  /** Every code grant, canonically ordered; present when the catalog was built with the policy. */
+  /**
+   * Every code grant, canonically ordered; present when the catalog was built
+   * with the policy.
+   */
   readonly grants?: readonly CatalogGrant[];
-  /** The policy's standing delegations, canonically ordered; present when the policy declares any. */
+  /**
+   * The policy's standing delegations, canonically ordered; present when the
+   * policy declares any.
+   */
   readonly delegations?: readonly CatalogDelegation[];
-  /** The `defineOperations` map in definition order; present when the config names an `operations` module. */
+  /**
+   * The `defineOperations` map in definition order; present when the config
+   * names an `operations` module.
+   */
   readonly operations?: readonly CatalogOperation[];
-  /** The policy's coarse OAuth scopes, sorted by scope; present when the policy declares any. */
+  /**
+   * The policy's coarse OAuth scopes, sorted by scope; present when the policy
+   * declares any.
+   */
   readonly oauthScopes?: readonly CatalogOAuthScope[];
 };
-/** One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization server issues and the permission keys it covers, sorted by code point. */
+/**
+ * One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization
+ * server issues and the permission keys it covers, sorted by code point.
+ */
 type CatalogOAuthScope = {
   readonly scope: string;
   readonly permissions: readonly string[];
 };
-/** One `defineOperations` entry: its name, the permission keys it is bound to, and its meta. */
+/**
+ * One `defineOperations` entry: its name, the permission keys it is bound to,
+ * and its meta.
+ */
 type CatalogOperation = {
   readonly name: string;
   readonly permission: string;
   readonly results?: string;
   readonly meta: OperationMeta;
 };
-/** One `definePolicy({ delegations })` entry: who hands over, to which actor, which permission keys, and when. */
+/**
+ * One `definePolicy({ delegations })` entry: who hands over, to which actor,
+ * which permission keys, and when.
+ */
 type CatalogDelegation = {
   readonly from: unknown;
   readonly to: {