mcp-authz 0.1.0 → 0.3.0

package/dist/openapi.js

@@ -0,0 +1,254 @@
+import { a as policyDenied, i as emitDecision, o as principalLabel, r as verifierFor, s as AccessDeniedError } from "./verifier-D6VIAYuT.js";
+import { i as reconcile } from "./policy-BBp3Jq6G.js";
+import { getOAuthProtectedResourceMetadataUrl, oauthMetadataResponse, requireBearerAuth } from "@modelcontextprotocol/server";
+//#region src/openapi.ts
+/** The methods OpenAPI defines on a path item. Anything else there is not an operation. */
+const METHODS = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace"
+];
+/**
+* What the document says this API can do, read off the document.
+*
+* The mirror of `recordCapabilities`, and it needs no running server: an
+* OpenAPI file is the catalogue, already sitting in your repository. Feed the
+* result to `toPermissionsModule` for a map priced `TODO:unassigned`, which no
+* role grants and the boot refuses until somebody decides what each operation
+* costs.
+*/
+function recordOperations(spec) {
+	const operations = [];
+	const seen = /* @__PURE__ */ new Map();
+	for (const [path, item] of Object.entries(spec.paths ?? {})) {
+		if (!item || typeof item !== "object") continue;
+		for (const method of METHODS) {
+			const operation = item[method];
+			if (!operation || typeof operation !== "object") continue;
+			const operationId = operation.operationId;
+			if (typeof operationId !== "string" || operationId.length === 0) throw new Error(`${method.toUpperCase()} ${path} has no operationId, and the permission map is keyed by it. Give the operation an operationId in the document.`);
+			const duplicate = seen.get(operationId);
+			if (duplicate) throw new Error(`operationId '${operationId}' is used by both ${duplicate} and ${method.toUpperCase()} ${path}. One id would price two routes, so the map could not say which.`);
+			seen.set(operationId, `${method.toUpperCase()} ${path}`);
+			operations.push({
+				operationId,
+				method,
+				path
+			});
+		}
+	}
+	return {
+		names: [...seen.keys()].sort(),
+		operations
+	};
+}
+/**
+* The document as this caller should see it: their operations, and nothing else.
+*
+* A path item left with no operations is dropped, so the reader is not offered
+* a route with no verbs. `components` is deliberately left whole — pruning it
+* means walking the `$ref` graph, and a schema nobody references costs a few
+* hundred tokens where a wrongly-pruned one breaks the document.
+*/
+function filterSpec(spec, principal, permissions) {
+	const paths = {};
+	for (const [path, item] of Object.entries(spec.paths ?? {})) {
+		if (!item || typeof item !== "object") continue;
+		const kept = {};
+		let any = false;
+		for (const [key, value] of Object.entries(item)) {
+			if (!METHODS.find((candidate) => candidate === key)) {
+				kept[key] = value;
+				continue;
+			}
+			const operationId = value?.operationId;
+			const permission = typeof operationId === "string" ? permissions[operationId] : void 0;
+			if (permission !== void 0 && principal.can(permission)) {
+				kept[key] = value;
+				any = true;
+			}
+		}
+		if (any) paths[path] = kept;
+	}
+	return {
+		...spec,
+		paths
+	};
+}
+/**
+* An OAuth 2.1 resource server in front of an API you already have.
+*
+* Anything the document does not describe is refused. That is the same rule as
+* the MCP side — a capability nobody priced is reachable by everyone or by
+* nobody, with no error to read — and it means routes you deliberately leave
+* out of the spec (a health check, static files) belong outside this wrapper
+* rather than behind it.
+*/
+function createOpenApiFetch(options) {
+	const { spec, permissions, resourceServerUrl, oauthMetadata, requiredScopes = ["api"], supportedScopes, policy, specPath = "/openapi.json", emitter, upstream } = options;
+	if (policy && options.authorize) throw new Error("Pass either `policy` or `authorize`, not both.");
+	if (!policy && !options.authorize) throw new Error("createOpenApiFetch needs a `policy` or an `authorize`.");
+	const record = recordOperations(spec);
+	const priced = /* @__PURE__ */ new Map();
+	for (const name of record.names) {
+		const permission = permissions[name];
+		if (permission === void 0) throw new Error(`The permission map puts no price on '${name}'. Every operation in the document needs an entry; recordOperations() and toPermissionsModule() generate the starting map.`);
+		priced.set(name, permission);
+	}
+	for (const name of Object.keys(permissions)) if (!priced.has(name)) throw new Error(`The permission map prices '${name}', which the document describes no operation for. A renamed operationId leaves an entry behind that stops gating anything.`);
+	if (policy) {
+		const { error, warning } = reconcile(policy.roles, priced);
+		if (warning) console.warn(warning);
+		if (error) throw new Error(error);
+	}
+	const routes = record.operations.map((operation) => ({
+		...operation,
+		match: matcher(operation.path)
+	})).sort((a, b) => templateCount(a.path) - templateCount(b.path) || b.path.length - a.path.length);
+	const { tokenVerifier, mapIdentity } = verifierFor({
+		oauthMetadata,
+		resourceServerUrl,
+		...options.verifier ? { verifier: options.verifier } : {},
+		...options.tokenVerifier ? { tokenVerifier: options.tokenVerifier } : {},
+		...options.identityFromAuth ? { identityFromAuth: options.identityFromAuth } : {}
+	});
+	const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceServerUrl);
+	const metadataOptions = {
+		oauthMetadata,
+		resourceServerUrl,
+		scopesSupported: [.../* @__PURE__ */ new Set([...requiredScopes, ...supportedScopes ?? []])]
+	};
+	const basePath = resourceServerUrl.pathname.replace(/\/$/, "");
+	return async function openApiFetch(request) {
+		const metadata = oauthMetadataResponse(request, metadataOptions);
+		if (metadata) return metadata;
+		const { pathname } = new URL(request.url);
+		if (!pathname.startsWith(basePath)) return new Response(`No API at ${pathname}. This server answers under ${basePath || "/"}, which is also the audience its tokens must carry.\n`, {
+			status: 404,
+			headers: { "Content-Type": "text/plain" }
+		});
+		const route = pathname.slice(basePath.length) || "/";
+		const auth = await requireBearerAuth({
+			verifier: tokenVerifier,
+			requiredScopes,
+			resourceMetadataUrl
+		})(request);
+		if (auth instanceof Response) return auth;
+		let identity;
+		let principal;
+		try {
+			identity = mapIdentity(auth);
+			principal = policy ? policy(identity) : await options.authorize(identity);
+			if (principal.permissions.length === 0) {
+				await emitDecision(options.onDecision, principal, "deny", "not_permitted", emitter);
+				throw AccessDeniedError.notPermitted(principalLabel(principal));
+			}
+		} catch (error) {
+			if (error instanceof AccessDeniedError) return policyDenied(error);
+			throw error;
+		}
+		if (route === specPath) {
+			await emitDecision(options.onDecision, principal, "allow", void 0, emitter);
+			return Response.json(filterSpec(spec, principal, permissions));
+		}
+		const method = request.method.toLowerCase();
+		const matched = routes.find((candidate) => candidate.method === method && candidate.match.test(route));
+		if (!matched) {
+			await emitDecision(options.onDecision, principal, "deny", "no_such_operation", emitter);
+			return Response.json({
+				error: "not_found",
+				error_description: `${request.method} ${route} is not in the document this server gates, so it is refused. Describe it in the OpenAPI document, or serve it outside this wrapper.`
+			}, { status: 404 });
+		}
+		const permission = priced.get(matched.operationId);
+		if (!principal.can(permission)) {
+			await emitDecision(options.onDecision, principal, "deny", "not_permitted", emitter);
+			return policyDenied(AccessDeniedError.notPermitted(principalLabel(principal), `the permission '${permission}'`));
+		}
+		await emitDecision(options.onDecision, principal, "allow", void 0, emitter);
+		const base = {
+			type: "mcp_authz.audit.v1",
+			callId: crypto.randomUUID(),
+			issuer: principal.issuer,
+			sub: principal.sub,
+			...principal.email ? { email: principal.email } : {},
+			...principal.domain ? { domain: principal.domain } : {},
+			...emitter ? { emitter } : {},
+			kind: "operation",
+			name: matched.operationId,
+			permission,
+			resource: route
+		};
+		const { onAudit, onAuditError } = options;
+		if (!onAudit) return upstream(request, principal);
+		const started = performance.now();
+		try {
+			await onAudit({
+				...base,
+				decision: "allow",
+				phase: "attempt",
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		} catch {
+			return Response.json({
+				error: "unavailable",
+				error_description: "The audit log refused the write, so the call did not run."
+			}, { status: 503 });
+		}
+		let response;
+		try {
+			response = await upstream(request, principal);
+		} catch (error) {
+			await deliver(onAudit, onAuditError, {
+				...base,
+				decision: "allow",
+				phase: "failure",
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				durationMs: performance.now() - started,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			throw error;
+		}
+		await deliver(onAudit, onAuditError, {
+			...base,
+			decision: "allow",
+			phase: response.ok ? "success" : "failure",
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			durationMs: performance.now() - started,
+			...response.ok ? {} : { error: `HTTP ${response.status}` }
+		});
+		return response;
+	};
+}
+async function deliver(sink, onError, event) {
+	try {
+		await sink(event);
+	} catch (error) {
+		try {
+			await onError?.({
+				error,
+				event
+			});
+		} catch {}
+	}
+}
+function templateCount(path) {
+	return (path.match(/\{/g) ?? []).length;
+}
+/**
+* A path template as a matcher.
+*
+* `{id}` matches one segment and never a `/`, so `/cases/{id}` does not answer
+* for `/cases/C1/notes` — which would hand a caller a route nobody priced.
+*/
+function matcher(template) {
+	const pattern = template.split("/").map((segment) => /^\{[^{}]+\}$/.test(segment) ? "[^/]+" : segment.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)).join("/");
+	return new RegExp(`^${pattern}$`);
+}
+//#endregion
+export { createOpenApiFetch, filterSpec, recordOperations };

package/dist/permissions-module-DxCHuE-N.d.ts

@@ -0,0 +1,31 @@
+//#region src/permissions-module.d.ts
+/**
+ * Rendering a permission map as source, shared by everything that records a
+ * catalogue.
+ *
+ * Its own module because the MCP recorder needs an optional peer dependency to
+ * talk to a server, and the OpenAPI one only needs a file it was handed. A
+ * caller after the scaffold should not have to install a client to get it.
+ */
+type PermissionMapRecord = {
+  /** Every capability, sorted, labelled the way the gate labels it. */
+  names: string[];
+  /** A digest per capability, when the source can produce one. */
+  fingerprints?: Record<string, string>;
+  /** `resource:` labels to the URI or template each answers on. */
+  resourceUris?: Record<string, string>;
+};
+/**
+ * A permission map to start from, priced so it cannot be forgotten.
+ *
+ * Every capability gets a placeholder no role grants, which `reconcile` reports
+ * as unreachable and the boot refuses. The scaffold is deliberately useless
+ * until a person has decided what each capability costs — that decision is the
+ * whole point of the file, and a default would quietly make it for them.
+ *
+ * Returned as source rather than written, so the caller chooses where it lands.
+ */
+declare const UNASSIGNED = "TODO:unassigned";
+declare function toPermissionsModule(record: PermissionMapRecord): string;
+//#endregion
+export { UNASSIGNED as n, toPermissionsModule as r, PermissionMapRecord as t };

package/dist/policy-BBp3Jq6G.js

@@ -0,0 +1,226 @@
+//#region src/policy.ts
+/**
+* A policy from a plain object.
+*
+* Written inline as a literal, the permission names become a string-literal
+* union, so a tool requiring `cases:wrtie` fails to compile. Handed
+* `JSON.parse(process.env.MCP_POLICY)` or a parsed YAML file the same call
+* still validates its shape and still reconciles against the tools at boot —
+* it just cannot type-check names TypeScript never sees. Nothing here reads the
+* environment or the filesystem: how an application loads configuration is the
+* application's business.
+*
+* There is deliberately no `default` setting. Matching no rule means no
+* permissions, and that is not configurable — a default that can be widened
+* eventually is, and the failure is silent.
+*/
+function definePolicy(spec) {
+	if (!isRecord(spec)) throw new Error("Policy must be an object.");
+	for (const key of Object.keys(spec)) if (![
+		"permissions",
+		"roles",
+		"rules"
+	].includes(key)) throw new Error(`Policy has unknown field '${key}'.`);
+	if (!isRecord(spec.roles)) throw new Error("Policy 'roles' must be an object.");
+	if (!Array.isArray(spec.rules)) throw new Error("Policy 'rules' must be an array.");
+	const catalogue = spec.permissions === void 0 ? void 0 : stringList(spec.permissions, "Policy 'permissions'");
+	if (catalogue?.includes("*")) throw new Error("Policy 'permissions' must name concrete permissions, not '*'.");
+	const known = catalogue ? new Set(catalogue) : void 0;
+	const roles = /* @__PURE__ */ new Map();
+	for (const [role, permissions] of Object.entries(spec.roles ?? {})) {
+		if (!role) throw new Error("Policy role names must not be empty.");
+		const validated = stringList(permissions, `Policy role '${role}'`);
+		if (validated.includes("*") && validated.length > 1) throw new Error(`Policy role '${role}' grants '*' and must not list redundant permissions.`);
+		for (const permission of validated) if (permission !== "*" && known && !known.has(permission)) throw new Error(`Policy role '${role}' grants '${permission}', which is absent from the permission catalogue.`);
+		roles.set(role, validated);
+	}
+	const rules = (spec.rules ?? []).map((rule, index) => {
+		const at = `Policy rule ${index}`;
+		if (!isRecord(rule)) throw new Error(`${at} must be an object.`);
+		for (const key of Object.keys(rule)) if (![
+			"match",
+			"role",
+			"deny"
+		].includes(key)) throw new Error(`${at} has unknown field '${key}'.`);
+		if (rule.deny !== void 0 && typeof rule.deny !== "boolean") throw new Error(`${at} 'deny' must be a boolean.`);
+		if (!rule.deny && rule.role === void 0) throw new Error(`${at} grants nothing: it needs a 'role' or 'deny: true'.`);
+		const named = roleNames(rule.role, at);
+		for (const role of named) if (!roles.has(role)) throw new Error(`${at} names role '${role}', which is not defined.`);
+		return {
+			index,
+			match: validateMatch(rule.match, at),
+			deny: rule.deny === true,
+			roles: named
+		};
+	});
+	const evaluate = (identity) => {
+		const matched = rules.filter((rule) => matches(rule.match, identity));
+		const deniedBy = matched.find((rule) => rule.deny);
+		const held = deniedBy ? [] : [...new Set(matched.flatMap((rule) => rule.roles))];
+		return {
+			matched,
+			deniedBy,
+			principal: createPrincipal(identity, held, deniedBy ? [] : [...new Set(held.flatMap((role) => [...roles.get(role) ?? []]))])
+		};
+	};
+	const policy = (identity) => evaluate(identity).principal;
+	const explain = (identity) => {
+		const { matched, deniedBy, principal } = evaluate(identity);
+		return {
+			principal,
+			matched: matched.map(toMatchedRule),
+			...deniedBy ? { deniedBy: toMatchedRule(deniedBy) } : {}
+		};
+	};
+	const concrete = catalogue ?? [...new Set([...roles.values()].flat().filter((permission) => permission !== "*"))];
+	return Object.assign(policy, {
+		roles,
+		permissions: concrete,
+		explain
+	});
+}
+function toMatchedRule(rule) {
+	return {
+		index: rule.index,
+		match: rule.match,
+		roles: [...rule.roles],
+		deny: rule.deny
+	};
+}
+/** A typed permission vocabulary for async authorizers that do not use a static policy. */
+function definePermissions(permissions) {
+	const catalogue = stringList(permissions, "Permission catalogue");
+	if (catalogue.includes("*")) throw new Error("Permission catalogue must name concrete permissions, not '*'.");
+	return { permissions: catalogue };
+}
+/** Build a sound principal from an external entitlement decision. */
+function createPrincipal(identity, roles, permissions) {
+	if (!isRecord(identity) || typeof identity.sub !== "string" || identity.sub.length === 0) throw new Error("Principal identity needs a non-empty subject.");
+	if (typeof identity.issuer !== "string" || identity.issuer.length === 0) throw new Error("Principal identity needs a non-empty issuer.");
+	if (identity.email !== void 0 && identity.email.length === 0) throw new Error("Principal identity email must not be empty.");
+	const heldRoles = [...new Set(stringList(roles, "Principal roles"))];
+	const heldPermissions = [...new Set(stringList(permissions, "Principal permissions"))];
+	const wildcard = heldPermissions.includes("*");
+	return {
+		issuer: identity.issuer,
+		sub: identity.sub,
+		email: identity.email,
+		domain: identity.domain,
+		roles: heldRoles,
+		permissions: heldPermissions,
+		can: (permission) => wildcard || heldPermissions.includes(permission)
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringList(value, at) {
+	if (!Array.isArray(value)) throw new Error(`${at} must be an array of permission strings.`);
+	const result = [];
+	for (const entry of value) {
+		if (typeof entry !== "string" || entry.length === 0) throw new Error(`${at} must be an array of non-empty permission strings.`);
+		if (!result.includes(entry)) result.push(entry);
+	}
+	return result;
+}
+function roleNames(value, at) {
+	if (value === void 0) return [];
+	const values = Array.isArray(value) ? value : [value];
+	if (values.length === 0 || values.some((role) => typeof role !== "string" || role.length === 0)) throw new Error(`${at} 'role' must be a non-empty role name or array of role names.`);
+	return [...new Set(values)];
+}
+function validateMatch(value, at) {
+	if (value === void 0) return {};
+	if (!isRecord(value)) throw new Error(`${at} 'match' must be an object.`);
+	for (const key of Object.keys(value)) if (![
+		"issuer",
+		"sub",
+		"email",
+		"domain",
+		"claim"
+	].includes(key)) throw new Error(`${at} match has unknown field '${key}'.`);
+	for (const key of [
+		"issuer",
+		"sub",
+		"email",
+		"domain"
+	]) {
+		const field = value[key];
+		if (field !== void 0 && (typeof field !== "string" || field.length === 0)) throw new Error(`${at} match '${key}' must be a non-empty string.`);
+	}
+	const claim = value.claim;
+	if (claim !== void 0) {
+		if (!isRecord(claim)) throw new Error(`${at} match 'claim' must be an object.`);
+		for (const [path, expected] of Object.entries(claim)) if (!path || typeof expected !== "string" || !expected) throw new Error(`${at} match claim entries must have non-empty string names and values.`);
+	}
+	return value;
+}
+function matches(match, identity) {
+	if (match.issuer !== void 0 && match.issuer !== identity.issuer) return false;
+	if (match.sub !== void 0 && match.sub !== identity.sub) return false;
+	if (match.email !== void 0 && (!identity.emailVerified || !equalsFold(match.email, identity.email))) return false;
+	if (match.domain !== void 0 && !equalsFold(match.domain, domainOf(identity))) return false;
+	for (const [path, expected] of Object.entries(match.claim ?? {})) {
+		const actual = claimAt(identity.claims, path);
+		if (!(Array.isArray(actual) ? actual.includes(expected) : actual === expected)) return false;
+	}
+	return true;
+}
+function equalsFold(a, b) {
+	return b !== void 0 && a.toLowerCase() === b.toLowerCase();
+}
+/** The `hd` claim when the AS passes it, otherwise whatever follows the `@`. */
+function domainOf(identity) {
+	if (!identity.emailVerified || !identity.email) return void 0;
+	if (identity.domain) return identity.domain;
+	const at = identity.email.lastIndexOf("@");
+	return at === -1 ? void 0 : identity.email.slice(at + 1);
+}
+/**
+* A literal claim name wins over a dotted path, because the namespaced claims
+* an IdP actually emits are full of dots — Auth0 writes group memberships to
+* `https://acme.com/groups`, and splitting that on `.` finds nothing.
+*/
+function claimAt(claims, path) {
+	if (path in claims) return claims[path];
+	let value = claims;
+	for (const key of path.split(".")) {
+		if (typeof value !== "object" || value === null) return void 0;
+		value = value[key];
+	}
+	return value;
+}
+/**
+* Compare what the tools demand against what the roles grant.
+*
+* A gateway cannot run this check at all — it does not learn the tool list
+* until traffic arrives, and its rules were never compiled alongside the
+* implementation.
+*/
+function reconcile(roles, required) {
+	const grantedBy = /* @__PURE__ */ new Map();
+	for (const [role, permissions] of roles) for (const permission of permissions) grantedBy.set(permission, [...grantedBy.get(permission) ?? [], role]);
+	const unreachable = grantedBy.has("*") ? [] : [...required].filter(([, permission]) => !grantedBy.has(permission));
+	const unused = [...grantedBy].filter(([permission]) => permission !== "*").filter(([permission]) => ![...required.values()].includes(permission));
+	const drift = {};
+	if (unreachable.length > 0) {
+		const report = [
+			"MCP policy validation failed",
+			"",
+			"Unreachable capability:"
+		];
+		for (const [tool, permission] of unreachable) report.push(`  ${tool}`, `    requires: ${permission}`, "    granted by: no role", "");
+		drift.error = report.join("\n");
+	}
+	if (unused.length > 0) {
+		const report = ["MCP policy has unused permissions:"];
+		for (const [permission, byRoles] of unused) {
+			const by = byRoles.map((role) => `"${role}"`).join(", ");
+			report.push(`  ${permission}`, `    granted by: ${by}`, "    required by: no registered capability", "");
+		}
+		drift.warning = report.join("\n");
+	}
+	return drift;
+}
+//#endregion
+export { reconcile as i, definePermissions as n, definePolicy as r, createPrincipal as t };

package/dist/{policy-CnQj53Hq.d.ts → policy-DuZbwrKf.d.ts}

@@ -85,11 +85,39 @@ type PolicySpec = {
   roles: Record<string, readonly string[]>;
   rules: readonly Rule[];
 };
+/** One rule that matched, pointed back at the line an administrator edits. */
+type MatchedRule = {
+  /** Index into the policy's own `rules` array. */
+  index: number;
+  match: Match;
+  roles: string[];
+  deny: boolean;
+};
+/**
+ * Why a principal came out the way it did.
+ *
+ * The decision alone answers "may Alice do this". It cannot answer "why", and
+ * that is the question asked when somebody is surprised. Deriving it a second
+ * time somewhere else would be a second matcher to keep in step, so it lives
+ * here beside the first one.
+ */
+type Explanation<P extends string = string> = {
+  principal: Principal<P>;
+  /** Every matching rule, in policy order. Empty means no rule matched. */
+  matched: MatchedRule[];
+  /** The deny that emptied the grant, when one did. */
+  deniedBy?: MatchedRule;
+};
 type Policy<P extends string = string> = ((identity: Identity) => Principal<P>) & {
   /** Role name to the permissions it grants. Reconciled against the tools at boot. */
   readonly roles: ReadonlyMap<string, readonly string[]>;
   /** Concrete permission vocabulary carried for builders and diagnostics. */
   readonly permissions: readonly P[];
+  /**
+   * The same decision, plus the rules that produced it. Off the request path:
+   * nothing in the gate calls this, so it costs a served request nothing.
+   */
+  readonly explain: (identity: Identity) => Explanation<P>;
 };
 type PermissionCatalog<P extends string = string> = {
   readonly permissions: readonly P[];
@@ -141,4 +169,4 @@ type Drift = {
  */
 declare function reconcile(roles: ReadonlyMap<string, readonly string[]>, required: ReadonlyMap<string, string>): Drift;
 //#endregion
-export { Policy as a, Rule as c, definePolicy as d, reconcile as f, Identity as h, PermissionOf as i, createPrincipal as l, DenialReason as m, Match as n, PolicySpec as o, AccessDeniedError as p, PermissionCatalog as r, Principal as s, Drift as t, definePermissions as u };
+export { Identity as _, PermissionCatalog as a, PolicySpec as c, createPrincipal as d, definePermissions as f, DenialReason as g, AccessDeniedError as h, MatchedRule as i, Principal as l, reconcile as m, Explanation as n, PermissionOf as o, definePolicy as p, Match as r, Policy as s, Drift as t, Rule as u };

package/dist/policy.d.ts

@@ -1,2 +1,2 @@
-import { a as Policy, c as Rule, d as definePolicy, f as reconcile, h as Identity, i as PermissionOf, l as createPrincipal, n as Match, o as PolicySpec, r as PermissionCatalog, s as Principal, t as Drift, u as definePermissions } from "./policy-CnQj53Hq.js";
-export { Drift, type Identity, Match, PermissionCatalog, PermissionOf, Policy, PolicySpec, Principal, Rule, createPrincipal, definePermissions, definePolicy, reconcile };
+import { _ as Identity, a as PermissionCatalog, c as PolicySpec, d as createPrincipal, f as definePermissions, i as MatchedRule, l as Principal, m as reconcile, n as Explanation, o as PermissionOf, p as definePolicy, r as Match, s as Policy, t as Drift, u as Rule } from "./policy-DuZbwrKf.js";
+export { Drift, Explanation, type Identity, Match, MatchedRule, PermissionCatalog, PermissionOf, Policy, PolicySpec, Principal, Rule, createPrincipal, definePermissions, definePolicy, reconcile };