> ## Documentation Index > Fetch the complete documentation index at: https://docs.bijection.com/llms.txt > Use this file to discover all available pages before exploring further. # Module: access > Reference for the bijection/access entry point. ## Interfaces * [AccessDescription](https://docs.bijection.com/api/interfaces/access.AccessDescription.md) * [GenericAccessDefinition](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition.md) * [AccessResource](https://docs.bijection.com/api/interfaces/access.AccessResource.md) * [AccessBindingOwner](https://docs.bijection.com/api/interfaces/access.AccessBindingOwner.md) * [AccessExpression](https://docs.bijection.com/api/interfaces/access.AccessExpression.md) * [AccessArrayExpression](https://docs.bijection.com/api/interfaces/access.AccessArrayExpression.md) * [AccessContributionDefinition](https://docs.bijection.com/api/interfaces/access.AccessContributionDefinition.md) * [AccessContribution](https://docs.bijection.com/api/interfaces/access.AccessContribution.md) * [RequirementIndexRange](https://docs.bijection.com/api/interfaces/access.RequirementIndexRange.md) * [AccessProtection](https://docs.bijection.com/api/interfaces/access.AccessProtection.md) * [RequestOperations](https://docs.bijection.com/api/interfaces/access.RequestOperations.md) * [AuthorizationIndexOptions](https://docs.bijection.com/api/interfaces/access.AuthorizationIndexOptions.md) * [AllowancesReader](https://docs.bijection.com/api/interfaces/access.AllowancesReader.md) * [AllowancesWriter](https://docs.bijection.com/api/interfaces/access.AllowancesWriter.md) ## References ### bothAccessResults Renames and re-exports \_\_type *** ### servicePrincipal Renames and re-exports \_\_type *** ### AccessInspection Re-exports [AccessInspection](https://docs.bijection.com/api/modules/browser#accessinspection) *** ### AccessInspectionBasis Re-exports [AccessInspectionBasis](https://docs.bijection.com/api/modules/browser#accessinspectionbasis) *** ### AccessRecoveryOffer Re-exports [AccessRecoveryOffer](https://docs.bijection.com/api/modules/browser#accessrecoveryoffer) *** ### AccessTrace Re-exports [AccessTrace](https://docs.bijection.com/api/modules/browser#accesstrace) *** ### DisclosureArgs Re-exports [DisclosureArgs](https://docs.bijection.com/api/modules/server#disclosureargs) *** ### ExecutionDescriptor Re-exports [ExecutionDescriptor](https://docs.bijection.com/api/modules/browser#executiondescriptor) *** ### ReadAccessArgs Re-exports [ReadAccessArgs](https://docs.bijection.com/api/modules/server#readaccessargs) ## Type Aliases ### RetainedPermission Ƭ **RetainedPermission**: `Object` Readonly evidence of an actual verified decision subject. The opaque value is bound to one model, resource check and application request. It cannot be used as a login, delegation, or permission to perform a mutation. #### Type declaration | Name | Type | | :- | :- | | `evidence` | `string` | | `allowed` | `boolean` | | `principal` | `string` | | `actor` | `string` | | `expiresAt` | `number` | *** ### AccessReadExecution Ƭ **AccessReadExecution**: \{ `kind`: `"key"` } | \{ `kind`: `"unbound"` } | \{ `kind`: `"native"` ; `ranges`: \{ `index`: `string` ; `field`: `string` ; `labels?`: `string` }\[] } Not exported: an exported type refers to it. *** ### AccessInstallation Ƭ **AccessInstallation**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `reads` | `string`\[] | | `read` | \{ `execution`: [`AccessReadExecution`](https://docs.bijection.com/api/modules/access#accessreadexecution) ; `appliesDelegation`: `boolean` } | | `read.execution` | [`AccessReadExecution`](https://docs.bijection.com/api/modules/access#accessreadexecution) | | `read.appliesDelegation` | `boolean` | | `write` | \{ `kind`: `"native"` ; `basis`: `"original"` \| `"final"` ; `appliesDelegation`: `boolean` } \| `null` | | `release` | \{ `kind`: `"native"` ; `appliesDelegation`: `boolean` } | | `release.kind` | `"native"` | | `release.appliesDelegation` | `boolean` | *** ### AssignmentListing Ƭ **AssignmentListing**: `Readonly`\<\{ `resourceType`: `string` ; `includeGroups`: `boolean` ; `index`: `"by_resource"` ; `order`: `"asc"` | `"desc"` ; `execution`: `"indexFilter"` }> *** ### AccessResourceDefinition Ƭ **AccessResourceDefinition**: `Omit`\<[`AccessTypeDefinition`](https://docs.bijection.com/api/modules/access#accesstypedefinition), `"table"` | `"erasable"` | `"parent"` | `"relations"` | `"read"` | `"unreadable"` | `"propertyRestrictions"` | `"immutable"` | `"write"` | `"fieldValidators"` | `"initialization"` | `"mutations"` | `"restrictions"` | `"integrity"` | `"conditions"` | `"resourceSets"` | typeof [`conditionRequiredFields`](https://docs.bijection.com/api/modules/access#conditionrequiredfields)> & \{ `parent?`: `string` ; `boundary?`: `"tenant"` ; `restrictions?`: \{ `root?`: \{ `type`: `string` ; `category`: `string` } } } Business meaning, independent of the table storing a resource. *** ### AccessDefinitionInput Ƭ **AccessDefinitionInput**: `Omit`\<[`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition), `"types"` | `"discoveries"` | `"observationSources"` | `"inputValidators"` | `"confer"` | `"requirements"` | `"conditions"`> & \{ `resources`: `Record`\<`string`, [`AccessResourceDefinition`](https://docs.bijection.com/api/modules/access#accessresourcedefinition)> ; `assignmentRules?`: [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition)\[`"confer"`] ; `requirements?`: `Record`\<`string`, [`AccessDefinitionRequirement`](https://docs.bijection.com/api/modules/access#accessdefinitionrequirement)> } One resource model; physical fields and indexes belong to schema bindings. *** ### AccessDefinitionRequirement Ƭ **AccessDefinitionRequirement**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `on` | readonly \[`string`, ...string\[]] | | `onOrigins?` | readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] | | `decision?` | `NonNullable`\<[`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition)\[`"requirements"`]>\[`string`]\[`"decision"`] | | `when?` | [`RequirementCondition`](https://docs.bijection.com/api/modules/access#requirementcondition) | *** ### AccessResourceBinding Ƭ **AccessResourceBinding**\<`Field`, `Permission`, `Document`, `Definition`, `Target`, `SourceOwned`>: `Omit`\<[`BoundAccessResourceBinding`](https://docs.bijection.com/api/modules/server#boundaccessresourcebinding)\<`Field`, `Permission`, `Document`, `Definition`, `Target`>, `"read"` | `"write"` | `"unreadable"` | `"immutable"` | `"propertyRestrictions"` | `"fieldValidators"` | `"initialization"` | `"mutations"` | `SourceOwned` extends `true` ? `"transitions"` | `"integrity"` : `never`> & \{ `document`: \{ `read`: [`AccessReadRequirement`](https://docs.bijection.com/api/modules/access#accessreadrequirement)\<`Permission`, `Field`, keyof `Definition`\[`"resources"`] & `string`> } & `SourceOwned` extends `true` ? \{ `create?`: `never` ; `delete?`: `never` } : \{ `create`: `Extract`\<`"create"`, `Permission`> | `false` ; `delete`: `Extract`\<`"delete"`, `Permission`> | `false` } ; `fields`: [`AccessFieldProtections`](https://docs.bijection.com/api/modules/access#accessfieldprotections)\<`Field`, `Permission`, keyof `Definition`\[`"resources"`] & `string`, `Document`, `SourceOwned`> ; `metadata?`: \{ `_creationTime?`: [`AccessReadRequirement`](https://docs.bijection.com/api/modules/access#accessreadrequirement)\<`Permission`, `Field`, keyof `Definition`\[`"resources"`] & `string`> | `false` } } & `SourceOwned` extends `true` ? \{ `transitions?`: `never` ; `integrity?`: `never` } : `unknown` Every field declares read protection. Locally owned tables also declare creation and update permissions; a source inherently owns those writes. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Permission` | extends `string` = `string` | | `Document` | `Record`\<`Field`, `string` \| `bigint` \| `boolean` \| readonly `string`\[] \| readonly `bigint`\[]> | | `Definition` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) = [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | | `Target` | extends `string` = `string` | | `SourceOwned` | extends `boolean` = `false` | *** ### AccessDocumentBinding Ƭ **AccessDocumentBinding**\<`Field`, `Permission`, `Document`, `Definition`, `Target`, `SourceOwned`>: `Omit`\<[`AccessResourceBinding`](https://docs.bijection.com/api/modules/access#accessresourcebinding)\<`Field`, `Permission`, `Document`, `Definition`, `Target`, `SourceOwned`>, `"document"` | `"fields"`> & \{ `document?`: `never` ; `fields?`: [`AccessFieldExceptions`](https://docs.bijection.com/api/modules/access#accessfieldexceptions)\<`Field`, `Permission`, keyof `Definition`\[`"resources"`] & `string`, `Document`, `SourceOwned`> } The short binding: the resource's `read`, `create`, `edit` and `delete` permissions apply to the document, unlisted fields follow it, and `fields` names only the exceptions. Everything else a binding declares (its parent, relations, labels, transitions, integrity, requirements) keeps its meaning. Declaring `document` selects the exhaustive `AccessResourceBinding`. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Permission` | extends `string` = `string` | | `Document` | `Record`\<`Field`, `string` \| `bigint` \| `boolean` \| readonly `string`\[] \| readonly `bigint`\[]> | | `Definition` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) = [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | | `Target` | extends `string` = `string` | | `SourceOwned` | extends `boolean` = `false` | *** ### SourceReadAccessBinding Ƭ **SourceReadAccessBinding**\<`Field`, `Permission`, `ParentField`>: `Object` One read permission over an explicit list of source-owned fields. Every unlisted field, including one a connector adds later, stays unreadable. Compiles to the ordinary document and field grants. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Permission` | extends `string` = `string` | | `ParentField` | extends `string` = `Field` | #### Type declaration | Name | Type | | :- | :- | | `read` | \{ `permission`: `Permission` ; `fields`: readonly `Field`\[] } | | `read.permission` | `Permission` | | `read.fields` | readonly `Field`\[] | | `parent?` | \{ `field`: `ParentField` ; `index?`: `string` } | | `parent.field` | `ParentField` | | `parent.index?` | `string` | *** ### PrincipalSourceTable Ƭ **PrincipalSourceTable**\<`Field`>: `Object` Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` | #### Type declaration | Name | Type | | :- | :- | | `[principalSource]` | `Field` | *** ### Binding Ƭ **Binding**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `table` | `Table` | | `options` | [`BoundAccessResourceBinding`](https://docs.bijection.com/api/modules/server#boundaccessresourcebinding) | *** ### ClassifiedRead Ƭ **ClassifiedRead**\<`R`, `Name`, `Field`>: `R` extends `false` ? `false` : \{ `permission`: `R` extends `string` ? `R` : `R` extends \{ `permission`: infer P } ? `P` : `never` ; `restrictions`: readonly (`R` extends \{ `restrictions`: readonly infer T\[] } ? `T` : `never` | \{ `type`: `Name` ; `field`: `Field` ; `allowed`: readonly `string`\[] })\[] } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `R` | `R` | | `Name` | extends `string` | | `Field` | extends `string` | *** ### ProfileCondition Ƭ **ProfileCondition**: \(`scope`: `Parameters`\<[`AccessTransitionCondition`](https://docs.bijection.com/api/modules/access#accesstransitioncondition)\<`Resource`, `Principal`, `Context`>>\[`0`]) => `AccessExpression` #### Type declaration ▸ \<`Resource`, `Principal`, `Context`>(`scope`): `AccessExpression` Not exported: an exported type refers to it. ##### Type parameters | Name | | :- | | `Resource` | | `Principal` | | `Context` | ##### Parameters | Name | Type | | :- | :- | | `scope` | `Parameters`\<[`AccessTransitionCondition`](https://docs.bijection.com/api/modules/access#accesstransitioncondition)\<`Resource`, `Principal`, `Context`>>\[`0`] | ##### Returns `AccessExpression` *** ### ReadPermission Ƭ **ReadPermission**\<`R`>: `R` extends `string` ? `R` : `R` extends \{ `permission`: infer P } ? `P` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `R` | *** ### ProfileReadCondition Ƭ **ProfileReadCondition**: \(`scope`: `Parameters`\<[`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition)\<`Resource`, `Principal`, `Context`>>\[`0`]) => `AccessExpression` #### Type declaration ▸ \<`Resource`, `Principal`, `Context`>(`scope`): `AccessExpression` Not exported: an exported type refers to it. ##### Type parameters | Name | | :- | | `Resource` | | `Principal` | | `Context` | ##### Parameters | Name | Type | | :- | :- | | `scope` | `Parameters`\<[`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition)\<`Resource`, `Principal`, `Context`>>\[`0`] | ##### Returns `AccessExpression` *** ### ClassifiedBinding Ƭ **ClassifiedBinding**\<`B`, `Name`, `Field`>: `Omit`\<`B`, `"document"` | `"fields"` | `"metadata"` | `"labels"` | `"transitions"` | `"requirements"`> & \{ `document`: `Omit`\<`B`\[`"document"`], `"read"`> & \{ `read`: [`ClassifiedRead`](https://docs.bijection.com/api/modules/access#classifiedread)\<`B`\[`"document"`]\[`"read"`], `Name`, `Field`> } ; `fields`: \{ \[K in keyof B\["fields"]]: Omit\ & Object } ; `labels`: \{ `field`: `Field` ; `type`: `Name` } ; `metadata?`: `B`\[`"metadata"`] extends \{ `_creationTime`: infer R } ? \{ `_creationTime`: [`ClassifiedRead`](https://docs.bijection.com/api/modules/access#classifiedread)\<`R`, `Name`, `Field`> } : `never` ; `requirements`: `B` extends \{ `requirements`: infer R } ? `R` : \{} & `Record`\<\`classification\_$\{Name}\`, \{ `on`: readonly [[`ReadPermission`](https://docs.bijection.com/api/modules/access#readpermission)\<`B`[``"document"``][``"read"``]\>] ; `when`: [`ProfileReadCondition`](https://docs.bijection.com/api/modules/access#profilereadcondition) \}\> ; `transitions`: `B` extends \{ `transitions`: infer T \} ? `T` : \{\} & `Record`\<\`classification\_$\{Name}\`, \{ `on`: readonly (`"create"` | `"update"` | `"move"`)\[] ; `when`: [`ProfileCondition`](https://docs.bijection.com/api/modules/access#profilecondition) }> } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `B` | extends `Binding` | | `Name` | extends `string` | | `Field` | extends `string` | *** ### ClassificationCategory Ƭ **ClassificationCategory**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `keys` | readonly `string`\[] | | `combine?` | `"all"` \| `"any"` | | `dominates?` | `Readonly`\<`Record`\<`string`, readonly `string`\[]>> | *** ### ClassificationKey Ƭ **ClassificationKey**\<`C`>: \{ \[K in keyof C & string]: \`$\{K}:$\{C\[K]\["keys"]\[number]}\` }\[keyof `C` & `string`] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `C` | extends `Record`\<`string`, [`ClassificationCategory`](https://docs.bijection.com/api/modules/access#classificationcategory)> | *** ### LabelRegistrySnapshot Ƭ **LabelRegistrySnapshot**: `Object` The organization's central label registry as `bijection organization label get --format json` prints it. A profile bound to it compiles exactly these categories; other fields are ignored. #### Type declaration | Name | Type | | :- | :- | | `organization_id` | `string` | | `revision` | `number` | | `categories` | readonly \{ `name`: `string` ; `combine`: `"all"` \| `"any"` ; `keys`: readonly `string`\[] ; `dominates?`: `Readonly`\<`Record`\<`string`, readonly `string`\[]>> }\[] | *** ### RegistryCategories Ƭ **RegistryCategories**\<`R`>: \{ \[K in R\["categories"]\[number] as K\["name"]]: Object } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `R` | extends [`LabelRegistrySnapshot`](https://docs.bijection.com/api/modules/access#labelregistrysnapshot) | *** ### RegistryBinding Ƭ **RegistryBinding**: `Readonly`\<\{ `organization`: `string` ; `revision`: `number` }> Not exported: an exported type refers to it. *** ### ClassificationProfile Ƭ **ClassificationProfile**\<`Name`, `Required`, `C`>: `ReturnType`\ A compiled classification profile. #### Type parameters | Name | Type | | :- | :- | | `Name` | extends `string` | | `Required` | extends readonly `string`\[] | | `C` | extends `Record`\<`string`, [`ClassificationCategory`](https://docs.bijection.com/api/modules/access#classificationcategory)> | *** ### Selection Ƭ **Selection**: \{ readonly \[K in keyof C & string]?: readonly C\[K]\["keys"]\[number]\[] } Not exported: an exported type refers to it. *** ### Destination Ƭ **Destination**: [`DisclosureArgs`](https://docs.bijection.com/api/modules/server#disclosureargs)\[`"destination"`] Not exported: an exported type refers to it. *** ### ComponentInstallationAccessRequest Ƭ **ComponentInstallationAccessRequest**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `component` | `string` \| [`DeclarationReference`](https://docs.bijection.com/api/modules/server#declarationreference)\<`string`> | | `worker?` | `never` | | `custody` | `boolean` | | `effects` | `Readonly`\<`Record`\<`string`, `never`>> | *** ### ComponentWorkerAccessRequest Ƭ **ComponentWorkerAccessRequest**\<`Effects`>: `Object` #### Type parameters | Name | Type | | :- | :- | | `Effects` | extends `string` = `string` | #### Type declaration | Name | Type | Description | | :- | :- | :- | | `component` | `string` | - | | `worker` | `string` | - | | `relative` | `boolean` | - | | `custody` | `true` | - | | `effects` | readonly `Effects`\[] \| `null` | null exists only in initial symbolic references. Native admission always resolves the worker and validates the named effects against its analysis. | *** ### ComponentAccessRequest Ƭ **ComponentAccessRequest**: [`ComponentInstallationAccessRequest`](https://docs.bijection.com/api/modules/access#componentinstallationaccessrequest) | [`ComponentWorkerAccessRequest`](https://docs.bijection.com/api/modules/access#componentworkeraccessrequest) *** ### ComponentWorkConsentOptions Ƭ **ComponentWorkConsentOptions**\<`Effects`>: `Object` #### Type parameters | Name | Type | | :- | :- | | `Effects` | extends `string` = `string` | #### Type declaration | Name | Type | | :- | :- | | `retain?` | `boolean` | | `effects?` | readonly `Effects`\[] | *** ### ComponentDataConsent Ƭ **ComponentDataConsent**: `Object` The host's consent to one request, for rows of the `from` resources. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `request` | [`ComponentAccessRequest`](https://docs.bijection.com/api/modules/access#componentaccessrequest) | - | | `from` | readonly `string`\[] | - | | `custody?` | `boolean` | Consent to the component's scheduled work holding these rows. | | `effects?` | readonly `string`\[] | The request's effects consented to, by name. | *** ### CompiledComponentBinding Ƭ **CompiledComponentBinding**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `component` | `string` | | `worker` | `string` \| `null` | | `relative` | `boolean` | | `from` | `Set`\<`string`> | | `custody` | `boolean` | | `effects` | \{ `name`: `string` }\[] | *** ### ComponentWorkBinding Ƭ **ComponentWorkBinding**: `Omit`\<[`ComponentDataConsent`](https://docs.bijection.com/api/modules/access#componentdataconsent), `"from"`> The host's consent to one request in a hand-written destination rule, which decides its own table's rows. *** ### AccessClaimType Ƭ **AccessClaimType**: `"String"` | `"Long"` | `"Bool"` | `"Set"` | `"Set"` Not exported: an exported type refers to it. *** ### CompiledConferEnvelope Ƭ **CompiledConferEnvelope**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `permission` | `string` | | `roles` | \{ `kind`: `"exact"` ; `role`: `RoleRef` } \| \{ `kind`: `"permissions"` ; `type`: `string` ; `permissions`: \{ `kind`: `"all"` } \| \{ `kind`: `"only"` ; `permissions`: `string`\[] } } \| \{ `kind`: `"tenant"` ; `type`: `string` } | | `recipients` | [`ConferRecipientKind`](https://docs.bijection.com/api/modules/server#conferrecipientkind)\[] | | `operations` | [`ConferOperation`](https://docs.bijection.com/api/modules/server#conferoperation)\[] | | `maxDuration?` | `number` | | `selfOnly?` | `boolean` | | `when?` | [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) | *** ### AssignmentHolder Ƭ **AssignmentHolder**: \{ `holderKind`: `"person"` | `"service"` ; `holderKey`: `string` ; `holderType?`: `never` ; `holderPermission?`: `never` ; `holderProgram?`: `never` } | \{ `holderKind`: `"group"` ; `holderKey`: `string` ; `holderType`: `string` ; `holderPermission`: `string` ; `holderProgram?`: `never` } | \{ `holderKind`: `"program"` ; `holderKey`: `string` ; `holderProgram`: [`ProgramGrantRef`](https://docs.bijection.com/api/modules/access#programgrantref) ; `holderType?`: `never` ; `holderPermission?`: `never` } Not exported: an exported type refers to it. *** ### AssignmentDocument Ƭ **AssignmentDocument**: [`AssignmentHolder`](https://docs.bijection.com/api/modules/access#assignmentholder) & \{ `_id`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `type`: `string` ; `key`: `string` ; `role`: `RoleRef` ; `expiresAt?`: `number` ; `_creationTime?`: `number` ; `reason?`: `string` } *** ### AccessCtx Ƭ **AccessCtx**: `Object` The context a rule or helper needs. Every query context satisfies it. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `auth` | [`Auth`](https://docs.bijection.com/api/interfaces/server.Auth) | - | | `db` | [`SelectableDatabaseReader`](https://docs.bijection.com/api/interfaces/server.SelectableDatabaseReader)\<`any`> | - | | `sources?` | `Pick`\<[`Sources`](https://docs.bijection.com/api/interfaces/sources.Sources), `"evidence"`> | The coverage of the sources that publish directory rows. Without it, no directory row confers a role. A rule decides from coverage alone; the acquisition schedule is not readable inside one. | | `audit?` | (`body`: [`AuditLogBody`](https://docs.bijection.com/api/modules/access#auditlogbody)) => `Promise`\<`void`> | Where audit records go; `log.audit` unless given. | *** ### AccessMutationCtx Ƭ **AccessMutationCtx**: `Object` The context of the grant mutation helpers. #### Type declaration | Name | Type | | :- | :- | | `auth` | [`Auth`](https://docs.bijection.com/api/interfaces/server.Auth) | | `db` | `Omit`\<[`GenericDatabaseWriter`](https://docs.bijection.com/api/interfaces/server.GenericDatabaseWriter)\<`any`>, `"query"`> & [`SelectableDatabaseReader`](https://docs.bijection.com/api/interfaces/server.SelectableDatabaseReader)\<`any`> | | `scheduler` | [`Scheduler`](https://docs.bijection.com/api/interfaces/server.Scheduler) | | `audit?` | (`body`: [`AuditLogBody`](https://docs.bijection.com/api/modules/access#auditlogbody)) => `Promise`\<`void`> | *** ### AccessRefusalReason Ƭ **AccessRefusalReason**: `"unauthenticated"` | `"narrowed"` | `"absent"` | `"restricted"` | `"condition"` | `"requirement"` | `"evidence_unavailable"` | `"no_authority"` | `"policy"` A policy refusal is a decision; an execution failure still throws. *** ### AccessDecision Ƭ **AccessDecision**: \{ `kind`: `"allowed"` ; `validUntil`: `number` | `null` } | \{ `kind`: `"denied"` ; `code`: `"not_authorized"` } | \{ `kind`: `"unavailable"` ; `code`: `"evaluation_failed"` } A disclosed permission result. Private provenance is never included. *** ### PermissionResult Ƭ **PermissionResult**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `outcome` | [`AuthorizationOutcome`](https://docs.bijection.com/api/modules/access_cedar#authorizationoutcome) | | `validUntil` | `number` \| `null` | *** ### AccessCheck Ƭ **AccessCheck**: `Object` One permission check of a batch: `permission` on the object `key` of `type`, as `require` takes them. #### Type declaration | Name | Type | | :- | :- | | `permission` | `string` | | `type` | `string` | | `key` | `string` | *** ### AccessContractContext Ƭ **AccessContractContext**: `Readonly`\<`Pick`\<[`Compiled`](https://docs.bijection.com/api/modules/access#compiled), `"session"` | `"users"` | `"guests"` | `"services"` | `"assignments"` | `"roles"`>> Schema-authoring facts only. This context contains no caller or verdict. *** ### ContractRequirement Ƭ **ContractRequirement**: [`Term`](https://docs.bijection.com/api/modules/access#term)\<[`AuthorityObligation`](https://docs.bijection.com/api/modules/access#authorityobligation)> *** ### ContractCase Ƭ **ContractCase**: `Readonly`\<\{ `on`: `"create"` | `"update"` | `"delete"` ; `changes`: readonly `string`\[] ; `require`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) }> *** ### ContractStorage Ƭ **ContractStorage**: `Readonly`\<\{ `table`: `string` ; `schema`: [`ValidatorJSON`](https://docs.bijection.com/api/modules/values#validatorjson) ; `indexes`: `Readonly`\<`Record`\<`string`, readonly `string`\[]>> ; `inputs`: readonly `string`\[] ; `read`: [`ReadProgram`](https://docs.bijection.com/api/modules/access_cedar#readprogram) ; `guard`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) ; `signatures`: `Readonly`\<`Record`\<`string`, `Readonly`\<\{ `publicKey`: `string` ; `usages`: readonly `string`\[] }>>> }> *** ### RecordContractDeclaration Ƭ **RecordContractDeclaration**: `Readonly`\<\{ `storage`: [`ContractStorage`](https://docs.bijection.com/api/modules/access#contractstorage) ; `kind`: `"record"` ; `cases`: `Readonly`\<`Record`\<`string`, [`ContractCase`](https://docs.bijection.com/api/modules/access#contractcase)>> }> *** ### ReviewedContractDeclaration Ƭ **ReviewedContractDeclaration**: `Readonly`\<\{ `storage`: [`ContractStorage`](https://docs.bijection.com/api/modules/access#contractstorage) ; `kind`: `"reviewed"` ; `state`: `Readonly`\<\{ `field`: `string` ; `proposed`: `string` ; `approved`: `string` ; `rejected`: `string` ; `withdrawn`: `string` }> ; `reviewer`: `string` ; `proposer`: `string` ; `expiry`: `string` ; `maxDuration`: `number` ; `propose`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) ; `approve`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) ; `reject`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) ; `withdraw`: [`ContractRequirement`](https://docs.bijection.com/api/modules/access#contractrequirement) }> *** ### AccessContractDeclaration Ƭ **AccessContractDeclaration**: [`RecordContractDeclaration`](https://docs.bijection.com/api/modules/access#recordcontractdeclaration) | [`ReviewedContractDeclaration`](https://docs.bijection.com/api/modules/access#reviewedcontractdeclaration) *** ### DecisionInstallation Ƭ **DecisionInstallation**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `reads` | () => `string`\[] | | `resources` | () => `Record`\<`string`, `string` \| `null`> | | `program` | () => [`AccessProgram`](https://docs.bijection.com/api/modules/server#accessprogram) | | `evaluate` | (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `checks`: readonly [`AccessCheck`](https://docs.bijection.com/api/modules/access#accesscheck)\[]) => `Promise`\<[`PermissionResult`](https://docs.bijection.com/api/modules/access#permissionresult)\[]> | *** ### Term Ƭ **Term**\<`A`>: `Readonly`\<\{ `kind`: `"atom"` ; `atom`: `A` }> | `Readonly`\<\{ `kind`: `"all"` | `"any"` ; `nodes`: readonly [`Term`](https://docs.bijection.com/api/modules/access#term)\<`A`>\[] }> | `Readonly`\<\{ `kind`: `"not"` ; `node`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<`A`> }> | `Readonly`\<\{ `kind`: `"choose"` ; `test`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<`A`> ; `yes`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<`A`> ; `no`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<`A`> }> Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `A` | *** ### AuthorityInput Ƭ **AuthorityInput**: \{ `kind`: `"key"` } | \{ `kind`: `"literal"` ; `value`: [`Value`](https://docs.bijection.com/api/modules/values#value) } | \{ `kind`: `"before"` | `"after"` ; `field`: `string` } | \{ `kind`: `"row"` ; `slot`: `string` ; `field`: `string` } | \{ `kind`: `"absent"` } | \{ `kind`: `"execution"` ; `field`: `"principal"` | `"decisionActor"` | `"active"` | `"origin"` | `"direct"` | `"transactionTime"` | `"authenticatedAt"` | `"verifiedEmail"` | `"issuer"` } | \{ `kind`: `"present"` | `"trimmed"` | `"utf16Length"` | `"principalKind"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"fixedHex"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `bytes`: `number` } | \{ `kind`: `"retained"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `directory`: [`AccessDirectory`](https://docs.bijection.com/api/modules/access#accessdirectory) | `null` } | \{ `kind`: `"deadline"` ; `duration`: `number` } | \{ `kind`: `"path"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `field`: `string` } | \{ `kind`: `"default"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `value`: [`Value`](https://docs.bijection.com/api/modules/values#value) } | \{ `kind`: `"principal"` | `"deadlineValue"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"recorded"` ; `table`: `string` ; `key`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `image`: `"before"` | `"after"` } | \{ `kind`: `"changeCount"` ; `table`: `string` ; `added`: `boolean` } Not exported: an exported type refers to it. *** ### AuthorityObligation Ƭ **AuthorityObligation**: \{ `kind`: `"witness"` ; `verifier`: `string` ; `usage`: `string` } | \{ `kind`: `"onlyChanges"` ; `fields`: readonly `string`\[] } | \{ `kind`: `"beforeExpiry"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"confer"` ; `assignment`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `permissions`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `operation`: `"grant"` | `"revoke"` ; `source`: `"original"` | `"placement"` } | \{ `kind`: `"programCustody"` ; `assignment`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"clearance"` ; `assignment`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"scopeChanged"` ; `assignment`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"construction"` ; `assignment`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `resource`: `string` ; `permission`: `string` } | \{ `kind`: `"ceiling"` ; `key`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `resource`: `string` ; `permission`: `string` } | \{ `kind`: `"reachability"` ; `key`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `resource`: `string` ; `ancestor`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `ancestorResource`: `string` } | \{ `kind`: `"environment"` ; `name`: `string` ; `bind`: `string` ; `body`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<[`AuthorityObligation`](https://docs.bijection.com/api/modules/access#authorityobligation)> } | \{ `kind`: `"equal"` ; `left`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `right`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) } | \{ `kind`: `"predicate"` ; `fields`: `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> ; `inputs`: `Record`\<`string`, [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput)> ; `expr`: [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) } | \{ `kind`: `"permission"` ; `basis`: `"original"` ; `judgment`: [`PermissionJudgment`](https://docs.bijection.com/api/modules/access_cedar#permissionjudgment) ; `permission`: `string` ; `on`: [`ResourceRef`](https://docs.bijection.com/api/modules/access_cedar#resourceref) ; `lifetime`: [`AuthorityLifetime`](https://docs.bijection.com/api/modules/access_cedar#authoritylifetime) } | \{ `kind`: `"each"` ; `input`: [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput) ; `bind`: `string` ; `body`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<[`AuthorityObligation`](https://docs.bijection.com/api/modules/access#authorityobligation)> } | \{ `kind`: `"atMost"` ; `view`: `"original"` | `"final"` ; `table`: `string` ; `index`: `string` ; `pins`: readonly readonly \[`string`, [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput)]\[] ; `maximum`: `number` } | \{ `kind`: `"range"` ; `view`: `"original"` | `"final"` ; `table`: `string` ; `index`: `string` ; `pins`: readonly readonly \[`string`, [`AuthorityInput`](https://docs.bijection.com/api/modules/access#authorityinput)]\[] ; `bind`: `string` ; `quantifier`: `"any"` | `"all"` | `"empty"` ; `body`: [`Term`](https://docs.bijection.com/api/modules/access#term)\<[`AuthorityObligation`](https://docs.bijection.com/api/modules/access#authorityobligation)> } Not exported: an exported type refers to it. *** ### AccessDiscoveryRoute Ƭ **AccessDiscoveryRoute**: `Readonly`\<\{ `kind`: `"get"` }> | `Readonly`\<\{ `kind`: `"shares"` ; `table`: `string` ; `index`: `string` }> | `Readonly`\<\{ `kind`: `"index"` ; `index`: `string` }> | `Readonly`\<\{ `kind`: `"scope"` ; `table`: `string` ; `index`: `string` }> Not exported: an exported type refers to it. *** ### AccessEmulationConfiguration Ƭ **AccessEmulationConfiguration**: `Object` An immutable centrally declared scope, authorized through native grants. Eligibility does not grant any of the scope's permissions. #### Type declaration | Name | Type | | :- | :- | | `requiredPreset` | `boolean` | | `applications?` | `Record`\<`string`, \{ `organization`: \{ `type`: `string` ; `key`: `string` } ; `eligibilityPermission`: `string` ; `dependencies`: readonly \{ `name`: `string` ; `resource`: \{ `type`: `string` ; `key`: `string` } ; `permissions`: readonly `string`\[] }\[] }> | | `presets` | `Record`\<`string`, \{ `organization`: \{ `type`: `string` ; `key`: `string` } ; `eligibilityPermission`: `string` ; `scope`: \{ `resources`: readonly \{ `type`: `string` ; `key`: `string` }\[] ; `roles?`: readonly `string`\[] ; `permissions?`: readonly `string`\[] ; `grantSources?`: \{ `direct`: `boolean` ; `groups`: readonly \{ `type`: `string` ; `key`: `string` }\[] } ; `clearances?`: readonly \{ `type`: `string` ; `key`: `string` }\[] } ; `targets`: readonly (`"live"` \| `"sandbox"`)\[] ; `maxDurationMs`: `number` }> | *** ### ContactKind Ƭ **ContactKind**: `"phone"` | `"email"` Typed evidence declarations. These describe propositions, never grants. *** ### ContactField Ƭ **ContactField**: `Readonly`\<\{ `kind`: [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind) ; `field`: `string` }> *** ### ContactIdentity Ƭ **ContactIdentity**: `Readonly`\<\{ `kind`: [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind) ; `value`: `string` }> *** ### EvidenceType Ƭ **EvidenceType**: \{ `kind`: `"resource"` ; `resource`: `string` } | \{ `kind`: `"contact"` ; `contact`: [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind) } | \{ `kind`: `"principal"` } | \{ `kind`: `"string"` } | \{ `kind`: `"bool"` } | \{ `kind`: `"long"` } *** ### EvidenceDeclaration Ƭ **EvidenceDeclaration**: `Readonly`\<\{ `scope`: `"participant"` | `"principal"` ; `fields`: `Readonly`\<`Record`\<`string`, [`EvidenceType`](https://docs.bijection.com/api/modules/access#evidencetype)>> }> Scope selects the evidence custody/audience namespace. The declared fields define its statement: consuming requirements bind every field, including any proposal, input version, program identity and permitted use the statement needs. A verifier establishes facts; neither its output nor these bindings grants a role. *** ### EvidenceValue Ƭ **EvidenceValue**: \{ `kind`: `"resource"` ; `resource`: `string` ; `key`: `string` } | \{ `kind`: `"contact"` ; `contact`: [`ContactIdentity`](https://docs.bijection.com/api/modules/access#contactidentity) } | \{ `kind`: `"principal"` ; `principal`: `string` } | \{ `kind`: `"string"` ; `value`: `string` } | \{ `kind`: `"bool"` ; `value`: `boolean` } | \{ `kind`: `"long"` ; `value`: `string` } *** ### ConditionScalar Ƭ **ConditionScalar**: `string` | `bigint` | `boolean` Not exported: an exported type refers to it. *** ### ConditionValue Ƭ **ConditionValue**: [`ConditionScalar`](https://docs.bijection.com/api/modules/access#conditionscalar) | readonly `string`\[] | readonly `bigint`\[] Not exported: an exported type refers to it. *** ### Operand Ƭ **Operand**\<`T`>: `T` | [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`> Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### AccessOptionalExpression Ƭ **AccessOptionalExpression**\<`T`>: `Pick`\<[`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`>, `"match"` | `"isPresent"`> Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### References Ƭ **References**\<`T`>: \{ readonly \[K in keyof T as NonNullable\ extends ConditionValue ? K : never]-?: 0 extends 1 & T\[K] ? AccessExpression\ : NonNullable\ extends readonly unknown\[] ? undefined extends T\[K] ? Pick\>, "isPresent" | "match"> : null extends T\[K] ? Pick\>, "isPresent" | "match"> : AccessArrayExpression\> : undefined extends T\[K] ? AccessOptionalExpression\> : null extends T\[K] ? AccessOptionalExpression\> : AccessExpression\ } Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### AccessConditionScope Ƭ **AccessConditionScope**\<`Resource`, `Principal`, `Context`>: `Object` Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Resource` | `any` | | `Principal` | `any` | | `Context` | `any` | #### Type declaration | Name | Type | | :- | :- | | `resource` | [`References`](https://docs.bijection.com/api/modules/access#references)\<`Resource`> | | `principal` | [`References`](https://docs.bijection.com/api/modules/access#references)\<`Principal`> | | `claims` | [`References`](https://docs.bijection.com/api/modules/access#references)\<`Context`> | | `set` | \(`value`: [`AccessArrayExpression`](https://docs.bijection.com/api/interfaces/access.AccessArrayExpression)\<`T`> \| [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`> \| `T`) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`> | | `all` | (...`conditions`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>\[]) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> | | `any` | (...`conditions`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>\[]) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> | | `not` | (`condition`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> | | `literal` | \(`value`: `T`) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`> | *** ### AccessCondition Ƭ **AccessCondition**\<`Resource`, `Principal`, `Context`>: (`scope`: [`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Resource`, `Principal`, `Context`>) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> #### Type parameters | Name | Type | | :- | :- | | `Resource` | `any` | | `Principal` | `any` | | `Context` | `any` | #### Type declaration ▸ (`scope`): [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> Not exported: an exported type refers to it. ##### Parameters | Name | Type | | :- | :- | | `scope` | [`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Resource`, `Principal`, `Context`> | ##### Returns [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> *** ### CompiledConditionBuilder Ƭ **CompiledConditionBuilder**: (`scope`: `any`) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> #### Type declaration ▸ (`scope`): [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> Not exported: an exported type refers to it. ##### Parameters | Name | Type | | :- | :- | | `scope` | `any` | ##### Returns [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> *** ### StateValue Ƭ **StateValue**: `string` | `boolean` | `bigint` Not exported: an exported type refers to it. *** ### FieldState Ƭ **FieldState**\<`T`>: `undefined` extends `T` ? \{ `initial?`: `never` ; `transitions?`: `never` } : \[`T`] extends \[[`StateValue`](https://docs.bijection.com/api/modules/access#statevalue)] ? \{ `initial?`: `T` ; `transitions?`: readonly readonly \[`T`, `T`]\[] } : \{ `initial?`: `never` ; `transitions?`: `never` } Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### AccessReadRequirement Ƭ **AccessReadRequirement**\<`Permission`, `Field`, `Resource`>: `true` | `Permission` | \{ `permission`: `Permission` ; `restrictions`: readonly ([`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction)\<`Resource`> | [`AccessReadLabelField`](https://docs.bijection.com/api/modules/access#accessreadlabelfield)\<`Field`, `Resource`>)\[] } Additional mandatory protections on a readable row or value. #### Type parameters | Name | Type | | :- | :- | | `Permission` | extends `string` = `string` | | `Field` | extends `string` = `string` | | `Resource` | extends `string` = `string` | *** ### AccessFieldProtection Ƭ **AccessFieldProtection**\<`Permission`, `Field`, `Resource`>: `Object` One explicit classification for a stored application field. #### Type parameters | Name | Type | | :- | :- | | `Permission` | extends `string` = `string` | | `Field` | extends `string` = `string` | | `Resource` | extends `string` = `string` | #### Type declaration | Name | Type | Description | | :- | :- | :- | | `read` | [`AccessReadRequirement`](https://docs.bijection.com/api/modules/access#accessreadrequirement)\<`Permission`, `Field`, `Resource`> \| `false` | - | | `create` | `Extract`\<`"create"`, `Permission`> \| `false` | Initialization is permitted only under the row's creation permission. | | `update` | `Permission` \| `false` | - | | `whole?` | [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | Explicit whole-value classification for opaque payloads. Its validator must equal this field's schema, including nested fields. | | `fields?` | `Record`\<`string`, [`AccessFieldProtection`](https://docs.bijection.com/api/modules/access#accessfieldprotection)\<`Permission`, `Field`, `Resource`>> | - | | `items?` | [`AccessFieldProtection`](https://docs.bijection.com/api/modules/access#accessfieldprotection)\<`Permission`, `Field`, `Resource`> | - | | `initial?` | [`StateValue`](https://docs.bijection.com/api/modules/access#statevalue) | - | | `transitions?` | readonly readonly \[[`StateValue`](https://docs.bijection.com/api/modules/access#statevalue), [`StateValue`](https://docs.bijection.com/api/modules/access#statevalue)]\[] | - | *** ### FieldPolicy Ƭ **FieldPolicy**\<`P`, `F`, `R`, `SourceOwned`>: `Pick`\<[`AccessFieldProtection`](https://docs.bijection.com/api/modules/access#accessfieldprotection)\<`P`, `F`, `R`>, `"read"`> & `SourceOwned` extends `true` ? \{ `create?`: `never` ; `update?`: `never` } : `Pick`\<[`AccessFieldProtection`](https://docs.bijection.com/api/modules/access#accessfieldprotection)\<`P`, `F`, `R`>, `"create"` | `"update"`> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `P` | extends `string` | | `F` | extends `string` | | `R` | extends `string` | | `SourceOwned` | extends `boolean` = `false` | *** ### AccessFieldProtections Ƭ **AccessFieldProtections**\<`Field`, `Permission`, `Resource`, `Document`, `SourceOwned`>: \{ \[K in Field as K extends \`\_\$\{string}\` ? never : K]-?: FieldPolicy\ & (K extends keyof Document ? FieldShape\ & (SourceOwned extends true ? Object : FieldState\) : unknown) } Every application field is classified, including optional fields. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` | | `Permission` | extends `string` | | `Resource` | extends `string` | | `Document` | `Record`\<`Field`, `unknown`> | | `SourceOwned` | extends `boolean` = `false` | *** ### AccessFieldExceptions Ƭ **AccessFieldExceptions**\<`Field`, `Permission`, `Resource`, `Document`, `SourceOwned`>: \{ \[K in Field as K extends \`\_\$\{string}\` ? never : K]?: Partial\> & (K extends keyof Document ? ExceptionShape\ & (SourceOwned extends true ? Object : FieldState\) : unknown) } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` | | `Permission` | extends `string` | | `Resource` | extends `string` | | `Document` | `Record`\<`Field`, `unknown`> | | `SourceOwned` | extends `boolean` = `false` | *** ### FieldException Ƭ **FieldException**\<`T`, `P`, `F`, `R`, `SourceOwned`>: `Partial`\<[`FieldPolicy`](https://docs.bijection.com/api/modules/access#fieldpolicy)\<`P`, `F`, `R`, `SourceOwned`>> & [`ExceptionShape`](https://docs.bijection.com/api/modules/access#exceptionshape)\<`T`, `P`, `F`, `R`, `SourceOwned`> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `T` | `T` | | `P` | extends `string` | | `F` | extends `string` | | `R` | extends `string` | | `SourceOwned` | extends `boolean` | *** ### ExceptionShape Ƭ **ExceptionShape**\<`T`, `P`, `F`, `R`, `SourceOwned`>: `0` extends `1` & `T` ? \{ `whole?`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `fields?`: `never` ; `items?`: `never` } : \[`NonNullable`\<`T`>] extends \[[`Geometry`](https://docs.bijection.com/api/modules/values#geometry)\<[`GeometrySpace`](https://docs.bijection.com/api/modules/apps#geometryspace)> | [`Position`](https://docs.bijection.com/api/modules/values#position) | [`ObjectRef`](https://docs.bijection.com/api/modules/runtime#objectref)] ? \{ `whole?`: `never` ; `fields?`: `never` ; `items?`: `never` } : \[`NonNullable`\<`T`>] extends \[readonly infer Item\[]] ? `true` extends [`Structured`](https://docs.bijection.com/api/modules/access#structured)\<`Item`> ? \{ `items?`: [`FieldException`](https://docs.bijection.com/api/modules/access#fieldexception)\<`Item`, `P`, `F`, `R`, `SourceOwned`> ; `fields?`: `never` ; `whole?`: `never` } : \{ `fields?`: `never` ; `items?`: `never` ; `whole?`: `never` } : `true` extends [`Structured`](https://docs.bijection.com/api/modules/access#structured)\<`T`> ? `string` extends [`Keys`](https://docs.bijection.com/api/modules/access#keys)\<`NonNullable`\<`T`>> ? \{ `whole?`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `fields?`: `never` ; `items?`: `never` } : \{ `fields?`: \{ \[K in Keys\> & string]?: FieldException\, K>, P, F, R, SourceOwned> } ; `items?`: `never` ; `whole?`: `never` } : \{ `fields?`: `never` ; `items?`: `never` ; `whole?`: `never` } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `T` | `T` | | `P` | extends `string` | | `F` | extends `string` | | `R` | extends `string` | | `SourceOwned` | extends `boolean` | *** ### Keys Ƭ **Keys**\<`T`>: `T` extends `string` | `number` | `bigint` | `boolean` | `ArrayBuffer` | readonly `unknown`\[] ? `never` : keyof `T` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### At Ƭ **At**\<`T`, `K`>: `T` extends `unknown` ? `K` extends keyof `T` ? `T`\[`K`] : `never` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | | `K` | *** ### FieldShape Ƭ **FieldShape**\<`T`, `P`, `F`, `R`, `SourceOwned`>: `0` extends `1` & `T` ? \{ `whole?`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `fields?`: `never` ; `items?`: `never` } : \[`NonNullable`\<`T`>] extends \[[`Geometry`](https://docs.bijection.com/api/modules/values#geometry)\<[`GeometrySpace`](https://docs.bijection.com/api/modules/apps#geometryspace)> | [`Position`](https://docs.bijection.com/api/modules/values#position) | [`ObjectRef`](https://docs.bijection.com/api/modules/runtime#objectref)] ? \{ `whole?`: `never` ; `fields?`: `never` ; `items?`: `never` } : \[`NonNullable`\<`T`>] extends \[readonly infer Item\[]] ? `true` extends [`Structured`](https://docs.bijection.com/api/modules/access#structured)\<`Item`> ? \{ `items`: [`FieldPolicy`](https://docs.bijection.com/api/modules/access#fieldpolicy)\<`P`, `F`, `R`, `SourceOwned`> & [`FieldShape`](https://docs.bijection.com/api/modules/access#fieldshape)\<`Item`, `P`, `F`, `R`, `SourceOwned`> ; `fields?`: `never` ; `whole?`: `never` } : \{ `fields?`: `never` ; `items?`: `never` ; `whole?`: `never` } : `true` extends [`Structured`](https://docs.bijection.com/api/modules/access#structured)\<`T`> ? `string` extends [`Keys`](https://docs.bijection.com/api/modules/access#keys)\<`NonNullable`\<`T`>> ? \{ `whole`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `fields?`: `never` ; `items?`: `never` } : \{ `fields`: \{ \[K in Keys\> & string]-?: FieldPolicy\ & FieldShape\, K>, P, F, R, SourceOwned> } ; `items?`: `never` ; `whole?`: `never` } : \{ `fields?`: `never` ; `items?`: `never` ; `whole?`: `never` } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `T` | `T` | | `P` | extends `string` | | `F` | extends `string` | | `R` | extends `string` | | `SourceOwned` | extends `boolean` | *** ### Structured Ƭ **Structured**\<`T`>: `0` extends `1` & `T` ? `true` : `T` extends readonly infer Item\[] ? [`Structured`](https://docs.bijection.com/api/modules/access#structured)\<`Item`> : `T` extends `string` | `number` | `bigint` | `boolean` | `ArrayBuffer` | [`CommitTsPlaceholder`](https://docs.bijection.com/api/classes/values.CommitTsPlaceholder) | [`ObjectRef`](https://docs.bijection.com/api/modules/runtime#objectref) ? `false` : `T` extends `object` ? `true` : `false` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### AccessIdentity Ƭ **AccessIdentity**: `Object` Verified request evidence and its application-owned association key. Resolving a key never rewrites the issuer, subject or session claims. #### Type declaration | Name | Type | | :- | :- | | `verified` | [`UserIdentity`](https://docs.bijection.com/api/interfaces/server.UserIdentity) | | `identityKey` | `string` | *** ### AccessInformationProtection Ƭ **AccessInformationProtection**\<`Field`, `Resource`>: `Object` One reusable protection. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Resource` | extends `string` = `string` | #### Type declaration | Name | Type | Description | | :- | :- | :- | | `restrictions?` | readonly ([`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction)\<`Resource`> \| [`AccessReadLabelField`](https://docs.bijection.com/api/modules/access#accessreadlabelfield)\<`Field`, `Resource`>)\[] | Restrictions a reader must clear, carried with derived information. | | `immutable?` | `true` | The value may be set at creation and never changes afterwards. | *** ### VisibleRead Ƭ **VisibleRead**: \{ `id`: `string` ; `kind`: `"object"` ; `object`: `Record`\<`string`, `unknown`> } | \{ `id`: `string` ; `kind`: `"absent"` } | \{ `id`: `string` ; `kind`: `"restricted"` } One identifier of a visible read: the object, with each selected property outside its visibility permission wrapped as a VisibleValue; or `absent`; or `restricted` when the reader may not see the object at all. *** ### PermissionExplanation Ƭ **PermissionExplanation**: \{ `authenticationRequired?`: [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) ; `permission`: `string` ; `emulation?`: `"allowed"` | `"ordinaryAuthority"` | `"permissionCeiling"` | `"resourceBounds"` | `"grantSources"` | `"clearances"` | `"unavailable"` ; `steps`: [`AccessStep`](https://docs.bijection.com/api/modules/browser#accessstep)\[] ; `trace?`: [`AccessTrace`](https://docs.bijection.com/api/modules/browser#accesstrace) ; `actions?`: \{ `kind`: `"request"` ; `role`: `string` }\[] } & \{ `outcome`: `"allowed"` ; `validUntil`: `number` | `null` ; `via`: `string` | `null` } | \{ `outcome`: `"denied"` ; `reason`: [`AccessRefusalReason`](https://docs.bijection.com/api/modules/access#accessrefusalreason) ; `refusedBy`: `string` } | \{ `outcome`: `"unavailable"` ; `missingFacts`: `string`\[] } How one permission on one object is decided for a principal. *** ### AccessOutcome Ƭ **AccessOutcome**: `"allowed"` | `"denied"` | `"unavailable"` An inspected permission's outcome. Invalid security metadata or an evaluation failure is an error, never an outcome. *** ### PolicyCompilationIdentity Ƭ **PolicyCompilationIdentity**: `Readonly`\<\{ `compilationDigest`: `string` ; `declarationDigest`: `string` ; `entryDigest`: `string` ; `schemaBindingDigest`: `string` | `null` ; `compilerRevision`: `string` ; `cedarVersion`: `string` ; `clauseCount`: `number` }> Identity of the admitted compiler plan. This carries no captured rows, private predicate values, or authority to reuse an inspection as a permit. *** ### ExecutionObservation Ƭ **ExecutionObservation**: `Object` #### Type declaration | Name | Type | | :- | :- | | `basis` | [`AccessInspectionBasis`](https://docs.bijection.com/api/modules/browser#accessinspectionbasis) | | `execution` | `ExecutionDescriptor` \| `null` | *** ### AccessIntegrity Ƭ **AccessIntegrity**\<`Field`>: `Object` Closed structural invariants over engine-recorded row images. These constrain writes; they never grant a permission. They do not track what influenced a value: information-flow protection belongs in `defineInformationProtection`. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | #### Type declaration | Name | Type | | :- | :- | | `insertOnly?` | `true` | | `noDelete?` | `true` | | `unchanged?` | readonly `Field`\[] | | `writeOnce?` | readonly `Field`\[] | | `issuedOnly?` | readonly `Field`\[] | *** ### AccessResolution Ƭ **AccessResolution**: \{ `kind`: `"ready"` } | \{ `kind`: `"interactionRequired"` ; `offers`: [`AccessRecoveryOffer`](https://docs.bijection.com/api/modules/browser#accessrecoveryoffer)\[] } | \{ `kind`: `"refused"` ; `code`: `"not_authorized"` } | \{ `kind`: `"unavailable"` ; `code`: `"evaluation_failed"` } A current inspection's disclosed next step. Offers remain advisory and owner-bound; completing one never retries the business operation. *** ### AccessFields Ƭ **AccessFields**: readonly `string`\[] | `"rest"` The fields a permission covers: a list, or every field no other permission of the same map lists. *** ### AccessReadRestriction Ƭ **AccessReadRestriction**\<`Type`>: `Object` A mandatory classification on values released by one permission. #### Type parameters | Name | Type | | :- | :- | | `Type` | extends `string` = `string` | #### Type declaration | Name | Type | | :- | :- | | `type` | `Type` | | `key` | `string` | | `field?` | `never` | | `allowed?` | `never` | *** ### AccessReadLabelField Ƭ **AccessReadLabelField**\<`Field`, `Type`>: `Object` Labels each row carries for one read group: `field` holds the keys of the row's labels, each one of `allowed`. A reader passes them as a row's own labels are passed: every label of an `all` category, one of each `any` category's. A key outside `allowed` is invalid security metadata, an error rather than an empty set. `allowed` bounds the work a projection spends resolving passes; it grants nothing. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Type` | extends `string` = `string` | #### Type declaration | Name | Type | | :- | :- | | `type` | `Type` | | `field` | `Field` | | `allowed` | readonly `string`\[] | | `key?` | `never` | *** ### AccessReadGroup Ƭ **AccessReadGroup**\<`Field`, `Type`>: readonly `Field`\[] | `"rest"` | \{ `fields`: readonly `Field`\[] | `"rest"` ; `restrictions`: readonly ([`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction)\<`Type`> | [`AccessReadLabelField`](https://docs.bijection.com/api/modules/access#accessreadlabelfield)\<`Field`, `Type`>)\[] } Fields covered by a read permission and the labels every reader must pass: fixed labels, each required independently, and labels each row carries in a field. Roles cannot override them. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Type` | extends `string` = `string` | *** ### AccessCreation Ƭ **AccessCreation**: `Object` What creating an object also establishes in the same transaction: an assignment of a fixed role of its type to its creator. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `assign` | \{ `role`: `string` ; `holder`: `"creator"` } | - | | `assign.role` | `string` | - | | `assign.holder` | `"creator"` | - | | `children?` | readonly `string`\[] | Child types whose constructors may compose with this fresh parent. | *** ### AccessTypeDefinition Ƭ **AccessTypeDefinition**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `table?` | `string` | | `parent?` | \{ `field`: `string` ; `type`: `string` ; `index`: `string` } | | `parent.field` | `string` | | `parent.type` | `string` | | `parent.index` | `string` | | `relations?` | `Record`\<`string`, \{ `type`: `string` ; `index`: `string` }> | | `permissions?` | readonly `string`\[] | | `audience?` | `Record`\<`string`, `"public"`> | | `erasable?` | `boolean` | | `read?` | `Record`\<`string`, [`AccessReadGroup`](https://docs.bijection.com/api/modules/access#accessreadgroup)> | | `propertyRestrictions?` | `Record`\<`string`, readonly ([`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction) \| [`AccessReadLabelField`](https://docs.bijection.com/api/modules/access#accessreadlabelfield))\[]> | | `unreadable?` | readonly `string`\[] | | `immutable?` | readonly `string`\[] | | `initialization?` | `Record`\<`string`, `boolean`> | | `fieldValidators?` | `Record`\<`string`, `unknown`> | | `mutations?` | \{ `create`: `boolean` ; `delete`: `boolean` } | | `mutations.create` | `boolean` | | `mutations.delete` | `boolean` | | `conditions?` | `Record`\<`string`, \{ `on`: readonly `string`\[] ; `when`: [`CompiledConditionBuilder`](https://docs.bijection.com/api/modules/access#compiledconditionbuilder) }> | | `resourceSets?` | `Record`\<`string`, [`ResourceSetDefinition`](https://docs.bijection.com/api/modules/server#resourcesetdefinition)> | | `transitions?` | `Record`\<`string`, [`TransitionConditionDeclaration`](https://docs.bijection.com/api/modules/access#transitionconditiondeclaration)> | | `fields?` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `[conditionRequiredFields]?` | readonly `string`\[] | | `write?` | `Record`\<`string`, [`AccessFields`](https://docs.bijection.com/api/modules/access#accessfields)> | | `restrictions?` | \{ `root?`: \{ `type`: `string` ; `category`: `string` } ; `field?`: \{ `name`: `string` ; `type`: `string` } } | | `restrictions.root?` | \{ `type`: `string` ; `category`: `string` } | | `restrictions.root.type` | `string` | | `restrictions.root.category` | `string` | | `restrictions.field?` | \{ `name`: `string` ; `type`: `string` } | | `restrictions.field.name` | `string` | | `restrictions.field.type` | `string` | | `category?` | `string` \| \{ `from`: `"key"` } | | `dominates?` | `Readonly`\<`Record`\<`string`, readonly `string`\[]>> | | `clearance?` | `"registry"` | | `create?` | [`AccessCreation`](https://docs.bijection.com/api/modules/access#accesscreation) | | `recovery?` | \{ `role`: `string` } | | `recovery.role` | `string` | | `holders?` | `string` | | `integrity?` | [`AccessIntegrity`](https://docs.bijection.com/api/modules/access#accessintegrity) | *** ### AccessRoleDefinition Ƭ **AccessRoleDefinition**: readonly `string`\[] | \{ `permissions`: readonly `string`\[] ; `assignment?`: \{ `maxDuration?`: `number` ; `reasonRequired?`: `boolean` ; `selfGrant?`: `string` ; `requestable?`: `boolean` ; `guests?`: `boolean` ; `purpose?`: `string` } ; `issuance?`: `Record`\<`string`, `never`> } A role: the permissions it bundles, as `type:name`, `type:*` or `type:grant.*`, on its own type and descendant types. A role may bound the duration of its grants, require a written reason on each, and let holders of a permission of its type grant it to themselves: just-in-time access, which must then be bounded and justified, and which ends no later than the holder's own grant of that permission. *** ### AccessDirectory Ƭ **AccessDirectory**: `Object` A source-owned table of identity-provider memberships assigning `role` on `(member, object)` pairs. `index` covers `[member, object]`. A row is the same assignment a grant record of that role and holder would be: one evaluator decides both. A row confers its role only while the source that published it (its `source_id`) has not lost continuity and either the exact record or a completed population acquisition was observed less than `maxAge` milliseconds ago, read through `ctx.sources.evidence`. A removal the provider exposes at time t therefore takes effect by t + `maxAge` at the latest, whether or not the sync runs, and a decision relying on a membership is valid until its source's observation is `maxAge` old. An observation stamped later than the decision's clock counts as made then, so no decision outlasts `maxAge` from now. A row without a source, or a context without `sources`, confers nothing. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `table` | `string` | - | | `memberIndex` | `string` | - | | `objectIndex` | `string` | - | | `type` | `string` | - | | `role` | `string` | - | | `object` | `string` | - | | `member` | `string` | - | | `maxAge` | `number` | How old, in milliseconds, the source's oldest qualifying observation may be for its rows to confer the role: 1 s to 365 days. | *** ### AccessDirectoryDeclaration Ƭ **AccessDirectoryDeclaration**: `Omit`\<[`AccessDirectory`](https://docs.bijection.com/api/modules/access#accessdirectory), `"role"`> & \{ `role`: `Extract`\<`RoleRef`, \{ `kind`: `"declared"` }> } A directory as a model declares it. `role` is a stable reference to a declared role of `type` (`{ kind: "declared", key }`); a tenant role is tenant data no model can name. A bounded role's `maxDuration` runs from when the source first asserted the membership: refreshing the same assertion keeps its row, and so its start. A role requiring a reason or granting itself cannot be a directory's. *** ### AccessDirectoryCoverage Ƭ **AccessDirectoryCoverage**: `Pick`\<[`SourceEvidence`](https://docs.bijection.com/api/modules/sources#sourceevidence), `"populationCovered"` | `"populationObservedFrom"` | `"recordObservedFrom"` | `"continuityLost"` | `"erased"`> What a directory's freshness rule reads of a source's coverage. *** ### AccessRoleDefinitions Ƭ **AccessRoleDefinitions**: `Object` Immutable tenant role bundles, scoped to one tenant root. Definition authority is separate from data use and bounded by an explicit permission envelope. Assignments separately require `grant.custom` on their target. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `table` | `string` | - | | `scope` | `string` | - | | `permissions` | `string`\[] | Administrative envelope, independent of the administrator's data access. `*` explicitly admits every permission below this scope. | *** ### RoleDefinitionDocument Ƭ **RoleDefinitionDocument**: `Object` One tenant-defined role: the permissions, as `type:name`, of a role of `type` usable on objects under the scope object `scope`. `maxDuration` bounds its grants as a declared role's does: each must expire within it, and renewing one extends it for at most that long. #### Type declaration | Name | Type | | :- | :- | | `_id` | [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> | | `scope` | `string` | | `type` | `string` | | `name` | `string` | | `permissions` | `string`\[] | | `maxDuration?` | `number` | | `reasonRequired?` | `boolean` | | `guests?` | `boolean` | *** ### AccessServiceDefinition Ƭ **AccessServiceDefinition**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `description` | `string` | | `ceiling` | readonly `string`\[] | | `maxDuration?` | `number` | *** ### AccessClientRestrictions Ƭ **AccessClientRestrictions**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `required` | `boolean` | | `providers` | `Record`\<`string`, `string`> | | `credentials` | `Record`\<`string`, `string`> | | `applications` | `Record`\<`string`, \{ `nativeSession?`: `true` ; `scopePermissions?`: `Readonly`\<`Record`\<`string`, readonly `string`\[]>> ; `permissions`: readonly `string`\[] ; `resources?`: readonly \{ `type`: `string` ; `key`: `string` }\[] ; `functions?`: readonly `string`\[] ; `maxDuration?`: `number` }> | *** ### AccessInitialOwner Ƭ **AccessInitialOwner**: `string` | \{ `environment`: `string` } A bootstrap identity key, or the deployment variable holding it. *** ### AccessModelDefinition Ƭ **AccessModelDefinition**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `contracts?` | `Readonly`\<`Record`\<`string`, [`AccessContractDeclaration`](https://docs.bijection.com/api/modules/access#accesscontractdeclaration)>> | | `assignmentListings?` | `Record`\<`string`, [`AssignmentListing`](https://docs.bijection.com/api/modules/access#assignmentlisting)> | | `observationSources?` | `Record`\<`string`, \{ `table`: `string` ; `inputs`: readonly `string`\[] }> | | `discoveries?` | `Readonly`\<`Record`\<`string`, [`AccessDiscoveryDefinition`](https://docs.bijection.com/api/modules/runtime#accessdiscoverydefinition)>> | | `initialOwner?` | [`AccessInitialOwner`](https://docs.bijection.com/api/modules/access#accessinitialowner) | | `assignments?` | `string` | | `requests?` | `string` | | `categories?` | `Record`\<`string`, `"all"` \| `"any"`> | | `types` | `Record`\<`string`, [`AccessTypeDefinition`](https://docs.bijection.com/api/modules/access#accesstypedefinition)> | | `roles` | `Record`\<`string`, [`AccessRoleDefinition`](https://docs.bijection.com/api/modules/access#accessroledefinition)> | | `confer?` | `Record`\<`string`, `Omit`\<[`AccessConferEnvelope`](https://docs.bijection.com/api/modules/server#accessconferenvelope), `"when"`> & \{ `when?`: (`scope`: `any`) => `AccessExpression` }> | | `evidence?` | `Record`\<`string`, [`EvidenceDeclaration`](https://docs.bijection.com/api/modules/access#evidencedeclaration)> | | `requirements?` | `Record`\<`string`, [`PermissionRequirement`](https://docs.bijection.com/api/modules/access#permissionrequirement)> | | `services?` | `Record`\<`string`, [`AccessServiceDefinition`](https://docs.bijection.com/api/modules/access#accessservicedefinition)> | | `clients?` | [`AccessClientRestrictions`](https://docs.bijection.com/api/modules/access#accessclientrestrictions) | | `emulation?` | [`AccessEmulationConfiguration`](https://docs.bijection.com/api/modules/access#accessemulationconfiguration) | | `guests?` | \{ `maxDuration?`: `number` } | | `guests.maxDuration?` | `number` | | `groups?` | \{ `types?`: readonly `string`\[] } | | `groups.types?` | readonly `string`\[] | | `directories?` | readonly [`AccessDirectoryDeclaration`](https://docs.bijection.com/api/modules/access#accessdirectorydeclaration)\[] | | `roleDefinitions?` | [`AccessRoleDefinitions`](https://docs.bijection.com/api/modules/access#accessroledefinitions) | | `claims?` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `inputValidators?` | [`AccessInputValidators`](https://docs.bijection.com/api/modules/access#accessinputvalidators) | | `conditions?` | `Record`\<`string`, \{ `when`: [`CompiledConditionBuilder`](https://docs.bijection.com/api/modules/access#compiledconditionbuilder) ; `on?`: readonly `string`\[] }> | | `requestScope?` | \{ `objects?`: `string` ; `permissions?`: `string` } | | `requestScope.objects?` | `string` | | `requestScope.permissions?` | `string` | | `destinations?` | `Record`\<`string`, [`AccessDestinationTarget`](https://docs.bijection.com/api/modules/access#accessdestinationtarget)> | | `releases?` | `Record`\<`string`, [`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease)> | | `components?` | readonly [`ComponentDataConsent`](https://docs.bijection.com/api/modules/access#componentdataconsent)\[] | | `audit?` | `boolean` | | `users?` | \{ `table`: `string` ; `index`: `string` ; `user`: `string` ; `principalIndex`: `string` ; `attributes?`: `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> } | | `users.table` | `string` | | `users.index` | `string` | | `users.user` | `string` | | `users.principalIndex` | `string` | | `users.attributes?` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | *** ### Fields Ƭ **Fields**: `Map`\<`string`, `string`> & \{ `rest?`: `string` } Not exported: an exported type refers to it. *** ### CompiledType Ƭ **CompiledType**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `erasable` | `boolean` | | `table?` | `string` | | `parent` | \{ `type`: `string` ; `field?`: `string` ; `index`: `string` } | | `parent.type` | `string` | | `parent.field?` | `string` | | `parent.index` | `string` | | `relations` | `Map`\<`string`, \{ `type`: `string` ; `index`: `string` }> | | `permissions` | `Set`\<`string`> | | `readFields` | [`Fields`](https://docs.bijection.com/api/modules/access#fields) | | `readGroups` | `Map`\<`string`, [`AccessFields`](https://docs.bijection.com/api/modules/access#accessfields)> | | `readRestrictions` | `Map`\<`string`, [`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction)\[]> | | `propertyRestrictions` | `Map`\<`string`, [`AccessReadRestriction`](https://docs.bijection.com/api/modules/access#accessreadrestriction)\[]> | | `propertyLabelFields` | `Map`\<`string`, \{ `type`: `string` ; `field`: `string` ; `allowed`: `string`\[] }\[]> | | `readLabelFields` | `Map`\<`string`, \{ `type`: `string` ; `field`: `string` ; `allowed`: `string`\[] }\[]> | | `visibility` | `string` | | `unreadable` | `Set`\<`string`> | | `writeFields` | [`Fields`](https://docs.bijection.com/api/modules/access#fields) | | `root?` | \{ `type`: `string` ; `category`: `string` } | | `root.type` | `string` | | `root.category` | `string` | | `inheritedRoots` | \{ `type`: `string` ; `category`: `string` }\[] | | `restrictionField?` | \{ `name`: `string` ; `type`: `string` } | | `restrictionField.name` | `string` | | `restrictionField.type` | `string` | | `category?` | `string` \| \{ `from`: `"key"` } | | `dominates?` | `Readonly`\<`Record`\<`string`, readonly `string`\[]>> | | `create?` | [`AccessCreation`](https://docs.bijection.com/api/modules/access#accesscreation) | | `recovery?` | \{ `role`: `string` } | | `recovery.role` | `string` | | `holders?` | `string` | | `integrity?` | [`AccessIntegrity`](https://docs.bijection.com/api/modules/access#accessintegrity) | | `resourceConditions` | \{ `name`: `string` ; `on`: `string`\[] ; `expr`: [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) ; `fields`: `Set`\<`string`> }\[] | | `resourceSets` | `Record`\<`string`, [`InstalledResourceSet`](https://docs.bijection.com/api/modules/access#installedresourceset)> | | `transitionConditions` | [`CompiledTransitionCondition`](https://docs.bijection.com/api/modules/access#compiledtransitioncondition)\[] | | `conditionFields` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `requiredConditionFields` | `Set`\<`string`> | *** ### CompiledService Ƭ **CompiledService**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `description` | `string` | | `ceiling` | `Set`\<`string`> | | `maxDuration?` | `number` | *** ### CompiledRole Ƭ **CompiledRole**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `type` | `string` | | `permissions` | `Set`\<`string`> | | `maxDuration?` | `number` | | `reasonRequired` | `boolean` | | `selfGrant?` | `string` | | `requestable` | `boolean` | | `guests` | `boolean` | | `purpose?` | `string` | | `sessions` | `boolean` | *** ### Compiled Ƭ **Compiled**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `assignmentListings` | `Record`\<`string`, [`AssignmentListing`](https://docs.bijection.com/api/modules/access#assignmentlisting)> | | `partitionLimits` | `Record`\<`string`, `Record`\<`string`, [`PartitionLimit`](https://docs.bijection.com/api/modules/runtime#partitionlimit)>> | | `observationSources` | `Record`\<`string`, \{ `table`: `string` ; `inputs`: readonly `string`\[] }> | | `declaration?` | [`CanonicalAccessDeclaration`](https://docs.bijection.com/api/modules/server#canonicalaccessdeclaration) | | `contracts` | `Readonly`\<`Record`\<`string`, [`AccessContractDeclaration`](https://docs.bijection.com/api/modules/access#accesscontractdeclaration)>> | | `discoveries` | `Readonly`\<`Record`\<`string`, [`AccessDiscoveryDefinition`](https://docs.bijection.com/api/modules/runtime#accessdiscoverydefinition)>> | | `session?` | \{ `people`: `string` ; `services`: `string` } | | `session.people` | `string` | | `session.services` | `string` | | `initialOwner?` | [`AccessInitialOwner`](https://docs.bijection.com/api/modules/access#accessinitialowner) | | `assignments` | `string` | | `requests?` | `string` | | `categories` | `Record`\<`string`, `"all"` \| `"any"`> | | `rootCategories` | `Set`\<`string`> | | `types` | `Map`\<`string`, [`CompiledType`](https://docs.bijection.com/api/modules/access#compiledtype)> | | `byTable` | `Map`\<`string`, [`CompiledType`](https://docs.bijection.com/api/modules/access#compiledtype)> | | `permissionCandidates` | `ReadonlyMap`\<`string`, readonly `string`\[]> | | `permissionTargets` | `ReadonlyMap`\<`string`, `string`> | | `roles` | `Map`\<`string`, [`CompiledRole`](https://docs.bijection.com/api/modules/access#compiledrole)> | | `confer` | `Map`\<`string`, [`CompiledConferEnvelope`](https://docs.bijection.com/api/modules/access#compiledconferenvelope)> | | `evidence` | `Map`\<`string`, [`EvidenceDeclaration`](https://docs.bijection.com/api/modules/access#evidencedeclaration)> | | `requirements` | `Readonly`\<`Record`\<`string`, [`CompiledPermissionRequirement`](https://docs.bijection.com/api/modules/access#compiledpermissionrequirement)>> | | `services` | `Map`\<`string`, [`CompiledService`](https://docs.bijection.com/api/modules/access#compiledservice)> | | `clients?` | [`CompiledClientRestrictions`](https://docs.bijection.com/api/modules/sessions#compiledclientrestrictions) | | `guests` | \{ `maxDuration`: `number` } | | `guests.maxDuration` | `number` | | `principalTypes` | `string`\[] | | `directories` | [`AccessDirectory`](https://docs.bijection.com/api/modules/access#accessdirectory)\[] | | `users?` | [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition)\[`"users"`] | | `roleDefinitions?` | [`AccessRoleDefinitions`](https://docs.bijection.com/api/modules/access#accessroledefinitions) | | `claims` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `conditions` | \{ `name`: `string` ; `expr`: [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) ; `claims`: `Set`\<`string`> ; `on`: `Set`\<`string`> \| `null` }\[] | | `requestScope` | \{ `objects?`: `string` ; `permissions?`: `string` } | | `requestScope.objects?` | `string` | | `requestScope.permissions?` | `string` | | `audit` | `boolean` | | `scoped` | `Set`\<`string`> | | `inputs` | `string`\[] | | `releases` | [`CompiledRelease`](https://docs.bijection.com/api/modules/access#compiledrelease)\[] | | `components` | [`CompiledComponentBinding`](https://docs.bijection.com/api/modules/access#compiledcomponentbinding)\[] | *** ### PrincipalSource Ƭ **PrincipalSource**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `kind` | `"workspaceIdentity"` | | `table` | `string` | | `index` | `string` | | `person` | `string` | *** ### WorkspaceStandingRequirement Ƭ **WorkspaceStandingRequirement**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `kind` | `"workspaceStanding"` | | `people` | `string` | | `services` | `string` | *** ### StorageBinding Ƭ **StorageBinding**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `table` | `string` | *** ### Table Ƭ **Table**: [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)\[`string`] Not exported: an exported type refers to it. *** ### Model Ƭ **Model**\<`T`>: [`DataModelFromSchemaDefinition`](https://docs.bijection.com/api/modules/server#datamodelfromschemadefinition)\<[`SchemaDefinition`](https://docs.bijection.com/api/classes/server.SchemaDefinition)\<\{ `observation`: `T` }, `true`>> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `T` | extends [`Table`](https://docs.bijection.com/api/modules/access#table) | *** ### Info Ƭ **Info**\<`T`>: [`Model`](https://docs.bijection.com/api/modules/access#model)\<`T`>\[keyof [`Model`](https://docs.bijection.com/api/modules/access#model)\<`T`>] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `T` | extends [`Table`](https://docs.bijection.com/api/modules/access#table) | *** ### Next Ƭ **Next**: \[`1`, `2`, `3`, `4`] Not exported: an exported type refers to it. *** ### BoundValue Ƭ **BoundValue**\<`T`>: `T` extends `string` | `boolean` | `bigint` ? `T` | [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`T`> : `never` | `T` extends [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ? [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`string`> : `never` | `T` extends `string` ? `Extract`\<[`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue), \{ `kind`: `"principal"` | `"program"` }> : `never` | `T` extends `string` | `boolean` | `bigint` ? `Extract`\<[`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue), \{ `kind`: `"claim"` }> : `never` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### Policy Ƭ **Policy**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `table` | `string` | | `policy` | `SchemaAccessPolicy` | *** ### Address Ƭ **Address**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `module` | `string` | | `export` | `string` | *** ### InstalledRule Ƭ **InstalledRule**: `ReturnType`\ | `ReturnType`\ Not exported: an exported type refers to it. *** ### AssignmentLifecycle Ƭ **AssignmentLifecycle**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `table` | () => `string` | | `expire` | (`ctx`: [`AccessMutationCtx`](https://docs.bijection.com/api/modules/access#accessmutationctx), `args`: \{ `assignmentId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> }) => `Promise`\<`null`> | *** ### AccessResourceRef Ƭ **AccessResourceRef**: \{ `type`: `"root"` ; `id?`: `never` ; `key?`: `never` } | \{ `type`: `string` ; `id`: `string` ; `key?`: `never` } | \{ `type`: `string` ; `key`: `string` ; `id?`: `never` } *** ### RoleRef Ƭ **RoleRef**\<`Key`>: `Key` | `Extract`\<`NativeRoleRef`, \{ `kind`: `"tenant"` }> #### Type parameters | Name | Type | | :- | :- | | `Key` | extends `string` = `string` | *** ### AccessPrincipal Ƭ **AccessPrincipal**\<`UserId`, `Service`>: \{ `kind`: `"user"` ; `userId`: `UserId` } | \{ `kind`: `"service"` ; `name`: `Service` } | \{ `kind`: `"session"` ; `service`: `Service` ; `id`: `string` } #### Type parameters | Name | Type | | :- | :- | | `UserId` | extends `string` = `string` | | `Service` | extends `string` = `string` | *** ### Holder Ƭ **Holder**\<`UserId`>: `Exclude`\<[`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal)\<`UserId`>, \{ `kind`: `"session"` }> | \{ `kind`: `"group"` ; `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) ; `memberPermission`: `string` } | \{ `kind`: `"program"` ; `program`: [`ProgramGrantRef`](https://docs.bijection.com/api/modules/access#programgrantref) } #### Type parameters | Name | Type | | :- | :- | | `UserId` | extends `string` = `string` | *** ### HolderInput Ƭ **HolderInput**: [`Holder`](https://docs.bijection.com/api/modules/access#holder) | \{ `kind`: `"self"` } | \{ `kind`: `"identity"` ; `tokenIdentifier`: `string` } *** ### Assignment Ƭ **Assignment**\<`AssignmentId`>: `Object` #### Type parameters | Name | Type | | :- | :- | | `AssignmentId` | extends [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> = [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> | #### Type declaration | Name | Type | | :- | :- | | `id` | `AssignmentId` | | `resource` | [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) | | `role` | [`RoleRef`](https://docs.bijection.com/api/modules/access#roleref) | | `holder` | [`Holder`](https://docs.bijection.com/api/modules/access#holder) | | `expiresAt?` | `number` | | `reason?` | `string` | *** ### AssignmentInput Ƭ **AssignmentInput**: `Omit`\<[`Assignment`](https://docs.bijection.com/api/modules/access#assignment), `"id"` | `"holder"`> & \{ `holder`: [`HolderInput`](https://docs.bijection.com/api/modules/access#holderinput) } *** ### AccessExplanation Ƭ **AccessExplanation**: `Omit`\<[`AccessExplanation`](https://docs.bijection.com/api/modules/browser#accessexplanation), `"resource"` | `"principal"` | `"execution"`> & \{ `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) ; `principal`: [`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal) | `null` ; `execution`: [`ExecutionDescriptor`](https://docs.bijection.com/api/modules/browser#executiondescriptor) | `null` } *** ### InspectionRequest Ƭ **InspectionRequest**: `Object` #### Type declaration | Name | Type | | :- | :- | | `resource` | [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) | | `principal?` | [`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal) | | `permissions?` | readonly `string`\[] | | `detail?` | `"evidence"` | | `excludedAssignments?` | readonly `string`\[] | *** ### AccessInspector Ƭ **AccessInspector**: `Object` #### Type declaration | Name | Type | | :- | :- | | `explain` | (`request`: [`InspectionRequest`](https://docs.bijection.com/api/modules/access#inspectionrequest)) => `Promise`\<[`AccessExplanation`](https://docs.bijection.com/api/modules/access#accessexplanation)> | | `simulate` | (`request`: [`InspectionRequest`](https://docs.bijection.com/api/modules/access#inspectionrequest) & \{ `changes`: `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> }) => `Promise`\<[`AccessExplanation`](https://docs.bijection.com/api/modules/access#accessexplanation)> | *** ### AccessHolders Ƭ **AccessHolders**\<`Resource`, `AssignmentId`>: `Object` #### Type parameters | Name | Type | | :- | :- | | `Resource` | extends [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) = [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) | | `AssignmentId` | extends [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> = [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> | #### Type declaration | Name | Type | | :- | :- | | `resource` | `Resource` | | `assignments` | [`Assignment`](https://docs.bijection.com/api/modules/access#assignment)\<`AssignmentId`>\[] | | `directories` | \{ `table`: `string` ; `role`: [`RoleRef`](https://docs.bijection.com/api/modules/access#roleref) }\[] | *** ### AccessRequest Ƭ **AccessRequest**: `Object` #### Type declaration | Name | Type | | :- | :- | | `permission` | `string` | | `resource` | [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) | *** ### RetainedPermissionBinding Ƭ **RetainedPermissionBinding**: [`AccessRequest`](https://docs.bijection.com/api/modules/access#accessrequest) & \{ `binding`: `string` } *** ### UnprovenReason Ƭ **UnprovenReason**: `Object` #### Type declaration | Name | Type | | :- | :- | | `field` | `string` | | `code` | `"FIELD_MAY_BE_MISSING"` \| `"BOUNDS_NOT_PROVEN"` \| `"FIELD_UNBOUNDED"` \| `"FIELD_UNPINNED"` | | `mayBeMissing` | `boolean` | | `message` | `string` | *** ### NativeReceiver Ƭ **NativeReceiver**: \{ `kind`: `"http"` ; `prefix`: `string` ; `methods`: `string`\[] | `null` } | \{ `kind`: `"integration"` ; `integration`: `string` ; `command`: `string` } | \{ `kind`: `"dataset"` ; `dataset`: `string` } | \{ `kind`: `"executor"` ; `onward`: `"unrestricted"` ; `executor`: [`ExecutorReceiver`](https://docs.bijection.com/api/modules/access#executorreceiver) } Not exported: an exported type refers to it. *** ### AccessReleaseCondition Ƭ **AccessReleaseCondition**\<`Args`>: `Object` Closed predicates over exact command arguments. These compile at schema analysis; no application callback makes a runtime authorization decision. #### Type parameters | Name | Type | | :- | :- | | `Args` | `any` | #### Type declaration | Name | Type | | :- | :- | | `fields` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `condition` | [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition)\<`Args`, \{}, \{}> | *** ### Releases Ƭ **Releases**\<`D`>: `D` extends \{ `releases`: infer R } ? `R` : \{} Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `D` | *** ### Destinations Ƭ **Destinations**\<`D`>: `D` extends \{ `destinations`: infer R } ? `R` : \{} Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `D` | *** ### DestinationCommand Ƭ **DestinationCommand**\<`D`, `Name`>: [`Releases`](https://docs.bijection.com/api/modules/access#releases)\<`D`>\[`Name`] extends \{ `destination`: infer Target } ? `Target` extends keyof [`Destinations`](https://docs.bijection.com/api/modules/access#destinations)\<`D`> ? [`Destinations`](https://docs.bijection.com/api/modules/access#destinations)\<`D`>\[`Target`] extends \{ `receiver`: infer C } ? `C` : `never` : `never` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | `D` | | `Name` | extends keyof [`Releases`](https://docs.bijection.com/api/modules/access#releases)\<`D`> | *** ### ReceiverNames Ƭ **ReceiverNames**\<`D`>: \{ \[Name in keyof Releases\ & string]: \[DestinationCommand\] extends \[never] ? never : Name }\[keyof [`Releases`](https://docs.bijection.com/api/modules/access#releases)\<`D`> & `string`] Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `D` | *** ### ReceiverInput Ƭ **ReceiverInput**\<`D`, `Name`>: \{ `args`: [`CommandArgs`](https://docs.bijection.com/api/modules/connectors#commandargs)\<[`DestinationCommand`](https://docs.bijection.com/api/modules/access#destinationcommand)\<`D`, `Name`>> } & [`DestinationCommand`](https://docs.bijection.com/api/modules/access#destinationcommand)\<`D`, `Name`> extends [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<`any`, `"resource"`> ? \{ `target?`: \{ `bindingId`: `string` } } : [`DestinationCommand`](https://docs.bijection.com/api/modules/access#destinationcommand)\<`D`, `Name`> extends [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<`any`, `"collection"`> ? \{ `target?`: [`CommandTarget`](https://docs.bijection.com/api/modules/connectors#commandtarget) } : \{ `target`: [`CommandTarget`](https://docs.bijection.com/api/modules/connectors#commandtarget) } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | `D` | | `Name` | extends [`ReceiverNames`](https://docs.bijection.com/api/modules/access#receivernames)\<`D`> | *** ### ReceiverRequest Ƭ **ReceiverRequest**\<`D`, `Name`>: \{ `integration`: [`IntegrationAddress`](https://docs.bijection.com/api/modules/sources#integrationaddress) ; `command`: `string` ; `release`: `Name` } & [`ReceiverInput`](https://docs.bijection.com/api/modules/access#receiverinput)\<`D`, `Name`> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | `D` | | `Name` | extends [`ReceiverNames`](https://docs.bijection.com/api/modules/access#receivernames)\<`D`> | *** ### ExecutorReceiver Ƭ **ExecutorReceiver**: \{ `kind`: `"python"` ; `component`: `string` | `null` ; `function`: `string` ; `connection`: `string` ; `program`: \{ `revision`: `string` } } | \{ `kind`: `"workload"` ; `component`: `string` | `null` ; `integration`: `string` ; `sourceId`: `string` ; `definitionRevision`: `string` ; `command`: `string` } Exact executor identity selected by native admission. A receiver admits this recipient; it never asserts technical confinement. *** ### AccessReceiver Ƭ **AccessReceiver**: [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<`any`> | \{ `http`: `string` ; `methods?`: readonly `string`\[] } | \{ `dataset`: `string` } | \{ `executor`: [`ExecutorReceiver`](https://docs.bijection.com/api/modules/access#executorreceiver) ; `onward`: `"unrestricted"` } Something leaving the deployment that a destination may send to: a binding and the operations on it. *** ### AccessDestinationTarget Ƭ **AccessDestinationTarget**: \{ `reader`: `true` } | \{ `table`: `string` } | \{ `receiver`: [`AccessReceiver`](https://docs.bijection.com/api/modules/access#accessreceiver) } Where a declared destination sends protected rows. *** ### AccessRelease Ƭ **AccessRelease**: `Object` One transfer contract. A named destination identifies a boundary and grants no authority; each release independently declares its sources and conditions. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `from` | readonly `string`\[] | The resource types whose rows the destination may carry. | | `destination` | `string` | - | | `requires?` | `string` | The permission each source type declares and the caller (for a command, its retained requester) must hold on every source object, or on the parent or root a range is decided at. Prefer a distinct permission, such as `geocode`: reusing `read` makes every reader eligible. Omit it only for a command decided without a requester, with `when`. | | `publisher?` | `string` | For dataset publication: the declared service whose live grants, ceiling and sponsorship authorize each batch. Requires a source permission and never declassifies information. | | `when?` | [`AccessReleaseCondition`](https://docs.bijection.com/api/modules/access#accessreleasecondition) | For an integration command receiver: decide its typed arguments (recipients, amounts) at every phase. Required when `requires` is omitted. | | `accepts?` | \{ `labels`: readonly `string`\[] } | The only labels data sent here may carry, as label keys. A source restricted by any other label is refused, whoever could declassify it: this narrows the destination, it grants nothing. Tenant roots are not labels and are unaffected. | | `accepts.labels` | readonly `string`\[] | - | | `declassify?` | readonly `string`\[] | Restriction types this contract may remove. Omitted preserves every obligation. The caller also needs declassify on each affected object; this declaration alone grants no authority. | | `transform?` | [`AccessTransform`](https://docs.bijection.com/api/modules/access#accesstransform) | Consent to one transformation's output, instead of its raw sources. Requires a table or integration command destination. | | `reasonRequired?` | `true` | A checkpoint, in the `reasonRequired` vocabulary of role assignments: the command declares a `reason: v.string()` argument, and every phase of the crossing is refused natively unless it states a non-empty reason. The decision's audit line records it (`access.justified`). Integration command receivers only. | *** ### AccessTransform Ƭ **AccessTransform**: `Object` One transformation a source owner consents to release. Native release compares the destination's payload with the return of the retained call it cites. That call's exact retained program, never the caller or recipient, must currently hold `requires` and the source's read permission on every source, through a program grant. `declassify` is then decided as that program too, so the caller gains no authority over the protected input. The release's own `requires` still decides who may receive the output. Every source of the crossing must have been read by that program during the cited call. A source the caller read separately refuses the route. Pinning a program establishes which code ran, not what its output reveals: the grant is the owner's judgment of that code. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `requires` | `string` | Source permission the exact retained program must currently hold. | | `call` | `string` | Dotted payload path citing the native business call record. | | `payload` | `string` | Dotted payload path holding the transformed output. | | `result?` | `string` | Top-level return field the output equals; omit for the whole return. | *** ### ReleaseFor Ƭ **ReleaseFor**\<`Destinations`>: \{ \[Name in keyof Destinations & string]: Omit\ & Object }\[keyof `Destinations` & `string`] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Destinations` | extends `Record`\<`string`, [`AccessDestinationTarget`](https://docs.bijection.com/api/modules/access#accessdestinationtarget)> | *** ### CompiledDestination Ƭ **CompiledDestination**: \{ `kind`: `"executor"` ; `executor`: [`ExecutorReceiver`](https://docs.bijection.com/api/modules/access#executorreceiver) ; `onward`: `"unrestricted"` } | \{ `kind`: `"table"` ; `table`: `string` } | \{ `kind`: `"http"` ; `prefix`: `URL` ; `methods`: `Set`\<`string`> | `null` } | \{ `kind`: `"integration"` ; `handle`: [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<`any`> } | \{ `kind`: `"reader"` } | \{ `kind`: `"dataset"` ; `dataset`: `string` } Not exported: an exported type refers to it. *** ### CompiledRelease Ƭ **CompiledRelease**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `from` | `Set`\<`string`> | | `to` | [`CompiledDestination`](https://docs.bijection.com/api/modules/access#compileddestination) | | `requires?` | `string` | | `publisher?` | `string` | | `when?` | [`CompiledReleaseCondition`](https://docs.bijection.com/api/modules/access_cedar#compiledreleasecondition) | | `accepts?` | `Set`\<`string`> | | `declassify?` | `Set`\<`string`> | | `reasonRequired?` | `true` | | `transform?` | [`AccessTransform`](https://docs.bijection.com/api/modules/access#accesstransform) | *** ### Declaration Ƭ **Declaration**\<`S`>: `S` extends \{ `[selectedAccess]?`: infer A } ? `A` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `S` | *** ### RequestClient Ƭ **RequestClient**\<`S`>: [`RequestAccessModel`](https://docs.bijection.com/api/modules/access#requestaccessmodel)\<[`Declaration`](https://docs.bijection.com/api/modules/access#declaration)\<`S`>, `S` extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) ? `S` : [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)> Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `S` | *** ### ReaderMethod Ƭ **ReaderMethod**: typeof [`readerMethods`](https://docs.bijection.com/api/modules/access#readermethods)\[`number`] Not exported: an exported type refers to it. *** ### WriterMethod Ƭ **WriterMethod**: typeof [`writerMethods`](https://docs.bijection.com/api/modules/access#writermethods)\[`number`] Not exported: an exported type refers to it. *** ### AccessReader Ƭ **AccessReader**\<`S`>: `0` extends `1` & `S` ? `any` : `Pick`\<[`RequestClient`](https://docs.bijection.com/api/modules/access#requestclient)\<`S`>, [`ReaderMethod`](https://docs.bijection.com/api/modules/access#readermethod)> Request-bound permission decisions and authorized discovery. #### Type parameters | Name | Type | | :- | :- | | `S` | [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | *** ### AccessWriter Ƭ **AccessWriter**\<`S`>: `0` extends `1` & `S` ? `any` : `Pick`\<[`RequestClient`](https://docs.bijection.com/api/modules/access#requestclient)\<`S`>, `Extract`\<[`ReaderMethod`](https://docs.bijection.com/api/modules/access#readermethod) | [`WriterMethod`](https://docs.bijection.com/api/modules/access#writermethod) | `"roles"`, keyof [`RequestClient`](https://docs.bijection.com/api/modules/access#requestclient)\<`S`>>> Request-bound assignment and release lifecycle. #### Type parameters | Name | Type | | :- | :- | | `S` | [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | *** ### AuthorityOrigin Ƭ **AuthorityOrigin**: `"person"` | `"service"` | `"issued"` | `"delegated"` | `"worker"` *** ### RequirementApplicability Ƭ **RequirementApplicability**: `Readonly`\<\{ `kind`: `"all"` }> | `Readonly`\<\{ `kind`: `"origins"` ; `origins`: readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] }> Not exported: an exported type refers to it. *** ### ProgramRequirementField Ƭ **ProgramRequirementField**: `"implementation"` | `"function"` | `"installation"` | `"record"` *** ### RequirementValue Ƭ **RequirementValue**: \{ `kind`: `"target"` } | \{ `kind`: `"principal"` } | \{ `kind`: `"claim"` ; `name`: `string` } | \{ `kind`: `"program"` ; `field`: [`ProgramRequirementField`](https://docs.bijection.com/api/modules/access#programrequirementfield) } | \{ `kind`: `"field"` ; `field`: `string` } | \{ `kind`: `"contact"` ; `field`: `string` ; `contact`: [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind) } | \{ `kind`: `"literal"` ; `value`: [`EvidenceValue`](https://docs.bijection.com/api/modules/access#evidencevalue) } *** ### RequirementCondition Ƭ **RequirementCondition**: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> | (`scope`: [`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> A permission requirement's condition: an expression of the one condition language, built from `requirement` and, in a builder, the claims, principal attributes and typed fields of the requirement's target. *** ### PermissionAuthentication Ƭ **PermissionAuthentication**: `Readonly`\<\{ `maxAgeMs`: `number` ; `acrValues`: readonly `string`\[] ; `requiredMethods`: readonly `string`\[] }> Exact verified OIDC evidence required from a direct actor. *** ### PermissionRequirement Ƭ **PermissionRequirement**: `Readonly`\<\{ `permission`: `string` ; `on`: `string` ; `applies_to?`: [`RequirementApplicability`](https://docs.bijection.com/api/modules/access#requirementapplicability) ; `decision?`: \{ `actors`: readonly (`"person"` | `"service"`)\[] ; `direct?`: `boolean` ; `authentication?`: [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) ; `unless?`: [`RequirementCondition`](https://docs.bijection.com/api/modules/access#requirementcondition) } ; `when?`: [`RequirementCondition`](https://docs.bijection.com/api/modules/access#requirementcondition) }> Not exported: an exported type refers to it. *** ### CompiledPermissionRequirement Ƭ **CompiledPermissionRequirement**: `Readonly`\<\{ `permission`: `string` ; `on`: `string` ; `applies_to`: [`RequirementApplicability`](https://docs.bijection.com/api/modules/access#requirementapplicability) ; `decision?`: \{ `actors`: readonly (`"person"` | `"service"`)\[] ; `direct`: `boolean` ; `authentication?`: [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) ; `unless?`: [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) } ; `when`: [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) }> Not exported: an exported type refers to it. *** ### InstalledResourceSet Ƭ **InstalledResourceSet**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `arguments` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `fields` | `Record`\<`string`, [`AccessClaimType`](https://docs.bijection.com/api/modules/access#accessclaimtype)> | | `requiredFields` | `string`\[] | | `predicate` | [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) | *** ### TransitionOperation Ƭ **TransitionOperation**: `"create"` | `"update"` | `"move"` | `"delete"` *** ### AccessTransitionCondition Ƭ **AccessTransitionCondition**\<`Resource`, `Principal`, `Context`>: (`scope`: `Omit`\<[`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Resource`, `Principal`, `Context`>, `"resource"`> & \{ `before`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Resource`> ; `after`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Resource`> }) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> #### Type parameters | Name | Type | | :- | :- | | `Resource` | `any` | | `Principal` | `any` | | `Context` | `any` | #### Type declaration ▸ (`scope`): [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> ##### Parameters | Name | Type | | :- | :- | | `scope` | `Omit`\<[`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Resource`, `Principal`, `Context`>, `"resource"`> & \{ `before`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Resource`> ; `after`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Resource`> } | ##### Returns [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> *** ### TransitionConditionDeclaration Ƭ **TransitionConditionDeclaration**\<`Resource`, `Principal`, `Context`>: `Object` #### Type parameters | Name | Type | | :- | :- | | `Resource` | `any` | | `Principal` | `any` | | `Context` | `any` | #### Type declaration | Name | Type | | :- | :- | | `on` | readonly [`TransitionOperation`](https://docs.bijection.com/api/modules/access#transitionoperation)\[] | | `when` | [`AccessTransitionCondition`](https://docs.bijection.com/api/modules/access#accesstransitioncondition)\<`Resource`, `Principal`, `Context`> | *** ### CompiledTransitionCondition Ƭ **CompiledTransitionCondition**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `on` | [`TransitionOperation`](https://docs.bijection.com/api/modules/access#transitionoperation)\[] | | `expr` | [`Expr`](https://docs.bijection.com/api/modules/access_cedar#expr) | *** ### ProgramGrantRef Ƭ **ProgramGrantRef**: `Readonly`\<\{ `installation`: `string` ; `callback`: `string` ; `record`: `string` ; `implementation`: `string` }> Exact retained execution. Public locators confer no authority without a resource assignment and live native record/code custody. *** ### AssignmentMutation Ƭ **AssignmentMutation**: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"mutation"`, `"internal"`, \{ `assignmentId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> }> A product internal mutation taking an assignment's id. *** ### AssignmentReminder Ƭ **AssignmentReminder**: `Object` A review reminder for a bounded assignment: `notify`, the product's internal mutation, runs `before` milliseconds ahead of the assignment's expiry (at once when that moment has passed) with the assignment's id. It calls `reviewDue` and commits the notice. #### Type declaration | Name | Type | | :- | :- | | `before` | `number` | | `notify` | [`AssignmentMutation`](https://docs.bijection.com/api/modules/access#assignmentmutation) | *** ### AssignmentOptions Ƭ **AssignmentOptions**: `Object` An optional application-owned review reminder; expiry uses the installed handler. #### Type declaration | Name | Type | | :- | :- | | `remind?` | [`AssignmentReminder`](https://docs.bijection.com/api/modules/access#assignmentreminder) | *** ### TypeNames Ƭ **TypeNames**\<`D`>: `"root"` | `Extract`\ Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | *** ### DeclaredPermissions Ƭ **DeclaredPermissions**\<`T`>: `T` extends \{ `permissions`: readonly infer P\[] } ? `P` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `T` | *** ### ResourceKey Ƭ **ResourceKey**\<`D`, `T`>: `T` extends `"root"` ? `"*"` : `T` extends keyof `D`\[`"types"`] ? `D`\[`"types"`]\[`T`] extends \{ `table`: infer Table } ? `string` extends `Table` ? `string` : [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`Table`> : `string` : `never` Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | | `T` | extends `string` | *** ### HandlerResource Ƭ **HandlerResource**\<`D`, `T`>: `T` extends `"root"` ? \{ `type`: `"root"` } : `D`\[`"types"`]\[`T`] extends \{ `table`: infer Table } ? `string` extends `Table` ? \{ `type`: `T` ; `id`: `string` ; `key?`: `never` } | \{ `type`: `T` ; `key`: `string` ; `id?`: `never` } : \{ `type`: `T` ; `id`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`Table`> ; `key?`: `never` } : \{ `type`: `T` ; `key`: [`ResourceKey`](https://docs.bijection.com/api/modules/access#resourcekey)\<`D`, `T`> ; `id?`: `never` } Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | | `T` | extends [`TypeNames`](https://docs.bijection.com/api/modules/access#typenames)\<`D`> | *** ### HandlerTarget Ƭ **HandlerTarget**\<`D`>: \{ \[T in TypeNames\]: HandlerResource\ }\[[`TypeNames`](https://docs.bijection.com/api/modules/access#typenames)\<`D`>] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | *** ### PermissionArguments Ƭ **PermissionArguments**\<`D`>: `string` extends `AccessPermission`\<`D`> ? \[permission: string, key?: string] : \{ \[P in AccessPermission\]: PermissionTarget\ extends "root" ? \[permission: P] : \[permission: P, key: ResourceKey\>] }\[`AccessPermission`\<`D`>] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | *** ### ResourceBinding Ƭ **ResourceBinding**\<`D`, `S`, `Name`>: \{ \[Table in Extract\]-?: S\[Table] extends AccessTableBinding\ ? R extends AccessResource\ ? Object & (B extends Object ? Object : Object) & (B extends Object ? Object : Object) : never : never }\[`Extract`\] Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | | `Name` | `Name` | *** ### LoweredResources Ƭ **LoweredResources**\<`D`, `S`>: \{ `roles`: `D`\[`"roles"`] ; `types`: \{ \[K in keyof D\["resources"]]: (\[ResourceBinding\] extends \[never] ? \[S] extends \[never] ? Object : string extends keyof S ? Object : Object : ResourceBinding\) & Object & (D\["resources"]\[K] extends Object ? Object : Object) & (D\["resources"]\[K] extends Object ? Object : Object) } } & `D` extends \{ `groups`: infer G } ? \{ `groups`: `G` } : \{} & `D` extends \{ `audit`: infer A } ? \{ `audit`: `A` } : \{} & `D` extends \{ `services`: infer Services } ? \{ `services`: `Services` } : \{} & `D` extends \{ `releases`: infer Releases } ? \{ `releases`: `Releases` } : \{} & `D` extends \{ `destinations`: infer Destinations } ? \{ `destinations`: `Destinations` } : \{} & `D` extends \{ `assignmentListings`: infer Listings } ? \{ `assignmentListings`: `Listings` } : \{} & `D` extends \{ `users`: infer U } ? \{ `users`: `U` } : \{} & `D` extends \{ `roleDefinitions`: infer R } ? \{ `roleDefinitions`: `R` } : \{} Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) = `never` | *** ### AccessPermission Ƭ **AccessPermission**\<`D`, `S`>: `AccessPermission`\<[`LoweredResources`](https://docs.bijection.com/api/modules/access#loweredresources)\<`D`, `S`>> Permission names inferred from semantic resources and scoped roles. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) = `never` | *** ### AssignmentSource Ƭ **AssignmentSource**\<`Definition`>: `Object` Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `Definition` | #### Type declaration | Name | Type | | :- | :- | | `[assignmentSource]` | `Definition` | *** ### AccessDefinition Ƭ **AccessDefinition**\<`D`>: `Omit`\<[`GenericAccessDefinition`](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition), `"resource"` | `"role"` | `"person"` | `"service"` | `"delegate"` | `"policy"` | `"assignments"`> & \{ `release`: \(`name`: `Name`, `input`: [`ReceiverInput`](https://docs.bijection.com/api/modules/access#receiverinput)\<`D`, `Name`>) => [`ReceiverRequest`](https://docs.bijection.com/api/modules/access#receiverrequest)\<`D`, `Name`> ; `assignments`: (...`args`: `Parameters`\<[`GenericAccessDefinition`](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition)\[`"assignments"`]>) => `ReturnType`\<[`GenericAccessDefinition`](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition)\[`"assignments"`]> & [`AssignmentSource`](https://docs.bijection.com/api/modules/access#assignmentsource)\<`D`> ; `policy`: (`type`: [`TypeNames`](https://docs.bijection.com/api/modules/access#typenames)\<[`LoweredResources`](https://docs.bijection.com/api/modules/access#loweredresources)\<`D`>>, `options?`: \{ `alsoTo?`: readonly `string`\[] }) => `SchemaAccessPolicy` ; `delegate`: (`client`: [`DelegationClient`](https://docs.bijection.com/api/interfaces/sessions.DelegationClient), `input`: `Omit`\<[`DelegationInput`](https://docs.bijection.com/api/modules/sessions#delegationinput), `"recipient"` | `"restriction"`> & \{ `recipient`: \{ `kind`: `"service"` ; `name`: `Extract`\, `string`> } | \{ `kind`: `"user"` ; `userId`: `string` } ; `restriction`: [`AccessRestriction`](https://docs.bijection.com/api/modules/sessions#accessrestriction)\<[`HandlerTarget`](https://docs.bijection.com/api/modules/access#handlertarget)\<[`LoweredResources`](https://docs.bijection.com/api/modules/access#loweredresources)\<`D`>>, `AccessPermission`\<[`LoweredResources`](https://docs.bijection.com/api/modules/access#loweredresources)\<`D`>>> }) => `Promise`\<[`DelegationGrant`](https://docs.bijection.com/api/modules/sessions#delegationgrant)> ; `[accessDefinition]`: `D` ; `resources`: \{ `root`: [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`undefined`, `"administer"`, `"root"`, `D`> } & \{ readonly \[K in keyof D\["resources"]]: AccessResource\ } } An immutable declaration with typed table-binding handles. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) = [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput) | *** ### RequestInspection Ƭ **RequestInspection**\<`D`, `S`>: `Object` Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | #### Type declaration | Name | Type | | :- | :- | | `resource` | [`HandlerTarget`](https://docs.bijection.com/api/modules/access#handlertarget)\<`D`> | | `permissions?` | readonly `AccessPermission`\<`D`>\[] | | `principal?` | [`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal)\<[`PrincipalKey`](https://docs.bijection.com/api/modules/server#principalkey)\<`D`, [`EndpointContext`](https://docs.bijection.com/api/modules/server#endpointcontext)\<`S`>>> | *** ### RequestAccess Ƭ **RequestAccess**\<`D`, `Definition`, `S`>: [`RequestOperations`](https://docs.bijection.com/api/interfaces/access.RequestOperations)\<`D`, `Definition`, `S`> & `string` extends keyof `D`\[`"types"`] ? \{ `roles`: [`RequestRoleWriter`](https://docs.bijection.com/api/modules/access#requestrolewriter) } : `D` extends \{ `roleDefinitions`: `object` } ? \{ `roles`: [`RequestRoleWriter`](https://docs.bijection.com/api/modules/access#requestrolewriter) } : \{} Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition) | | `Definition` | `Definition` | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | *** ### RequestRoleWriter Ƭ **RequestRoleWriter**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `create` | (`input`: `Omit`\<`Parameters`\<`AccessModel`\[`"roles"`]\[`"create"`]>\[`1`], `"scope"`> & \{ `scope`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) }) => `ReturnType`\<`AccessModel`\[`"roles"`]\[`"create"`]> | | `rename` | (`role`: `Parameters`\<`AccessModel`\[`"roles"`]\[`"rename"`]>\[`1`], `name`: `Parameters`\<`AccessModel`\[`"roles"`]\[`"rename"`]>\[`2`]) => `Promise`\<`void`> | | `remove` | (`role`: `Parameters`\<`AccessModel`\[`"roles"`]\[`"remove"`]>\[`1`]) => `Promise`\<`void`> | *** ### RequestAccessModel Ƭ **RequestAccessModel**\<`M`, `S`>: \[[`EndpointDefinition`](https://docs.bijection.com/api/modules/server#endpointdefinition)\<`M`>] extends \[`never`] ? [`RequestAccess`](https://docs.bijection.com/api/modules/access#requestaccess)\<[`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition), [`AccessModelDefinition`](https://docs.bijection.com/api/modules/access#accessmodeldefinition), [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)> : [`RequestAccess`](https://docs.bijection.com/api/modules/access#requestaccess)\<[`LoweredResources`](https://docs.bijection.com/api/modules/access#loweredresources)\<[`EndpointDefinition`](https://docs.bijection.com/api/modules/server#endpointdefinition)\<`M`>, `S`>, [`EndpointDefinition`](https://docs.bijection.com/api/modules/server#endpointdefinition)\<`M`>, `S`> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `M` | `M` | | `S` | extends [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema) | *** ### AccessValidators Ƭ **AccessValidators**: `Record`\<`string`, [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator)> *** ### AccessInputValidatorJSON Ƭ **AccessInputValidatorJSON**: \{ `type`: `"string"` | `"boolean"` | `"bigint"` } | \{ `type`: `"literal"` ; `value`: `string` | `boolean` | \{ `$integer`: `string` } } | \{ `type`: `"array"` ; `value`: [`AccessInputValidatorJSON`](https://docs.bijection.com/api/modules/access#accessinputvalidatorjson) } | \{ `type`: `"union"` ; `value`: [`AccessInputValidatorJSON`](https://docs.bijection.com/api/modules/access#accessinputvalidatorjson)\[] } Not exported: an exported type refers to it. *** ### AccessInputValidators Ƭ **AccessInputValidators**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `claims` | `Record`\<`string`, \{ `validator`: [`AccessInputValidatorJSON`](https://docs.bijection.com/api/modules/access#accessinputvalidatorjson) ; `optional`: `boolean` }> | | `attributes` | `Record`\<`string`, \{ `validator`: [`AccessInputValidatorJSON`](https://docs.bijection.com/api/modules/access#accessinputvalidatorjson) ; `optional`: `boolean` }> | *** ### AccessSignatureQuestion Ƭ **AccessSignatureQuestion**: `Readonly`\<\{ `table`: `string` ; `record`: `string` ; `verifier`: `string` ; `usage`: `string` }> *** ### AccessSignatureWitness Ƭ **AccessSignatureWitness**: `Readonly`\<\{ `question`: [`AccessSignatureQuestion`](https://docs.bijection.com/api/modules/access#accesssignaturequestion) ; `signature`: `string` }> *** ### AdmissionGateKind Ƭ **AdmissionGateKind**: `"entitlement"` | `"capacity"` | `"provider"` | `"assurance"` Independent owners contribute mandatory conditions; none grants the operation's business permission. *** ### AdmissionGate Ƭ **AdmissionGate**\<`Row`, `Principal`, `Claims`>: `Object` A gate compiles to an ordinary mandatory permission requirement. Reading an entitlement from a source therefore retains that source's native reads, freshness and withdrawal controls. #### Type parameters | Name | Type | | :- | :- | | `Row` | `any` | | `Principal` | `any` | | `Claims` | `any` | #### Type declaration | Name | Type | | :- | :- | | `kind` | [`AdmissionGateKind`](https://docs.bijection.com/api/modules/access#admissiongatekind) | | `on` | readonly \[`string`, ...string\[]] | | `when` | [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition)\<`Row`, `Principal`, `Claims`> | | `onOrigins?` | readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] | | `decision?` | \{ `actors`: readonly (`"person"` \| `"service"`)\[] ; `direct?`: `boolean` ; `authentication?`: [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) } | | `decision.actors` | readonly (`"person"` \| `"service"`)\[] | | `decision.direct?` | `boolean` | | `decision.authentication?` | [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) | *** ### AllowanceReference Ƭ **AllowanceReference**: `Readonly`\<\{ `address`: `Readonly`\<\{ `module`: `string` ; `export`: `string` }> ; `unit`: `string` }> *** ### AllowanceDefinition Ƭ **AllowanceDefinition**: `Readonly`\<\{ `isAllowance`: `true` ; `[reference]`: () => [`AllowanceReference`](https://docs.bijection.com/api/modules/access#allowancereference) ; `exportAllowance`: () => `string` }> A quantity with one installed address and immutable unit. *** ### AllowanceCharge Ƭ **AllowanceCharge**\<`Argument`>: `Readonly`\<\{ `allowance`: [`AllowanceDefinition`](https://docs.bijection.com/api/modules/access#allowancedefinition) ; `amount`: `Argument` }> A charge is derived from final validated effect arguments. #### Type parameters | Name | Type | | :- | :- | | `Argument` | extends `string` = `string` | *** ### AllowanceAllocation Ƭ **AllowanceAllocation**: `Readonly`\<\{ `allowance`: [`AllowanceDefinition`](https://docs.bijection.com/api/modules/access#allowancedefinition) | [`AllowanceReference`](https://docs.bijection.com/api/modules/access#allowancereference) ; `limit`: `bigint` | `"unbounded"` }> Allocation at this level; inherited allocations continue to apply. *** ### AllowanceObservation Ƭ **AllowanceObservation**: `Object` #### Type declaration | Name | Type | | :- | :- | | `available` | `string` \| `null` | | `pools` | \{ `owner`: `string` ; `limit`: `string` ; `reserved`: `string` ; `spent`: `string` ; `available`: `string` }\[] | *** ### ApplicationAuthServerOptions Ƭ **ApplicationAuthServerOptions**: `Object` Server callbacks with HttpOnly cookie custody over native session records. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `deploymentUrl` | `string` | - | | `clientId?` | `string` | Exact installed OAuth client ID; required when several clients exist. | | `applicationOrigin` | `string` | - | | `flowSecret` | `Uint8Array` | At least 32 random bytes, retained privately across server restarts. | | `basePath?` | `string` | - | | `fetch?` | typeof `fetch` | - | *** ### CliSignInOptions Ƭ **CliSignInOptions**: `Object` CLI sign-in uses the provider's public OIDC client with PKCE. Register loopback redirects with the provider. No client secret is retained. #### Type declaration | Name | Type | | :- | :- | | `scopes?` | `string`\[] | *** ### BrowserSignInOptions Ƭ **BrowserSignInOptions**: `Object` Browser sign-in uses exact registered HTTPS callback URLs. #### Type declaration | Name | Type | | :- | :- | | `redirectUris` | `string`\[] | | `scopes?` | `string`\[] | *** ### ApplicationAuthConfig Ƭ **ApplicationAuthConfig**: `Object` Ordinary provider admission with optional application-owned sign-in. Select cli, browser, or both on one OIDC provider. Other admitted providers may use the same issuer with another audience. An explicit workosAuthkit declaration adds the public AuthKit PKCE protocol to its custom JWT verifier. Other custom JWT admission retains its inherited contract. #### Type declaration | Name | Type | | :- | :- | | `providers` | [`AuthProvider`](https://docs.bijection.com/api/modules/server#authprovider) & \{ `sourceId?`: `string` ; `grantProtocol?`: `"oidc"` \| `"workosAuthkit"` ; `clientSecretCredential?`: `string` ; `nativeClientId?`: `string` ; `nativeSessions?`: \{ `authenticationAssurance?`: \{ `acrValues`: `string`\[] ; `requiredMethods`: `string`\[] } \| `null` ; `providerEvidence?`: \{ `requiredFacts`: (`"sessionActive"` \| `"accountEnabled"`)\[] ; `maximumAgeMs`: `number` } \| `null` ; `accessTokenLifetimeMs`: `number` ; `absoluteLifetimeMs`: `number` ; `idleLifetimeMs`: `number` } ; `cli?`: [`CliSignInOptions`](https://docs.bijection.com/api/modules/access#clisigninoptions) ; `browser?`: [`BrowserSignInOptions`](https://docs.bijection.com/api/modules/access#browsersigninoptions) ; `sessionRevocation?`: \{ `type`: `"workos"` ; `apiKeyCredential`: `string` } ; `providerSecurity?`: `boolean` ; `securityEvents?`: \{ `type`: `"workos"` ; `signingSecretCredential`: `string` } ; `caepEvents?`: \{ `issuer`: `string` ; `audience`: `string` ; `jwksUrl`: `string` ; `sessionIdentifier`: `"providerSid"` } ; `backChannelLogout?`: `boolean` }\[] | *** ### AuthenticationIsolationCase Ƭ **AuthenticationIsolationCase**: `Object` #### Type declaration | Name | Type | | :- | :- | | `name` | `string` | | `issuer` | `string` | | `audiences` | readonly `string`\[] | *** ### ApplicationSessionControl Ƭ **ApplicationSessionControl**: `Object` A native authority control. The principal is the exact issuer|subject; provider-session effects intersect it with the issuer, client and sid. #### Type declaration | Name | Type | | :- | :- | | `requestId` | `string` | | `principal` | `string` | | `reason` | `string` | | `action` | \{ `kind`: `"endAll"` \| `"requireReauthentication"` \| `"disable"` \| `"enable"` } \| \{ `kind`: `"endSession"` ; `session`: `string` } \| \{ `kind`: `"revokeProviderSession"` ; `issuer`: `string` ; `client`: `string` ; `session`: `string` } | *** ### ApplicationSessionControlReceipt Ƭ **ApplicationSessionControlReceipt**: `Object` #### Type declaration | Name | Type | | :- | :- | | `requestId` | `string` | | `principal` | `string` | | `action` | [`ApplicationSessionControl`](https://docs.bijection.com/api/modules/access#applicationsessioncontrol)\[`"action"`] | | `authorityRevision` | `string` | | `acceptedAt` | `number` | *** ### AuditEventDeclaration Ƭ **AuditEventDeclaration**: `Object` #### Type declaration | Name | Type | | :- | :- | | `resources` | readonly `string`\[] | | `metadata` | [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | *** ### AuditEventDefinitions Ƭ **AuditEventDefinitions**: `Record`\<`string`, \{ `resources`: `string`\[] ; `metadata`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator)\[`"json"`] }> *** ### AuditLogBody Ƭ **AuditLogBody**: `Object` #### Index signature ▪ \[key: `string`]: [`AuditLogValue`](https://docs.bijection.com/api/modules/access#auditlogvalue) *** ### AuditLogValue Ƭ **AuditLogValue**: `null` | `undefined` | `boolean` | `number` | `string` | [`LogVar`](https://docs.bijection.com/api/modules/access#logvar) | [`AuditLogValue`](https://docs.bijection.com/api/modules/access#auditlogvalue)\[] | \{ `[key: string]`: [`AuditLogValue`](https://docs.bijection.com/api/modules/access#auditlogvalue); } *** ### AutomationCredential Ƭ **AutomationCredential**: `Object` #### Type declaration | Name | Type | | :- | :- | | `credential` | `string` | | `service` | `string` | | `label` | `string` | | `owner` | \{ `personal`: \{ `issuer`: `string` ; `subject`: `string` ; `session`: `string` ; `participation`: `string` } \| `null` ; `resource`: \{ `type`: `string` ; `key`: `string` } ; `createdBy`: `string` ; `model`: `string` ; `modelDigest`: `string` ; `requestId`: `string` ; `restriction`: [`AccessRestriction`](https://docs.bijection.com/api/modules/sessions#accessrestriction) ; `predecessor`: `string` \| `null` ; `successor`: \{ `credential`: `string` ; `overlapUntil`: `number` } \| `null` } | | `owner.personal` | \{ `issuer`: `string` ; `subject`: `string` ; `session`: `string` ; `participation`: `string` } \| `null` | | `owner.resource` | \{ `type`: `string` ; `key`: `string` } | | `owner.resource.type` | `string` | | `owner.resource.key` | `string` | | `owner.createdBy` | `string` | | `owner.model` | `string` | | `owner.modelDigest` | `string` | | `owner.requestId` | `string` | | `owner.restriction` | [`AccessRestriction`](https://docs.bijection.com/api/modules/sessions#accessrestriction) | | `owner.predecessor` | `string` \| `null` | | `owner.successor` | \{ `credential`: `string` ; `overlapUntil`: `number` } \| `null` | | `installedAt` | `number` | | `expiresAt` | `number` \| `null` | | `revokedAt` | `number` \| `null` | *** ### PolicyContract Ƭ **PolicyContract**\<`Args`, `Result`>: `Object` A package's validator contract. It contains no application authority. #### Type parameters | Name | Type | | :- | :- | | `Args` | extends [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) = [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) | | `Result` | extends [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) = [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | #### Type declaration | Name | Type | | :- | :- | | `args` | `Args` | | `returns` | `Result` | *** ### ComponentAccessPolicy Ƭ **ComponentAccessPolicy**\<`Kind`>: `Object` Standard resource decisions derived by component schema declarations, optionally narrowed by the package to the resource kinds it installs. #### Type parameters | Name | Type | | :- | :- | | `Kind` | extends `string` = `string` | #### Type declaration | Name | Type | | :- | :- | | `args` | typeof [`componentAccessArgs`](https://docs.bijection.com/api/modules/runtime#componentaccessargs) | | `returns` | typeof [`readAccessResults`](https://docs.bijection.com/api/modules/access#readaccessresults) | | `componentAccess` | `true` | | `resourceKinds?` | readonly `Kind`\[] | *** ### AuthenticationCeremony Ƭ **AuthenticationCeremony**: `Object` #### Type declaration | Name | Type | | :- | :- | | `principal` | `string` | | `session` | `string` | | `issuer` | `string` | | `clientId` | `string` | | `configurationDigest` | `string` | | `configurationRevision` | `string` | | `providerOrganization` | `string` \| `null` | | `providerMethod` | `string` \| `null` | | `methods` | `string`\[] | | `authenticatedAtMs` | `number` \| `null` | | `observedAtMs` | `number` | *** ### Configuration Ƭ **Configuration**: `Object` Not exported: an exported type refers to it. #### Type declaration | Name | Type | | :- | :- | | `issuer` | `string` | | `clientId` | `string` | | `providerOrganization` | `string` | *** ### Observation Ƭ **Observation**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ Not exported: an exported type refers to it. *** ### Proof Ƭ **Proof**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ Not exported: an exported type refers to it. *** ### ReadContext Ƭ **ReadContext**: [`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`any`, `any`> Not exported: an exported type refers to it. *** ### SetupTable Ƭ **SetupTable**\<`Table`, `Resource`>: `Table` & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<`Resource`, `any`> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Table` | `Table` | | `Resource` | extends [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | *** ### Population Ƭ **Population**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ Not exported: an exported type refers to it. *** ### IdentityCorrelation Ƭ **IdentityCorrelation**: \{ `kind`: `"matched"` ; `person`: `string` ; `organization`: `string` ; `provider`: `string` ; `subject`: `string` ; `evidence`: [`InspectionEvidence`](https://docs.bijection.com/api/modules/apps#inspectionevidence)\[] ; `validUntil`: `number` } | \{ `kind`: `"conflict"` ; `people`: `string`\[] ; `evidence`: [`InspectionEvidence`](https://docs.bijection.com/api/modules/apps#inspectionevidence)\[] } | \{ `kind`: `"unmatched"` ; `evidence`: [`InspectionEvidence`](https://docs.bijection.com/api/modules/apps#inspectionevidence)\[] } | \{ `kind`: `"unavailable"` ; `evidence`: [`InspectionEvidence`](https://docs.bijection.com/api/modules/apps#inspectionevidence)\[] } *** ### IdentityFieldAuthority Ƭ **IdentityFieldAuthority**\<`Row`, `Principal`, `Claims`>: (`scope`: `Omit`\<[`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Row`, `Principal`, `Claims`>, `"resource"`> & \{ `before`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Row`> }) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> #### Type parameters | Name | Type | | :- | :- | | `Row` | `any` | | `Principal` | `any` | | `Claims` | `any` | #### Type declaration ▸ (`scope`): [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> Field management is a transition obligation, independent of disclosure and ordinary edit permission. The authority builder receives only the recorded original identity; proposed identity fields cannot establish their owner. ##### Parameters | Name | Type | | :- | :- | | `scope` | `Omit`\<[`AccessConditionScope`](https://docs.bijection.com/api/modules/access#accessconditionscope)\<`Row`, `Principal`, `Claims`>, `"resource"`> & \{ `before`: [`References`](https://docs.bijection.com/api/modules/access#references)\<`Row`> } | ##### Returns [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> *** ### PolicySlot Ƭ **PolicySlot**\<`Args`, `Result`>: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, `Args`, `Result`> A component's typed policy dependency. Each installation's application binds it to one policy query in the component's binding (`policies`). Calling it outside native policy evaluation is refused. #### Type parameters | Name | Type | | :- | :- | | `Args` | extends [`DefaultFunctionArgs`](https://docs.bijection.com/api/modules/server#defaultfunctionargs) = [`DefaultFunctionArgs`](https://docs.bijection.com/api/modules/server#defaultfunctionargs) | | `Result` | `any` | *** ### QueryPolicy Ƭ **QueryPolicy**: `Object` Explicit inputs and shared query calls for a query used by a policy. #### Type declaration | Name | Type | | :- | :- | | `reads` | readonly `string`\[] \| () => readonly `string`\[] | | `calls?` | readonly [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"public"` \| `"internal"`>\[] | *** ### PolicyExecution Ƭ **PolicyExecution**: \{ `kind`: `"caller"` } | \{ `kind`: `"program"` ; `program`: [`DerivationProgramExecution`](https://docs.bijection.com/api/modules/runtime_adapters_relational#derivationprogramexecution) } | \{ `kind`: `"custody"` ; `component`: `string` | `null` ; `owner`: `string` | `null` } & \{ `scheduled`: \{ `function`: `string` ; `job`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`"_scheduled_functions"`> } | `null` } Native execution of the decision being evaluated. It confers no person or resource permission. Available only inside a rule with private inputs. A custody holder is set by native scheduling/worker admission; an ordinary caller, including an anonymous or administrator caller, cannot select it. A decision for a delegated human remains a caller decision. *** ### LogVar Ƭ **LogVar**: typeof [`REQUEST_ID`](https://docs.bijection.com/api/modules/server#request_id) | typeof [`IP`](https://docs.bijection.com/api/modules/server#ip) | typeof [`USER_AGENT`](https://docs.bijection.com/api/modules/server#user_agent) | typeof [`NOW`](https://docs.bijection.com/api/modules/server#now) | typeof [`BIJECTION_ACTOR`](https://docs.bijection.com/api/modules/server#bijection_actor) Not exported: an exported type refers to it. *** ### Workflow Ƭ **Workflow**: \{ `role`: `string` ; `maxDurationMs`: `number` | `null` } & \{ `kind`: `"participation"` } | \{ `kind`: `"task"` ; `args`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `perform`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"mutation"`, `"internal"`, `any`, `any`> ; `completion`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `invitationId`: `string` ; `result`: [`Value`](https://docs.bijection.com/api/modules/values#value) }, typeof [`type`](https://docs.bijection.com/api/classes/values.VDerived#type)> } Not exported: an exported type refers to it. *** ### Decision Ƭ **Decision**\<`Result`>: `void` | `Result` | `Promise`\<`void` | `Result`> Not exported: an exported type refers to it. #### Type parameters | Name | | :- | | `Result` | *** ### CommandDecision Ƭ **CommandDecision**: `null` | \{ `validUntil`: `number` } | \{ `recheckAt`: `number` } One command decision: permit (optionally until `validUntil`), or defer with `recheckAt`, which refuses now and is never permission. *** ### CommandContract Ƭ **CommandContract**\<`Args`, `Target`>: `Object` A connector's protocol contract for one command: its argument validators and, when the connector fixes it, its target. It carries no installed source and no application authority. #### Type parameters | Name | Type | | :- | :- | | `Args` | extends [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) = [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) | | `Target` | extends [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `"required"`, `any`> \| `undefined` = [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `"required"`, `any`> \| `undefined` | #### Type declaration | Name | Type | | :- | :- | | `args` | `Args` | | `target?` | `Target` | *** ### CommandPolicyDefinition Ƭ **CommandPolicyDefinition**\<`Contract`, `Target`, `DataModel`>: \{ `reads?`: readonly `Extract`\\[] ; `calls?`: readonly [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"public"` | `"internal"`, `any`, `any`>\[] ; `handler`: (`ctx`: [`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`DataModel`>, `input`: `Omit`\<[`CommandGoverningInput`](https://docs.bijection.com/api/modules/sources#commandgoverninginput), `"target"` | `"args"`> & \{ `target`: `Target`\[`"type"`] ; `args`: [`ObjectType`](https://docs.bijection.com/api/modules/values#objecttype)\<`Contract`\[`"args"`]> }) => [`Decision`](https://docs.bijection.com/api/modules/access#decision)\<[`CommandDecision`](https://docs.bijection.com/api/modules/access#commanddecision)> } & `Contract`\[`"target"`] extends [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `"required"`, `any`> ? \{ `target?`: `never` } : \{ `target`: `Target` } Application admission for one command contract. Completing normally permits, throwing refuses, and an explicit decision adds an expiry or a deferral. Omitted `reads` means no table reads. #### Type parameters | Name | Type | | :- | :- | | `Contract` | extends [`CommandContract`](https://docs.bijection.com/api/modules/access#commandcontract) | | `Target` | extends [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `"required"`, `any`> | | `DataModel` | extends [`GenericDataModel`](https://docs.bijection.com/api/modules/server#genericdatamodel) | *** ### ReadAccessRequest Ƭ **ReadAccessRequest**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\\[`number`] One native object or searched-domain authorization obligation. *** ### Crossing Ƭ **Crossing**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ One crossing out of the backend. *** ### ResourceAuditPage Ƭ **ResourceAuditPage**: `Object` A scoped statement retains the journal's native outcome and attribution. Body fields are authored claims. Source bodies can be withheld independently. #### Type declaration | Name | Type | | :- | :- | | `items` | \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"committed"` \| `"execution_failed"` \| `"authorized"` \| `"refused"` \| `"observed"` ; `observed_at_ms`: `number` ; `request_id`: `string` \| `null` ; `function`: `string` \| `null` ; `actor`: `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> \| `null` ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] | | `cursor` | `string` \| `null` | | `hasMore` | `boolean` | | `retentionDays` | `number` | | `earliestRecordingTimeMs` | `number` | | `snapshotRevision` | `string` | *** ### ResourceAuthority Ƭ **ResourceAuthority**\<`Mode`>: `Object` A programmable policy owner for a table inside an installed component, installed through `.access`. Applications declare their tables' protection with `defineAccess` and `.access(access.resources., ...)` instead: activation refuses a programmable policy on an application (root) table. The queries decide the actual caller or finite programme under current policy; this declaration grants no component or programme authority itself. #### Type parameters | Name | Type | | :- | :- | | `Mode` | extends `"read"` \| `"readWrite"` = `"read"` \| `"readWrite"` | #### Type declaration | Name | Type | | :- | :- | | `[authority]` | `true` | | `mode` | `Mode` | *** ### Query Ƭ **Query**\<`A`>: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"public"` | `"internal"`, `A`, [`ReadAccessResults`](https://docs.bijection.com/api/modules/server#readaccessresults)> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `A` | extends `Record`\<`string`, `any`> | *** ### ResourceAuthorityOptions Ƭ **ResourceAuthorityOptions**: `Object` Private policy inputs are ordinary tables in this schema. The fixed query declarations name their callable policy dependencies separately. #### Type declaration | Name | Type | Description | | :- | :- | :- | | `read` | [`Query`](https://docs.bijection.com/api/modules/access#query)\<[`ReadAccessArgs`](https://docs.bijection.com/api/modules/server#readaccessargs)> | - | | `destination` | [`Query`](https://docs.bijection.com/api/modules/access#query)\<[`DisclosureArgs`](https://docs.bijection.com/api/modules/server#disclosureargs)> | - | | `export?` | [`Query`](https://docs.bijection.com/api/modules/access#query)\<[`DisclosureArgs`](https://docs.bijection.com/api/modules/server#disclosureargs)> | Separately authorize loss of runtime control at an external executor. | | `writeReads?` | readonly `string`\[] \| () => readonly `string`\[] | Write policy inputs may additionally include invariant tables. | | `write?` | [`Query`](https://docs.bijection.com/api/modules/access#query)\<\{ `changes`: `any`\[] }> | - | | `writeBasis?` | `"original"` \| `"final"` | - | | `rowsFollowRange?` | [`ReadAccess`](https://docs.bijection.com/api/modules/server#readaccess)\[`"rowsFollowRange"`] | - | | `audit?` | `boolean` | - | | `appliesDelegation?` | `boolean` | - | *** ### RiskBinding Ƭ **RiskBinding**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ *** ### RiskObservation Ƭ **RiskObservation**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ *** ### RiskAssessment Ƭ **RiskAssessment**: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\ *** ### SecuritySection Ƭ **SecuritySection**: `Readonly`\<\{ `owner`: [`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner) ; `population`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `principal`: `string` ; `limit`: `number` ; `cursor`: `string` | `null` }, typeof [`type`](https://docs.bijection.com/api/classes/values.VDerived#type)> }> *** ### InspectionReader Ƭ **InspectionReader**: `Pick`\<[`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`any`, `any`>, `"runQuery"` | `"auth"`> *** ### InspectionWriter Ƭ **InspectionWriter**: `Pick`\<[`BijectionMutationCtx`](https://docs.bijection.com/api/interfaces/server.BijectionMutationCtx)\<`any`, `any`>, `"runQuery"` | `"runMutation"` | `"auth"`> *** ### InspectionOwner Ƭ **InspectionOwner**\<`Facts`>: `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`Facts`>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> #### Type parameters | Name | Type | | :- | :- | | `Facts` | `any` | *** ### ApplicationSubjectInspection Ƭ **ApplicationSubjectInspection**: readonly [`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner)\[] ## Variables ### accessResource • `Const` **accessResource**: typeof [`accessResource`](https://docs.bijection.com/api/modules/access#accessresource) Not exported: an exported type refers to it. *** ### accessBindingOwner • `Const` **accessBindingOwner**: typeof [`accessBindingOwner`](https://docs.bijection.com/api/modules/access#accessbindingowner) Not exported: an exported type refers to it. *** ### accessModelExtension • `Const` **accessModelExtension**: `Readonly`\<\{ `transactionTime`: () => `Promise`\<`number`> ; `signatureChallenge`: (`question`: [`AccessSignatureQuestion`](https://docs.bijection.com/api/modules/access#accesssignaturequestion)) => `Promise`\<`string`> ; `presentSignatureWitness`: (`witness`: [`AccessSignatureWitness`](https://docs.bijection.com/api/modules/access#accesssignaturewitness)) => `Promise`\<`void`> ; `accessMetadata`: (`value`: `object`) => `Pick`\<[`AccessProtection`](https://docs.bijection.com/api/interfaces/access.AccessProtection), `"isAccessModel"` | `"accessAddress"` | `"accessRules"` | `"assignmentTableName"` | `"initializationRole"` | `"requestsConfigured"` | `"requestActions"` | `"assignmentTable"` | typeof [`attachAccess`](https://docs.bijection.com/api/modules/access#attachaccess)> ; `defineAccessContribution`: (`definition`: [`AccessContributionDefinition`](https://docs.bijection.com/api/interfaces/access.AccessContributionDefinition)) => [`AccessContribution`](https://docs.bijection.com/api/interfaces/access.AccessContribution) ; `accessContribution`: typeof [`accessContribution`](https://docs.bijection.com/api/modules/access#accesscontribution) ; `servicePrincipal`: (`identity`: \{ `issuer`: `string` ; `subject?`: `string` }) => \{ `service`: `string` ; `session`: `string` | `null` } | `null` ; `accessScope`: \(`ctx`: `C`) => `C` ; `accessMemo`: \(`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `key`: `object`, `resolve`: () => `Promise`\<`T`>) => `Promise`\<`T`> ; `resolveAccessIdentity`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx)) => `Promise`\<[`AccessIdentity`](https://docs.bijection.com/api/modules/access#accessidentity) | `null`> ; `readIdentityAssociation`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `source`: \{ `table`: `string` ; `index`: `string` }, `identityKey`: `string`) => `Promise`\<`Record`\<`string`, `any`> | `null`> ; `accessProtection`: (`definitions`: `Record`\<`string`, [`Policy`](https://docs.bijection.com/api/modules/access#policy)> | () => `Record`\<`string`, [`Policy`](https://docs.bijection.com/api/modules/access#policy)>, `owner?`: [`AccessBindingOwner`](https://docs.bijection.com/api/interfaces/access.AccessBindingOwner), `decisions?`: [`DecisionInstallation`](https://docs.bijection.com/api/modules/access#decisioninstallation), `lifecycle?`: [`AssignmentLifecycle`](https://docs.bijection.com/api/modules/access#assignmentlifecycle)) => [`AccessProtection`](https://docs.bijection.com/api/interfaces/access.AccessProtection) ; `installAccessMetadata`: \(`target`: `T`, `installation`: [`AccessProtection`](https://docs.bijection.com/api/interfaces/access.AccessProtection)) => `T` ; `accessBindingOwner`: typeof [`accessBindingOwner`](https://docs.bijection.com/api/modules/access#accessbindingowner) ; `accessResource`: typeof [`accessResource`](https://docs.bijection.com/api/modules/access#accessresource) ; `markPrincipalSource`: \(`table`: `T`, `field`: `Field`) => `T` & [`PrincipalSourceTable`](https://docs.bijection.com/api/modules/access#principalsourcetable)\<`Field`> ; `DELEGATION_CLAIMS`: \{ `recipient`: `"delegatedRecipient"` = "delegatedRecipient"; `clientLabel`: `"delegatedClientLabel"` = "delegatedClientLabel"; `support`: `"delegatedSupport"` = "delegatedSupport"; `personal`: `"delegatedPersonal"` = "delegatedPersonal"; `credentialScope`: `"bijectionCredentialScope"` = "bijectionCredentialScope"; `ancestry`: `"delegatedAncestry"` = "delegatedAncestry"; `scope`: `"delegatedScope"` = "delegatedScope"; `restriction`: `"delegatedRestriction"` = "delegatedRestriction"; `permissions`: `"delegatedPermissions"` = "delegatedPermissions" } ; `both`: (...`results`: [`ReadAccessResult`](https://docs.bijection.com/api/modules/server#readaccessresult)\[]) => [`GoverningResult`](https://docs.bijection.com/api/modules/server#governingresult) }> *** ### conditionRequiredFields • `Const` **conditionRequiredFields**: typeof [`conditionRequiredFields`](https://docs.bijection.com/api/modules/access#conditionrequiredfields) Not exported: an exported type refers to it. *** ### ROOT\_TYPE • `Const` **ROOT\_TYPE**: `"root"` The one object every tree hangs from. A type without a parent is a child of the root, so an administrator of everything is an ordinary role on an ordinary object, and a whole-table read is a scope pinned at the root. *** ### ROOT\_KEY • `Const` **ROOT\_KEY**: `"*"` The key of the single root object. *** ### accessContribution • `Const` **accessContribution**: typeof [`accessContribution`](https://docs.bijection.com/api/modules/access#accesscontribution) Not exported: an exported type refers to it. *** ### requirement • `Const` **requirement**: `Readonly`\<\{ `query`: \(`table`: `T`) => `Readonly`\<\{ `withIndex`: \(`name`: `Name`, `range`: (`q`: [`RequirementIndexRange`](https://docs.bijection.com/api/interfaces/access.RequirementIndexRange)\<[`DocumentByInfo`](https://docs.bijection.com/api/modules/server#documentbyinfo)\<[`Info`](https://docs.bijection.com/api/modules/access#info)\<`T`>>, [`NamedIndex`](https://docs.bijection.com/api/modules/server#namedindex)\<[`Info`](https://docs.bijection.com/api/modules/access#info)\<`T`>, `Name`>>) => `unknown`) => `Readonly`\<\{ `exists`: () => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> ; `filter`: (`predicate`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition)\<[`DocumentByInfo`](https://docs.bijection.com/api/modules/server#documentbyinfo)\<[`Info`](https://docs.bijection.com/api/modules/access#info)\<`T`>>>) => `Readonly`\<\{ exists: () => AccessExpression\; filter: (predicate: AccessCondition\>>) => Readonly\<...>; }> }> }> = accessPropositionQuery; `target`: () => [`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue) ; `principal`: () => `Extract`\<[`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue), \{ `kind`: `"principal"` }> ; `claim`: (`name`: `string`) => `Extract`\<[`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue), \{ `kind`: `"claim"` }> ; `program`: (`field`: [`ProgramRequirementField`](https://docs.bijection.com/api/modules/access#programrequirementfield)) => `Extract`\<[`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue), \{ `kind`: `"program"` }> ; `field`: (`field`: `string`) => [`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue) ; `contact`: (`contact`: [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind), `field`: `string`) => [`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue) ; `literal`: (`value`: [`EvidenceValue`](https://docs.bijection.com/api/modules/access#evidencevalue)) => [`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue) ; `evidence`: (`predicate`: `string`, `bindings`: `Record`\<`string`, [`RequirementValue`](https://docs.bijection.com/api/modules/access#requirementvalue)>, `audience`: `"established"` | `"any"`) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> ; `all`: (...`of`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>\[]) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> ; `any`: (...`of`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>\[]) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> ; `not`: (`condition`: [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`>) => [`AccessExpression`](https://docs.bijection.com/api/interfaces/access.AccessExpression)\<`boolean`> }> *** ### attachAccess • `Const` **attachAccess**: typeof [`attachAccess`](https://docs.bijection.com/api/modules/access#attachaccess) Not exported: an exported type refers to it. *** ### readerMethods • `Const` **readerMethods**: \[`"check"`, `"require"`, `"requirePrincipalPermission"`, `"capturePermission"`, `"recheckPermission"`, `"permissionsOn"`, `"assignments"`, `"holders"`, `"reviewDue"`, `"explain"`, `"simulate"`, `"requestable"`, `"principal"`, `"isInitialOwner"`] Not exported: an exported type refers to it. *** ### writerMethods • `Const` **writerMethods**: \[`"grant"`, `"renew"`, `"revoke"`, `"revokeAll"`] Not exported: an exported type refers to it. *** ### billablePopulation • `Const` **billablePopulation**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"unavailable"` } | \{ `kind`: `"counted"` ; `owner`: `string` ; `revision`: `string` ; `count`: `number` ; `observedAtMs`: `number` ; `validUntilMs`: `number` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"unavailable"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`> }, `"required"`, `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"counted"` ; `owner`: `string` ; `revision`: `string` ; `count`: `number` ; `observedAtMs`: `number` ; `validUntilMs`: `number` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"counted"`, `"required"`> ; `owner`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `count`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAtMs`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntilMs`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"kind"` | `"owner"` | `"revision"` | `"count"` | `"observedAtMs"` | `"validUntilMs"`>], `"required"`, `"kind"` | `"owner"` | `"revision"` | `"count"` | `"observedAtMs"` | `"validUntilMs"`> A complete native count from the application's declared participation population. Source-backed populations must establish their native coverage and freshness in this query; unavailable input is never zero seats. *** ### componentAccessPolicy • `Const` **componentAccessPolicy**: [`ComponentAccessPolicy`](https://docs.bijection.com/api/modules/access#componentaccesspolicy) *** ### discoveryAdmissionArgs • `Const` **discoveryAdmissionArgs**: `Object` A metadata decision uses the caller's ordinary query context and tracked reads. `false` withholds this definition; a dependency failure throws. It grants no row, property, transition, or execution permission. #### Type declaration | Name | Type | | :- | :- | | `resources` | [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> | *** ### enterpriseProviderObservation • `Const` **enterpriseProviderObservation**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"connection"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `active`: `null` | `boolean` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } } | \{ `kind`: `"certificate"` ; `expiresAt`: `null` | `number` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } } | \{ `kind`: `"directory"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `complete`: `boolean` ; `checkpoint`: `null` | `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `publicationRevision`: `null` | `string` } | \{ `kind`: `"policy"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `ssoEnforced`: `null` | `boolean` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"connection"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `active`: `null` | `boolean` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } }, \{ `configuration`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` }, \{ `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"issuer"` | `"clientId"` | `"providerOrganization"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"blocked"` | `"ready"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"ready"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"connection"`, `"required"`> ; `active`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `boolean`, \[[`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"source"` | `"revision"` | `"state"` | `"active"` | `"observedAt"` | `"validUntil"` | `"configuration"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"certificate"` ; `expiresAt`: `null` | `number` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } }, \{ `configuration`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` }, \{ `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"issuer"` | `"clientId"` | `"providerOrganization"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"blocked"` | `"ready"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"ready"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"certificate"`, `"required"`> ; `expiresAt`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"expiresAt"` | `"source"` | `"revision"` | `"state"` | `"observedAt"` | `"validUntil"` | `"configuration"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"directory"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `complete`: `boolean` ; `checkpoint`: `null` | `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `publicationRevision`: `null` | `string` }, \{ `configuration`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` }, \{ `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"issuer"` | `"clientId"` | `"providerOrganization"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"blocked"` | `"ready"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"ready"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"directory"`, `"required"`> ; `checkpoint`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `publicationRevision`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `complete`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> }, `"required"`, `"kind"` | `"source"` | `"revision"` | `"state"` | `"observedAt"` | `"validUntil"` | `"complete"` | `"checkpoint"` | `"configuration"` | `"publicationRevision"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"policy"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `state`: `"unavailable"` | `"blocked"` | `"ready"` ; `observedAt`: `number` ; `validUntil`: `number` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `ssoEnforced`: `null` | `boolean` }, \{ `configuration`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` }, \{ `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"issuer"` | `"clientId"` | `"providerOrganization"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"blocked"` | `"ready"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"ready"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"policy"`, `"required"`> ; `ssoEnforced`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `boolean`, \[[`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"source"` | `"revision"` | `"state"` | `"observedAt"` | `"validUntil"` | `"configuration"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"` | `"ssoEnforced"`>], `"required"`, `"kind"` | `"expiresAt"` | `"source"` | `"revision"` | `"state"` | `"active"` | `"observedAt"` | `"validUntil"` | `"complete"` | `"checkpoint"` | `"configuration"` | `"publicationRevision"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"` | `"ssoEnforced"`> A fixed provider owner supplies observed facts. Unknown certificate or directory state stays unavailable; configuration alone proves neither. *** ### enterpriseSetupProof • `Const` **enterpriseSetupProof**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }, \{ `outcome`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"blocked"` | `"ready"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"ready"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `configurationDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `validUntil`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `reason`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"source"` | `"revision"` | `"reason"` | `"validUntil"` | `"outcome"` | `"configurationDigest"` | `"definitionDigest"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"`> A proof owner returns current facts about this exact configuration. *** ### identityCorrelationPopulation • `Const` **identityCorrelationPopulation**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `coverage`: `"partial"` | `"complete"` ; `records`: \{ subject: string; organization: string; person: string; source: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; }; revision: string; provider: string; validUntil: number; }\[] }, \{ `coverage`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"partial"` | `"complete"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"complete"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"partial"`, `"required"`>], `"required"`, `never`> ; `records`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `subject`: `string` ; `organization`: `string` ; `person`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `provider`: `string` ; `validUntil`: `number` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `subject`: `string` ; `organization`: `string` ; `person`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `provider`: `string` ; `validUntil`: `number` }, \{ `organization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `provider`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `subject`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `person`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `source`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> = subjectRefValidator; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"subject"` | `"organization"` | `"person"` | `"source"` | `"revision"` | `"provider"` | `"validUntil"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"`>, `"required"`> }, `"required"`, `"coverage"` | `"records"`> *** ### identityProjectionObservation • `Const` **identityProjectionObservation**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` | `"unmatched"` | `"conflict"` } | \{ `key`: `string` ; `kind`: `"observed"` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `groups`: `Record`\<`string`, \{ kind: "selected"; values: Record\; } | \{ kind: "skipped"; reason: "unavailable" | "conflict" | "sourceNotAuthoritative"; }> ; `validUntilMs`: `number` ; `identityId`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` | `"unmatched"` | `"conflict"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`> ; `reason`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"unmatched"` | `"conflict"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unmatched"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"conflict"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"reason"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"observed"` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `groups`: `Record`\<`string`, \{ kind: "selected"; values: Record\; } | \{ kind: "skipped"; reason: "unavailable" | "conflict" | "sourceNotAuthoritative"; }> ; `validUntilMs`: `number` ; `identityId`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"observed"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `identityId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `source`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> = subjectRefValidator; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `validUntilMs`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `groups`: [`VRecord`](https://docs.bijection.com/api/classes/values.VRecord)\<`Record`\<`string`, \{ `kind`: `"selected"` ; `values`: `Record`\<`string`, `any`> } | \{ `kind`: `"skipped"` ; `reason`: `"unavailable"` | `"conflict"` | `"sourceNotAuthoritative"` }>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"selected"` ; `values`: `Record`\<`string`, `any`> } | \{ `kind`: `"skipped"` ; `reason`: `"unavailable"` | `"conflict"` | `"sourceNotAuthoritative"` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"selected"` ; `values`: `Record`\<`string`, `any`> }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"selected"`, `"required"`> ; `values`: [`VRecord`](https://docs.bijection.com/api/classes/values.VRecord)\<`Record`\<`string`, `any`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`>, `"required"`, `string`> }, `"required"`, `"kind"` | `"values"` | \`values.$\{string}\`\>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: ``"skipped"`` ; `reason`: ``"unavailable"`` \| ``"conflict"`` \| ``"sourceNotAuthoritative"`` \}, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"skipped"``, ``"required"``\> ; `reason`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``"unavailable"`` \| ``"conflict"`` \| ``"sourceNotAuthoritative"``, [[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"sourceNotAuthoritative"``, ``"required"``\>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"conflict"``, ``"required"``\>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"unavailable"``, ``"required"``\>], ``"required"``, `never`\> = skippedReason \}, ``"required"``, ``"kind"`` \| ``"reason"``\>], ``"required"``, ``"kind"`` \| ``"values"`` \| ``"reason"`` \| \`values.$\{string}\`>, `"required"`, `string`> }, `"required"`, `"key"` | `"kind"` | `"source"` | `"revision"` | `"groups"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"validUntilMs"` | `"identityId"` | \`groups.$\{string}\`\>], ``"required"``, ``"key"`` \| ``"kind"`` \| ``"source"`` \| ``"revision"`` \| ``"reason"`` \| ``"groups"`` \| ``"source.id"`` \| ``"source.installation"`` \| ``"source.location"`` \| ``"source.protocol"`` \| ``"source.location.incarnation"`` \| ``"source.location.branch"`` \| ``"source.location.deployment_id"`` \| ``"source.location.branch.key"`` \| ``"source.location.branch.generation"`` \| ``"validUntilMs"`` \| ``"identityId"`` \| \`groups.$\{string}\`> Returned by an installed internal query over current source evidence and a reviewed immutable-identity association. No public endpoint accepts it. Native field transitions and ordinary target permissions remain required. *** ### identityProjectionResult • `Const` **identityProjectionResult**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` | `"unmatched"` | `"conflict"` } | \{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" | "accepted" | "conflict" | "sourceNotAuthoritative" | "sameValue"; outcome: "unchanged" | "skipped" | "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` | `"unmatched"` | `"conflict"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"blocked"`, `"required"`> ; `reason`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"unmatched"` | `"conflict"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unmatched"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"conflict"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"reason"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" | "accepted" | "conflict" | "sourceNotAuthoritative" | "sameValue"; outcome: "unchanged" | "skipped" | "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"projected"`, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `projectionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `source`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> = subjectRefValidator; `sourceRevision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `identityId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `beforeDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `afterDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `groups`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `name`: `string` ; `reason`: `"unavailable"` | `"accepted"` | `"conflict"` | `"sourceNotAuthoritative"` | `"sameValue"` ; `outcome`: `"unchanged"` | `"skipped"` | `"applied"` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `name`: `string` ; `reason`: `"unavailable"` | `"accepted"` | `"conflict"` | `"sourceNotAuthoritative"` | `"sameValue"` ; `outcome`: `"unchanged"` | `"skipped"` | `"applied"` }, \{ `name`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `outcome`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unchanged"` | `"skipped"` | `"applied"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"applied"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unchanged"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"skipped"`, `"required"`>], `"required"`, `never`> ; `reason`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"accepted"` | `"conflict"` | `"sourceNotAuthoritative"` | `"sameValue"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"accepted"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"sameValue"`, `"required"`>, [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"conflict"` | `"sourceNotAuthoritative"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"sourceNotAuthoritative"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"conflict"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`>], `"required"`, `never`> }, `"required"`, `"name"` | `"reason"` | `"outcome"`>, `"required"`> ; `recordedAtMs`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"kind"` | `"requestId"` | `"source"` | `"sourceRevision"` | `"groups"` | `"recordedAtMs"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"identityId"` | `"projectionDigest"` | `"beforeDigest"` | `"afterDigest"`>], `"required"`, `"kind"` | `"requestId"` | `"source"` | `"reason"` | `"sourceRevision"` | `"groups"` | `"recordedAtMs"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"identityId"` | `"projectionDigest"` | `"beforeDigest"` | `"afterDigest"`> *** ### onboardingReceipt • `Const` **onboardingReceipt**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `revision`: `bigint` ; `state`: `"revoked"` | `"completed"` | `"accepted"` | `"claimed"` | `"invited"` ; `participation`: `null` | `string` ; `invitationId`: `string` }, \{ `invitationId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"revoked"` | `"completed"` | `"accepted"` | `"claimed"` | `"invited"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"invited"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"claimed"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"accepted"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"completed"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"revoked"`, `"required"`>], `"required"`, `never`> ; `participation`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"revision"` | `"state"` | `"participation"` | `"invitationId"`> *** ### onboardingCompletion • `Const` **onboardingCompletion**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"pending"` } | \{ `kind`: `"complete"` ; `receipt`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"pending"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"pending"`, `"required"`> }, `"required"`, `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"complete"` ; `receipt`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"complete"`, `"required"`> ; `receipt`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"receipt"`>], `"required"`, `"kind"` | `"receipt"`> *** ### PERSON\_DECISION\_REQUIRED • `Const` **PERSON\_DECISION\_REQUIRED**: `"Only a person signed in directly can make this decision"` The refusal every surface gives a non-person at a person's decision. *** ### readAccessArgs • `Const` **readAccessArgs**: `Object` Arguments for an ordinary query used by `.access({ read, reads })`. The native reader constructs the complete batch. Calling the query directly does not grant private policy-input access or authorize another database read. `properties: null` requires the whole document. Otherwise properties include selected fields and fields contributing to membership, filtering and order, including `_id` and `_creationTime`. Nested paths require their whole top-level property. Query equalities are guaranteed index bounds, not guessed filters. An omitted equality value denotes absence; null remains an explicit value. A query target with `covers: true` stands for rows the engine does not present as requests of their own: a maintained total, a count, a table change token, a whole relation's status, a range folded past the read evidence bound (`rowsFollowRange`) or a retained obligation kept in place of per-row requests. Its result decides every row it covers. Without the key, any row the read returned arrives as a request of its own. #### Type declaration | Name | Type | | :- | :- | | `requests` | [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `properties`: `null` \| `string`\[] ; `target`: \{ kind: "object"; id: string; } \| \{ covers?: true; interval?: \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; }; kind: "query"; equalities: \{ ...; }\[]; } ; `table`: `string` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `properties`: `null` \| `string`\[] ; `target`: \{ kind: "object"; id: string; } \| \{ covers?: true; interval?: \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; }; kind: "query"; equalities: \{ ...; }\[]; } ; `table`: `string` }, \{ `table`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `properties`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`\[], \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`>], `"required"`, `never`> ; `target`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"object"` ; `id`: `string` } \| \{ `covers`: `undefined` \| `true` ; `interval`: `undefined` \| \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; } ; `kind`: `"query"` ; `equalities`: \{ value?: Value; field: string; }\[] }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"object"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"object"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` \| `"id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `covers`: `undefined` \| `true` ; `interval`: `undefined` \| \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; } ; `kind`: `"query"` ; `equalities`: \{ value?: Value; field: string; }\[] }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"query"`, `"required"`> ; `equalities`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `field`: `string` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `field`: `string` }, \{ `field`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), `"optional"`, `string`> }, `"required"`, `"value"` \| `"field"` \| \`value.$\{string}\`\>, ``"required"``\> ; `covers`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`undefined` \| ``true``, ``"optional"``\> ; `interval`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<`undefined` \| \{ `field`: ``null`` \| `string` ; `index`: `string` ; `lower`: ``null`` \| \{ value?: Value; inclusive: boolean; \} ; `upper`: ``null`` \| \{ value?: Value; inclusive: boolean; \} \}, \{ `index`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `field`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `string`, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\>], ``"required"``, `never`\> ; `lower`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| \{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, \{ `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), ``"optional"``, `string`\> ; `inclusive`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, ``"required"``\> \}, ``"required"``, ``"value"`` \| \`value.$\{string}\` \| `"inclusive"`>], `"required"`, `"value"` \| \`value.$\{string}\` \| ``"inclusive"``\> ; `upper`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| \{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, \{ `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), ``"optional"``, `string`\> ; `inclusive`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, ``"required"``\> \}, ``"required"``, ``"value"`` \| \`value.$\{string}\` \| `"inclusive"`>], `"required"`, `"value"` \| \`value.$\{string}\` \| ``"inclusive"``\> \}, ``"optional"``, ``"field"`` \| ``"index"`` \| ``"lower"`` \| ``"upper"`` \| ``"lower.value"`` \| \`lower.value.$\{string}\` \| `"lower.inclusive"` \| `"upper.value"` \| \`upper.value.$\{string}\` \| ``"upper.inclusive"``\> \}, ``"required"``, ``"kind"`` \| ``"covers"`` \| ``"interval"`` \| ``"equalities"`` \| ``"interval.field"`` \| ``"interval.index"`` \| ``"interval.lower"`` \| ``"interval.upper"`` \| ``"interval.lower.value"`` \| \`interval.lower.value.$\{string}\` \| `"interval.lower.inclusive"` \| `"interval.upper.value"` \| \`interval.upper.value.$\{string}\` \| ``"interval.upper.inclusive"``\>], ``"required"``, ``"kind"`` \| ``"id"`` \| ``"covers"`` \| ``"interval"`` \| ``"equalities"`` \| ``"interval.field"`` \| ``"interval.index"`` \| ``"interval.lower"`` \| ``"interval.upper"`` \| ``"interval.lower.value"`` \| \`interval.lower.value.$\{string}\` \| `"interval.lower.inclusive"` \| `"interval.upper.value"` \| \`interval.upper.value.$\{string}\` \| ``"interval.upper.inclusive"``\> \}, ``"required"``, ``"properties"`` \| ``"target"`` \| ``"table"`` \| ``"target.kind"`` \| ``"target.id"`` \| ``"target.covers"`` \| ``"target.interval"`` \| ``"target.equalities"`` \| ``"target.interval.field"`` \| ``"target.interval.index"`` \| ``"target.interval.lower"`` \| ``"target.interval.upper"`` \| ``"target.interval.lower.value"`` \| \`target.interval.lower.value.$\{string}\` \| `"target.interval.lower.inclusive"` \| `"target.interval.upper.value"` \| \`target.interval.upper.value.\$\{string}\` \| `"target.interval.upper.inclusive"`>, `"required"`> | *** ### readAccessResults • `Const` **readAccessResults**: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<(`null` | \{ `reason`: `undefined` | `string` ; `validUntil`: `number` } | \{ `reason`: `string` })\[], [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `reason`: `undefined` | `string` ; `validUntil`: `number` } | \{ `reason`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `reason`: `undefined` | `string` ; `validUntil`: `number` }, \{ `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> }, `"required"`, `"reason"` | `"validUntil"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `reason`: `string` }, \{ `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"reason"`>], `"required"`, `"reason"` | `"validUntil"`>, `"required"`> The return validator of every rule: read, destination, a table's write rule (`.govern`) and an integration command's rule. A command rule gives no reason; one that defers with `recheckAt` declares that member beside `null` and `{ validUntil }`. *** ### crossing • `Const` **crossing**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"rows"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } | \{ target: string; source: string; site: "source"; } | \{ dataset: string; site: "catalog"; catalog: string; } } | \{ `kind`: `"state"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } } | \{ `kind`: `"keys"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } } | \{ `kind`: `"range"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } } | \{ `kind`: `"values"` ; `fields`: `string`\[] ; `from`: `null` | `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"rows"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } | \{ target: string; source: string; site: "source"; } | \{ dataset: string; site: "catalog"; catalog: string; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"rows"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `site`: `"compute"` } | \{ `target`: `string` ; `source`: `string` ; `site`: `"source"` } | \{ `dataset`: `string` ; `site`: `"catalog"` ; `catalog`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `site`: `"compute"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"compute"`, `"required"`> }, `"required"`, `"site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` | `"source"` | `"site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `dataset`: `string` ; `site`: `"catalog"` ; `catalog`: `string` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"catalog"`, `"required"`> ; `catalog`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `dataset`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"dataset"` | `"site"` | `"catalog"`>], `"required"`, `"target"` | `"dataset"` | `"source"` | `"site"` | `"catalog"`> ; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.target"` | `"to.dataset"` | `"to.source"` | `"to.site"` | `"to.catalog"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"state"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"state"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `site`: `"compute"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"compute"`, `"required"`> }, `"required"`, `"site"`> = computeSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"keys"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"keys"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` | `"source"` | `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.target"` | `"to.source"` | `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"range"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"range"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` | `"source"` | `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.target"` | `"to.source"` | `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"values"` ; `fields`: `string`\[] ; `from`: `null` | `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"values"`, `"required"`> ; `from`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` | `"source"` | `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.target"` | `"to.source"` | `"to.site"`>], `"required"`, `"kind"` | `"fields"` | `"from"` | `"to"` | `"to.target"` | `"to.dataset"` | `"to.source"` | `"to.site"` | `"to.catalog"`> What one step moves out of the backend, and where. Every place a table's data is computed or stored outside the backend is a crossing: an installed executor or query compute, a customer catalog. `fields` name fields, never values. A site may retain what it receives: a crossing is disclosure, not a claim that the site erases it, and a revocation stops later crossings without recalling earlier ones. Two timings decide it: * standing, for background work with no caller (a dataset publication to its catalog): `rows` decided with no identity (`ctx.auth.getUserIdentity()` returns `null`) for one request covering every row (`target.covers`), before every send; * per call (a query step): decided for the protected rows the calling function has read, under its caller, before the call leaves. * `rows`: the named fields of `from` disclosed to the installed executor, or to bounded local dataset browsing. The destination is explicit. * `state`: aggregate states computed at the source from `from`'s rows, into compute. Admitted `rows` imply it. * `keys`: the exact set of `from`'s join keys, sent to another source to prune its scan. * `range`: only the least and greatest of those keys. Admitted `keys` imply it; a join filter refused `keys` and admitted `range` sends the range. * `values`: a bounded local relation `from` uploaded as parameters, or with `from: null` query literals (possibly derived from earlier protected reads), whose compared source fields are named `table.field`. Complete queries authorize their input rows to one installed executor. Legacy state/key/range kinds never authorize that row disclosure. A refusal stops execution and never selects another placement. *** ### disclosureArgs • `Const` **disclosureArgs**: `Object` Arguments for the source's `.access({ destination, export })` queries. The host supplies actual information dependencies and the exact fixed destination. A table release gives the resulting record its destination table's policy; it does not grant future reads of the source or retract previously released bytes when a source grant is later revoked. #### Type declaration | Name | Type | | :- | :- | | `requests` | [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `properties`: `null` \| `string`\[] ; `target`: \{ kind: "object"; id: string; } \| \{ covers?: true; interval?: \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; }; kind: "query"; equalities: \{ ...; }\[]; } ; `table`: `string` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `properties`: `null` \| `string`\[] ; `target`: \{ kind: "object"; id: string; } \| \{ covers?: true; interval?: \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; }; kind: "query"; equalities: \{ ...; }\[]; } ; `table`: `string` }, \{ `table`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `properties`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`\[], \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`>], `"required"`, `never`> ; `target`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"object"` ; `id`: `string` } \| \{ `covers`: `undefined` \| `true` ; `interval`: `undefined` \| \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; } ; `kind`: `"query"` ; `equalities`: \{ value?: Value; field: string; }\[] }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"object"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"object"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` \| `"id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `covers`: `undefined` \| `true` ; `interval`: `undefined` \| \{ field: string \| null; index: string; lower: \{ value?: Value; inclusive: boolean; } \| null; upper: \{ value?: Value; inclusive: boolean; } \| null; } ; `kind`: `"query"` ; `equalities`: \{ value?: Value; field: string; }\[] }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"query"`, `"required"`> ; `equalities`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `field`: `string` }\[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `field`: `string` }, \{ `field`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), `"optional"`, `string`> }, `"required"`, `"value"` \| `"field"` \| \`value.$\{string}\`\>, ``"required"``\> ; `covers`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`undefined` \| ``true``, ``"optional"``\> ; `interval`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<`undefined` \| \{ `field`: ``null`` \| `string` ; `index`: `string` ; `lower`: ``null`` \| \{ value?: Value; inclusive: boolean; \} ; `upper`: ``null`` \| \{ value?: Value; inclusive: boolean; \} \}, \{ `index`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `field`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `string`, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\>], ``"required"``, `never`\> ; `lower`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| \{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, \{ `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), ``"optional"``, `string`\> ; `inclusive`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, ``"required"``\> \}, ``"required"``, ``"value"`` \| \`value.$\{string}\` \| `"inclusive"`>], `"required"`, `"value"` \| \`value.$\{string}\` \| ``"inclusive"``\> ; `upper`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| \{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, [[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value) ; `inclusive`: `boolean` \}, \{ `value`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`undefined` \| [`Value`](https://docs.bijection.com/api/modules/values#value), ``"optional"``, `string`\> ; `inclusive`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, ``"required"``\> \}, ``"required"``, ``"value"`` \| \`value.$\{string}\` \| `"inclusive"`>], `"required"`, `"value"` \| \`value.$\{string}\` \| ``"inclusive"``\> \}, ``"optional"``, ``"field"`` \| ``"index"`` \| ``"lower"`` \| ``"upper"`` \| ``"lower.value"`` \| \`lower.value.$\{string}\` \| `"lower.inclusive"` \| `"upper.value"` \| \`upper.value.$\{string}\` \| ``"upper.inclusive"``\> \}, ``"required"``, ``"kind"`` \| ``"covers"`` \| ``"interval"`` \| ``"equalities"`` \| ``"interval.field"`` \| ``"interval.index"`` \| ``"interval.lower"`` \| ``"interval.upper"`` \| ``"interval.lower.value"`` \| \`interval.lower.value.$\{string}\` \| `"interval.lower.inclusive"` \| `"interval.upper.value"` \| \`interval.upper.value.$\{string}\` \| ``"interval.upper.inclusive"``\>], ``"required"``, ``"kind"`` \| ``"id"`` \| ``"covers"`` \| ``"interval"`` \| ``"equalities"`` \| ``"interval.field"`` \| ``"interval.index"`` \| ``"interval.lower"`` \| ``"interval.upper"`` \| ``"interval.lower.value"`` \| \`interval.lower.value.$\{string}\` \| `"interval.lower.inclusive"` \| `"interval.upper.value"` \| \`interval.upper.value.$\{string}\` \| ``"interval.upper.inclusive"``\> \}, ``"required"``, ``"properties"`` \| ``"target"`` \| ``"table"`` \| ``"target.kind"`` \| ``"target.id"`` \| ``"target.covers"`` \| ``"target.interval"`` \| ``"target.equalities"`` \| ``"target.interval.field"`` \| ``"target.interval.index"`` \| ``"target.interval.lower"`` \| ``"target.interval.upper"`` \| ``"target.interval.lower.value"`` \| \`target.interval.lower.value.$\{string}\` \| `"target.interval.lower.inclusive"` \| `"target.interval.upper.value"` \| \`target.interval.upper.value.\$\{string}\` \| `"target.interval.upper.inclusive"`>, `"required"`> | | `destination` | [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"executor"` ; `executor`: \{ function: string; kind: "python"; component: string \| null; program: \{ revision: string; }; endpoint: string; connection: string; } \| \{ kind: "workload"; sourceId: string; component: string \| null; integration: string; command: string; binding: string; definitionRevision: string; credentialDigest: string; authorityDigest: string; } ; `onward`: `"unrestricted"` } \| \{ `kind`: `"crossing"` ; `component`: `null` \| `string` ; `crossing`: \{ kind: "rows"; fields: string\[]; from: string; to: \{ site: "compute"; } \| \{ target: string; source: string; site: "source"; } \| \{ dataset: string; site: "catalog"; catalog: string; }; } \| \{ kind: "state"; fields: string\[]; from: string; to: \{ site: "compute"; }; } \| \{ kind: "keys"; fields: string\[]; from: string; to: \{ target: string; source: string; site: "source"; }; } \| \{ kind: "range"; fields: string\[]; from: string; to: \{ target: string; source: string; site: "source"; }; } \| \{ kind: "values"; fields: string\[]; from: string \| null; to: \{ target: string; source: string; site: "source"; }; } } \| \{ `kind`: `"virtualTableRetention"` ; `component`: `null` \| `string` ; `expiresAt`: `string` ; `tables`: `string`\[] } \| \{ `kind`: `"sourceControl"` ; `component`: `null` \| `string` ; `target`: `string` ; `integration`: `string` ; `control`: `"check"` \| `"refresh"` } \| \{ `kind`: `"seriesSource"` ; `component`: `null` \| `string` ; `table`: `string` ; `source`: `string` ; `retired`: `boolean` } \| \{ `kind`: `"seriesMaintenance"` ; `component`: `null` \| `string` ; `series`: `string` ; `table`: `string` ; `hour`: `bigint` } \| \{ `kind`: `"seriesErase"` ; `component`: `null` \| `string` ; `target`: \{ kind: "series"; series: string; } \| \{ kind: "source"; series: string; source: string; } \| \{ generation?: number; kind: "event"; series: string; source: string; event: string; } \| \{ kind: "range"; series: string; from: bigint; to: bigint; } ; `table`: `string` } \| \{ `kind`: `"publication"` ; `component`: `null` \| `string` ; `table`: `string` ; `group`: `string` ; `selection`: `string` ; `producer`: `string` ; `run`: `string` } \| \{ `work`: `undefined` \| \{ component: string; worker: string; installation: string; effect: string \| null; } ; `kind`: `"table"` ; `component`: `null` \| `string` ; `table`: `string` ; `changes`: \{ id: string; before: any; after: any; }\[] } \| \{ `kind`: `"http"` ; `method`: `string` ; `url`: `string` } \| \{ `release`: `undefined` \| `string` ; `work`: `undefined` \| \{ component: string; worker: string; installation: string; effect: string \| null; } ; `kind`: `"command"` ; `component`: `null` \| `string` ; `args`: `any` ; `target`: `string` \| \{ sourceId: string; } ; `integration`: `string` ; `command`: `string` ; `contract`: `string` ; `phase`: `"send"` \| `"cancel"` \| `"reconcile"` \| `"acceptance"` } \| \{ `kind`: `"storageShare"` ; `size`: `number` ; `expiresAt`: `number` ; `sha256`: `string` ; `recipient`: `string` ; `storageId`: `string` ; `shareId`: `string` } \| \{ `kind`: `"storageErase"` ; `size`: `number` ; `storageId`: `string` } \| \{ `kind`: `"storageRecordErase"` ; `record`: `string` } \| \{ `kind`: `"recordErase"` ; `record`: `string` } \| \{ `kind`: `"storageRevoke"` ; `recipient`: `string` ; `storageId`: `string` ; `shareId`: `string` } \| \{ `work`: `undefined` \| \{ component: string; worker: string; installation: string; effect: string \| null; } ; `kind`: `"custody"` ; `component`: `null` \| `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"executor"` ; `executor`: \{ function: string; kind: "python"; component: string \| null; program: \{ revision: string; }; endpoint: string; connection: string; } \| \{ kind: "workload"; sourceId: string; component: string \| null; integration: string; command: string; binding: string; definitionRevision: string; credentialDigest: string; authorityDigest: string; } ; `onward`: `"unrestricted"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"executor"`, `"required"`> ; `onward`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unrestricted"`, `"required"`> ; `executor`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `function`: `string` ; `kind`: `"python"` ; `component`: `null` \| `string` ; `program`: \{ revision: string; } ; `endpoint`: `string` ; `connection`: `string` } \| \{ `kind`: `"workload"` ; `sourceId`: `string` ; `component`: `null` \| `string` ; `integration`: `string` ; `command`: `string` ; `binding`: `string` ; `definitionRevision`: `string` ; `credentialDigest`: `string` ; `authorityDigest`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `function`: `string` ; `kind`: `"python"` ; `component`: `null` \| `string` ; `program`: \{ revision: string; } ; `endpoint`: `string` ; `connection`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"python"`, `"required"`> ; `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `function`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `connection`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `endpoint`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `program`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `revision`: `string` }, \{ `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"revision"`> }, `"required"`, `"function"` \| `"kind"` \| `"component"` \| `"program"` \| `"endpoint"` \| `"connection"` \| `"program.revision"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"workload"` ; `sourceId`: `string` ; `component`: `null` \| `string` ; `integration`: `string` ; `command`: `string` ; `binding`: `string` ; `definitionRevision`: `string` ; `credentialDigest`: `string` ; `authorityDigest`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"workload"`, `"required"`> ; `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `integration`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sourceId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionRevision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `command`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `binding`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `credentialDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `authorityDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` \| `"sourceId"` \| `"component"` \| `"integration"` \| `"command"` \| `"binding"` \| `"definitionRevision"` \| `"credentialDigest"` \| `"authorityDigest"`>], `"required"`, `"function"` \| `"kind"` \| `"sourceId"` \| `"component"` \| `"program"` \| `"integration"` \| `"command"` \| `"endpoint"` \| `"binding"` \| `"connection"` \| `"program.revision"` \| `"definitionRevision"` \| `"credentialDigest"` \| `"authorityDigest"`> }, `"required"`, `"kind"` \| `"executor"` \| `"onward"` \| `"executor.function"` \| `"executor.kind"` \| `"executor.sourceId"` \| `"executor.component"` \| `"executor.program"` \| `"executor.integration"` \| `"executor.command"` \| `"executor.endpoint"` \| `"executor.binding"` \| `"executor.connection"` \| `"executor.program.revision"` \| `"executor.definitionRevision"` \| `"executor.credentialDigest"` \| `"executor.authorityDigest"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"crossing"` ; `component`: `null` \| `string` ; `crossing`: \{ kind: "rows"; fields: string\[]; from: string; to: \{ site: "compute"; } \| \{ target: string; source: string; site: "source"; } \| \{ dataset: string; site: "catalog"; catalog: string; }; } \| \{ kind: "state"; fields: string\[]; from: string; to: \{ site: "compute"; }; } \| \{ kind: "keys"; fields: string\[]; from: string; to: \{ target: string; source: string; site: "source"; }; } \| \{ kind: "range"; fields: string\[]; from: string; to: \{ target: string; source: string; site: "source"; }; } \| \{ kind: "values"; fields: string\[]; from: string \| null; to: \{ target: string; source: string; site: "source"; }; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"crossing"`, `"required"`> ; `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `crossing`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"rows"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } \| \{ target: string; source: string; site: "source"; } \| \{ dataset: string; site: "catalog"; catalog: string; } } \| \{ `kind`: `"state"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } } \| \{ `kind`: `"keys"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } } \| \{ `kind`: `"range"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } } \| \{ `kind`: `"values"` ; `fields`: `string`\[] ; `from`: `null` \| `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"rows"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } \| \{ target: string; source: string; site: "source"; } \| \{ dataset: string; site: "catalog"; catalog: string; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"rows"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `site`: `"compute"` } \| \{ `target`: `string` ; `source`: `string` ; `site`: `"source"` } \| \{ `dataset`: `string` ; `site`: `"catalog"` ; `catalog`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `site`: `"compute"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"compute"`, `"required"`> }, `"required"`, `"site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` \| `"source"` \| `"site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `dataset`: `string` ; `site`: `"catalog"` ; `catalog`: `string` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"catalog"`, `"required"`> ; `catalog`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `dataset`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"dataset"` \| `"site"` \| `"catalog"`>], `"required"`, `"target"` \| `"dataset"` \| `"source"` \| `"site"` \| `"catalog"`> ; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.target"` \| `"to.dataset"` \| `"to.source"` \| `"to.site"` \| `"to.catalog"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"state"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ site: "compute"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"state"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `site`: `"compute"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"compute"`, `"required"`> }, `"required"`, `"site"`> = computeSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"keys"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"keys"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` \| `"source"` \| `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.target"` \| `"to.source"` \| `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"range"` ; `fields`: `string`\[] ; `from`: `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"range"`, `"required"`> ; `from`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` \| `"source"` \| `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.target"` \| `"to.source"` \| `"to.site"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"values"` ; `fields`: `string`\[] ; `from`: `null` \| `string` ; `to`: \{ target: string; source: string; site: "source"; } }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"values"`, `"required"`> ; `from`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `to`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `target`: `string` ; `source`: `string` ; `site`: `"source"` }, \{ `site`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"source"`, `"required"`> ; `source`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"target"` \| `"source"` \| `"site"`> = sourceSite; `fields`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> }, `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.target"` \| `"to.source"` \| `"to.site"`>], `"required"`, `"kind"` \| `"fields"` \| `"from"` \| `"to"` \| `"to.target"` \| `"to.dataset"` \| `"to.source"` \| `"to.site"` \| `"to.catalog"`> }, `"required"`, `"kind"` \| `"component"` \| `"crossing"` \| `"crossing.kind"` \| `"crossing.fields"` \| `"crossing.from"` \| `"crossing.to"` \| `"crossing.to.target"` \| `"crossing.to.dataset"` \| `"crossing.to.source"` \| `"crossing.to.site"` \| `"crossing.to.catalog"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"virtualTableRetention"` ; `component`: `null` \| `string` ; `expiresAt`: `string` ; `tables`: `string`\[] }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"virtualTableRetention"`, `"required"`> ; `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>], `"required"`, `never`> ; `tables`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> ; `expiresAt`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` \| `"component"` \| `"expiresAt"` \| `"tables"`>], `"required"`, `"kind"` \| `"component"` \| `"record"` \| `"args"` \| `"size"` \| `"expiresAt"` \| `"target"` \| `"method"` \| `"integration"` \| `"command"` \| `"series"` \| `"table"` \| `"sha256"` \| `"contract"` \| `"source"` \| `"hour"` \| `"group"` \| `"recipient"` \| `"release"` \| `"tables"` \| `"selection"` \| `"phase"` \| `"changes"` \| `"url"` \| `"control"` \| `"target.kind"` \| `"executor"` \| `"onward"` \| `"executor.function"` \| `"executor.kind"` \| `"executor.sourceId"` \| `"executor.component"` \| `"executor.program"` \| `"executor.integration"` \| `"executor.command"` \| `"executor.endpoint"` \| `"executor.binding"` \| `"executor.connection"` \| `"executor.program.revision"` \| `"executor.definitionRevision"` \| `"executor.credentialDigest"` \| `"executor.authorityDigest"` \| `"crossing"` \| `"crossing.kind"` \| `"crossing.fields"` \| `"crossing.from"` \| `"crossing.to"` \| `"crossing.to.target"` \| `"crossing.to.dataset"` \| `"crossing.to.source"` \| `"crossing.to.site"` \| `"crossing.to.catalog"` \| `"retired"` \| `"target.series"` \| `"target.source"` \| `"target.event"` \| `"target.generation"` \| `"target.from"` \| `"target.to"` \| `"producer"` \| `"run"` \| `"work"` \| `"work.component"` \| `"work.worker"` \| `"work.installation"` \| `"work.effect"` \| \`args.\$\{string}\` \| `"target.sourceId"` \| `"storageId"` \| `"shareId"`> | *** ### riskBinding • `Const` **riskBinding**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `organization`: `string` ; `principal`: `string` ; `participant`: `null` | `string` ; `target`: \{ key: string; type: string; } ; `operation`: `string` ; `request`: `string` ; `session`: `string` ; `executor`: `string` ; `attempt`: `string` ; `client`: `string` ; `policyVersion`: `string` }, \{ `request`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `attempt`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `principal`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `executor`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `organization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `target`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `type`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"type"`> ; `operation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `client`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `session`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `participant`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `policyVersion`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"organization"` | `"principal"` | `"participant"` | `"target"` | `"operation"` | `"request"` | `"session"` | `"executor"` | `"attempt"` | `"client"` | `"target.key"` | `"policyVersion"` | `"target.type"`> The operation owner captures this from authenticated request context. None of these identities may be taken from a caller's proposed risk verdict. *** ### riskObservation • `Const` **riskObservation**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `decision`: `"unavailable"` | `"challenge"` | `"allow"` | `"deny"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `binding`: `string` ; `policyVersion`: `string` }, \{ `binding`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `policyVersion`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `decision`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"challenge"` | `"allow"` | `"deny"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"allow"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"deny"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"challenge"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"decision"` | `"source"` | `"revision"` | `"observedAt"` | `"validUntil"` | `"binding"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"policyVersion"`> *** ### assessment • `Const` **assessment**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"unavailable"` | `"challenge"` | `"allow"` | `"deny"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `null` | `string` ; `reason`: `string` ; `validUntil`: `null` | `number` ; `binding`: `null` | `string` ; `handling`: `"refuse"` | `"challenge"` }, \{ `kind`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"unavailable"` | `"challenge"` | `"allow"` | `"deny"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"allow"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"deny"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"challenge"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`>], `"required"`, `never`> ; `binding`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `handling`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"refuse"` | `"challenge"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"refuse"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"challenge"`, `"required"`>], `"required"`, `never`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `revision`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `validUntil`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"source"` | `"revision"` | `"reason"` | `"validUntil"` | `"binding"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"handling"`> Not exported: an exported type refers to it. *** ### securityPopulation • `Const` **securityPopulation**: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `kind`: `"unsupported"` } | \{ `kind`: `"unavailable"` } | \{ `kind`: `"observed"` ; `cursor`: `null` | `string` ; `coverage`: `"partial"` | `"complete"` ; `ids`: `string`\[] ; `observedAtMs`: `number` ; `validUntilMs`: `null` | `number` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"unsupported"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unsupported"`, `"required"`> }, `"required"`, `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"unavailable"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"unavailable"`, `"required"`> }, `"required"`, `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"observed"` ; `cursor`: `null` | `string` ; `coverage`: `"partial"` | `"complete"` ; `ids`: `string`\[] ; `observedAtMs`: `number` ; `validUntilMs`: `null` | `number` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"observed"`, `"required"`> ; `observedAtMs`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntilMs`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `coverage`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"partial"` | `"complete"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"complete"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"partial"`, `"required"`>], `"required"`, `never`> ; `ids`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> ; `cursor`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"kind"` | `"cursor"` | `"coverage"` | `"ids"` | `"observedAtMs"` | `"validUntilMs"`>], `"required"`, `"kind"` | `"cursor"` | `"coverage"` | `"ids"` | `"observedAtMs"` | `"validUntilMs"`> A population query receives the verified caller, never a caller-selected person. Its own native reads and the inspection owner still enforce access. Unsupported and unavailable populations never become empty inventories. *** ### SERVICE\_ISSUER • `Const` **SERVICE\_ISSUER**: `"https://services.bijection.invalid"` The issuer every service principal's issuer extends. *** ### SESSION\_SUBJECT • `Const` **SESSION\_SUBJECT**: `"session:"` What an issued session's subject is prefixed with. *** ### CREDENTIAL\_CLAIM • `Const` **CREDENTIAL\_CLAIM**: `"bijectionCredential"` The claim naming the credential that authenticated a service or a session it issued. Only the deployment's own credential verification sets it. *** ### workosEnterpriseHealthObservation • `Const` **workosEnterpriseHealthObservation**: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `directoryEvidence`: `undefined` | `null` | \{ evidence: \{ dataset?: \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; }; source: \{ ...; }; directory: string; } ; `record`: `null` | \{ id: string; organization: string; directory: string | null; connectionState: string; ssoEnforced: null; connectionType: string; directoryState: string | null; certificateState: "unavailable" | "observed" | "notApplicable"; certificates: \{ ...; }\[]; } ; `evidence`: `null` | \{ dataset?: \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; } ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `selection`: \{ connection: string; directory: string | null; } ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } }, \{ `configuration`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` }, \{ `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"issuer"` | `"clientId"` | `"providerOrganization"`> ; `selection`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `connection`: `string` ; `directory`: `null` | `string` }, \{ `connection`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `directory`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"connection"` | `"directory"`> ; `source`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> ; `evidence`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `dataset`: `undefined` | \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; } ; `recordObservedFrom`: `undefined` | `number` ; `recordObservedTo`: `undefined` | `number` ; `capabilities`: `null` | \{ evidence: "native" | "asserted" | "brokered"; consistency: "snapshot" | "observations"; coverage: "records" | "enumeration" | "snapshot" | "queryResult" | "incrementalSnapshot" | "committedPrefix" | "latestPerKey"; ... 6 more ...; snapshotMaxRows: string | null; } ; `population`: `null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `erased`: `boolean` ; `publication`: `null` | \{ sourceId: SourceId; scope: string; publicationId: SourcePublicationId; checkpoint: \{ position: \{ value: string; space: string; } | null; captureId: string; } | null; epoch: SourceEpoch; } ; `populationCovered`: `boolean` ; `populationObservedFrom`: `null` | `number` ; `observedFrom`: `null` | `number` ; `observedTo`: `null` | `number` ; `continuityLost`: `boolean` ; `historyInterrupted`: `boolean` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `dataset`: `undefined` | \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; } ; `recordObservedFrom`: `undefined` | `number` ; `recordObservedTo`: `undefined` | `number` ; `capabilities`: `null` | \{ evidence: "native" | "asserted" | "brokered"; consistency: "snapshot" | "observations"; coverage: "records" | "enumeration" | "snapshot" | "queryResult" | "incrementalSnapshot" | "committedPrefix" | "latestPerKey"; ... 6 more ...; snapshotMaxRows: string | null; } ; `population`: `null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `erased`: `boolean` ; `publication`: `null` | \{ sourceId: SourceId; scope: string; publicationId: SourcePublicationId; checkpoint: \{ position: \{ value: string; space: string; } | null; captureId: string; } | null; epoch: SourceEpoch; } ; `populationCovered`: `boolean` ; `populationObservedFrom`: `null` | `number` ; `observedFrom`: `null` | `number` ; `observedTo`: `null` | `number` ; `continuityLost`: `boolean` ; `historyInterrupted`: `boolean` }, \{ `publication`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` | \{ position: \{ value: string; space: string; } | null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` | \{ position: \{ value: string; space: string; } | null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) }, \{ `sourceId`: [`VIdentity`](https://docs.bijection.com/api/classes/values.VIdentity)\<[`SourceId`](https://docs.bijection.com/api/modules/values#sourceid), `"sourceId"`, `"required"`> ; `epoch`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch), `"required"`> ; `scope`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `publicationId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), `"required"`> ; `checkpoint`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `position`: `null` | \{ value: string; space: string; } ; `captureId`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `position`: `null` | \{ value: string; space: string; } ; `captureId`: `string` }, \{ `captureId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `position`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `value`: `string` ; `space`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `string` ; `space`: `string` }, \{ `space`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `value`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"value"` | `"space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"value"` | `"space"`> }, `"required"`, `"position"` | `"captureId"` | `"position.value"` | `"position.space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"position"` | `"captureId"` | `"position.value"` | `"position.space"`> }, `"required"`, `"sourceId"` | `"scope"` | `"publicationId"` | `"checkpoint"` | `"epoch"` | `"checkpoint.position"` | `"checkpoint.captureId"` | `"checkpoint.position.value"` | `"checkpoint.position.space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"sourceId"` | `"scope"` | `"publicationId"` | `"checkpoint"` | `"epoch"` | `"checkpoint.position"` | `"checkpoint.captureId"` | `"checkpoint.position.value"` | `"checkpoint.position.space"`> ; `populationCovered`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `populationObservedFrom`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `observedFrom`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `observedTo`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `recordObservedFrom`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `recordObservedTo`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `continuityLost`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `historyInterrupted`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `erased`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `dataset`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<`undefined` | \{ `component`: `null` | `string` ; `dataset`: `null` | `string` ; `version`: `null` | `string` ; `revision`: `null` | `string` ; `publicationId`: `null` | [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `coherent`: `boolean` ; `completeVersion`: `boolean` }, \{ `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `dataset`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `version`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `revision`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `publicationId`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `coherent`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `completeVersion`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> }, `"optional"`, `"component"` | `"dataset"` | `"version"` | `"revision"` | `"publicationId"` | `"coherent"` | `"completeVersion"`> ; `capabilities`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `evidence`: `"native"` | `"asserted"` | `"brokered"` ; `consistency`: `"snapshot"` | `"observations"` ; `coverage`: `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `reconciliation`: `boolean` ; `history`: `"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"` ; `protocol`: `"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"` ; `atomicity`: `"record"` | `"snapshot"` | `"sourceTransaction"` ; `recordRefresh`: `boolean` ; `notifications`: `boolean` ; `snapshotMaxRows`: `null` | `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `evidence`: `"native"` | `"asserted"` | `"brokered"` ; `consistency`: `"snapshot"` | `"observations"` ; `coverage`: `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `reconciliation`: `boolean` ; `history`: `"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"` ; `protocol`: `"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"` ; `atomicity`: `"record"` | `"snapshot"` | `"sourceTransaction"` ; `recordRefresh`: `boolean` ; `notifications`: `boolean` ; `snapshotMaxRows`: `null` | `string` }, \{ `consistency`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"snapshot"` | `"observations"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"observations"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"snapshot"`, `"required"`>], `"required"`, `never`> = validatorSourceConsistency; `evidence`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"native"` | `"asserted"` | `"brokered"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"native"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"brokered"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"asserted"`, `"required"`>], `"required"`, `never`> = validatorEvidenceClass; `recordRefresh`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `reconciliation`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `notifications`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `snapshotMaxRows`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `protocol`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"`, `"required"`, `any`> ; `coverage`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, `"required"`, `any`> ; `atomicity`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"record"` | `"snapshot"` | `"sourceTransaction"`, `"required"`, `any`> ; `history`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"`, `"required"`, `any`> }, `"required"`, `"evidence"` | `"consistency"` | `"coverage"` | `"reconciliation"` | `"history"` | `"protocol"` | `"atomicity"` | `"recordRefresh"` | `"notifications"` | `"snapshotMaxRows"` | \`coverage.$\{any}\` \| \`history.$\{any}\` | \`protocol.$\{any}\` \| \`atomicity.$\{any}\`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"evidence"` | `"consistency"` | `"coverage"` | `"reconciliation"` | `"history"` | `"protocol"` | `"atomicity"` | `"recordRefresh"` | `"notifications"` | `"snapshotMaxRows"` | \`coverage.$\{any}\` \| \`history.$\{any}\` | \`protocol.$\{any}\` \| \`atomicity.$\{any}\`> ; `population`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, \[[`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, `"required"`, `any`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `any`> }, `"required"`, `"dataset"` | `"capabilities"` | `"population"` | `"erased"` | `"publication"` | `"populationCovered"` | `"populationObservedFrom"` | `"observedFrom"` | `"observedTo"` | `"continuityLost"` | `"historyInterrupted"` | `"recordObservedFrom"` | `"recordObservedTo"` | `"capabilities.evidence"` | `"capabilities.consistency"` | `"capabilities.coverage"` | `"capabilities.reconciliation"` | `"capabilities.history"` | `"capabilities.protocol"` | `"capabilities.atomicity"` | `"capabilities.recordRefresh"` | `"capabilities.notifications"` | `"capabilities.snapshotMaxRows"` | `"dataset.component"` | `"dataset.dataset"` | `"dataset.version"` | `"dataset.revision"` | `"dataset.publicationId"` | `"dataset.coherent"` | `"dataset.completeVersion"` | `"publication.sourceId"` | `"publication.scope"` | `"publication.publicationId"` | `"publication.checkpoint"` | `"publication.epoch"` | `"publication.checkpoint.position"` | `"publication.checkpoint.captureId"` | `"publication.checkpoint.position.value"` | `"publication.checkpoint.position.space"` | \`capabilities.coverage.$\{any}\` \| \`capabilities.history.$\{any}\` | \`capabilities.protocol.$\{any}\` \| \`capabilities.atomicity.$\{any}\` | \`population.$\{any}\`\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, ``"dataset"`` \| ``"capabilities"`` \| ``"population"`` \| ``"erased"`` \| ``"publication"`` \| ``"populationCovered"`` \| ``"populationObservedFrom"`` \| ``"observedFrom"`` \| ``"observedTo"`` \| ``"continuityLost"`` \| ``"historyInterrupted"`` \| ``"recordObservedFrom"`` \| ``"recordObservedTo"`` \| ``"capabilities.evidence"`` \| ``"capabilities.consistency"`` \| ``"capabilities.coverage"`` \| ``"capabilities.reconciliation"`` \| ``"capabilities.history"`` \| ``"capabilities.protocol"`` \| ``"capabilities.atomicity"`` \| ``"capabilities.recordRefresh"`` \| ``"capabilities.notifications"`` \| ``"capabilities.snapshotMaxRows"`` \| ``"dataset.component"`` \| ``"dataset.dataset"`` \| ``"dataset.version"`` \| ``"dataset.revision"`` \| ``"dataset.publicationId"`` \| ``"dataset.coherent"`` \| ``"dataset.completeVersion"`` \| ``"publication.sourceId"`` \| ``"publication.scope"`` \| ``"publication.publicationId"`` \| ``"publication.checkpoint"`` \| ``"publication.epoch"`` \| ``"publication.checkpoint.position"`` \| ``"publication.checkpoint.captureId"`` \| ``"publication.checkpoint.position.value"`` \| ``"publication.checkpoint.position.space"`` \| \`capabilities.coverage.$\{any}\` | \`capabilities.history.$\{any}\` \| \`capabilities.protocol.$\{any}\` | \`capabilities.atomicity.$\{any}\` \| \`population.$\{any}\`> ; `directoryEvidence`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`undefined` | `null` | \{ `evidence`: \{ dataset?: \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; } ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `directory`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `evidence`: \{ dataset?: \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; } ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `directory`: `string` }, \{ `directory`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `source`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` }, \{ `location`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `incarnation`: `string` ; `branch`: `null` | \{ key: string; generation: string; } ; `deployment_id`: `string` }, \{ `deployment_id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `incarnation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `branch`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `key`: `string` ; `generation`: `string` }, \[[`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `generation`: `string` }, \{ `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `generation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"generation"`>], `"required"`, `"key"` | `"generation"`> }, `"required"`, `"incarnation"` | `"branch"` | `"deployment_id"` | `"branch.key"` | `"branch.generation"`> ; `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `protocol`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"id"` | `"installation"` | `"location"` | `"protocol"` | `"location.incarnation"` | `"location.branch"` | `"location.deployment_id"` | `"location.branch.key"` | `"location.branch.generation"`> = subjectRefValidator; `evidence`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `dataset`: `undefined` | \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; } ; `recordObservedFrom`: `undefined` | `number` ; `recordObservedTo`: `undefined` | `number` ; `capabilities`: `null` | \{ evidence: "native" | "asserted" | "brokered"; consistency: "snapshot" | "observations"; coverage: "records" | "enumeration" | "snapshot" | "queryResult" | "incrementalSnapshot" | "committedPrefix" | "latestPerKey"; ... 6 more ...; snapshotMaxRows: string | null; } ; `population`: `null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `erased`: `boolean` ; `publication`: `null` | \{ sourceId: SourceId; scope: string; publicationId: SourcePublicationId; checkpoint: \{ position: \{ value: string; space: string; } | null; captureId: string; } | null; epoch: SourceEpoch; } ; `populationCovered`: `boolean` ; `populationObservedFrom`: `null` | `number` ; `observedFrom`: `null` | `number` ; `observedTo`: `null` | `number` ; `continuityLost`: `boolean` ; `historyInterrupted`: `boolean` }, \{ `publication`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` | \{ position: \{ value: string; space: string; } | null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` | \{ position: \{ value: string; space: string; } | null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) }, \{ `sourceId`: [`VIdentity`](https://docs.bijection.com/api/classes/values.VIdentity)\<[`SourceId`](https://docs.bijection.com/api/modules/values#sourceid), `"sourceId"`, `"required"`> ; `epoch`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch), `"required"`> ; `scope`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `publicationId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), `"required"`> ; `checkpoint`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `position`: `null` | \{ value: string; space: string; } ; `captureId`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `position`: `null` | \{ value: string; space: string; } ; `captureId`: `string` }, \{ `captureId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `position`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `value`: `string` ; `space`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `value`: `string` ; `space`: `string` }, \{ `space`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `value`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"value"` | `"space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"value"` | `"space"`> }, `"required"`, `"position"` | `"captureId"` | `"position.value"` | `"position.space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"position"` | `"captureId"` | `"position.value"` | `"position.space"`> }, `"required"`, `"sourceId"` | `"scope"` | `"publicationId"` | `"checkpoint"` | `"epoch"` | `"checkpoint.position"` | `"checkpoint.captureId"` | `"checkpoint.position.value"` | `"checkpoint.position.space"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"sourceId"` | `"scope"` | `"publicationId"` | `"checkpoint"` | `"epoch"` | `"checkpoint.position"` | `"checkpoint.captureId"` | `"checkpoint.position.value"` | `"checkpoint.position.space"`> ; `populationCovered`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `populationObservedFrom`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `observedFrom`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `observedTo`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `recordObservedFrom`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `recordObservedTo`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `continuityLost`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `historyInterrupted`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `erased`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `dataset`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<`undefined` | \{ `component`: `null` | `string` ; `dataset`: `null` | `string` ; `version`: `null` | `string` ; `revision`: `null` | `string` ; `publicationId`: `null` | [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `coherent`: `boolean` ; `completeVersion`: `boolean` }, \{ `component`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `dataset`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `version`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `revision`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `publicationId`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<[`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid), `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `coherent`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `completeVersion`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> }, `"optional"`, `"component"` | `"dataset"` | `"version"` | `"revision"` | `"publicationId"` | `"coherent"` | `"completeVersion"`> ; `capabilities`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | \{ `evidence`: `"native"` | `"asserted"` | `"brokered"` ; `consistency`: `"snapshot"` | `"observations"` ; `coverage`: `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `reconciliation`: `boolean` ; `history`: `"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"` ; `protocol`: `"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"` ; `atomicity`: `"record"` | `"snapshot"` | `"sourceTransaction"` ; `recordRefresh`: `boolean` ; `notifications`: `boolean` ; `snapshotMaxRows`: `null` | `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `evidence`: `"native"` | `"asserted"` | `"brokered"` ; `consistency`: `"snapshot"` | `"observations"` ; `coverage`: `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `reconciliation`: `boolean` ; `history`: `"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"` ; `protocol`: `"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"` ; `atomicity`: `"record"` | `"snapshot"` | `"sourceTransaction"` ; `recordRefresh`: `boolean` ; `notifications`: `boolean` ; `snapshotMaxRows`: `null` | `string` }, \{ `consistency`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"snapshot"` | `"observations"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"observations"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"snapshot"`, `"required"`>], `"required"`, `never`> = validatorSourceConsistency; `evidence`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"native"` | `"asserted"` | `"brokered"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"native"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"brokered"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"asserted"`, `"required"`>], `"required"`, `never`> = validatorEvidenceClass; `recordRefresh`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `reconciliation`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `notifications`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `snapshotMaxRows`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `protocol`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"dataset"` | `"changeFeed"` | `"recordObservation"` | `"transactionalFeed"` | `"streamLatest"`, `"required"`, `any`> ; `coverage`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, `"required"`, `any`> ; `atomicity`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"record"` | `"snapshot"` | `"sourceTransaction"`, `"required"`, `any`> ; `history`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"observations"` | `"completeChanges"` | `"completeOccurrences"` | `"latestState"`, `"required"`, `any`> }, `"required"`, `"evidence"` | `"consistency"` | `"coverage"` | `"reconciliation"` | `"history"` | `"protocol"` | `"atomicity"` | `"recordRefresh"` | `"notifications"` | `"snapshotMaxRows"` | \`coverage.$\{any}\` \| \`history.$\{any}\` | \`protocol.$\{any}\` \| \`atomicity.$\{any}\`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `"evidence"` | `"consistency"` | `"coverage"` | `"reconciliation"` | `"history"` | `"protocol"` | `"atomicity"` | `"recordRefresh"` | `"notifications"` | `"snapshotMaxRows"` | \`coverage.$\{any}\` \| \`history.$\{any}\` | \`protocol.$\{any}\` \| \`atomicity.$\{any}\`> ; `population`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, \[[`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"`, `"required"`, `any`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `any`> }, `"required"`, `"dataset"` | `"capabilities"` | `"population"` | `"erased"` | `"publication"` | `"populationCovered"` | `"populationObservedFrom"` | `"observedFrom"` | `"observedTo"` | `"continuityLost"` | `"historyInterrupted"` | `"recordObservedFrom"` | `"recordObservedTo"` | `"capabilities.evidence"` | `"capabilities.consistency"` | `"capabilities.coverage"` | `"capabilities.reconciliation"` | `"capabilities.history"` | `"capabilities.protocol"` | `"capabilities.atomicity"` | `"capabilities.recordRefresh"` | `"capabilities.notifications"` | `"capabilities.snapshotMaxRows"` | `"dataset.component"` | `"dataset.dataset"` | `"dataset.version"` | `"dataset.revision"` | `"dataset.publicationId"` | `"dataset.coherent"` | `"dataset.completeVersion"` | `"publication.sourceId"` | `"publication.scope"` | `"publication.publicationId"` | `"publication.checkpoint"` | `"publication.epoch"` | `"publication.checkpoint.position"` | `"publication.checkpoint.captureId"` | `"publication.checkpoint.position.value"` | `"publication.checkpoint.position.space"` | \`capabilities.coverage.$\{any}\` \| \`capabilities.history.$\{any}\` | \`capabilities.protocol.$\{any}\` \| \`capabilities.atomicity.$\{any}\` | \`population.$\{any}\`\> = sourceStatusValidator.fields.evidence \}, ``"required"``, ``"evidence"`` \| ``"source"`` \| ``"directory"`` \| ``"evidence.dataset"`` \| ``"evidence.capabilities"`` \| ``"evidence.population"`` \| ``"evidence.erased"`` \| ``"evidence.publication"`` \| ``"evidence.populationCovered"`` \| ``"evidence.populationObservedFrom"`` \| ``"evidence.observedFrom"`` \| ``"evidence.observedTo"`` \| ``"evidence.continuityLost"`` \| ``"evidence.historyInterrupted"`` \| ``"evidence.recordObservedFrom"`` \| ``"evidence.recordObservedTo"`` \| ``"evidence.capabilities.evidence"`` \| ``"evidence.capabilities.consistency"`` \| ``"evidence.capabilities.coverage"`` \| ``"evidence.capabilities.reconciliation"`` \| ``"evidence.capabilities.history"`` \| ``"evidence.capabilities.protocol"`` \| ``"evidence.capabilities.atomicity"`` \| ``"evidence.capabilities.recordRefresh"`` \| ``"evidence.capabilities.notifications"`` \| ``"evidence.capabilities.snapshotMaxRows"`` \| ``"evidence.dataset.component"`` \| ``"evidence.dataset.dataset"`` \| ``"evidence.dataset.version"`` \| ``"evidence.dataset.revision"`` \| ``"evidence.dataset.publicationId"`` \| ``"evidence.dataset.coherent"`` \| ``"evidence.dataset.completeVersion"`` \| ``"evidence.publication.sourceId"`` \| ``"evidence.publication.scope"`` \| ``"evidence.publication.publicationId"`` \| ``"evidence.publication.checkpoint"`` \| ``"evidence.publication.epoch"`` \| ``"evidence.publication.checkpoint.position"`` \| ``"evidence.publication.checkpoint.captureId"`` \| ``"evidence.publication.checkpoint.position.value"`` \| ``"evidence.publication.checkpoint.position.space"`` \| \`evidence.capabilities.coverage.$\{any}\` | \`evidence.capabilities.history.$\{any}\` \| \`evidence.capabilities.protocol.$\{any}\` | \`evidence.capabilities.atomicity.$\{any}\` \| \`evidence.population.$\{any}\` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"optional"`, `"evidence"` | `"source"` | `"directory"` | `"evidence.dataset"` | `"evidence.capabilities"` | `"evidence.population"` | `"evidence.erased"` | `"evidence.publication"` | `"evidence.populationCovered"` | `"evidence.populationObservedFrom"` | `"evidence.observedFrom"` | `"evidence.observedTo"` | `"evidence.continuityLost"` | `"evidence.historyInterrupted"` | `"evidence.recordObservedFrom"` | `"evidence.recordObservedTo"` | `"evidence.capabilities.evidence"` | `"evidence.capabilities.consistency"` | `"evidence.capabilities.coverage"` | `"evidence.capabilities.reconciliation"` | `"evidence.capabilities.history"` | `"evidence.capabilities.protocol"` | `"evidence.capabilities.atomicity"` | `"evidence.capabilities.recordRefresh"` | `"evidence.capabilities.notifications"` | `"evidence.capabilities.snapshotMaxRows"` | `"evidence.dataset.component"` | `"evidence.dataset.dataset"` | `"evidence.dataset.version"` | `"evidence.dataset.revision"` | `"evidence.dataset.publicationId"` | `"evidence.dataset.coherent"` | `"evidence.dataset.completeVersion"` | `"evidence.publication.sourceId"` | `"evidence.publication.scope"` | `"evidence.publication.publicationId"` | `"evidence.publication.checkpoint"` | `"evidence.publication.epoch"` | `"evidence.publication.checkpoint.position"` | `"evidence.publication.checkpoint.captureId"` | `"evidence.publication.checkpoint.position.value"` | `"evidence.publication.checkpoint.position.space"` | \`evidence.capabilities.coverage.$\{any}\` \| \`evidence.capabilities.history.$\{any}\` | \`evidence.capabilities.protocol.$\{any}\` \| \`evidence.capabilities.atomicity.$\{any}\` | \`evidence.population.$\{any}\` \| ``"source.id"`` \| ``"source.installation"`` \| ``"source.location"`` \| ``"source.protocol"`` \| ``"source.location.incarnation"`` \| ``"source.location.branch"`` \| ``"source.location.deployment_id"`` \| ``"source.location.branch.key"`` \| ``"source.location.branch.generation"``\> ; `record`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| \{ `id`: `string` ; `organization`: `string` ; `directory`: ``null`` \| `string` ; `connectionState`: `string` ; `ssoEnforced`: ``null`` ; `connectionType`: `string` ; `directoryState`: ``null`` \| `string` ; `certificateState`: ``"unavailable"`` \| ``"observed"`` \| ``"notApplicable"`` ; `certificates`: \{ id: string; notBefore: number \| null; notAfter: number \| null; \}[] \}, [[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `organization`: `string` ; `directory`: ``null`` \| `string` ; `connectionState`: `string` ; `ssoEnforced`: ``null`` ; `connectionType`: `string` ; `directoryState`: ``null`` \| `string` ; `certificateState`: ``"unavailable"`` \| ``"observed"`` \| ``"notApplicable"`` ; `certificates`: \{ id: string; notBefore: number \| null; notAfter: number \| null; \}[] \}, \{ `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `organization`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `connectionType`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `connectionState`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `directory`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `string`, [[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, `never`\> ; `directoryState`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `string`, [[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, `never`\> ; `certificateState`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``"unavailable"`` \| ``"observed"`` \| ``"notApplicable"``, [[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"observed"``, ``"required"``\>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"unavailable"``, ``"required"``\>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<``"notApplicable"``, ``"required"``\>], ``"required"``, `never`\> ; `certificates`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<\{ `id`: `string` ; `notBefore`: ``null`` \| `number` ; `notAfter`: ``null`` \| `number` \}[], [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `id`: `string` ; `notBefore`: ``null`` \| `number` ; `notAfter`: ``null`` \| `number` \}, \{ `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, ``"required"``\> ; `notBefore`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `number`, [[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, ``"required"``\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, `never`\> ; `notAfter`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<``null`` \| `number`, [[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, ``"required"``\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, `never`\> \}, ``"required"``, ``"id"`` \| ``"notBefore"`` \| ``"notAfter"``\>, ``"required"``\> ; `ssoEnforced`: [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\> \}, ``"required"``, ``"id"`` \| ``"organization"`` \| ``"directory"`` \| ``"connectionState"`` \| ``"ssoEnforced"`` \| ``"connectionType"`` \| ``"directoryState"`` \| ``"certificateState"`` \| ``"certificates"``\>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<``null``, ``"required"``\>], ``"required"``, ``"id"`` \| ``"organization"`` \| ``"directory"`` \| ``"connectionState"`` \| ``"ssoEnforced"`` \| ``"connectionType"`` \| ``"directoryState"`` \| ``"certificateState"`` \| ``"certificates"``\> \}, ``"required"``, ``"record"`` \| ``"evidence"`` \| ``"source"`` \| ``"selection"`` \| ``"configuration"`` \| ``"evidence.dataset"`` \| ``"evidence.capabilities"`` \| ``"evidence.population"`` \| ``"evidence.erased"`` \| ``"evidence.publication"`` \| ``"evidence.populationCovered"`` \| ``"evidence.populationObservedFrom"`` \| ``"evidence.observedFrom"`` \| ``"evidence.observedTo"`` \| ``"evidence.continuityLost"`` \| ``"evidence.historyInterrupted"`` \| ``"evidence.recordObservedFrom"`` \| ``"evidence.recordObservedTo"`` \| ``"evidence.capabilities.evidence"`` \| ``"evidence.capabilities.consistency"`` \| ``"evidence.capabilities.coverage"`` \| ``"evidence.capabilities.reconciliation"`` \| ``"evidence.capabilities.history"`` \| ``"evidence.capabilities.protocol"`` \| ``"evidence.capabilities.atomicity"`` \| ``"evidence.capabilities.recordRefresh"`` \| ``"evidence.capabilities.notifications"`` \| ``"evidence.capabilities.snapshotMaxRows"`` \| ``"evidence.dataset.component"`` \| ``"evidence.dataset.dataset"`` \| ``"evidence.dataset.version"`` \| ``"evidence.dataset.revision"`` \| ``"evidence.dataset.publicationId"`` \| ``"evidence.dataset.coherent"`` \| ``"evidence.dataset.completeVersion"`` \| ``"evidence.publication.sourceId"`` \| ``"evidence.publication.scope"`` \| ``"evidence.publication.publicationId"`` \| ``"evidence.publication.checkpoint"`` \| ``"evidence.publication.epoch"`` \| ``"evidence.publication.checkpoint.position"`` \| ``"evidence.publication.checkpoint.captureId"`` \| ``"evidence.publication.checkpoint.position.value"`` \| ``"evidence.publication.checkpoint.position.space"`` \| \`evidence.capabilities.coverage.$\{any}\` | \`evidence.capabilities.history.$\{any}\` \| \`evidence.capabilities.protocol.$\{any}\` | \`evidence.capabilities.atomicity.$\{any}\` \| \`evidence.population.$\{any}\` | `"record.id"` | `"source.id"` | `"source.installation"` | `"source.location"` | `"source.protocol"` | `"source.location.incarnation"` | `"source.location.branch"` | `"source.location.deployment_id"` | `"source.location.branch.key"` | `"source.location.branch.generation"` | `"configuration.issuer"` | `"configuration.clientId"` | `"configuration.providerOrganization"` | `"directoryEvidence"` | `"record.organization"` | `"record.directory"` | `"record.connectionState"` | `"record.ssoEnforced"` | `"record.connectionType"` | `"record.directoryState"` | `"record.certificateState"` | `"record.certificates"` | `"selection.connection"` | `"selection.directory"` | `"directoryEvidence.evidence"` | `"directoryEvidence.source"` | `"directoryEvidence.directory"` | `"directoryEvidence.evidence.dataset"` | `"directoryEvidence.evidence.capabilities"` | `"directoryEvidence.evidence.population"` | `"directoryEvidence.evidence.erased"` | `"directoryEvidence.evidence.publication"` | `"directoryEvidence.evidence.populationCovered"` | `"directoryEvidence.evidence.populationObservedFrom"` | `"directoryEvidence.evidence.observedFrom"` | `"directoryEvidence.evidence.observedTo"` | `"directoryEvidence.evidence.continuityLost"` | `"directoryEvidence.evidence.historyInterrupted"` | `"directoryEvidence.evidence.recordObservedFrom"` | `"directoryEvidence.evidence.recordObservedTo"` | `"directoryEvidence.evidence.capabilities.evidence"` | `"directoryEvidence.evidence.capabilities.consistency"` | `"directoryEvidence.evidence.capabilities.coverage"` | `"directoryEvidence.evidence.capabilities.reconciliation"` | `"directoryEvidence.evidence.capabilities.history"` | `"directoryEvidence.evidence.capabilities.protocol"` | `"directoryEvidence.evidence.capabilities.atomicity"` | `"directoryEvidence.evidence.capabilities.recordRefresh"` | `"directoryEvidence.evidence.capabilities.notifications"` | `"directoryEvidence.evidence.capabilities.snapshotMaxRows"` | `"directoryEvidence.evidence.dataset.component"` | `"directoryEvidence.evidence.dataset.dataset"` | `"directoryEvidence.evidence.dataset.version"` | `"directoryEvidence.evidence.dataset.revision"` | `"directoryEvidence.evidence.dataset.publicationId"` | `"directoryEvidence.evidence.dataset.coherent"` | `"directoryEvidence.evidence.dataset.completeVersion"` | `"directoryEvidence.evidence.publication.sourceId"` | `"directoryEvidence.evidence.publication.scope"` | `"directoryEvidence.evidence.publication.publicationId"` | `"directoryEvidence.evidence.publication.checkpoint"` | `"directoryEvidence.evidence.publication.epoch"` | `"directoryEvidence.evidence.publication.checkpoint.position"` | `"directoryEvidence.evidence.publication.checkpoint.captureId"` | `"directoryEvidence.evidence.publication.checkpoint.position.value"` | `"directoryEvidence.evidence.publication.checkpoint.position.space"` | \`directoryEvidence.evidence.capabilities.coverage.$\{any}\` \| \`directoryEvidence.evidence.capabilities.history.$\{any}\` | \`directoryEvidence.evidence.capabilities.protocol.$\{any}\` \| \`directoryEvidence.evidence.capabilities.atomicity.$\{any}\` | \`directoryEvidence.evidence.population.\$\{any}\` | `"directoryEvidence.source.id"` | `"directoryEvidence.source.installation"` | `"directoryEvidence.source.location"` | `"directoryEvidence.source.protocol"` | `"directoryEvidence.source.location.incarnation"` | `"directoryEvidence.source.location.branch"` | `"directoryEvidence.source.location.deployment_id"` | `"directoryEvidence.source.location.branch.key"` | `"directoryEvidence.source.location.branch.generation"`> Read only through a fixed internal query which obtains the row and its exact record evidence from ctx.sources.evidence(...,\{record:row.\_id}). ## Functions ### defineClassificationProfile ▸ **defineClassificationProfile**\<`Name`, `Required`, `C`>(`input`): [`ClassificationProfile`](https://docs.bijection.com/api/modules/access#classificationprofile)\<`Name`, `Required`, `C`> A fixed classification vocabulary with explicit required resource bindings. Every generated binding protects object identity and readable properties and refuses empty or unknown classification sets on create, update and move. A profile either declares its own `categories` or adopts the organization's central label `registry`. A registry-bound profile cannot redefine a category: the management registry is the only author, the profile records the revision it compiled, and `clearances` declares the directory through which the deployment acquires central clearances. #### Type parameters | Name | Type | | :- | :- | | `Name` | extends `string` | | `Required` | extends readonly `string`\[] | | `C` | extends `Record`\<`string`, [`ClassificationCategory`](https://docs.bijection.com/api/modules/access#classificationcategory)> | #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.resource` | `Name` | | `input.categories` | `C` | | `input.requiredOn` | `Required` | #### Returns [`ClassificationProfile`](https://docs.bijection.com/api/modules/access#classificationprofile)\<`Name`, `Required`, `C`> ▸ **defineClassificationProfile**\<`Name`, `Required`, `R`>(`input`): [`ClassificationProfile`](https://docs.bijection.com/api/modules/access#classificationprofile)\<`Name`, `Required`, [`RegistryCategories`](https://docs.bijection.com/api/modules/access#registrycategories)\<`R`>> #### Type parameters | Name | Type | | :- | :- | | `Name` | extends `string` | | `Required` | extends readonly `string`\[] | | `R` | extends [`LabelRegistrySnapshot`](https://docs.bijection.com/api/modules/access#labelregistrysnapshot) | #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.resource` | `Name` | | `input.registry` | `R` | | `input.requiredOn` | `Required` | #### Returns [`ClassificationProfile`](https://docs.bijection.com/api/modules/access#classificationprofile)\<`Name`, `Required`, [`RegistryCategories`](https://docs.bijection.com/api/modules/access#registrycategories)\<`R`>> *** ### classificationProfile ▸ **classificationProfile**\<`Name`, `Required`, `C`>(`input`, `registry`): `Readonly`\<\{ `resources`: `Readonly`\<`Record`\<`Name`, `Readonly`\<\{ `category`: `Readonly`\<\{ `from`: `"key"` }> ; `clearance?`: `"registry"` ; `permissions`: \[`"pass"`, `"apply"`, `"declassify"`] ; `dominates?`: `Readonly`\<`Record`\<`string`, readonly `string`\[]>> }>>> ; `categories`: `Readonly`\<`Record`\> ; `registry`: `null` | `Readonly`\<\{ `organization`: `string` ; `revision`: `number` }> ; `clearances`: \(`options`: \{ `table`: `Table` ; `maxAge`: `number` ; `member?`: `string` ; `object?`: `string` ; `memberIndex?`: `string` ; `objectIndex?`: `string` }) => `Readonly`\<\{ `roles`: `Readonly`\<`Record`\<\`$\{Name}:cleared\`, readonly [\`$\{Name}:pass\`]>> ; `directory`: `Readonly`\<\{ `table`: `Table` = options.table; `memberIndex`: `string` ; `objectIndex`: `string` ; `type`: `Name` = resourceName; `role`: `Readonly`\<\{ `kind`: `"declared"` ; `key`: \`\$\{Name}:cleared\` = role }> ; `member`: `string` ; `object`: `string` ; `maxAge`: `number` = options.maxAge }> }> ; `labelName`: (`key`: [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>) => `string` ; `labelNames`: (`selection`: [`Selection`](https://docs.bijection.com/api/modules/access#selection)) => `string`\[] ; `keyOf`: (`name`: `string`) => [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`> | `null` ; `readers`: (`options`: \{ `member`: (`ctx`: `any`) => `Promise`\<`boolean`> ; `principalOf?`: (`ctx`: `any`, `actor`: `string`) => `Promise`\<`AccessPrincipal` | `null`> }) => `Readonly`\<\{ `member`: (`ctx`: `any`) => `Promise`\<`boolean`> = options.member; `cleared`: (`ctx`: `any`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> ; `permits`: (`ctx`: `any`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> = cleared; `clearedFor`: (`ctx`: `any`, `actor`: `string`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> }> ; `datasetRelease`: (`input`: \{ `destination`: `string` ; `dataset`: \{ `dataset`: `string` ; `definition`: \{ `labels?`: readonly `string`\[] } } ; `publisher`: `string` ; `requires`: `string` }) => [`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease) ; `validator`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[], [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>, `"required"`>\[], `"required"`, `never`>, `"required"`> ; `release`: \(`input`: \{ `destination`: `Destination` ; `requires?`: `string` ; `publisher?`: `string` ; `when?`: `NonNullable`\<[`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease)\[`"when"`]> ; `accepts`: readonly [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[] ; `declassify?`: `boolean` }) => [`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease) & \{ `destination`: `Destination` } ; `modelEgress`: \(`input`: \{ `providers`: `Providers` ; `requires`: `string` ; `approved`: readonly [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[] }) => \{ `destinations`: \{ \[K in keyof Providers]: Object } ; `releases`: \{ \[K in keyof Providers]: AccessRelease & Object } } ; `bindings`: \(`bindings`: `B` & `Record`\<`Exclude`\, `never`>) => \{ \[K in string | number | symbol]: B\[K] extends Object ? ClassifiedBinding\ : never } }> Not exported: an exported type refers to it. #### Type parameters | Name | Type | | :- | :- | | `Name` | extends `string` | | `Required` | extends readonly `string`\[] | | `C` | extends `Record`\<`string`, [`ClassificationCategory`](https://docs.bijection.com/api/modules/access#classificationcategory)> | #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.resource` | `Name` | | `input.categories` | `C` | | `input.requiredOn` | `Required` | | `registry` | [`RegistryBinding`](https://docs.bijection.com/api/modules/access#registrybinding) \| `null` | #### Returns `Readonly`\<\{ `resources`: `Readonly`\<`Record`\<`Name`, `Readonly`\<\{ `category`: `Readonly`\<\{ `from`: `"key"` }> ; `clearance?`: `"registry"` ; `permissions`: \[`"pass"`, `"apply"`, `"declassify"`] ; `dominates?`: `Readonly`\<`Record`\<`string`, readonly `string`\[]>> }>>> ; `categories`: `Readonly`\<`Record`\> ; `registry`: `null` | `Readonly`\<\{ `organization`: `string` ; `revision`: `number` }> ; `clearances`: \
(`options`: \{ `table`: `Table` ; `maxAge`: `number` ; `member?`: `string` ; `object?`: `string` ; `memberIndex?`: `string` ; `objectIndex?`: `string` }) => `Readonly`\<\{ `roles`: `Readonly`\<`Record`\<\`$\{Name}:cleared\`, readonly [\`$\{Name}:pass\`]>> ; `directory`: `Readonly`\<\{ `table`: `Table` = options.table; `memberIndex`: `string` ; `objectIndex`: `string` ; `type`: `Name` = resourceName; `role`: `Readonly`\<\{ `kind`: `"declared"` ; `key`: \`\$\{Name}:cleared\` = role }> ; `member`: `string` ; `object`: `string` ; `maxAge`: `number` = options.maxAge }> }> ; `labelName`: (`key`: [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>) => `string` ; `labelNames`: (`selection`: [`Selection`](https://docs.bijection.com/api/modules/access#selection)) => `string`\[] ; `keyOf`: (`name`: `string`) => [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`> | `null` ; `readers`: (`options`: \{ `member`: (`ctx`: `any`) => `Promise`\<`boolean`> ; `principalOf?`: (`ctx`: `any`, `actor`: `string`) => `Promise`\<`AccessPrincipal` | `null`> }) => `Readonly`\<\{ `member`: (`ctx`: `any`) => `Promise`\<`boolean`> = options.member; `cleared`: (`ctx`: `any`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> ; `permits`: (`ctx`: `any`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> = cleared; `clearedFor`: (`ctx`: `any`, `actor`: `string`, `names`: readonly `string`\[]) => `Promise`\<`boolean`> }> ; `datasetRelease`: (`input`: \{ `destination`: `string` ; `dataset`: \{ `dataset`: `string` ; `definition`: \{ `labels?`: readonly `string`\[] } } ; `publisher`: `string` ; `requires`: `string` }) => [`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease) ; `validator`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[], [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<[`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>, `"required"`>\[], `"required"`, `never`>, `"required"`> ; `release`: \(`input`: \{ `destination`: `Destination` ; `requires?`: `string` ; `publisher?`: `string` ; `when?`: `NonNullable`\<[`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease)\[`"when"`]> ; `accepts`: readonly [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[] ; `declassify?`: `boolean` }) => [`AccessRelease`](https://docs.bijection.com/api/modules/access#accessrelease) & \{ `destination`: `Destination` } ; `modelEgress`: \(`input`: \{ `providers`: `Providers` ; `requires`: `string` ; `approved`: readonly [`ClassificationKey`](https://docs.bijection.com/api/modules/access#classificationkey)\<`C`>\[] }) => \{ `destinations`: \{ \[K in keyof Providers]: Object } ; `releases`: \{ \[K in keyof Providers]: AccessRelease & Object } } ; `bindings`: \(`bindings`: `B` & `Record`\<`Exclude`\, `never`>) => \{ \[K in string | number | symbol]: B\[K] extends Object ? ClassifiedBinding\ : never } }> *** ### componentWork ▸ **componentWork**(`bindings`): (`destination`: [`Destination`](https://docs.bijection.com/api/modules/access#destination)) => `Promise`\<`boolean`> Component work in a hand-written destination rule, with the access model's meaning: a release is admitted when a binding consents to its component's scheduled work holding the rule's rows (`custody`), or names an effect that admits the destination and the release is that component's own work. Returns false otherwise, including a consented effect's destination reached by other work (a member's own act, say), for the rule's own decision. Call it inside a private policy (declare `reads`); restrictions stay the rule's. #### Parameters | Name | Type | | :- | :- | | `bindings` | readonly [`ComponentWorkBinding`](https://docs.bijection.com/api/modules/access#componentworkbinding)\[] | #### Returns `fn` ▸ (`destination`): `Promise`\<`boolean`> ##### Parameters | Name | Type | | :- | :- | | `destination` | [`Destination`](https://docs.bijection.com/api/modules/access#destination) | ##### Returns `Promise`\<`boolean`> *** ### defineAccessContracts ▸ **defineAccessContracts**\<`T`>(`input`): `Readonly`\<`T`> Native admission independently checks schema and physical index bindings. #### Type parameters | Name | Type | | :- | :- | | `T` | extends `Readonly`\<`Record`\<`string`, [`AccessContractDeclaration`](https://docs.bijection.com/api/modules/access#accesscontractdeclaration)>> | #### Parameters | Name | Type | | :- | :- | | `input` | `T` | #### Returns `Readonly`\<`T`> *** ### decisionQuery ▸ **decisionQuery**(`installation`): [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `checks`: \{ key: string; type: string; permission: string; }\[] }, `Promise`\<[`PermissionResult`](https://docs.bijection.com/api/modules/access#permissionresult)\[]>> Not exported: an exported type refers to it. #### Parameters | Name | Type | | :- | :- | | `installation` | [`DecisionInstallation`](https://docs.bijection.com/api/modules/access#decisioninstallation) | #### Returns [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `checks`: \{ key: string; type: string; permission: string; }\[] }, `Promise`\<[`PermissionResult`](https://docs.bijection.com/api/modules/access#permissionresult)\[]>> *** ### defineEvidence ▸ **defineEvidence**\<`T`>(`declarations`): `Readonly`\<`T`> #### Type parameters | Name | Type | | :- | :- | | `T` | extends `Record`\<`string`, [`EvidenceDeclaration`](https://docs.bijection.com/api/modules/access#evidencedeclaration)> | #### Parameters | Name | Type | | :- | :- | | `declarations` | `T` | #### Returns `Readonly`\<`T`> *** ### canonicalContact ▸ **canonicalContact**(`kind`, `input`): [`ContactIdentity`](https://docs.bijection.com/api/modules/access#contactidentity) Canonicalize under an explicitly declared contact type. #### Parameters | Name | Type | | :- | :- | | `kind` | [`ContactKind`](https://docs.bijection.com/api/modules/access#contactkind) | | `input` | `string` | #### Returns [`ContactIdentity`](https://docs.bijection.com/api/modules/access#contactidentity) *** ### validateContactField ▸ **validateContactField**(`value`): `void` #### Parameters | Name | Type | | :- | :- | | `value` | [`ContactField`](https://docs.bijection.com/api/modules/access#contactfield) | #### Returns `void` *** ### defineInformationProtection ▸ **defineInformationProtection**\<`Field`, `Resource`>(`protection`): `Readonly`\<\{ `protect`: \(`field`: `F`) => `F` }> Name one protection so every field carrying it states the same obligations. #### Type parameters | Name | Type | | :- | :- | | `Field` | extends `string` = `string` | | `Resource` | extends `string` = `string` | #### Parameters | Name | Type | | :- | :- | | `protection` | [`AccessInformationProtection`](https://docs.bijection.com/api/modules/access#accessinformationprotection)\<`Field`, `Resource`> | #### Returns `Readonly`\<\{ `protect`: \(`field`: `F`) => `F` }> *** ### expiryMutation ▸ **expiryMutation**(`lifecycle`): [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `assignmentId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> }, `Promise`\<`null`>> Not exported: an exported type refers to it. #### Parameters | Name | Type | | :- | :- | | `lifecycle` | [`AssignmentLifecycle`](https://docs.bijection.com/api/modules/access#assignmentlifecycle) | #### Returns [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `assignmentId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> }, `Promise`\<`null`>> *** ### principalReference ▸ **principalReference**\<`Key`>(`key`): [`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal)\<`Key`> #### Type parameters | Name | Type | | :- | :- | | `Key` | extends `string` | #### Parameters | Name | Type | | :- | :- | | `key` | `Key` | #### Returns [`AccessPrincipal`](https://docs.bijection.com/api/modules/access#accessprincipal)\<`Key`> *** ### defineReleases ▸ **defineReleases**\<`Destinations`, `Releases`>(`destinations`, `releases`): `Releases` Declare reusable transfer contracts against a destination vocabulary. Command argument predicates retain the exact receiver's argument type. Native admission independently resolves every reference; this builder grants no authority. #### Type parameters | Name | Type | | :- | :- | | `Destinations` | extends `Record`\<`string`, [`AccessDestinationTarget`](https://docs.bijection.com/api/modules/access#accessdestinationtarget)> | | `Releases` | extends `Record`\<`string`, [`ReleaseFor`](https://docs.bijection.com/api/modules/access#releasefor)\<`Destinations`>> | #### Parameters | Name | Type | | :- | :- | | `destinations` | `Destinations` | | `releases` | `Releases` | #### Returns `Releases` *** ### receiver ▸ **receiver**\<`C`>(`command`): `Object` Name an integration command boundary. This declaration supplies no source permission or transfer consent; releases reference the installed destination. #### Type parameters | Name | Type | | :- | :- | | `C` | extends [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<`any`> | #### Parameters | Name | Type | | :- | :- | | `command` | `C` | #### Returns `Object` | Name | Type | | :- | :- | | `receiver` | `C` | *** ### createAccessReader ▸ **createAccessReader**\<`D`>(`definition`, `ctx`): `Pick`\<[`RequestAccessModel`](https://docs.bijection.com/api/modules/access#requestaccessmodel)\<`D`, [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)>, [`ReaderMethod`](https://docs.bijection.com/api/modules/access#readermethod)> Construct the same request API for a library’s selected declaration. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`GenericAccessDefinition`](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition) | #### Parameters | Name | Type | | :- | :- | | `definition` | `D` | | `ctx` | [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx) | #### Returns `Pick`\<[`RequestAccessModel`](https://docs.bijection.com/api/modules/access#requestaccessmodel)\<`D`, [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)>, [`ReaderMethod`](https://docs.bijection.com/api/modules/access#readermethod)> *** ### createAccessWriter ▸ **createAccessWriter**\<`D`>(`definition`, `ctx`): [`RequestAccessModel`](https://docs.bijection.com/api/modules/access#requestaccessmodel)\<`D`, [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)> Construct assignment operations for a mutation context. #### Type parameters | Name | Type | | :- | :- | | `D` | extends [`GenericAccessDefinition`](https://docs.bijection.com/api/interfaces/access.GenericAccessDefinition) | #### Parameters | Name | Type | | :- | :- | | `definition` | `D` | | `ctx` | [`AccessMutationCtx`](https://docs.bijection.com/api/modules/access#accessmutationctx) | #### Returns [`RequestAccessModel`](https://docs.bijection.com/api/modules/access#requestaccessmodel)\<`D`, [`GenericSchema`](https://docs.bijection.com/api/modules/server#genericschema)> *** ### assignmentsTable ▸ **assignmentsTable**(): [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"person"` ; `holderKey`: `string` } | \{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"service"` ; `holderKey`: `string` } | \{ `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `expiresAt`: `number` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"program"` ; `holderKey`: `string` ; `holderProgram`: \{ record: string; implementation: string; installation: string; callback: string; } } | \{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"group"` ; `holderType`: `string` ; `holderKey`: `string` ; `holderPermission`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"person"` ; `holderKey`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"person"`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"service"` ; `holderKey`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"service"`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `expiresAt`: `number` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"program"` ; `holderKey`: `string` ; `holderProgram`: \{ record: string; implementation: string; installation: string; callback: string; } }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"program"`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `holderProgram`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `record`: `string` ; `implementation`: `string` ; `installation`: `string` ; `callback`: `string` }, \{ `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `callback`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `record`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `implementation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"record"` | `"implementation"` | `"installation"` | `"callback"`> = programGrantRefValidator }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"` | `"holderProgram"` | `"holderProgram.record"` | `"holderProgram.implementation"` | `"holderProgram.installation"` | `"holderProgram.callback"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"group"` ; `holderType`: `string` ; `holderKey`: `string` ; `holderPermission`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"group"`, `"required"`> ; `holderType`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `holderPermission`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderType"` | `"holderKey"` | `"holderPermission"` | `"role.key"` | `"role.kind"` | `"role.id"`>], `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderType"` | `"holderKey"` | `"holderPermission"` | `"role.key"` | `"role.kind"` | `"role.id"` | `"holderProgram"` | `"holderProgram.record"` | `"holderProgram.implementation"` | `"holderProgram.installation"` | `"holderProgram.callback"`>, \{ `by_holder`: \[`"holderKind"`, `"holderType"`, `"holderKey"`, `"holderPermission"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_resource`: \[`"type"`, `"key"`, `"holderKind"`, `"role.kind"`, `"role.key"`, `"role.id"`, `"holderKey"`, `"_creationTime"`] ; `by_role`: \[`"role.kind"`, `"role.key"`, `"role.id"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_key`: \[`"key"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> Not exported: an exported type refers to it. #### Returns [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"person"` ; `holderKey`: `string` } | \{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"service"` ; `holderKey`: `string` } | \{ `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `expiresAt`: `number` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"program"` ; `holderKey`: `string` ; `holderProgram`: \{ record: string; implementation: string; installation: string; callback: string; } } | \{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"group"` ; `holderType`: `string` ; `holderKey`: `string` ; `holderPermission`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"person"` ; `holderKey`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"person"`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"service"` ; `holderKey`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"service"`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `expiresAt`: `number` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"program"` ; `holderKey`: `string` ; `holderProgram`: \{ record: string; implementation: string; installation: string; callback: string; } }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"program"`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `holderProgram`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `record`: `string` ; `implementation`: `string` ; `installation`: `string` ; `callback`: `string` }, \{ `installation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `callback`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `record`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `implementation`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"record"` | `"implementation"` | `"installation"` | `"callback"`> = programGrantRefValidator }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderKey"` | `"role.key"` | `"role.kind"` | `"role.id"` | `"holderProgram"` | `"holderProgram.record"` | `"holderProgram.implementation"` | `"holderProgram.installation"` | `"holderProgram.callback"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `reason`: `undefined` | `string` ; `key`: `string` ; `type`: `string` ; `role`: \{ key: string; kind: "declared"; } | \{ kind: "tenant"; id: string; } ; `holderKind`: `"group"` ; `holderType`: `string` ; `holderKey`: `string` ; `holderPermission`: `string` }, \{ `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<\{ `key`: `string` ; `kind`: `"declared"` } | \{ `kind`: `"tenant"` ; `id`: `string` }, \[[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `key`: `string` ; `kind`: `"declared"` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"declared"`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"kind"`>, [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"tenant"` ; `id`: `string` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"tenant"`, `"required"`> ; `id`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"kind"` | `"id"`>], `"required"`, `"key"` | `"kind"` | `"id"`> ; `holderKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `holderKind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"group"`, `"required"`> ; `holderType`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `holderPermission`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderType"` | `"holderKey"` | `"holderPermission"` | `"role.key"` | `"role.kind"` | `"role.id"`>], `"required"`, `"key"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"holderKind"` | `"holderType"` | `"holderKey"` | `"holderPermission"` | `"role.key"` | `"role.kind"` | `"role.id"` | `"holderProgram"` | `"holderProgram.record"` | `"holderProgram.implementation"` | `"holderProgram.installation"` | `"holderProgram.callback"`>, \{ `by_holder`: \[`"holderKind"`, `"holderType"`, `"holderKey"`, `"holderPermission"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_resource`: \[`"type"`, `"key"`, `"holderKind"`, `"role.kind"`, `"role.key"`, `"role.id"`, `"holderKey"`, `"_creationTime"`] ; `by_role`: \[`"role.kind"`, `"role.key"`, `"role.id"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_key`: \[`"key"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> *** ### requestsTable ▸ **requestsTable**(`assignments`, `expire`): [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `comment`: `undefined` | `string` ; `reviewer`: `undefined` | `string` ; `assignmentId`: `undefined` | `string` ; `reviewerLabel`: `undefined` | `string` ; `key`: `string` ; `requestId`: `string` ; `type`: `string` ; `reason`: `string` ; `role`: `string` ; `updatedAt`: `number` ; `status`: `"pending"` | `"rejected"` | `"approved"` | `"withdrawn"` ; `acknowledged`: `boolean` ; `beneficiary`: `string` ; `requester`: `string` ; `requesterLabel`: `string` }, \{ `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `beneficiary`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `requester`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requesterLabel`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `status`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"pending"` | `"rejected"` | `"approved"` | `"withdrawn"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"pending"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"approved"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"rejected"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"withdrawn"`, `"required"`>], `"required"`, `never`> ; `acknowledged`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `updatedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `reviewer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `reviewerLabel`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `comment`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `assignmentId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> }, `"required"`, `"key"` | `"requestId"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"updatedAt"` | `"status"` | `"comment"` | `"reviewer"` | `"acknowledged"` | `"assignmentId"` | `"beneficiary"` | `"requester"` | `"requesterLabel"` | `"reviewerLabel"`>, \{ `by_status`: \[`"status"`, `"_creationTime"`] ; `by_requester`: \[`"requester"`, `"status"`, `"_creationTime"`] ; `by_request`: \[`"requester"`, `"requestId"`, `"_creationTime"`] ; `by_beneficiary`: \[`"beneficiary"`, `"status"`, `"_creationTime"`] ; `by_requester_resource`: \[`"requester"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_beneficiary_resource`: \[`"beneficiary"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_resource`: \[`"type"`, `"key"`, `"role"`, `"status"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> Not exported: an exported type refers to it. #### Parameters | Name | Type | | :- | :- | | `assignments` | `string` | | `expire` | () => [`AssignmentMutation`](https://docs.bijection.com/api/modules/access#assignmentmutation) | #### Returns [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `undefined` | `number` ; `comment`: `undefined` | `string` ; `reviewer`: `undefined` | `string` ; `assignmentId`: `undefined` | `string` ; `reviewerLabel`: `undefined` | `string` ; `key`: `string` ; `requestId`: `string` ; `type`: `string` ; `reason`: `string` ; `role`: `string` ; `updatedAt`: `number` ; `status`: `"pending"` | `"rejected"` | `"approved"` | `"withdrawn"` ; `acknowledged`: `boolean` ; `beneficiary`: `string` ; `requester`: `string` ; `requesterLabel`: `string` }, \{ `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `key`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `beneficiary`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `requester`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requesterLabel`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `reason`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `status`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"pending"` | `"rejected"` | `"approved"` | `"withdrawn"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"pending"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"approved"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"rejected"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"withdrawn"`, `"required"`>], `"required"`, `never`> ; `acknowledged`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `updatedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `reviewer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `reviewerLabel`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `comment`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> ; `assignmentId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`undefined` | `string`, `"optional"`> }, `"required"`, `"key"` | `"requestId"` | `"type"` | `"expiresAt"` | `"reason"` | `"role"` | `"updatedAt"` | `"status"` | `"comment"` | `"reviewer"` | `"acknowledged"` | `"assignmentId"` | `"beneficiary"` | `"requester"` | `"requesterLabel"` | `"reviewerLabel"`>, \{ `by_status`: \[`"status"`, `"_creationTime"`] ; `by_requester`: \[`"requester"`, `"status"`, `"_creationTime"`] ; `by_request`: \[`"requester"`, `"requestId"`, `"_creationTime"`] ; `by_beneficiary`: \[`"beneficiary"`, `"status"`, `"_creationTime"`] ; `by_requester_resource`: \[`"requester"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_beneficiary_resource`: \[`"beneficiary"`, `"type"`, `"key"`, `"_creationTime"`] ; `by_resource`: \[`"type"`, `"key"`, `"role"`, `"status"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> *** ### roleDefinitionsTable ▸ **roleDefinitionsTable**(): [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `guests`: `undefined` | `boolean` ; `maxDuration`: `undefined` | `number` ; `reasonRequired`: `undefined` | `boolean` ; `name`: `string` ; `type`: `string` ; `scope`: `string` ; `permissions`: `string`\[] }, \{ `scope`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `name`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `permissions`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> ; `maxDuration`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reasonRequired`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`undefined` | `boolean`, `"optional"`> ; `guests`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`undefined` | `boolean`, `"optional"`> }, `"required"`, `"name"` | `"type"` | `"scope"` | `"permissions"` | `"guests"` | `"maxDuration"` | `"reasonRequired"`>, \{ `by_scope`: \[`"scope"`, `"type"`, `"name"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> Not exported: an exported type refers to it. #### Returns [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `guests`: `undefined` | `boolean` ; `maxDuration`: `undefined` | `number` ; `reasonRequired`: `undefined` | `boolean` ; `name`: `string` ; `type`: `string` ; `scope`: `string` ; `permissions`: `string`\[] }, \{ `scope`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `type`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `name`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `permissions`: [`VArray`](https://docs.bijection.com/api/classes/values.VArray)\<`string`\[], [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, `"required"`> ; `maxDuration`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`undefined` | `number`, `"optional"`> ; `reasonRequired`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`undefined` | `boolean`, `"optional"`> ; `guests`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`undefined` | `boolean`, `"optional"`> }, `"required"`, `"name"` | `"type"` | `"scope"` | `"permissions"` | `"guests"` | `"maxDuration"` | `"reasonRequired"`>, \{ `by_scope`: \[`"scope"`, `"type"`, `"name"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> *** ### admissionGates ▸ **admissionGates**\<`Gates`>(`gates`): `Readonly`\<\{ `requirements`: \{ readonly \[Name in string | number | symbol]: Omit\ } ; `describe`: () => \{ `name`: `string` ; `kind`: [`AdmissionGateKind`](https://docs.bijection.com/api/modules/access#admissiongatekind) ; `permissions`: `string`\[] }\[] }> Use `.requirements` in a resource binding or defineAccess declaration. Inspection metadata describes the gate's owner category, never a verdict about private facts or permission to attempt a business operation. #### Type parameters | Name | Type | | :- | :- | | `Gates` | extends `Readonly`\<`Record`\<`string`, [`AdmissionGate`](https://docs.bijection.com/api/modules/access#admissiongate)>> | #### Parameters | Name | Type | | :- | :- | | `gates` | `Gates` | #### Returns `Readonly`\<\{ `requirements`: \{ readonly \[Name in string | number | symbol]: Omit\ } ; `describe`: () => \{ `name`: `string` ; `kind`: [`AdmissionGateKind`](https://docs.bijection.com/api/modules/access#admissiongatekind) ; `permissions`: `string`\[] }\[] }> *** ### defineAllowance ▸ **defineAllowance**(`definition`): [`AllowanceDefinition`](https://docs.bijection.com/api/modules/access#allowancedefinition) Declare once, then import the same definition in charges and allocations. #### Parameters | Name | Type | | :- | :- | | `definition` | `Object` | | `definition.unit` | `string` | #### Returns [`AllowanceDefinition`](https://docs.bijection.com/api/modules/access#allowancedefinition) *** ### allowanceKey ▸ **allowanceKey**(`value`): `string` #### Parameters | Name | Type | | :- | :- | | `value` | [`AllowanceDefinition`](https://docs.bijection.com/api/modules/access#allowancedefinition) \| [`AllowanceReference`](https://docs.bijection.com/api/modules/access#allowancereference) | #### Returns `string` *** ### checkedAllocations ▸ **checkedAllocations**(`allocations`, `fail?`): `Readonly`\<`Record`\<`string`, `bigint` | `"unbounded"`>> Validate allocations when minting a delegation. #### Parameters | Name | Type | | :- | :- | | `allocations` | `unknown` | | `fail` | (`message`: `string`) => `never` | #### Returns `Readonly`\<`Record`\<`string`, `bigint` | `"unbounded"`>> *** ### applicationAuth ▸ **applicationAuth**(`options`): `Object` Mount the returned handler at basePath/\* and /connections/callback in your application's server. No provider or native refresh grant reaches JS. Cookies hold opaque references; rotation and exact recovery live in Bijection. #### Parameters | Name | Type | | :- | :- | | `options` | [`ApplicationAuthServerOptions`](https://docs.bijection.com/api/modules/access#applicationauthserveroptions) | #### Returns `Object` | Name | Type | | :- | :- | | `handle` | (`request`: `Request`) => `Promise`\<`Response`> | *** ### reviewAuthIsolation ▸ **reviewAuthIsolation**(`config`, `forbidden`): \{ `name`: `string` = test.name; `issuer`: `string` = test.issuer; `audiences`: `string`\[] ; `outcome`: `"overlapping"` | `"isolated"` ; `matchingProviders`: `number`\[] ; `evidence`: `"resolvedConfiguration"` }\[] Evaluate resolved issuer/audience admission. This is a configuration review, independently of whether a token has a valid signature or current lifetime. #### Parameters | Name | Type | | :- | :- | | `config` | `Pick`\<[`ApplicationAuthConfig`](https://docs.bijection.com/api/modules/access#applicationauthconfig), `"providers"`> | | `forbidden` | readonly [`AuthenticationIsolationCase`](https://docs.bijection.com/api/modules/access#authenticationisolationcase)\[] | #### Returns \{ `name`: `string` = test.name; `issuer`: `string` = test.issuer; `audiences`: `string`\[] ; `outcome`: `"overlapping"` | `"isolated"` ; `matchingProviders`: `number`\[] ; `evidence`: `"resolvedConfiguration"` }\[] *** ### isolateAuthentication ▸ **isolateAuthentication**\<`T`>(`config`, `forbidden`): `T` Use as the default export of auth.config.ts so normal deployment analysis refuses an issuer/audience overlap with the declared unwanted contexts. #### Type parameters | Name | Type | | :- | :- | | `T` | extends `Pick`\<[`ApplicationAuthConfig`](https://docs.bijection.com/api/modules/access#applicationauthconfig), `"providers"`> | #### Parameters | Name | Type | | :- | :- | | `config` | `T` | | `forbidden` | readonly [`AuthenticationIsolationCase`](https://docs.bijection.com/api/modules/access#authenticationisolationcase)\[] | #### Returns `T` *** ### identityAdmin ▸ **identityAdmin**(`options`): `Object` Server-only native identity administration. Keep the deployment key in private server custody and retain the exact control across an unknown result. #### Parameters | Name | Type | | :- | :- | | `options` | `Object` | | `options.deploymentUrl` | `string` | | `options.adminKey` | `string` | | `options.fetch?` | typeof `fetch` | #### Returns `Object` | Name | Type | | :- | :- | | `control` | (`request`: [`ApplicationSessionControl`](https://docs.bijection.com/api/modules/access#applicationsessioncontrol)) => `Promise`\<[`ApplicationSessionControlReceipt`](https://docs.bijection.com/api/modules/access#applicationsessioncontrolreceipt)> | | `sessions` | (`principal`: `string`) => `Promise`\<[`ApplicationSessionInventory`](https://docs.bijection.com/api/modules/browser#applicationsessioninventory)> | | `receipt` | (`principal`: `string`, `requestId`: `string`) => `Promise`\<[`ApplicationSessionEnd`](https://docs.bijection.com/api/modules/browser#applicationsessionend)> | *** ### applicationSignInClients ▸ **applicationSignInClients**(`_ctx`): `Promise`\<\{ `sourceId`: `string` ; `issuer`: `string` ; `clientId`: `string` ; `revision`: `string` ; `digest`: `string` }\[]> Public installed client facts, under the native login policy's tracked revisions. A registration proves configuration, never provider health. #### Parameters | Name | Type | | :- | :- | | `_ctx` | [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx) | #### Returns `Promise`\<\{ `sourceId`: `string` ; `issuer`: `string` ; `clientId`: `string` ; `revision`: `string` ; `digest`: `string` }\[]> *** ### defineAuditEvents ▸ **defineAuditEvents**\<`Events`>(`events`): `Readonly`\<\{ `definitions`: [`AuditEventDefinitions`](https://docs.bijection.com/api/modules/access#auditeventdefinitions) ; `describe`: () => \{ `resources`: `string`\[] ; `metadata`: [`ValidatorJSON`](https://docs.bijection.com/api/modules/values#validatorjson) ; `name`: `string` ; `digest`: `string` }\[] ; `record`: \(`access`: `object`, `_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `name`: `Name`, `metadata`: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\<`Events`\[`Name`]\[`"metadata"`]>) => `Promise`\<`void`> }> Install `.definitions` in defineSchema(\{ ... }, \{ auditEvents }). Runtime recording selects the installed contract; native attribution remains separate from application-authored metadata. #### Type parameters | Name | Type | | :- | :- | | `Events` | extends `Record`\<`string`, [`AuditEventDeclaration`](https://docs.bijection.com/api/modules/access#auditeventdeclaration)> | #### Parameters | Name | Type | | :- | :- | | `events` | `Events` | #### Returns `Readonly`\<\{ `definitions`: [`AuditEventDefinitions`](https://docs.bijection.com/api/modules/access#auditeventdefinitions) ; `describe`: () => \{ `resources`: `string`\[] ; `metadata`: [`ValidatorJSON`](https://docs.bijection.com/api/modules/values#validatorjson) ; `name`: `string` ; `digest`: `string` }\[] ; `record`: \(`access`: `object`, `_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `name`: `Name`, `metadata`: [`Infer`](https://docs.bijection.com/api/modules/values#infer)\<`Events`\[`Name`]\[`"metadata"`]>) => `Promise`\<`void`> }> *** ### defineAuditSubscriptions ▸ **defineAuditSubscriptions**(`input`): `Object` Customer-owned journal subscriptions reuse native service grants, scoped reads and command delivery. Install all three tables and exact writer functions; a destination is an installed command/binding, never a URL. The current governing query re-opens and hashes the journal body at every send, retaining native source/key fences through physical dispatch. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.table` | `string` | | `input.batchesTable` | `string` | | `input.requestsTable` | `string` | | `input.access` | `object` | | `input.ownerTable` | `string` | | `input.ownerType` | `string` | | `input.resource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.batchResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.requestResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.service` | `string` | | `input.deliveryRole` | `string` | | `input.destinations` | `Readonly`\<`Record`\<`string`, `Destination`>> | #### Returns `Object` | Name | Type | | :- | :- | | `table` | `any` | | `batches` | `any` | | `requests` | `any` | | `functions` | \{ `read`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `cursor`: `null` \| `string` ; `limit`: `number` ; `subscriptionId`: `string` }, `Promise`\<[`ResourceAuditPage`](https://docs.bijection.com/api/modules/access#resourceauditpage)>> ; `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` ; `destination`: `string` ; `fromMs`: `number` }, `Promise`\<\{ `subscriptionId`: `any` ; `revision`: `bigint` }>> ; `change`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `action`: `"revoke"` \| `"resume"` \| `"pause"` \| `"discard"` ; `expectedRevision`: `bigint` ; `subscriptionId`: `string` }, `Promise`\<\{ `subscriptionId`: `any` = row.\_id; `revision`: `any` = patch.revision }>> ; `prepare`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `subscriptionId`: `string` }, `Promise`\<\{ `batchId`: `any` = batch.\_id; `revision`: `any` = batch.revision; `settled`: `any` = batch.settled; `command`: [`Value`](https://docs.bijection.com/api/modules/values#value) } \| \{ `kind`: `string` = coverage }>> ; `settle`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `subscriptionId`: `string` }, `Promise`\<\{ `kind`: `string` = "idle"; `observation`: `undefined` ; `batchId?`: `undefined` = batch.\_id } \| \{ `kind`: `string` = "pending"; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } ; `batchId?`: `undefined` = batch.\_id } \| \{ `observation`: `undefined` ; `kind`: `string` = "settled"; `batchId`: `any` = batch.\_id }>> ; `governing`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, `any`, `Promise`\<(`null` \| \{ `validUntil`: `any` = assignment.expiresAt })\[]>> } | | `functions.read` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `cursor`: `null` \| `string` ; `limit`: `number` ; `subscriptionId`: `string` }, `Promise`\<[`ResourceAuditPage`](https://docs.bijection.com/api/modules/access#resourceauditpage)>> | | `functions.create` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` ; `destination`: `string` ; `fromMs`: `number` }, `Promise`\<\{ `subscriptionId`: `any` ; `revision`: `bigint` }>> | | `functions.change` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `action`: `"revoke"` \| `"resume"` \| `"pause"` \| `"discard"` ; `expectedRevision`: `bigint` ; `subscriptionId`: `string` }, `Promise`\<\{ `subscriptionId`: `any` = row.\_id; `revision`: `any` = patch.revision }>> | | `functions.prepare` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `subscriptionId`: `string` }, `Promise`\<\{ `batchId`: `any` = batch.\_id; `revision`: `any` = batch.revision; `settled`: `any` = batch.settled; `command`: [`Value`](https://docs.bijection.com/api/modules/values#value) } \| \{ `kind`: `string` = coverage }>> | | `functions.settle` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `subscriptionId`: `string` }, `Promise`\<\{ `kind`: `string` = "idle"; `observation`: `undefined` ; `batchId?`: `undefined` = batch.\_id } \| \{ `kind`: `string` = "pending"; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } ; `batchId?`: `undefined` = batch.\_id } \| \{ `observation`: `undefined` ; `kind`: `string` = "settled"; `batchId`: `any` = batch.\_id }>> | | `functions.governing` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, `any`, `Promise`\<(`null` \| \{ `validUntil`: `any` = assignment.expiresAt })\[]>> | | `endpoints` | \{ `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> ; `change`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> ; `prepare`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> ; `settle`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> ; `tick`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `subscriptionId`: `string` }, `Promise`\<`any`>> ; `inspect`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `subscriptionId`: `string` }, `Promise`\<\{ `subscriptionId`: `any` = row.\_id; `owner`: `any` = row\.owner; `destination`: `any` = row\.destination; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `definitionCurrent`: `boolean` ; `coverage`: `any` = row\.coverage; `fromMs`: `any` = row\.fromMs; `snapshotRevision`: `any` = row\.snapshotRevision; `earliestRecordingTimeMs`: `any` = row\.earliestRecordingTimeMs; `settledCursor`: `any` = row\.cursor; `pending`: `null` \| \{ `batchId`: `any` = batch.\_id; `revision`: `any` = batch.revision; `settled`: `any` = batch.settled; `command`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } } }>> ; `recover`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `destination`: `string` ; `fromMs`: `number` } \| \{ `requestId`: `string` ; `action`: `"revoke"` \| `"resume"` \| `"pause"` \| `"discard"` ; `expectedRevision`: `bigint` ; `subscriptionId`: `string` }, `Promise`\<`null` \| \{ `subscriptionId`: `any` ; `revision`: `bigint` }>> } | | `endpoints.create` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> | | `endpoints.change` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> | | `endpoints.prepare` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> | | `endpoints.settle` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, `any`, `Promise`\<`any`>> | | `endpoints.tick` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `subscriptionId`: `string` }, `Promise`\<`any`>> | | `endpoints.inspect` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `subscriptionId`: `string` }, `Promise`\<\{ `subscriptionId`: `any` = row.\_id; `owner`: `any` = row\.owner; `destination`: `any` = row\.destination; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `definitionCurrent`: `boolean` ; `coverage`: `any` = row\.coverage; `fromMs`: `any` = row\.fromMs; `snapshotRevision`: `any` = row\.snapshotRevision; `earliestRecordingTimeMs`: `any` = row\.earliestRecordingTimeMs; `settledCursor`: `any` = row\.cursor; `pending`: `null` \| \{ `batchId`: `any` = batch.\_id; `revision`: `any` = batch.revision; `settled`: `any` = batch.settled; `command`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } } }>> | | `endpoints.recover` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `destination`: `string` ; `fromMs`: `number` } \| \{ `requestId`: `string` ; `action`: `"revoke"` \| `"resume"` \| `"pause"` \| `"discard"` ; `expectedRevision`: `bigint` ; `subscriptionId`: `string` }, `Promise`\<`null` \| \{ `subscriptionId`: `any` ; `revision`: `bigint` }>> | *** ### assertAuthorization ▸ **assertAuthorization**\<`Args`>(`authorize`, `...args`): `Promise`\<`void`> Run an authorization assertion. Denial throws; returned values never grant access. #### Type parameters | Name | Type | | :- | :- | | `Args` | extends `unknown`\[] | #### Parameters | Name | Type | | :- | :- | | `authorize` | (...`args`: `Args`) => `void` \| `Promise`\<`void`> | | `...args` | `Args` | #### Returns `Promise`\<`void`> *** ### automationCredentials ▸ **automationCredentials**(`access`): `Readonly`\<\{ `create`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `service`: `string` ; `permissions`: readonly `string`\[] ; `label`: `string` ; `expiresAt`: `number` ; `requestId`: `string` ; `functions?`: readonly `string`\[] ; `participation?`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` }> ; `list`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref)) => `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }> ; `rotate`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`, `input`: \{ `label`: `string` ; `expiresAt`: `number` ; `overlapMs`: `number` ; `requestId`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }> ; `usage`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `credential`: `string` ; `limit`: `number` ; `cursor?`: `string` | `null` ; `from?`: `number` ; `to?`: `number` }) => `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }> ; `revoke`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`) => `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }> ; `functions`: \{ `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `participation`: `undefined` | `string` ; `functions`: `undefined` | `string`\[] ; `requestId`: `string` ; `resource`: \{ key: string; type: string; } ; `service`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `permissions`: `string`\[] }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` }>> ; `list`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `resource`: \{ key: string; type: string; } }, `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }>> ; `rotate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `credential`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `overlapMs`: `number` }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }>> ; `usage`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `undefined` | `null` | `string` ; `from`: `undefined` | `number` ; `to`: `undefined` | `number` ; `resource`: \{ key: string; type: string; } ; `credential`: `string` ; `limit`: `number` }, `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `credential`: `string` }, `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }>> } }> Customer-owned automation uses deployment-minted service secrets under native permission/resource restrictions. A retry recovers the original ID; the secret is returned only once. #### Parameters | Name | Type | | :- | :- | | `access` | `object` | #### Returns `Readonly`\<\{ `create`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `service`: `string` ; `permissions`: readonly `string`\[] ; `label`: `string` ; `expiresAt`: `number` ; `requestId`: `string` ; `functions?`: readonly `string`\[] ; `participation?`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` }> ; `list`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref)) => `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }> ; `rotate`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`, `input`: \{ `label`: `string` ; `expiresAt`: `number` ; `overlapMs`: `number` ; `requestId`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }> ; `usage`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `credential`: `string` ; `limit`: `number` ; `cursor?`: `string` | `null` ; `from?`: `number` ; `to?`: `number` }) => `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }> ; `revoke`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`) => `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }> ; `functions`: \{ `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `participation`: `undefined` | `string` ; `functions`: `undefined` | `string`\[] ; `requestId`: `string` ; `resource`: \{ key: string; type: string; } ; `service`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `permissions`: `string`\[] }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` }>> ; `list`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `resource`: \{ key: string; type: string; } }, `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }>> ; `rotate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `credential`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `overlapMs`: `number` }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }>> ; `usage`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `undefined` | `null` | `string` ; `from`: `undefined` | `number` ; `to`: `undefined` | `number` ; `resource`: \{ key: string; type: string; } ; `credential`: `string` ; `limit`: `number` }, `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `credential`: `string` }, `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }>> } }> *** ### personalCredentials ▸ **personalCredentials**(`access`): `Readonly`\<\{ `create`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `service`: `string` ; `permissions`: readonly `string`\[] ; `label`: `string` ; `expiresAt`: `number` ; `requestId`: `string` ; `functions?`: readonly `string`\[] ; `participation?`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` }> ; `list`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref)) => `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }> ; `rotate`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`, `input`: \{ `label`: `string` ; `expiresAt`: `number` ; `overlapMs`: `number` ; `requestId`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }> ; `usage`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `credential`: `string` ; `limit`: `number` ; `cursor?`: `string` | `null` ; `from?`: `number` ; `to?`: `number` }) => `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }> ; `revoke`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`) => `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }> ; `functions`: \{ `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `participation`: `undefined` | `string` ; `functions`: `undefined` | `string`\[] ; `requestId`: `string` ; `resource`: \{ key: string; type: string; } ; `service`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `permissions`: `string`\[] }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` }>> ; `list`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `resource`: \{ key: string; type: string; } }, `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }>> ; `rotate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `credential`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `overlapMs`: `number` }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }>> ; `usage`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `undefined` | `null` | `string` ; `from`: `undefined` | `number` ; `to`: `undefined` | `number` ; `resource`: \{ key: string; type: string; } ; `credential`: `string` ; `limit`: `number` }, `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `credential`: `string` }, `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }>> } }> Durable personal access retains live participation and the person's current authority, independently of browser sign-in. It supplies no provider claims or human authentication assurance. #### Parameters | Name | Type | | :- | :- | | `access` | `object` | #### Returns `Readonly`\<\{ `create`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `service`: `string` ; `permissions`: readonly `string`\[] ; `label`: `string` ; `expiresAt`: `number` ; `requestId`: `string` ; `functions?`: readonly `string`\[] ; `participation?`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` }> ; `list`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref)) => `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }> ; `rotate`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`, `input`: \{ `label`: `string` ; `expiresAt`: `number` ; `overlapMs`: `number` ; `requestId`: `string` }) => `Promise`\<\{ `credential`: `string` ; `secret`: `string` | `null` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }> ; `usage`: (`ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `input`: \{ `credential`: `string` ; `limit`: `number` ; `cursor?`: `string` | `null` ; `from?`: `number` ; `to?`: `number` }) => `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }> ; `revoke`: (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `credential`: `string`) => `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }> ; `functions`: \{ `create`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `participation`: `undefined` | `string` ; `functions`: `undefined` | `string`\[] ; `requestId`: `string` ; `resource`: \{ key: string; type: string; } ; `service`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `permissions`: `string`\[] }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` }>> ; `list`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `resource`: \{ key: string; type: string; } }, `Promise`\<\{ `credentials`: [`AutomationCredential`](https://docs.bijection.com/api/modules/access#automationcredential)\[] }>> ; `rotate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `credential`: `string` ; `expiresAt`: `number` ; `label`: `string` ; `overlapMs`: `number` }, `Promise`\<\{ `credential`: `string` ; `secret`: `null` | `string` ; `created`: `boolean` ; `predecessor`: `string` ; `overlapUntil`: `number` }>> ; `usage`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `undefined` | `null` | `string` ; `from`: `undefined` | `number` ; `to`: `undefined` | `number` ; `resource`: \{ key: string; type: string; } ; `credential`: `string` ; `limit`: `number` }, `Promise`\<\{ `items`: \{ `id`: `string` ; `revision`: `string` ; `recordedAtMs`: `number` ; `source`: `string` ; `outcome`: `"refused"` | `"observed"` | `"committed"` | `"execution_failed"` | `"authorized"` ; `observed_at_ms`: `number` ; `request_id`: `null` | `string` ; `function`: `null` | `string` ; `actor`: `null` | `Record`\<`string`, [`Value`](https://docs.bijection.com/api/modules/values#value)> ; `body`: [`Value`](https://docs.bijection.com/api/modules/values#value) }\[] = observations; `latestAuthenticationInPage`: `null` | `number` ; `coverage`: \{ `authentication`: `"nativeCustomerSecretPresentations"` ; `authorizedUse`: `"notCollected"` ; `range`: `"retainedJournalPage"` ; `complete`: `boolean` = !page.hasMore } ; `cursor`: `null` | `string` ; `hasMore`: `boolean` ; `retentionDays`: `number` ; `earliestRecordingTimeMs`: `number` ; `snapshotRevision`: `string` }>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `credential`: `string` }, `Promise`\<\{ `credential`: `string` ; `revoked`: `boolean` }>> } }> *** ### defineBillableParticipation ▸ **defineBillableParticipation**(`input`): `Object` Retains one exact meter report and its original native command. The count comes only from an installed query. Install table/state and export functions under module; current report and meter policy still authorize every send. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.reportsTable` | `string` | | `input.stateTable` | `string` | | `input.resource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.stateResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.ownerTable` | `string` | | `input.permission` | `string` | | `input.population` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `owner`: `string` }, typeof [`type`](https://docs.bijection.com/api/classes/values.VDerived#type)> | | `input.command` | [`CommandHandle`](https://docs.bijection.com/api/modules/connectors#commandhandle)\<\{ `value`: `string` ; `timestamp`: `number` ; `reportId`: `string` ; `reportDigest`: `string` }, `"resource"`> | | `input.target` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `owner`: `string` }, \{ `bindingId`: `string` }> | #### Returns `Object` | Name | Type | | :- | :- | | `table` | `any` | | `state` | `any` | | `functions` | \{ `report`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<\{ `value`: `string` ; `command`: \{ kind: "command"; sourceId: SourceId \| null; requestId: RequestId; command: \{ integration: \{ module: string; export: string; }; command: string; version: 1; }; request: string; recoverUntil: number; } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` }>> } | | `functions.report` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<\{ `value`: `string` ; `command`: \{ kind: "command"; sourceId: SourceId \| null; requestId: RequestId; command: \{ integration: \{ module: string; export: string; }; command: string; version: 1; }; request: string; recoverUntil: number; } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` }>> | | `endpoints` | \{ `report`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`any`>> ; `receipt`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`null` \| \{ `value`: `string` ; `command`: \{ kind: "command"; sourceId: SourceId \| null; requestId: RequestId; command: \{ integration: \{ module: string; export: string; }; command: string; version: 1; }; request: string; recoverUntil: number; } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` }>> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`null` \| \{ `value`: `string` ; `command`: \{ `kind`: `"command"` ; `sourceId`: `null` \| [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `command`: \{ integration: \{ module: string; export: string; }; command: string; version: 1; } ; `request`: `string` ; `recoverUntil`: `number` } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` ; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } }>> } | | `endpoints.report` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`any`>> | | `endpoints.receipt` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`null` \| \{ `value`: `string` ; `command`: \{ kind: "command"; sourceId: SourceId \| null; requestId: RequestId; command: \{ integration: \{ module: string; export: string; }; command: string; version: 1; }; request: string; recoverUntil: number; } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` }>> | | `endpoints.status` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` }, `Promise`\<`null` \| \{ `value`: `string` ; `command`: \{ `kind`: `"command"` ; `sourceId`: `null` \| [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `command`: \{ integration: \{ module: string; export: string; }; command: string; version: 1; } ; `request`: `string` ; `recoverUntil`: `number` } ; `timestamp`: `number` ; `reportId`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `reportDigest`: `string` ; `observation`: `null` \| \{ `revision`: `number` ; `recovery`: \{ next: "none" \| "send" \| "interpret" \| "publish" \| "wait" \| "reconcile" \| "attention"; reason: "attemptInFlight" \| "attemptNotDispatched" \| "providerOutcomeUnknown" \| "sendWindowExpired" \| ... 10 more ... \| null; nextAtMs: number \| null; } ; `delivery`: \{ phase: "uncertain" \| "blocked" \| "refused" \| "pending" \| "cancelled" \| "held" \| "delivered" \| "queued" \| "dispatching" \| "notApplied" \| "duplicated"; mayHaveDispatched: boolean; settlement: "unbounded" \| ... 1 more ... \| "unsettled"; } ; `execution`: \{ authorityRevoked: boolean; cancelRequested: boolean; } ; `publication`: `"none"` \| `"blocked"` \| `"running"` \| `"pending"` \| `"complete"` ; `effect`: `"unknown"` \| `"applied"` \| `"notApplied"` \| `"duplicated"` ; `canSubmit`: `boolean` ; `recoverUntil`: `number` } }>> | | `governing` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, `any`, `Promise`\<`any`\[]>> | *** ### componentAccessPolicyFor ▸ **componentAccessPolicyFor**\<`Kind`>(`...kinds`): [`ComponentAccessPolicy`](https://docs.bijection.com/api/modules/access#componentaccesspolicy)\<`Kind`> A package-owned access contract whose handlers see only these resource kinds. A decision about any other kind refuses before the handler runs. #### Type parameters | Name | Type | | :- | :- | | `Kind` | extends `string` | #### Parameters | Name | Type | | :- | :- | | `...kinds` | readonly `Kind`\[] | #### Returns [`ComponentAccessPolicy`](https://docs.bijection.com/api/modules/access#componentaccesspolicy)\<`Kind`> *** ### exposeFunctions ▸ **exposeFunctions**\<`T`>(`registrations`, `metadata`): `T` Publish the ordinary public functions returned by a component's root application helper. Internal helpers and native operation doors keep their own declarations. The supplied admission is shared, never a new policy. #### Type parameters | Name | Type | | :- | :- | | `T` | extends `object` | #### Parameters | Name | Type | | :- | :- | | `registrations` | `T` | | `metadata` | `Pick`\<[`DiscoveryDefinition`](https://docs.bijection.com/api/modules/server#discoverydefinition), `"admission"` \| `"appliesDelegation"`> | #### Returns `T` *** ### domainName ▸ **domainName**(`value`): `string` #### Parameters | Name | Type | | :- | :- | | `value` | `string` | #### Returns `string` *** ### domainRoutingResources ▸ **domainRoutingResources**\<`Owner`>(`owner?`): `Object` Public discovery contains only deliberately published route descriptors. Claims remain private children of their actual organization. #### Type parameters | Name | Type | | :- | :- | | `Owner` | extends `string` = `"organization"` | #### Parameters | Name | Type | | :- | :- | | `owner` | `Owner` | #### Returns `Object` | Name | Type | | :- | :- | | `domainClaim` | \{ `parent`: `Owner` = owner; `permissions`: \[`"read"`, `"create"`, `"manage"`] } | | `domainClaim.parent` | `Owner` | | `domainClaim.permissions` | \[`"read"`, `"create"`, `"manage"`] | | `signInRoute` | \{ `permissions`: \[`"read"`, `"create"`, `"manage"`] ; `audience`: \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } } | | `signInRoute.permissions` | \[`"read"`, `"create"`, `"manage"`] | | `signInRoute.audience` | \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } | | `signInRoute.audience.read` | `"public"` | | `signInRoute.audience.create` | `"public"` | | `signInRoute.audience.manage` | `"public"` | | `domainRequest` | \{ `parent`: `"domainClaim"` = "domainClaim"; `permissions`: \[`"read"`, `"create"`] } | | `domainRequest.parent` | `"domainClaim"` | | `domainRequest.permissions` | \[`"read"`, `"create"`] | *** ### defineDomainRouting ▸ **defineDomainRouting**(`input`): `Object` Install claims, routes and exact internal exports. DNS is read in an action; only its internal recorder can publish evidence. The recorder rechecks the original challenge, actor, revision and current owner permission. Routes are explicit publications and cannot grant an assignment or admit an identity. The same domain may have multiple owners and multiple routes. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.claimsTable` | `string` | | `input.routesTable` | `string` | | `input.requestsTable` | `string` | | `input.ownerType` | `string` | | `input.owner` | [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | | `input.permission` | `string` | | `input.claimResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.routeResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.requestResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.clients` | `Readonly`\<`Record`\<`string`, \{ `issuer`: `string` ; `clientId`: `string` }>> | #### Returns `Object` | Name | Type | | :- | :- | | `claims` | [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `owner`: `any` ; `requestId`: `string` ; `expiresAt`: `number` ; `revision`: `bigint` ; `actor`: `string` ; `observedAt`: `number` ; `token`: `string` ; `domain`: `string` ; `verifiedUntil`: `number` }, \{ `owner`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) = input.owner; `domain`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `token`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `actor`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `verifiedUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `observedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"requestId"` \| `"expiresAt"` \| `"owner"` \| `"revision"` \| `"actor"` \| `"observedAt"` \| `"token"` \| `"domain"` \| \`owner.\$\{any}\` \| `"verifiedUntil"`>, \{ `by_owner`: \[`"owner"`, `"_creationTime"`] ; `by_request`: \[`"owner"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> | | `routes` | [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `claim`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `owner`: `string` ; `revision`: `bigint` ; `issuer`: `string` ; `clientId`: `string` ; `domain`: `string` ; `enabled`: `boolean` ; `client`: `string` ; `providerOrganization`: `null` \| `string` ; `verifiedUntil`: `number` }, \{ `owner`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `claim`: [`VId`](https://docs.bijection.com/api/classes/values.VId)\<[`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`>, `"required"`> ; `domain`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `client`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `issuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `clientId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `providerOrganization`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `enabled`: [`VBoolean`](https://docs.bijection.com/api/classes/values.VBoolean)\<`boolean`, `"required"`> ; `verifiedUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> }, `"required"`, `"claim"` \| `"owner"` \| `"revision"` \| `"issuer"` \| `"clientId"` \| `"domain"` \| `"enabled"` \| `"client"` \| `"providerOrganization"` \| `"verifiedUntil"`>, \{ `by_domain`: \[`"domain"`, `"_creationTime"`] ; `by_claim_client`: \[`"claim"`, `"client"`, `"_creationTime"`] ; `by_claim`: \[`"claim"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> | | `requests` | [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `claim`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `termsDigest`: `string` ; `resultJson`: `string` }, \{ `claim`: [`VId`](https://docs.bijection.com/api/classes/values.VId)\<[`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`>, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `termsDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `resultJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"requestId"` \| `"claim"` \| `"termsDigest"` \| `"resultJson"`>, \{ `by_claim`: \[`"claim"`, `"_creationTime"`] ; `by_request`: \[`"claim"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> | | `functions` | \{ `claim`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` ; `domain`: `string` }, `Promise`\<`any`>> ; `challenge`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `claimId`: `string` }, `Promise`\<`any`>> ; `receipt`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requestId`: `string` ; `expectedRevision`: `bigint` ; `claimId`: `string` }, `Promise`\<[`Value`](https://docs.bijection.com/api/modules/values#value)>> ; `record`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `observedAt`: `number` ; `token`: `string` ; `outcome`: `"unavailable"` \| `"pending"` \| `"verified"` ; `expectedRevision`: `bigint` ; `ttlSeconds`: `number` ; `claimId`: `string` }, `Promise`\<`any`>> ; `publish`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `enabled`: `boolean` ; `client`: `string` ; `expectedRevision`: `bigint` ; `providerOrganization`: `null` \| `string` ; `claimId`: `string` }, `Promise`\<`any`>> } | | `functions.claim` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `owner`: `string` ; `domain`: `string` }, `Promise`\<`any`>> | | `functions.challenge` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `claimId`: `string` }, `Promise`\<`any`>> | | `functions.receipt` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requestId`: `string` ; `expectedRevision`: `bigint` ; `claimId`: `string` }, `Promise`\<[`Value`](https://docs.bijection.com/api/modules/values#value)>> | | `functions.record` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `observedAt`: `number` ; `token`: `string` ; `outcome`: `"unavailable"` \| `"pending"` \| `"verified"` ; `expectedRevision`: `bigint` ; `ttlSeconds`: `number` ; `claimId`: `string` }, `Promise`\<`any`>> | | `functions.publish` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `enabled`: `boolean` ; `client`: `string` ; `expectedRevision`: `bigint` ; `providerOrganization`: `null` \| `string` ; `claimId`: `string` }, `Promise`\<`any`>> | | `endpoints` | \{ `claim`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `domain`: `string` }, `Promise`\<`any`>> ; `inspect`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `claimId`: `string` }, `Promise`\<\{ `claimId`: `any` = row.\_id; `domain`: `any` = row\.domain; `revision`: `any` = row\.revision; `recordName`: `string` ; `recordValue`: `any` = row\.token; `expiresAt`: `any` = row\.expiresAt; `verifiedUntil`: `any` = row\.verifiedUntil }>> ; `verify`: \{ `isBijectionFunction`: `true` ; `isAction`: `true` } & \{ `_visibility`: `"public"` } & \{ `isPublic`: `true` } & \{ `exportCapabilities`: () => `string` } ; `publish`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `enabled`: `boolean` ; `client`: `string` ; `expectedRevision`: `bigint` ; `providerOrganization`: `null` \| `string` ; `claimId`: `string` }, `Promise`\<`any`>> ; `discover`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `domain`: `string` }, `Promise`\<\{ `kind`: `string` ; `routes`: \{ `routeId`: `any` = row.\_id; `sourceId`: `any` = row\.client; `clientId`: `any` = row\.clientId; `issuer`: `any` = row\.issuer; `providerOrganization`: `any` = row\.providerOrganization; `validUntil`: `any` = row\.verifiedUntil }\[] }>> } | | `endpoints.claim` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `domain`: `string` }, `Promise`\<`any`>> | | `endpoints.inspect` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `claimId`: `string` }, `Promise`\<\{ `claimId`: `any` = row.\_id; `domain`: `any` = row\.domain; `revision`: `any` = row\.revision; `recordName`: `string` ; `recordValue`: `any` = row\.token; `expiresAt`: `any` = row\.expiresAt; `verifiedUntil`: `any` = row\.verifiedUntil }>> | | `endpoints.verify` | \{ `isBijectionFunction`: `true` ; `isAction`: `true` } & \{ `_visibility`: `"public"` } & \{ `isPublic`: `true` } & \{ `exportCapabilities`: () => `string` } | | `endpoints.publish` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `enabled`: `boolean` ; `client`: `string` ; `expectedRevision`: `bigint` ; `providerOrganization`: `null` \| `string` ; `claimId`: `string` }, `Promise`\<`any`>> | | `endpoints.discover` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `domain`: `string` }, `Promise`\<\{ `kind`: `string` ; `routes`: \{ `routeId`: `any` = row.\_id; `sourceId`: `any` = row\.client; `clientId`: `any` = row\.clientId; `issuer`: `any` = row\.issuer; `providerOrganization`: `any` = row\.providerOrganization; `validUntil`: `any` = row\.verifiedUntil }\[] }>> | *** ### applicationAuthentication ▸ **applicationAuthentication**(`_ctx`): `Promise`\<[`AuthenticationCeremony`](https://docs.bijection.com/api/modules/access#authenticationceremony) | `null`> Immutable facts from a successful native provider exchange. A refresh does not create another ceremony or advance authentication time. #### Parameters | Name | Type | | :- | :- | | `_ctx` | `unknown` | #### Returns `Promise`\<[`AuthenticationCeremony`](https://docs.bijection.com/api/modules/access#authenticationceremony) | `null`> *** ### defineEnterpriseAuthentication ▸ **defineEnterpriseAuthentication**(`input`): `Readonly`\<\{ `table`: [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `owner`: `string` ; `validUntil`: `number` ; `configurationDigest`: `string` ; `definitionDigest`: `string` ; `recordedAt`: `number` ; `recordedBy`: `string` ; `evidenceJson`: `string` }, \{ `owner`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`string`, `"required"`, `any`> = input.owner; `configurationDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recordedBy`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `evidenceJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recordedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"requestId"` | `"owner"` | `"validUntil"` | `"configurationDigest"` | `"definitionDigest"` | \`owner.\$\{any}\` | `"recordedAt"` | `"recordedBy"` | `"evidenceJson"`>, \{ `by_owner`: \[`"owner"`, `"_creationTime"`] ; `by_owner_configuration`: \[`"owner"`, `"configurationDigest"`, `"_creationTime"`] ; `by_request`: \[`"owner"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> ; `definitionDigest`: `string` ; `inspectionOwner`: () => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`any`>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `functions`: \{ `observe`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `string` ; `configurationDigest`: `string` ; `requestId`: `string` }, `Promise`\<\{ `observation`: `any` = previous.\_id; `recovered`: `boolean` = true }>> ; `proof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"blocked"` ; `reason`: `string` = "No successful native authentication has been observed for this configuration" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"unavailable"` ; `reason`: `string` = "The authentication observation expired" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> } ; `endpoints`: \{ `observe`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `configurationDigest`: `string` }, `Promise`\<`any`>> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `string` }, `Promise`\<\{ `tested`: `boolean` ; `successful`: `boolean` ; `proof`: \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"blocked"` ; `reason`: `string` = "No successful native authentication has been observed for this configuration" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"unavailable"` ; `reason`: `string` = "The authentication observation expired" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"ready"` ; `reason`: `null` = null } = current }>> } }> Observed enterprise authentication is application-owned history. The only writer captures native facts itself; no endpoint accepts a caller's claim that SSO succeeded. Install the table and exact internal writer module. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.table` | `string` | | `input.owner` | [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`string`, `"required"`, `any`> | | `input.resource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.configuration` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` }, [`Configuration`](https://docs.bijection.com/api/modules/access#configuration)> | | `input.status` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` }, `any`> | | `input.method` | \{ `kind`: `"provider"` ; `value`: `string` } \| \{ `kind`: `"oidc"` ; `values`: readonly `string`\[] } | | `input.maximumAgeMs` | `number` | #### Returns `Readonly`\<\{ `table`: [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `owner`: `string` ; `validUntil`: `number` ; `configurationDigest`: `string` ; `definitionDigest`: `string` ; `recordedAt`: `number` ; `recordedBy`: `string` ; `evidenceJson`: `string` }, \{ `owner`: [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`string`, `"required"`, `any`> = input.owner; `configurationDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recordedBy`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `evidenceJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recordedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `validUntil`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"requestId"` | `"owner"` | `"validUntil"` | `"configurationDigest"` | `"definitionDigest"` | \`owner.\$\{any}\` | `"recordedAt"` | `"recordedBy"` | `"evidenceJson"`>, \{ `by_owner`: \[`"owner"`, `"_creationTime"`] ; `by_owner_configuration`: \[`"owner"`, `"configurationDigest"`, `"_creationTime"`] ; `by_request`: \[`"owner"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> ; `definitionDigest`: `string` ; `inspectionOwner`: () => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`any`>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `functions`: \{ `observe`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `string` ; `configurationDigest`: `string` ; `requestId`: `string` }, `Promise`\<\{ `observation`: `any` = previous.\_id; `recovered`: `boolean` = true }>> ; `proof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"blocked"` ; `reason`: `string` = "No successful native authentication has been observed for this configuration" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"unavailable"` ; `reason`: `string` = "The authentication observation expired" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> } ; `endpoints`: \{ `observe`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `owner`: `string` ; `configurationDigest`: `string` }, `Promise`\<`any`>> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `string` }, `Promise`\<\{ `tested`: `boolean` ; `successful`: `boolean` ; `proof`: \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"blocked"` ; `reason`: `string` = "No successful native authentication has been observed for this configuration" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"unavailable"` ; `reason`: `string` = "The authentication observation expired" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `validUntil`: `any` ; `outcome`: `"ready"` ; `reason`: `null` = null } = current }>> } }> *** ### defineEnterpriseProviderProof ▸ **defineEnterpriseProviderProof**(`input`): [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> Adapt an acquired provider observation to the existing enterprise proof owner. The query is fixed by installed code; proof evaluation does no HTTP. Certificate expiry, source checkpoints and policy enforcement retain their own meaning and deadlines. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.query` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` }, [`Observation`](https://docs.bijection.com/api/modules/access#observation)> | | `input.kind` | [`Observation`](https://docs.bijection.com/api/modules/access#observation)\[`"kind"`] | | `input.maximumAgeMs` | `number` | #### Returns [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } | \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` | \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> *** ### defineEnterpriseSetup ▸ **defineEnterpriseSetup**(`input`): `Readonly`\<\{ `table`: [`SetupTable`](https://docs.bijection.com/api/modules/access#setuptable)\<[`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `owner`: `any` ; `revision`: `bigint` ; `configurationDigest`: `string` ; `definitionDigest`: `string` ; `configurationJson`: `string` ; `activationJson`: `null` | `string` ; `lastRequest`: `string` }, \{ `owner`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) = input.owner; `configurationJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `configurationDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `activationJson`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `lastRequest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"owner"` | `"revision"` | `"configurationDigest"` | `"definitionDigest"` | `"configurationJson"` | `"activationJson"` | `"lastRequest"` | \`owner.\$\{any}\`>, \{ `by_owner`: \[`"owner"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` }, [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>> ; `requests`: [`SetupTable`](https://docs.bijection.com/api/modules/access#setuptable)\<[`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `action`: `string` ; `revision`: `bigint` ; `setup`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `termsDigest`: `string` ; `recordedAt`: `number` }, \{ `setup`: [`VId`](https://docs.bijection.com/api/classes/values.VId)\<[`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`>, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `termsDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `action`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `recordedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"requestId"` | `"action"` | `"revision"` | `"setup"` | `"termsDigest"` | `"recordedAt"`>, \{ `by_setup`: \[`"setup"`, `"_creationTime"`] ; `by_request`: \[`"setup"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` }, [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>> ; `definitionDigest`: `string` ; `inspect`: (`ctx`: `Pick`\<[`ReadContext`](https://docs.bijection.com/api/modules/access#readcontext), `"db"` | `"runQuery"`>, `owner`: `string`) => `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }> ; `functions`: \{ `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `any` }, `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }>> ; `configure`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `configuration`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> ; `activate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` ; `configurationDigest`: `string` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> ; `deactivate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` ; `configurationDigest`: `string` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> } ; `endpoints`: \{ `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `any` }, `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }>> ; `configure`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> ; `activate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> ; `deactivate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> } ; `inspectionOwner`: (`anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` }, `any`>) => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<\{ `configured`: `any` = status.configured; `active`: `any` = status.active; `ready`: `any` = status.ready; `revision`: `any` ; `configurationDigest`: `any` ; `definitionDigest`: `any` = status.definitionDigest; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> }>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `requireActive`: (`ctx`: `Pick`\<[`ReadContext`](https://docs.bijection.com/api/modules/access#readcontext), `"db"` | `"runQuery"`>, `owner`: `string`) => `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }> }> Application-owned enterprise setup. Install both returned tables and export the internal writer functions under the exact configured module. The native committer refuses every other writer, including direct mutations. #### Parameters | Name | Type | Description | | :- | :- | :- | | `input` | `Object` | - | | `input.module` | `string` | - | | `input.table` | `string` | - | | `input.requests` | `string` | - | | `input.resource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | - | | `input.requestResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | - | | `input.owner` | [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | - | | `input.configuration` | [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) | - | | `input.operationPermissions?` | `Object` | Separate task configuration from activation authority. These are native permissions on the declared owner resource, in addition to table manage. A setup recipient may configure while activation stays with its sponsor. | | `input.operationPermissions.resourceType` | `string` | - | | `input.operationPermissions.configure` | `string` | - | | `input.operationPermissions.activate` | `string` | - | | `input.operationPermissions.deactivate` | `string` | - | | `input.proofs` | `Readonly`\<`Record`\<`string`, [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` ; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `configurationDigest`: `string` }, [`Proof`](https://docs.bijection.com/api/modules/access#proof)>>> | - | #### Returns `Readonly`\<\{ `table`: [`SetupTable`](https://docs.bijection.com/api/modules/access#setuptable)\<[`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `owner`: `any` ; `revision`: `bigint` ; `configurationDigest`: `string` ; `definitionDigest`: `string` ; `configurationJson`: `string` ; `activationJson`: `null` | `string` ; `lastRequest`: `string` }, \{ `owner`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) = input.owner; `configurationJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `configurationDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `activationJson`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` | `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `lastRequest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"owner"` | `"revision"` | `"configurationDigest"` | `"definitionDigest"` | `"configurationJson"` | `"activationJson"` | `"lastRequest"` | \`owner.\$\{any}\`>, \{ `by_owner`: \[`"owner"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` }, [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>> ; `requests`: [`SetupTable`](https://docs.bijection.com/api/modules/access#setuptable)\<[`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `action`: `string` ; `revision`: `bigint` ; `setup`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `termsDigest`: `string` ; `recordedAt`: `number` }, \{ `setup`: [`VId`](https://docs.bijection.com/api/classes/values.VId)\<[`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`>, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `termsDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `action`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `recordedAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"requestId"` | `"action"` | `"revision"` | `"setup"` | `"termsDigest"` | `"recordedAt"`>, \{ `by_setup`: \[`"setup"`, `"_creationTime"`] ; `by_request`: \[`"setup"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` }, [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>> ; `definitionDigest`: `string` ; `inspect`: (`ctx`: `Pick`\<[`ReadContext`](https://docs.bijection.com/api/modules/access#readcontext), `"db"` | `"runQuery"`>, `owner`: `string`) => `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }> ; `functions`: \{ `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `any` }, `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }>> ; `configure`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `configuration`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> ; `activate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` ; `configurationDigest`: `string` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> ; `deactivate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `owner`: `any` ; `requestId`: `string` ; `expectedRevision`: `bigint` ; `configurationDigest`: `string` }, `Promise`\<\{ `setup`: `any` = row.\_id; `revision`: `any` ; `recovered`: `boolean` = true }>> } ; `endpoints`: \{ `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `owner`: `any` }, `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }>> ; `configure`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> ; `activate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> ; `deactivate`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{}, `Promise`\<`any`>> } ; `inspectionOwner`: (`anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `owner`: `string` }, `any`>) => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<\{ `configured`: `any` = status.configured; `active`: `any` = status.active; `ready`: `any` = status.ready; `revision`: `any` ; `configurationDigest`: `any` ; `definitionDigest`: `any` = status.definitionDigest; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> }>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `requireActive`: (`ctx`: `Pick`\<[`ReadContext`](https://docs.bijection.com/api/modules/access#readcontext), `"db"` | `"runQuery"`>, `owner`: `string`) => `Promise`\<\{ `configured`: `false` ; `definitionDigest`: `string` ; `active`: `boolean` = false; `ready`: `boolean` = false; `proofs`: \{} = \{} } | \{ `ready`: `boolean` ; `proofs`: `Record`\<`string`, \{ `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` ; `reason`: `null` | `string` ; `validUntil`: `null` | `number` ; `outcome`: `"unavailable"` | `"blocked"` | `"ready"` ; `configurationDigest`: `string` ; `definitionDigest`: `string` }> = observed; `configured`: `true` ; `setup`: `any` = row.\_id; `revision`: `any` = row\.revision; `definitionDigest`: `string` ; `configurationDigest`: `any` = row\.configurationDigest; `configuration`: [`Value`](https://docs.bijection.com/api/modules/values#value) ; `active`: `boolean` ; `activation`: `any` }> }> *** ### defineIdentityCorrelation ▸ **defineIdentityCorrelation**(`providers`): `Readonly`\<\{ `resolve`: (`ctx`: `Pick`\<[`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`any`, `any`>, `"auth"` | `"runQuery"`>, `name`: `string`) => `Promise`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `provider`: `string` }, `Promise`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)>> ; `inspectionOwner`: (`anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `provider`: `string` }, [`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)>) => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<\{ `outcome`: `"unavailable"` | `"unmatched"` | `"matched"` | `"conflict"` = current.kind; `people`: `string`\[] ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] = current.evidence }>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `request`: (`ctx`: `Parameters`\\[`0`], `provider`: `string`, `review`: (`person`: `string`, `correlation`: `Extract`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation), \{ `kind`: `"matched"` }>) => `Promise`\<`unknown`>) => `Promise`\<\{ `correlation`: \{ `kind`: `"conflict"` ; `people`: `string`\[] ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } | \{ `kind`: `"unmatched"` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } | \{ `kind`: `"unavailable"` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } ; `request`: `null` = null } | \{ `correlation`: \{ `kind`: `"matched"` ; `person`: `string` ; `organization`: `string` ; `provider`: `string` ; `subject`: `string` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] ; `validUntil`: `number` } ; `request`: `unknown` }> }> Each installed provider maps verified immutable IDs to an authorized source query. Correlation proposes an association; reviewed identity linking keeps ownership of the actual decision. Emails establish no association. #### Parameters | Name | Type | | :- | :- | | `providers` | `Readonly`\<`Record`\<`string`, \{ `issuer`: `string` ; `organizationClaim`: `string` ; `query`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `organization`: `string` ; `provider`: `string` ; `subject`: `string` }, [`Population`](https://docs.bijection.com/api/modules/access#population)> }>> | #### Returns `Readonly`\<\{ `resolve`: (`ctx`: `Pick`\<[`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`any`, `any`>, `"auth"` | `"runQuery"`>, `name`: `string`) => `Promise`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `provider`: `string` }, `Promise`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)>> ; `inspectionOwner`: (`anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, \{ `provider`: `string` }, [`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation)>) => `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<\{ `outcome`: `"unavailable"` | `"unmatched"` | `"matched"` | `"conflict"` = current.kind; `people`: `string`\[] ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] = current.evidence }>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) | `null`> }> ; `request`: (`ctx`: `Parameters`\\[`0`], `provider`: `string`, `review`: (`person`: `string`, `correlation`: `Extract`\<[`IdentityCorrelation`](https://docs.bijection.com/api/modules/access#identitycorrelation), \{ `kind`: `"matched"` }>) => `Promise`\<`unknown`>) => `Promise`\<\{ `correlation`: \{ `kind`: `"conflict"` ; `people`: `string`\[] ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } | \{ `kind`: `"unmatched"` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } | \{ `kind`: `"unavailable"` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] } ; `request`: `null` = null } | \{ `correlation`: \{ `kind`: `"matched"` ; `person`: `string` ; `organization`: `string` ; `provider`: `string` ; `subject`: `string` ; `evidence`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] ; `validUntil`: `number` } ; `request`: `unknown` }> }> *** ### identityFieldAuthority ▸ **identityFieldAuthority**\<`Row`, `Principal`, `Claims`>(`fields`): `Record`\<`string`, [`TransitionConditionDeclaration`](https://docs.bijection.com/api/modules/access#transitionconditiondeclaration)\<`Row`, `Principal`, `Claims`>> Compile identity-field management through the existing native transition language. Install the returned declarations in the identity table's access binding. Creation and deletion keep their ordinary native permissions. #### Type parameters | Name | Type | | :- | :- | | `Row` | extends `Record`\<`string`, `any`> = `any` | | `Principal` | `any` | | `Claims` | `any` | #### Parameters | Name | Type | | :- | :- | | `fields` | `Partial`\<`Record`\>> | #### Returns `Record`\<`string`, [`TransitionConditionDeclaration`](https://docs.bijection.com/api/modules/access#transitionconditiondeclaration)\<`Row`, `Principal`, `Claims`>> *** ### defineIdentityProjection ▸ **defineIdentityProjection**(`input`): `Object` One governed transaction applies independent field groups and records their actual outcomes. Install receipts and the exact internal `apply` export. Add writer to the target table's writers and retain identityFieldAuthority transitions there. Source precedence is supplied by the installed observation query; it cannot bypass the target's native authority or uniqueness rules. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.targetTable` | `string` | | `input.receiptsTable` | `string` | | `input.receiptResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.observation` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `key`: `string` }, typeof [`type`](https://docs.bijection.com/api/classes/values.VDerived#type)> | | `input.groups` | `Readonly`\<`Record`\<`string`, `Readonly`\<`Record`\<`string`, [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator)>>>> | #### Returns `Object` | Name | Type | | :- | :- | | `writer` | `string` | | `receipts` | `any` | | `projectionDigest` | `string` | | `functions` | \{ `apply`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` \| `"unmatched"` \| `"conflict"` } \| \{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" \| "accepted" \| "conflict" \| "sourceNotAuthoritative" \| "sameValue"; outcome: "unchanged" \| "skipped" \| "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }>> } | | `functions.apply` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<\{ `kind`: `"blocked"` ; `reason`: `"unavailable"` \| `"unmatched"` \| `"conflict"` } \| \{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" \| "accepted" \| "conflict" \| "sourceNotAuthoritative" \| "sameValue"; outcome: "unchanged" \| "skipped" \| "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }>> | | `endpoints` | \{ `preview`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` }, `Promise`\<`any`>> ; `apply`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<`any`>> ; `receipt`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<`null` \| \{ `kind`: `"blocked"` ; `reason`: `"unavailable"` \| `"unmatched"` \| `"conflict"` } \| \{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" \| "accepted" \| "conflict" \| "sourceNotAuthoritative" \| "sameValue"; outcome: "unchanged" \| "skipped" \| "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }>> } | | `endpoints.preview` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` }, `Promise`\<`any`>> | | `endpoints.apply` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<`any`>> | | `endpoints.receipt` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` ; `requestId`: `string` }, `Promise`\<`null` \| \{ `kind`: `"blocked"` ; `reason`: `"unavailable"` \| `"unmatched"` \| `"conflict"` } \| \{ `kind`: `"projected"` ; `requestId`: `string` ; `source`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `sourceRevision`: `string` ; `groups`: \{ name: string; reason: "unavailable" \| "accepted" \| "conflict" \| "sourceNotAuthoritative" \| "sameValue"; outcome: "unchanged" \| "skipped" \| "applied"; }\[] ; `recordedAtMs`: `number` ; `identityId`: `string` ; `projectionDigest`: `string` ; `beforeDigest`: `string` ; `afterDigest`: `string` }>> | *** ### definePolicySlot ▸ **definePolicySlot**\<`Args`, `Returns`>(`definition`): [`PolicySlot`](https://docs.bijection.com/api/modules/access#policyslot)\<[`ObjectType`](https://docs.bijection.com/api/modules/values#objecttype)\<`Args`>, [`Infer`](https://docs.bijection.com/api/modules/values#infer)\<`Returns`>> Declare a policy dependency of this component. Name it in a policy query's `policy.calls`; the application binds a query with exactly these validators and declared `policy.reads` per installation. Deployment refuses a missing, extra or incompatible binding. The decision stays current: no code is retained. #### Type parameters | Name | Type | | :- | :- | | `Args` | extends [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) | | `Returns` | extends [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `any`, `any`> | #### Parameters | Name | Type | | :- | :- | | `definition` | `Object` | | `definition.name` | `string` | | `definition.args` | `Args` | | `definition.returns` | `Returns` | #### Returns [`PolicySlot`](https://docs.bijection.com/api/modules/access#policyslot)\<[`ObjectType`](https://docs.bijection.com/api/modules/values#objecttype)\<`Args`>, [`Infer`](https://docs.bijection.com/api/modules/values#infer)\<`Returns`>> *** ### currentPolicyQuery ▸ **currentPolicyQuery**\<`Q`>(`query`, `args`): `Promise`\<[`FunctionReturnType`](https://docs.bijection.com/api/modules/server#functionreturntype)\<`Q`>> Consult an explicitly declared shared policy query at the live parent. Its actual current read dependencies fence this decision's release. The executing query must list the reference in `policy.calls`; both the branch and current parent declarations must admit it. Available only in private policy evaluation, with the same actual requester and program provenance. Ordinary data queries retain their selected snapshot basis. #### Type parameters | Name | Type | | :- | :- | | `Q` | extends [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"public"` \| `"internal"`> | #### Parameters | Name | Type | | :- | :- | | `query` | `Q` | | `args` | [`FunctionArgs`](https://docs.bijection.com/api/modules/server#functionargs)\<`Q`> | #### Returns `Promise`\<[`FunctionReturnType`](https://docs.bijection.com/api/modules/server#functionreturntype)\<`Q`>> *** ### policyExecution ▸ **policyExecution**(): `Promise`\<[`PolicyExecution`](https://docs.bijection.com/api/modules/access#policyexecution)> Inspect the actual execution holder inside a private policy. #### Returns `Promise`\<[`PolicyExecution`](https://docs.bijection.com/api/modules/access#policyexecution)> *** ### invitationEmail ▸ **invitationEmail**(`value`): `string` #### Parameters | Name | Type | | :- | :- | | `value` | `string` | #### Returns `string` *** ### onboardingResources ▸ **onboardingResources**(): `Object` Invitations and receipts each enforce their mandatory participant condition. Sharing an organization grants no access to either resource. Bind both resources with defineOnboarding. #### Returns `Object` | Name | Type | | :- | :- | | `invitation` | \{ `permissions`: \[`"read"`, `"create"`, `"manage"`] ; `audience`: \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } } | | `invitation.permissions` | \[`"read"`, `"create"`, `"manage"`] | | `invitation.audience` | \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } | | `invitation.audience.read` | `"public"` | | `invitation.audience.create` | `"public"` | | `invitation.audience.manage` | `"public"` | | `invitationReceipt` | \{ `parent`: `"invitation"` = "invitation"; `permissions`: \[`"read"`, `"create"`, `"manage"`] ; `audience`: \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } } | | `invitationReceipt.parent` | `"invitation"` | | `invitationReceipt.permissions` | \[`"read"`, `"create"`, `"manage"`] | | `invitationReceipt.audience` | \{ `read`: `"public"` = "public"; `create`: `"public"` = "public"; `manage`: `"public"` = "public" } | | `invitationReceipt.audience.read` | `"public"` | | `invitationReceipt.audience.create` | `"public"` | | `invitationReceipt.audience.manage` | `"public"` | *** ### onboardingVisibility ▸ **onboardingVisibility**(`service`): [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) Install on a root-level invitation resource with public read/manage audiences. This mandatory native condition limits disclosure to the issuer, the exact verified recipient and the declared native finalizer. Creation stays behind the factory's exclusive issuer writer and its native grant-permission check. Declare issuer, subject, email and emailVerified claim types in the model. #### Parameters | Name | Type | | :- | :- | | `service` | `string` | #### Returns [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) *** ### defineOnboarding ▸ **defineOnboarding**(`input`): `Object` Invitations and one-purpose administration tasks share native assignments, retained sponsor decisions and ordinary request receipts. Acceptance records the verified recipient; a declared external finalizer then atomically creates the participation and acceptance receipt under its own native grant authority. No callback restores an issuer's identity or accepts a caller-supplied role. Install table/receipts, export functions under module, and endpoints separately. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.table` | `string` | | `input.receiptsTable` | `string` | | `input.access` | `object` | | `input.resource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.receiptResource` | [`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`> | | `input.service` | `string` | | `input.workflows` | `Readonly`\<`Record`\<`string`, [`Workflow`](https://docs.bijection.com/api/modules/access#workflow)>> | #### Returns `Object` | Name | Type | | :- | :- | | `table` | [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `expiresAt`: `number` ; `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `role`: `string` ; `participation`: `null` \| `string` ; `scopeKey`: `string` ; `workflow`: `string` ; `definitionDigest`: `string` ; `termsDigest`: `string` ; `programDigest`: `string` ; `sponsorIssuer`: `string` ; `sponsorSubject`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `acceptedIssuer`: `string` ; `acceptedSubject`: `string` ; `scopeType`: `string` ; `sponsor`: `string` ; `participationExpiresAt`: `null` \| `number` ; `createdRequestId`: `string` ; `sponsorEvidence`: `string` ; `sponsorBinding`: `string` ; `acceptedBy`: `null` \| `string` ; `completionReceipt`: `null` \| `string` ; `lastResult`: `null` \| `string` }, \{ `workflow`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `definitionDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `programDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `scopeType`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `scopeKey`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `role`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsor`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorSubject`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recipientIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recipientEmail`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> ; `participationExpiresAt`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `number`, \[[`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `createdRequestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `termsDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorEvidence`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorBinding`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `revision`: [`VInt64`](https://docs.bijection.com/api/classes/values.VInt64)\<`bigint`, `"required"`> ; `state`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"invited"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"claimed"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"accepted"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"completed"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"revoked"`, `"required"`>], `"required"`, `never`> ; `acceptedBy`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `acceptedIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `acceptedSubject`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `participation`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `completionReceipt`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> ; `lastResult`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`null` \| `string`, \[[`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`>, [`VNull`](https://docs.bijection.com/api/classes/values.VNull)\<`null`, `"required"`>], `"required"`, `never`> }, `"required"`, `"expiresAt"` \| `"revision"` \| `"state"` \| `"role"` \| `"participation"` \| `"scopeKey"` \| `"workflow"` \| `"definitionDigest"` \| `"termsDigest"` \| `"programDigest"` \| `"sponsorIssuer"` \| `"sponsorSubject"` \| `"recipientIssuer"` \| `"recipientEmail"` \| `"acceptedIssuer"` \| `"acceptedSubject"` \| `"scopeType"` \| `"sponsor"` \| `"participationExpiresAt"` \| `"createdRequestId"` \| `"sponsorEvidence"` \| `"sponsorBinding"` \| `"acceptedBy"` \| `"completionReceipt"` \| `"lastResult"`>, \{ `by_create`: \[`"sponsor"`, `"createdRequestId"`, `"_creationTime"`] ; `by_recipient`: \[`"recipientIssuer"`, `"recipientEmail"`, `"state"`, `"_creationTime"`] ; `by_state`: \[`"state"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> | | `receipts` | [`TableDefinition`](https://docs.bijection.com/api/classes/server.TableDefinition)\<[`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `requestId`: `string` ; `state`: `string` ; `termsDigest`: `string` ; `invitation`: [`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`> ; `sponsorIssuer`: `string` ; `sponsorSubject`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `acceptedIssuer`: `string` ; `acceptedSubject`: `string` ; `resultJson`: `string` }, \{ `invitation`: [`VId`](https://docs.bijection.com/api/classes/values.VId)\<[`GenericId`](https://docs.bijection.com/api/modules/values#genericid)\<`string`>, `"required"`> ; `requestId`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `termsDigest`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `resultJson`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `sponsorSubject`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recipientIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `recipientEmail`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `acceptedIssuer`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `acceptedSubject`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `state`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> }, `"required"`, `"requestId"` \| `"state"` \| `"termsDigest"` \| `"invitation"` \| `"sponsorIssuer"` \| `"sponsorSubject"` \| `"recipientIssuer"` \| `"recipientEmail"` \| `"acceptedIssuer"` \| `"acceptedSubject"` \| `"resultJson"`>, \{ `by_invitation`: \[`"invitation"`, `"_creationTime"`] ; `by_request`: \[`"invitation"`, `"requestId"`, `"_creationTime"`] }, \{}, \{}, `false`, \{}> & \{ `isWriterOwned`: `true` } & [`AccessTableBinding`](https://docs.bijection.com/api/interfaces/server.AccessTableBinding)\<[`AccessResource`](https://docs.bijection.com/api/interfaces/access.AccessResource)\<`any`, `any`, `any`, [`AccessDefinitionInput`](https://docs.bijection.com/api/modules/access#accessdefinitioninput)>, `any`> | | `functions` | \{ `issue`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `expiresAt`: `number` ; `scopeKey`: `string` ; `workflow`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `scopeType`: `string` ; `participationExpiresAt`: `null` \| `number` }, `Promise`\<\{ `invitationId`: `any` ; `revision`: `bigint` ; `state`: `"invited"` ; `participation`: `null` = null }>> ; `accept`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> ; `finalize`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> ; `perform`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `input`: `any` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<[`Value`](https://docs.bijection.com/api/modules/values#value)>> ; `complete`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> } | | `functions.issue` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `expiresAt`: `number` ; `scopeKey`: `string` ; `workflow`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `scopeType`: `string` ; `participationExpiresAt`: `null` \| `number` }, `Promise`\<\{ `invitationId`: `any` ; `revision`: `bigint` ; `state`: `"invited"` ; `participation`: `null` = null }>> | | `functions.accept` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> | | `functions.finalize` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> | | `functions.revoke` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> | | `functions.perform` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `input`: `any` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<[`Value`](https://docs.bijection.com/api/modules/values#value)>> | | `functions.complete` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"internal"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<\{ `revision`: `bigint` ; `state`: `"revoked"` \| `"completed"` \| `"accepted"` \| `"claimed"` \| `"invited"` ; `participation`: `null` \| `string` ; `invitationId`: `string` }>> | | `endpoints` | \{ `issue`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `expiresAt`: `number` ; `scopeKey`: `string` ; `workflow`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `scopeType`: `string` ; `participationExpiresAt`: `null` \| `number` }, `Promise`\<`any`>> ; `accept`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> ; `finalize`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> ; `revoke`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> ; `perform`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `input`: `any` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> ; `complete`: [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> ; `inspect`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `invitationId`: `string` }, `Promise`\<\{ `invitationId`: `any` = row.\_id; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `participation`: `any` = row\.participation; `workflow`: `any` = row\.workflow; `scope`: \{ `type`: `any` = row\.scopeType; `key`: `any` = row\.scopeKey } ; `recipientEmail`: `any` = row\.recipientEmail; `expiresAt`: `any` = row\.expiresAt; `participationExpiresAt`: `any` = row\.participationExpiresAt; `completionReceipt`: `any` = row\.completionReceipt; `operation`: [`Value`](https://docs.bijection.com/api/modules/values#value) }>> ; `pending`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `null` \| `string` ; `limit`: `number` ; `state`: `"accepted"` \| `"claimed"` }, `Promise`\<\{ `page`: \{ `invitationId`: `any` = row.\_id; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `participation`: `any` = row\.participation }\[] ; `isDone`: `boolean` ; `continueCursor`: `string` ; `splitCursor?`: `null` \| `string` ; `pageStatus?`: `null` \| `"SplitRecommended"` \| `"SplitRequired"` }>> ; `recover`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `terms`: `any` ; `invitationId`: `string` }, `Promise`\<\{ `kind`: `string` = "recovered"; `result`: [`Value`](https://docs.bijection.com/api/modules/values#value) = prior.result } \| \{ `result?`: `undefined` ; `kind`: `string` = "notFound" }>> } | | `endpoints.issue` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `expiresAt`: `number` ; `scopeKey`: `string` ; `workflow`: `string` ; `recipientIssuer`: `string` ; `recipientEmail`: `string` ; `scopeType`: `string` ; `participationExpiresAt`: `null` \| `number` }, `Promise`\<`any`>> | | `endpoints.accept` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> | | `endpoints.finalize` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> | | `endpoints.revoke` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> | | `endpoints.perform` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `input`: `any` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> | | `endpoints.complete` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `requestId`: `string` ; `invitationId`: `string` ; `expectedRevision`: `bigint` }, `Promise`\<`any`>> | | `endpoints.inspect` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `invitationId`: `string` }, `Promise`\<\{ `invitationId`: `any` = row.\_id; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `participation`: `any` = row\.participation; `workflow`: `any` = row\.workflow; `scope`: \{ `type`: `any` = row\.scopeType; `key`: `any` = row\.scopeKey } ; `recipientEmail`: `any` = row\.recipientEmail; `expiresAt`: `any` = row\.expiresAt; `participationExpiresAt`: `any` = row\.participationExpiresAt; `completionReceipt`: `any` = row\.completionReceipt; `operation`: [`Value`](https://docs.bijection.com/api/modules/values#value) }>> | | `endpoints.pending` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `null` \| `string` ; `limit`: `number` ; `state`: `"accepted"` \| `"claimed"` }, `Promise`\<\{ `page`: \{ `invitationId`: `any` = row.\_id; `revision`: `any` = row\.revision; `state`: `any` = row\.state; `participation`: `any` = row\.participation }\[] ; `isDone`: `boolean` ; `continueCursor`: `string` ; `splitCursor?`: `null` \| `string` ; `pageStatus?`: `null` \| `"SplitRecommended"` \| `"SplitRequired"` }>> | | `endpoints.recover` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `requestId`: `string` ; `terms`: `any` ; `invitationId`: `string` }, `Promise`\<\{ `kind`: `string` = "recovered"; `result`: [`Value`](https://docs.bijection.com/api/modules/values#value) = prior.result } \| \{ `result?`: `undefined` ; `kind`: `string` = "notFound" }>> | *** ### operatorIdentity ▸ **operatorIdentity**(): [`AuthProvider`](https://docs.bijection.com/api/modules/server#authprovider) Explicitly trust this installation's member identities in auth.config.ts. The deployment owner supplies the issuer and immutable deployment audience. Authentication grants no operation, read, or approval permission. #### Returns [`AuthProvider`](https://docs.bijection.com/api/modules/server#authprovider) *** ### organizationAdmission ▸ **organizationAdmission**\<`Permission`>(`input`): `Readonly`\<\{ `requirements`: `Readonly`\<`Record`\<`string`, \{ `on`: \[`Permission`, ...Permission\[]] ; `onOrigins`: readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] ; `when`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) ; `decision?`: \{ `actors`: readonly (`"service"` | `"person"`)\[] ; `authentication`: `Readonly`\<\{ `maxAgeMs`: `number` ; `acrValues`: readonly `string`\[] ; `requiredMethods`: readonly `string`\[] }> ; `unless`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) } }>> ; `describe`: () => \{ `permissions`: `Permission`\[] ; `origins`: [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] ; `profiles`: \{ `name`: `string` ; `authentication`: `null` | `Readonly`\<\{ `maxAgeMs`: `number` ; `acrValues`: readonly `string`\[] ; `requiredMethods`: readonly `string`\[] }> }\[] } }> Organization admission narrows tenant pass; it never creates membership. Choose the covered origins explicitly. Delegated claims cannot satisfy a direct authentication requirement; mediated admission needs its own reviewed native approval requirement. #### Type parameters | Name | Type | | :- | :- | | `Permission` | extends `string` | #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.on` | readonly \[`Permission`, ...Permission\[]] | | `input.onOrigins` | readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] | | `input.profiles` | `Readonly`\<`Record`\<`string`, \{ `selected`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) ; `when`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) ; `authentication?`: [`PermissionAuthentication`](https://docs.bijection.com/api/modules/access#permissionauthentication) }>> | #### Returns `Readonly`\<\{ `requirements`: `Readonly`\<`Record`\<`string`, \{ `on`: \[`Permission`, ...Permission\[]] ; `onOrigins`: readonly [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] ; `when`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) ; `decision?`: \{ `actors`: readonly (`"service"` | `"person"`)\[] ; `authentication`: `Readonly`\<\{ `maxAgeMs`: `number` ; `acrValues`: readonly `string`\[] ; `requiredMethods`: readonly `string`\[] }> ; `unless`: [`AccessCondition`](https://docs.bijection.com/api/modules/access#accesscondition) } }>> ; `describe`: () => \{ `permissions`: `Permission`\[] ; `origins`: [`AuthorityOrigin`](https://docs.bijection.com/api/modules/access#authorityorigin)\[] ; `profiles`: \{ `name`: `string` ; `authentication`: `null` | `Readonly`\<\{ `maxAgeMs`: `number` ; `acrValues`: readonly `string`\[] ; `requiredMethods`: readonly `string`\[] }> }\[] } }> *** ### organizationShares ▸ **organizationShares**(`access`): `Object` Organization shares are standing, source-reviewed positive projections. Source approval requires current `:share` on the exact source. Executing the review records recipient acceptance with `:acceptShare`. Reads require current recipient `:pass`; either side can revoke with `:revokeShare`. Source tenant membership is never conferred. #### Parameters | Name | Type | | :- | :- | | `access` | `object` | #### Returns `Object` | Name | Type | | :- | :- | | `define` | (`options`: `Omit`\<`Parameters`\\[`0`], `"sharing"` \| `"is_standing"` \| `"component"` \| `"input"`> & \{ `source`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) ; `recipient`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref) ; `recipientField`: `string` }) => [`DataReleaseDefinition`](https://docs.bijection.com/api/modules/apps#datareleasedefinition) | *** ### readPolicy ▸ **readPolicy**\<`DataModel`>(`decide`, `options?`): [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requests`: \{ properties: string\[] | null; target: \{ kind: "object"; id: string; } | \{ covers?: true; interval?: \{ field: string | null; index: string; lower: \{ value?: Value; inclusive: boolean; } | null; upper: \{ ...; } | null; }; kind: "query"; equalities: \{ ...; }\[]; }; table: string; }\[] }, `Promise`\<[`ReadAccessResults`](https://docs.bijection.com/api/modules/server#readaccessresults)>> A read rule that decides each request of the native batch on its own. `decide` sees one request; the batch and its result list stay native. #### Type parameters | Name | Type | | :- | :- | | `DataModel` | extends [`GenericDataModel`](https://docs.bijection.com/api/modules/server#genericdatamodel) = [`GenericDataModel`](https://docs.bijection.com/api/modules/server#genericdatamodel) | #### Parameters | Name | Type | | :- | :- | | `decide` | (`ctx`: [`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`DataModel`>, `request`: [`ReadAccessRequest`](https://docs.bijection.com/api/modules/access#readaccessrequest)) => [`Decision`](https://docs.bijection.com/api/modules/access#decision)\<[`ReadAccessResult`](https://docs.bijection.com/api/modules/server#readaccessresult)> | | `options?` | `Object` | | `options.reads?` | readonly `Extract`\\[] | | `options.calls?` | readonly [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"public"` \| `"internal"`, `any`, `any`>\[] | #### Returns [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requests`: \{ properties: string\[] | null; target: \{ kind: "object"; id: string; } | \{ covers?: true; interval?: \{ field: string | null; index: string; lower: \{ value?: Value; inclusive: boolean; } | null; upper: \{ ...; } | null; }; kind: "query"; equalities: \{ ...; }\[]; }; table: string; }\[] }, `Promise`\<[`ReadAccessResults`](https://docs.bijection.com/api/modules/server#readaccessresults)>> *** ### mandatePolicy ▸ **mandatePolicy**\<`Target`, `Args`, `DataModel`>(`command`, `decide`): [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \[\{ `phase`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"review_mandate"` | `"issue_mandate"` | `"revoke_mandate"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"review_mandate"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"issue_mandate"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"revoke_mandate"`, `"required"`>], `"required"`, `never`> ; `actor`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `initiator`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requester`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `continuation`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"organization"` ; `service`: `string` ; `credential`: `string` ; `expiresAt`: `number` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"organization"`, `"required"`> ; `service`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `credential`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"kind"` | `"service"` | `"credential"` | `"expiresAt"`> ; `delivery`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `condition`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `target`: `Target` = command.target; `args`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<[`Expand`](https://docs.bijection.com/api/modules/server#expand)\<\{ \[Property in string | number | symbol]?: Exclude\, undefined> } & \{ \[Property in string | number | symbol]: Infer\ }>, `Args`, `"required"`, \{ \[Property in string | number | symbol]: Property | \`$\{Property & string}.$\{Args\[Property]\["fieldPaths"]}\` }\[keyof `Args`] & `string`> ; `approval`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `terms`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"optional"`, `string`> }] extends \[[`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators)] ? \[\{}] : [`OneArgArray`](https://docs.bijection.com/api/modules/server#oneargarray)\<[`DefaultFunctionArgs`](https://docs.bijection.com/api/modules/server#defaultfunctionargs)>\[`0`], `Promise`\<(`null` | \{ `validUntil`: `number` } | \{ `recheckAt`: `number` })\[]>> Consent to issue, review or withdraw one organizational commitment. Every ordinary command decision and source disclosure remains required. The native owner supplies the actor and exact retained effect. #### Type parameters | Name | Type | | :- | :- | | `Target` | extends [`Validator`](https://docs.bijection.com/api/modules/values#validator)\<`any`, `"required"`, `any`> | | `Args` | extends [`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators) | | `DataModel` | extends [`GenericDataModel`](https://docs.bijection.com/api/modules/server#genericdatamodel) = [`GenericDataModel`](https://docs.bijection.com/api/modules/server#genericdatamodel) | #### Parameters | Name | Type | | :- | :- | | `command` | `Object` | | `command.target` | `Target` | | `command.args` | `Args` | | `decide` | (`ctx`: [`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`DataModel`>, `input`: `Omit`\<[`CommandMandateInput`](https://docs.bijection.com/api/modules/connectors#commandmandateinput), `"target"` \| `"args"`> & \{ `target`: `Target`\[`"type"`] ; `args`: [`ObjectType`](https://docs.bijection.com/api/modules/values#objecttype)\<`Args`> }) => [`Decision`](https://docs.bijection.com/api/modules/access#decision)\<[`CommandDecision`](https://docs.bijection.com/api/modules/access#commanddecision)> | #### Returns [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \[\{ `phase`: [`VUnion`](https://docs.bijection.com/api/classes/values.VUnion)\<`"review_mandate"` | `"issue_mandate"` | `"revoke_mandate"`, \[[`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"review_mandate"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"issue_mandate"`, `"required"`>, [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"revoke_mandate"`, `"required"`>], `"required"`, `never`> ; `actor`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `initiator`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `requester`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `continuation`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<\{ `kind`: `"organization"` ; `service`: `string` ; `credential`: `string` ; `expiresAt`: `number` }, \{ `kind`: [`VLiteral`](https://docs.bijection.com/api/classes/values.VLiteral)\<`"organization"`, `"required"`> ; `service`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `credential`: [`VString`](https://docs.bijection.com/api/classes/values.VString)\<`string`, `"required"`> ; `expiresAt`: [`VFloat64`](https://docs.bijection.com/api/classes/values.VFloat64)\<`number`, `"required"`> }, `"required"`, `"kind"` | `"service"` | `"credential"` | `"expiresAt"`> ; `delivery`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `condition`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `target`: `Target` = command.target; `args`: [`VObject`](https://docs.bijection.com/api/classes/values.VObject)\<[`Expand`](https://docs.bijection.com/api/modules/server#expand)\<\{ \[Property in string | number | symbol]?: Exclude\, undefined> } & \{ \[Property in string | number | symbol]: Infer\ }>, `Args`, `"required"`, \{ \[Property in string | number | symbol]: Property | \`$\{Property & string}.$\{Args\[Property]\["fieldPaths"]}\` }\[keyof `Args`] & `string`> ; `approval`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"required"`, `string`> ; `terms`: [`VAny`](https://docs.bijection.com/api/classes/values.VAny)\<`any`, `"optional"`, `string`> }] extends \[[`PropertyValidators`](https://docs.bijection.com/api/modules/values#propertyvalidators)] ? \[\{}] : [`OneArgArray`](https://docs.bijection.com/api/modules/server#oneargarray)\<[`DefaultFunctionArgs`](https://docs.bijection.com/api/modules/server#defaultfunctionargs)>\[`0`], `Promise`\<(`null` | \{ `validUntil`: `number` } | \{ `recheckAt`: `number` })\[]>> *** ### requireDirectPerson ▸ **requireDirectPerson**(): `Promise`\<`void`> Require a directly signed-in person using host-owned authentication. Native conversation grants are deliberately absent from public identity facts, so inspecting those facts cannot authorize consent or another personal decision. Backend only; this check makes no permission grant. #### Returns `Promise`\<`void`> *** ### isPerson ▸ **isPerson**(`identity`): `boolean` Whether `identity` is a person signed in directly: the only caller whose approval, review, grant or share may be recorded as a person's decision. #### Parameters | Name | Type | | :- | :- | | `identity` | \{ `issuer`: `string` ; `subject?`: `string` ; `delegationId?`: `unknown` } \| `null` \| `undefined` | #### Returns `boolean` *** ### decideEach ▸ **decideEach**\<`R`>(`requests`, `decide`): `Promise`\<[`ReadAccessResults`](https://docs.bijection.com/api/modules/server#readaccessresults)> Decide each request of a batch on its own, in order. A return inside `decide` settles only its own request; a throw refuses the batch. #### Type parameters | Name | | :- | | `R` | #### Parameters | Name | Type | | :- | :- | | `requests` | readonly `R`\[] | | `decide` | (`request`: `R`) => [`ReadAccessResult`](https://docs.bijection.com/api/modules/server#readaccessresult) \| `Promise`\<[`ReadAccessResult`](https://docs.bijection.com/api/modules/server#readaccessresult)> | #### Returns `Promise`\<[`ReadAccessResults`](https://docs.bijection.com/api/modules/server#readaccessresults)> *** ### resourceAudit ▸ **resourceAudit**(`access`): `Object` Resource audit uses the original sealed deployment journal. Recording requires `:pass`; every query page requires current `:audit`. One audited invocation belongs to one resource scope. This API runs in application queries/mutations, against the current deployment journal. #### Parameters | Name | Type | | :- | :- | | `access` | `object` | #### Returns `Object` | Name | Type | | :- | :- | | `record` | (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `body`: [`AuditLogBody`](https://docs.bijection.com/api/modules/access#auditlogbody)) => `Promise`\<`void`> | | `page` | (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `options`: \{ `limit`: `number` ; `cursor?`: `string` \| `null` ; `from?`: `number` ; `to?`: `number` }) => `Promise`\<[`ResourceAuditPage`](https://docs.bijection.com/api/modules/access#resourceauditpage)> | | `follow` | (`_ctx`: [`AccessCtx`](https://docs.bijection.com/api/modules/access#accessctx), `resource`: [`AccessResourceRef`](https://docs.bijection.com/api/modules/access#accessresourceref), `options`: \{ `limit`: `number` ; `cursor?`: `string` \| `null` ; `from?`: `number` }) => `Promise`\<[`ResourceAuditPage`](https://docs.bijection.com/api/modules/access#resourceauditpage)> | *** ### resourceAuthority ▸ **resourceAuthority**(`options`): [`ResourceAuthority`](https://docs.bijection.com/api/modules/access#resourceauthority)\<`"readWrite"`> Declare one complete programmable resource authority for a table inside an installed component. Application tables use the native access model (`defineAccess` with `.access(access.resources., ...)`); activation refuses a programmable policy at the application root. Use a read-only handle for component source tables and views, and a handle with `write` for component-owned local tables. All checks retain the runtime's ordinary dependency, current-policy, original/final write, delegation and per-release enforcement. #### Parameters | Name | Type | | :- | :- | | `options` | [`ResourceAuthorityOptions`](https://docs.bijection.com/api/modules/access#resourceauthorityoptions) & \{ `write`: `NonNullable`\<[`ResourceAuthorityOptions`](https://docs.bijection.com/api/modules/access#resourceauthorityoptions)\[`"write"`]> } | #### Returns [`ResourceAuthority`](https://docs.bijection.com/api/modules/access#resourceauthority)\<`"readWrite"`> ▸ **resourceAuthority**(`options`): [`ResourceAuthority`](https://docs.bijection.com/api/modules/access#resourceauthority)\<`"read"`> #### Parameters | Name | Type | | :- | :- | | `options` | [`ResourceAuthorityOptions`](https://docs.bijection.com/api/modules/access#resourceauthorityoptions) & \{ `write?`: `never` ; `writeBasis?`: `never` ; `writeReads?`: `never` } | #### Returns [`ResourceAuthority`](https://docs.bijection.com/api/modules/access#resourceauthority)\<`"read"`> *** ### riskBindingDigest ▸ **riskBindingDigest**(`binding`): `string` Exact request identity shared by the immutable operation owner and its authenticated external assessment. Changing any context changes the digest. #### Parameters | Name | Type | | :- | :- | | `binding` | [`RiskBinding`](https://docs.bijection.com/api/modules/access#riskbinding-2) | #### Returns `string` *** ### defineRiskCheck ▸ **defineRiskCheck**(`input`): `Readonly`\<\{ `evidence`: `Readonly`\<\{}> ; `check`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `request`: `string` }, `Promise`\<\{ `kind`: `"matched"` ; `values`: `Record`\<`string`, `string`> } | \{ `kind`: `"unmatched"` }>> ; `inspect`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `request`: `string` }, `Promise`\<\{ `kind`: `"unavailable"` | `"challenge"` | `"allow"` | `"deny"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `null` | `string` ; `reason`: `string` ; `validUntil`: `null` | `number` ; `binding`: `null` | `string` ; `handling`: `"refuse"` | `"challenge"` }>> ; `requirement`: (`permission`: `string`, `bindingField`: `string`) => [`PermissionRequirement`](https://docs.bijection.com/api/modules/access#permissionrequirement) ; `verification`: (`check`: [`CheckContractReference`](https://docs.bijection.com/api/modules/tools#checkcontractreference)\<\{ `request`: `string` }, [`ContextCheckResult`](https://docs.bijection.com/api/modules/sessions#contextcheckresult)>, `request?`: `string`) => [`KnowledgeDeclaration`](https://docs.bijection.com/api/modules/sessions#knowledgedeclaration) }> External risk narrows existing authority through native expiring evidence. The two queries are fixed by installed code. Their owner authenticates the provider and captures the original request; evaluation performs no HTTP. Export `check`, analyze it, then pass its generated check contract to `verification`. The ordinary interaction owns attempts, facts and expiry. #### Parameters | Name | Type | Description | | :- | :- | :- | | `input` | `Object` | - | | `input.on` | `string` | - | | `input.predicate` | `string` | - | | `input.scope` | `"principal"` \| `"participant"` | - | | `input.policyVersion` | `string` | - | | `input.binding` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `request`: `string` }, [`RiskBinding`](https://docs.bijection.com/api/modules/access#riskbinding-2) \| `null`> | - | | `input.observation` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `binding`: `string` ; `policyVersion`: `string` }, [`RiskObservation`](https://docs.bijection.com/api/modules/access#riskobservation-2) \| `null`> | - | | `input.reads` | readonly `string`\[] | - | | `input.maximumObservationAgeMs` | `number` | - | | `input.validForMs` | `number` | - | | `input.unavailable` | `"refuse"` \| `"challenge"` | Both choices withhold evidence. The owner may present a challenge or refuse and retry acquisition later; neither silently permits an effect. | #### Returns `Readonly`\<\{ `evidence`: `Readonly`\<\{}> ; `check`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `request`: `string` }, `Promise`\<\{ `kind`: `"matched"` ; `values`: `Record`\<`string`, `string`> } | \{ `kind`: `"unmatched"` }>> ; `inspect`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `request`: `string` }, `Promise`\<\{ `kind`: `"unavailable"` | `"challenge"` | `"allow"` | `"deny"` ; `source`: `null` | \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; }; protocol: string; } ; `revision`: `null` | `string` ; `reason`: `string` ; `validUntil`: `null` | `number` ; `binding`: `null` | `string` ; `handling`: `"refuse"` | `"challenge"` }>> ; `requirement`: (`permission`: `string`, `bindingField`: `string`) => [`PermissionRequirement`](https://docs.bijection.com/api/modules/access#permissionrequirement) ; `verification`: (`check`: [`CheckContractReference`](https://docs.bijection.com/api/modules/tools#checkcontractreference)\<\{ `request`: `string` }, [`ContextCheckResult`](https://docs.bijection.com/api/modules/sessions#contextcheckresult)>, `request?`: `string`) => [`KnowledgeDeclaration`](https://docs.bijection.com/api/modules/sessions#knowledgedeclaration) }> *** ### defineSecurityModule ▸ **defineSecurityModule**(`input`): `Object` Security management composes existing owners and their original receipts. Install these endpoints in the application's security module. Provider inventories are fixed internal queries; factor secrets stay with providers. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.authorize` | (`ctx`: [`BijectionQueryCtx`](https://docs.bijection.com/api/interfaces/server.BijectionQueryCtx)\<`any`, `any`>) => `Promise`\<`unknown`> | | `input.sections` | `Readonly`\<`Record`\<`string`, [`SecuritySection`](https://docs.bijection.com/api/modules/access#securitysection) \| `null`>> | #### Returns `Object` | Name | Type | | :- | :- | | `overview` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{}, `Promise`\<`any`>> | | `page` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `cursor`: `undefined` \| `string` ; `limit`: `number` ; `section`: `string` }, `Promise`\<\{ `kind`: `"unsupported"` } \| \{ `kind`: `"unavailable"` } \| \{ `kind`: `"observed"` ; `observedAtMs`: `number` = population.observedAtMs; `validUntilMs`: `null` \| `number` = population.validUntilMs; `coverage`: `"partial"` \| `"complete"` = population.coverage; `items`: (\{ `kind`: `"unavailable"` ; `subject`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } } \| \{ `kind`: `"observed"` ; `observation`: `Readonly`\<\{ `subject`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAtMs`: `number` ; `facts`: `unknown` ; `waits`: `Readonly`\<\{ `items`: \{ `key`: `string` ; `code`: `string` ; `message`: `string` ; `targets`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }\[] ; `nextCheckAtMs`: `null` \| `number` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `links`: `Readonly`\<\{ `items`: \{ `target`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `evidence`: \{ subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; revision: string; }\[] ; `relation`: `"uses"` \| `"causedBy"` \| `"produced"` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `evidence`: `Readonly`\<\{ `items`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `controls`: \{ `key`: `string` ; `target`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `label`: `string` ; `expectedRevision`: `string` }\[] }> })\[] ; `cursor`: `null` \| `string` = population.cursor }>> | | `control` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `key`: `string` ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `expectedRevision`: `string` }, `Promise`\<\{ `intent`: \{ key: string; requestId: RequestId; subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; expectedRevision: string; } ; `recordedAtMs`: `number` ; `recoverUntilMs`: `number` }>> | | `recover` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `expectedRevision`: `string` }, `Promise`\<`null` \| \{ `intent`: \{ key: string; requestId: RequestId; subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; expectedRevision: string; } ; `recordedAtMs`: `number` ; `recoverUntilMs`: `number` }>> | | `inspectionOwners` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{}, `Promise`\<\{ `location`: `Readonly`\<[`ResourceLocation`](https://docs.bijection.com/api/modules/browser#resourcelocation)> ; `installation`: `string` ; `protocol`: `string` }\[]>> | | `inspectSubject` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `context`: `undefined` \| \{ definition\_digest: string; } ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } }, `Promise`\<\{ `kind`: `"unavailable"` ; `subject`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `context`: \{ `definition_digest`: `string` } = basis } \| \{ `kind`: `"observed"` ; `observation`: `Readonly`\<\{ `subject`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAtMs`: `number` ; `facts`: `unknown` ; `waits`: `Readonly`\<\{ `items`: \{ `key`: `string` ; `code`: `string` ; `message`: `string` ; `targets`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }\[] ; `nextCheckAtMs`: `null` \| `number` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `links`: `Readonly`\<\{ `items`: \{ `target`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `evidence`: \{ subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; revision: string; }\[] ; `relation`: `"uses"` \| `"causedBy"` \| `"produced"` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `evidence`: `Readonly`\<\{ `items`: \{ `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `revision`: `string` }\[] ; `coverage`: `"partial"` \| `"complete"` }> ; `controls`: \{ `key`: `string` ; `target`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `label`: `string` ; `expectedRevision`: `string` }\[] }> ; `context`: \{ `definition_digest`: `string` } = basis }>> | | `explainSubject` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `context`: `undefined` \| \{ definition\_digest: string; } ; `maxDepth`: `undefined` \| `number` ; `maxNodes`: `undefined` \| `number` ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } }, `Promise`\<\{ `root`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `scope`: `Readonly`\<\{ `maxDepth`: `number` ; `maxNodes`: `number` ; `direction`: `"outgoing"` ; `relationships`: (`"uses"` \| `"causedBy"` \| `"produced"` \| `"waitingFor"`)\[] }> ; `nodes`: [`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`unknown`>\[] ; `edges`: `Readonly`\<\{ `from`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `to`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `relation`: `"uses"` \| `"causedBy"` \| `"produced"` \| `"waitingFor"` ; `waitKey`: `null` \| `string` }>\[] ; `frontier`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` }\[] ; `coverage`: `Readonly`\<\{ `traversal`: `"bounded"` \| `"complete"` ; `observations`: `"partial"` \| `"complete"` ; `history`: `"notRequested"` }> ; `context`: \{ `definition_digest`: `string` } = basis }>> | | `controlSubject` | [`RegisteredMutation`](https://docs.bijection.com/api/modules/server#registeredmutation)\<`"public"`, \{ `key`: `string` ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `expectedRevision`: `string` }, `Promise`\<\{ `intent`: \{ key: string; requestId: RequestId; subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; expectedRevision: string; } ; `recordedAtMs`: `number` ; `recoverUntilMs`: `number` }>> | | `recoverSubjectControl` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"public"`, \{ `key`: `string` ; `requestId`: [`RequestId`](https://docs.bijection.com/api/modules/values#requestid) ; `subject`: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `expectedRevision`: `string` }, `Promise`\<`null` \| \{ `intent`: \{ key: string; requestId: RequestId; subject: \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; }; expectedRevision: string; } ; `recordedAtMs`: `number` ; `recoverUntilMs`: `number` }>> | *** ### defineNativeSessionSecurity ▸ **defineNativeSessionSecurity**(`input`): `Object` Ready-to-install native session section. Export functions in `module`, then pass section to defineSecurityModule. Provider sessions remain a separate inventory and revocation owner. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | #### Returns `Object` | Name | Type | | :- | :- | | `section` | \{ `owner`: `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`any`>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) \| `null`> }> ; `population`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `principal`: `string` ; `limit`: `number` ; `cursor`: `null` \| `string` }, \{ `kind`: `"unsupported"` } \| \{ `kind`: `"unavailable"` } \| \{ `kind`: `"observed"` ; `cursor`: `null` \| `string` ; `coverage`: `"partial"` \| `"complete"` ; `ids`: `string`\[] ; `observedAtMs`: `number` ; `validUntilMs`: `null` \| `number` }> } | | `section.owner` | `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`any`>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) \| `null`> }> | | `section.population` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `principal`: `string` ; `limit`: `number` ; `cursor`: `null` \| `string` }, \{ `kind`: `"unsupported"` } \| \{ `kind`: `"unavailable"` } \| \{ `kind`: `"observed"` ; `cursor`: `null` \| `string` ; `coverage`: `"partial"` \| `"complete"` ; `ids`: `string`\[] ; `observedAtMs`: `number` ; `validUntilMs`: `null` \| `number` }> | | `functions` | \{ `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `sessionId`: `string` }, `Promise`\<`null` \| \{ `expiresAt`: `number` ; `active`: `boolean` ; `issuer`: `string` ; `sessionId`: `string` ; `client`: `string` ; `endedAt`: `null` \| `number` }>> ; `population`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `cursor`: `null` \| `string` ; `principal`: `string` ; `limit`: `number` }, `Promise`\<\{ `kind`: `"observed"` ; `observedAtMs`: `number` ; `validUntilMs`: `null` \| `number` ; `coverage`: `"complete"` ; `ids`: `string`\[] ; `cursor`: `null` \| `string` }>> ; `receipt`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requestId`: `string` }, `Promise`\<`any`>> } | | `functions.status` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `sessionId`: `string` }, `Promise`\<`null` \| \{ `expiresAt`: `number` ; `active`: `boolean` ; `issuer`: `string` ; `sessionId`: `string` ; `client`: `string` ; `endedAt`: `null` \| `number` }>> | | `functions.population` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `cursor`: `null` \| `string` ; `principal`: `string` ; `limit`: `number` }, `Promise`\<\{ `kind`: `"observed"` ; `observedAtMs`: `number` ; `validUntilMs`: `null` \| `number` ; `coverage`: `"complete"` ; `ids`: `string`\[] ; `cursor`: `null` \| `string` }>> | | `functions.receipt` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `requestId`: `string` }, `Promise`\<`any`>> | *** ### serviceIssuer ▸ **serviceIssuer**(`service`): `string` The issuer of `service`'s tokens. #### Parameters | Name | Type | | :- | :- | | `service` | `string` | #### Returns `string` *** ### serviceTokenIdentifier ▸ **serviceTokenIdentifier**(`service`): `string` The token identifier of `service` itself: the subject its grants name. #### Parameters | Name | Type | | :- | :- | | `service` | `string` | #### Returns `string` *** ### defineInspectionOwner ▸ **defineInspectionOwner**\<`Facts`>(`owner`): [`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner)\<`Facts`> Configuration is authored code; subjects can only select an admitted anchor. #### Type parameters | Name | | :- | | `Facts` | #### Parameters | Name | Type | | :- | :- | | `owner` | [`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner)\<`Facts`> | #### Returns [`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner)\<`Facts`> *** ### ownerObservation ▸ **ownerObservation**\<`Facts`>(`subject`, `input`): [`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`Facts`> Construct an observation, without storing or inferring another lifecycle. #### Type parameters | Name | | :- | | `Facts` | #### Parameters | Name | Type | | :- | :- | | `subject` | [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref) | | `input` | `Object` | | `input.revision` | `string` | | `input.facts` | `Facts` | | `input.waits?` | readonly [`InspectionWait`](https://docs.bijection.com/api/modules/apps#inspectionwait)\[] | | `input.links?` | readonly [`InspectionLink`](https://docs.bijection.com/api/modules/apps#inspectionlink-2)\[] | | `input.evidence?` | readonly [`InspectionEvidence`](https://docs.bijection.com/api/modules/apps#inspectionevidence)\[] | | `input.controls?` | readonly [`InspectionControl`](https://docs.bijection.com/api/modules/apps#inspectioncontrol)\[] | | `input.coverage?` | `"complete"` \| `"partial"` | #### Returns [`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<`Facts`> *** ### inspectionSubject ▸ **inspectionSubject**(`owner`, `id`): `Promise`\<[`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)> #### Parameters | Name | Type | | :- | :- | | `owner` | `Pick`\<[`InspectionOwner`](https://docs.bijection.com/api/modules/access#inspectionowner), `"protocol"` \| `"anchor"`> | | `id` | `string` | #### Returns `Promise`\<[`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)> *** ### defineWorkosEnterpriseHealthReader ▸ **defineWorkosEnterpriseHealthReader**(`input`): [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `selection`: \{ `connection`: `string` ; `directory`: `null` | `string` } ; `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } ; `source`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `evidence`: \{ `dataset`: `undefined` | \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; } ; `recordObservedFrom`: `undefined` | `number` ; `recordObservedTo`: `undefined` | `number` ; `capabilities`: `null` | \{ evidence: "native" | "asserted" | "brokered"; consistency: "snapshot" | "observations"; coverage: "records" | "enumeration" | "snapshot" | "queryResult" | "incrementalSnapshot" | "committedPrefix" | "latestPerKey"; ... 6 more ...; snapshotMaxRows: string | null; } ; `population`: `null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `erased`: `boolean` ; `publication`: `null` | \{ sourceId: SourceId; scope: string; publicationId: SourcePublicationId; checkpoint: \{ position: \{ value: string; space: string; } | null; captureId: string; } | null; epoch: SourceEpoch; } ; `populationCovered`: `boolean` ; `populationObservedFrom`: `null` | `number` ; `observedFrom`: `null` | `number` ; `observedTo`: `null` | `number` ; `continuityLost`: `boolean` ; `historyInterrupted`: `boolean` } ; `record`: \{ `id`: `string` ; `organization`: `string` ; `directory`: `null` | `string` ; `connectionState`: `string` ; `ssoEnforced`: `null` ; `connectionType`: `string` ; `directoryState`: `null` | `string` ; `certificateState`: `"unavailable"` | `"observed"` | `"notApplicable"` ; `certificates`: \{ id: string; notBefore: number | null; notAfter: number | null; }\[] } } | \{ `selection`: \{ `connection`: `string` ; `directory`: `null` | `string` } ; `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } ; `source`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `record`: `null` = null; `evidence`: `null` = null }>> Install the concrete source reader beside the health proof module. The table, owner index, reviewed configuration and inspection anchor are fixed by code. It always reads the exact row's evidence, never population freshness. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.table` | `string` | | `input.index?` | `string` | | `input.ownerField?` | `string` | | `input.configuration` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `owner`: `string` }, `Pick`\<`Observation`, `"configuration"` \| `"selection"`>> | | `input.anchor` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `owner`: `string` }, `Observation`> | #### Returns [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `selection`: \{ `connection`: `string` ; `directory`: `null` | `string` } ; `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } ; `source`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `evidence`: \{ `dataset`: `undefined` | \{ component: string | null; dataset: string | null; version: string | null; revision: string | null; publicationId: SourcePublicationId | null; coherent: boolean; completeVersion: boolean; } ; `recordObservedFrom`: `undefined` | `number` ; `recordObservedTo`: `undefined` | `number` ; `capabilities`: `null` | \{ evidence: "native" | "asserted" | "brokered"; consistency: "snapshot" | "observations"; coverage: "records" | "enumeration" | "snapshot" | "queryResult" | "incrementalSnapshot" | "committedPrefix" | "latestPerKey"; ... 6 more ...; snapshotMaxRows: string | null; } ; `population`: `null` | `"records"` | `"enumeration"` | `"snapshot"` | `"queryResult"` | `"incrementalSnapshot"` | `"committedPrefix"` | `"latestPerKey"` ; `erased`: `boolean` ; `publication`: `null` | \{ sourceId: SourceId; scope: string; publicationId: SourcePublicationId; checkpoint: \{ position: \{ value: string; space: string; } | null; captureId: string; } | null; epoch: SourceEpoch; } ; `populationCovered`: `boolean` ; `populationObservedFrom`: `null` | `number` ; `observedFrom`: `null` | `number` ; `observedTo`: `null` | `number` ; `continuityLost`: `boolean` ; `historyInterrupted`: `boolean` } ; `record`: \{ `id`: `string` ; `organization`: `string` ; `directory`: `null` | `string` ; `connectionState`: `string` ; `ssoEnforced`: `null` ; `connectionType`: `string` ; `directoryState`: `null` | `string` ; `certificateState`: `"unavailable"` | `"observed"` | `"notApplicable"` ; `certificates`: \{ id: string; notBefore: number | null; notAfter: number | null; }\[] } } | \{ `selection`: \{ `connection`: `string` ; `directory`: `null` | `string` } ; `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } ; `source`: \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } | null; deployment\_id: string; } ; `protocol`: `string` } ; `record`: `null` = null; `evidence`: `null` = null }>> *** ### defineWorkosEnterpriseHealth ▸ **defineWorkosEnterpriseHealth**(`input`): `Object` Concrete WorkOS interpretation over native acquired observations. Export the returned internal functions under module. Missing provider APIs and gaps never become positive readiness evidence. This factory performs no network I/O. #### Parameters | Name | Type | | :- | :- | | `input` | `Object` | | `input.module` | `string` | | `input.read` | [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `"internal"`, \{ `owner`: `string` }, `Observation`> | | `input.maximumAgeMs` | `number` | #### Returns `Object` | Name | Type | | :- | :- | | `inspectionOwner` | `Readonly`\<\{ `protocol`: `string` ; `anchor`: [`FunctionReference`](https://docs.bijection.com/api/modules/server#functionreference)\<`"query"`, `any`, `any`, `any`> ; `facts`: [`GenericValidator`](https://docs.bijection.com/api/modules/values#genericvalidator) ; `read`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `subject`: [`SubjectRef`](https://docs.bijection.com/api/modules/apps#subjectref)) => `Promise`\<[`SubjectInspection`](https://docs.bijection.com/api/modules/apps#subjectinspection)\<\{ `directoryEvidence`: `undefined` \| `null` \| \{ evidence: \{ dataset?: \{ component: string \| null; dataset: string \| null; version: string \| null; revision: string \| null; publicationId: SourcePublicationId \| null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; }; source: \{ ...; }; directory: string; } ; `record`: `null` \| \{ id: string; organization: string; directory: string \| null; connectionState: string; ssoEnforced: null; connectionType: string; directoryState: string \| null; certificateState: "unavailable" \| "observed" \| "notApplicable"; certificates: \{ ...; }\[]; } ; `evidence`: `null` \| \{ dataset?: \{ component: string \| null; dataset: string \| null; version: string \| null; revision: string \| null; publicationId: SourcePublicationId \| null; coherent: boolean; completeVersion: boolean; }; ... 11 more ...; historyInterrupted: boolean; } ; `source`: `null` \| \{ id: string; installation: string; location: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; }; protocol: string; } ; `selection`: \{ connection: string; directory: string \| null; } ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } }>> ; `control?`: (`ctx`: [`InspectionWriter`](https://docs.bijection.com/api/modules/access#inspectionwriter), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt)> ; `recoverControl?`: (`ctx`: [`InspectionReader`](https://docs.bijection.com/api/modules/access#inspectionreader), `input`: [`InspectionControlIntent`](https://docs.bijection.com/api/modules/apps#inspectioncontrolintent)) => `Promise`\<[`InspectionControlReceipt`](https://docs.bijection.com/api/modules/apps#inspectioncontrolreceipt) \| `null`> }> | | `functions` | \{ `connection`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> ; `certificate`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> ; `policy`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> ; `directory`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> ; `status`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = result.facts.configuration; `selection`: \{ `connection`: `string` ; `directory`: `null` \| `string` } = result.facts.selection; `connection`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } = result.connection; `certificate`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } = result.certificate; `policy`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } = result.policy; `directory`: \{ `state`: `null` \| `string` ; `coverage`: `string` ; `proof`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` } = result.directory } ; `source`: `null` \| \{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` \| \{ position: \{ value: string; space: string; } \| null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) } ; `repair`: `null` \| \{ `action`: `string` = "refreshSource"; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = result.facts.source } ; `validUntil`: `null` \| `number` }>> ; `connectionProof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> ; `certificateProof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> ; `policyProof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> ; `directoryProof`: [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> } | | `functions.connection` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> | | `functions.certificate` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> | | `functions.policy` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> | | `functions.directory` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } \| \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` }>> | | `functions.status` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` }, `Promise`\<\{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = result.facts.configuration; `selection`: \{ `connection`: `string` ; `directory`: `null` \| `string` } = result.facts.selection; `connection`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `kind`: `"connection"` ; `active`: `null` \| `boolean` } = result.connection; `certificate`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"certificate"` ; `expiresAt`: `null` \| `number` ; `state`: `"unavailable"` \| `"blocked"` \| `"ready"` } = result.certificate; `policy`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `revision`: `string` ; `observedAt`: `number` ; `validUntil`: `number` ; `kind`: `"policy"` ; `state`: `"unavailable"` ; `ssoEnforced`: `null` = null } = result.policy; `directory`: \{ `state`: `null` \| `string` ; `coverage`: `string` ; `proof`: \{ `configuration`: \{ `issuer`: `string` ; `clientId`: `string` ; `providerOrganization`: `string` } = facts.configuration; `kind`: `"directory"` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } ; `revision`: `string` ; `observedAt`: `number` = directoryObservedAt; `validUntil`: `number` ; `state`: `"unavailable"` \| `"ready"` ; `checkpoint`: `null` \| `string` ; `publicationRevision`: `null` \| [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `complete`: `boolean` } = result.directory } ; `source`: `null` \| \{ `sourceId`: [`SourceId`](https://docs.bijection.com/api/modules/values#sourceid) ; `scope`: `string` ; `publicationId`: [`SourcePublicationId`](https://docs.bijection.com/api/modules/values#sourcepublicationid) ; `checkpoint`: `null` \| \{ position: \{ value: string; space: string; } \| null; captureId: string; } ; `epoch`: [`SourceEpoch`](https://docs.bijection.com/api/modules/values#sourceepoch) } ; `repair`: `null` \| \{ `action`: `string` = "refreshSource"; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = result.facts.source } ; `validUntil`: `null` \| `number` }>> | | `functions.connectionProof` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> | | `functions.certificateProof` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> | | `functions.policyProof` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> | | `functions.directoryProof` | [`RegisteredQuery`](https://docs.bijection.com/api/modules/server#registeredquery)\<`"internal"`, \{ `owner`: `string` ; `configuration`: \{ issuer: string; clientId: string; providerOrganization: string; } ; `configurationDigest`: `string` }, `Promise`\<\{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `null` \| `number` ; `outcome`: `"unavailable"` \| `"blocked"` = facts.state; `reason`: `string` = "Provider state is not ready" } \| \{ `configurationDigest`: `string` = args.configurationDigest; `definitionDigest`: `string` ; `revision`: `string` ; `source`: `null` \| \{ `id`: `string` ; `installation`: `string` ; `location`: \{ incarnation: string; branch: \{ key: string; generation: string; } \| null; deployment\_id: string; } ; `protocol`: `string` } = facts.source; `validUntil`: `number` ; `outcome`: `"ready"` ; `reason`: `null` = null }>> | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.