permdock 0.1.0 → 0.2.0

package/dist/ids-DC4V4CFu.js

@@ -0,0 +1,18 @@
+//#region src/core/ids.ts
+/**
+* The canonical text of a scope or object id: a non-empty string as is, a
+* finite number or a bigint as its decimal text (a `bigint` key column read
+* through supabase-js arrives as a number), anything else none.
+*/
+function idText(value) {
+	if (typeof value === "string") return value === "" ? void 0 : value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value === "bigint") return String(value);
+}
+/** Whether two ids are the same id once both are read as text; a missing id matches nothing. */
+function sameId(left, right) {
+	const text = idText(left);
+	return text !== void 0 && text === idText(right);
+}
+//#endregion
+export { sameId as n, idText as t };

package/dist/{index-LF_hS-yn.d.ts → index-A0YNL8jZ.d.ts}

@@ -1,4 +1,4 @@
-import { $ as DecisionSink, Et as TokenVerifier, ct as MembershipSource } from "./policy-CInmNGkM.js";
+import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-CFZAr_Al.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";

package/dist/index-CtE07CBF.d.ts

@@ -0,0 +1,6 @@
+import { C as Policy, Nr as Principal } from "./policy-CFZAr_Al.js";
+import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-9AWO9EGt.js";
+//#region src/ssf/create.d.ts
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
+//#endregion
+export { createPermDock as t };

package/dist/{index-xIxJLwOQ.d.ts → index-D3vbkoSI.d.ts}

@@ -1,11 +1,13 @@
-import { C as Policy, E as PolicyVocabulary, Er as SqlFunctionCondition, Pn as DenialReason, Sr as OpaqueCondition, Tr as SqlFunctionArg, Z as DecisionEvent, Zt as PermDock, at as LimitStore, cr as CustomRole, ct as MembershipSource, ft as RelationSource, gt as Snapshot, h as Grant, hr as Subject, mr as Principal, pr as Membership, q as AccessEvent, tt as EntitlementSource, ur as Delegation, vr as ConditionRef, w as PolicyDelegation } from "./policy-CInmNGkM.js";
-import { d as Permission, n as ActionMeta, p as PermissionTree, t as ActionList, x as ResourceRelationInput, y as ResourceParent } from "./permissions-B4apnahQ.js";
+import { $ as AccessEvent, C as Policy, D as PolicyVocabulary, Dr as CustomRole, Gr as SqlFunctionArg, Kr as SqlFunctionCondition, Lr as ConditionRef, Mr as Membership, Nr as Principal, Pr as Subject, Tt as Snapshot, Vr as OpaqueCondition, Zn as DenialReason, bt as RelationSource, dt as LimitStore, gt as MembershipSource, h as Grant, kr as Delegation, ln as PermDock, pt as LocalSnapshotManifest, rt as DecisionEvent, st as EntitlementSource, w as PolicyDelegation, xt as RoleSource } from "./policy-CFZAr_Al.js";
+import { C as ResourceRelationInput, f as Permission, m as PermissionTree, n as ActionMeta, t as ActionList, w as ResourceRestricted, x as ResourceParent } from "./permissions-DttnqqxC.js";
 //#region src/core/custom-roles.d.ts
-type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed";
+type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
 /** Why part of a custom role was left out: a permission, or an undeclared include. */
 type CustomRoleDrop = {
   readonly permission: string;
   readonly reason: CustomRoleDropReason;
+  /** The stored level, for `unknown-level`. */
+  readonly level?: string;
 } | {
   readonly role: string;
   readonly reason: "unknown-role";
@@ -118,13 +120,29 @@ declare function composeMemberships(sources: readonly MembershipSource[]): Membe
 /**
  * Trust the memberships the verified token carries, and read `source` only
  * when the token marks them truncated. With `version`, a token minted before
- * the latest membership change is stale for the policy's `fresh` permissions.
+ * the latest membership change is stale for the policy's `fresh` permissions,
+ * or with `onStale: 'reread'` has its memberships read from `source` instead.
  */
 declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
   readonly version?: MembershipSource["version"];
+  readonly onStale?: "deny" | "reread";
 }): MembershipSource;
 /** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
 declare function isExternallyManaged(membership: Membership): boolean;
+/**
+ * How many principals hold `role` in one scope instance now, from the
+ * source's member list (`MembershipSource.list`): live memberships of exactly
+ * that scope and instance, each principal counted once. The `holders` a
+ * `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
+ * when the source cannot list or the read fails, which that check denies.
+ */
+declare function countHolders(source: MembershipSource | readonly MembershipSource[], query: {
+  readonly scope: string;
+  readonly id: string;
+  readonly role: string | {
+    readonly key: string;
+  };
+}): Promise<number | undefined>;
 //#endregion
 //#region src/core/stripe-entitlements.d.ts
 /** The part of the Stripe Node SDK this source calls: `stripe.entitlements.activeEntitlements.list`. */
@@ -164,6 +182,14 @@ declare function memoryLimitStore(): LimitStore & {
   size(): number;
 };
 //#endregion
+//#region src/core/local-manifest.d.ts
+/**
+ * What the policy grants, as JSON a device turns into snapshots from its own
+ * membership rows (`localSnapshot` in `permdock/react-native`). Write it at
+ * build time; the policy itself never ships to the client.
+ */
+declare function localSnapshotManifest(policy: Policy): LocalSnapshotManifest;
+//#endregion
 //#region src/core/may-access.d.ts
 /**
  * An optimistic routing hint for a proxy or middleware, never a decision.
@@ -184,6 +210,48 @@ declare function mayAccess(policy: Policy, user: unknown, permission: Permission
  * skills, never a decision; the call itself is decided in full.
  */
 declare function mayUse(permdock: PermDock, permission: Permission): boolean;
+type PermittedIdsOptions = {
+  readonly within?: string;
+  readonly conditioned?: boolean;
+};
+/**
+ * The instances of `scope` in which the subject holds `permission`, from its
+ * live memberships of exactly that scope, within its delegation: by default
+ * those with an allow that carries no row condition (`where`, `check`, a
+ * validity window or a non-portable test; a `fields` limit is not a row
+ * condition), minus the instances any deny of the permission reaches. The
+ * in-process mirror of the SQL `permitted_<scope>_ids_by_permission`. With
+ * `conditioned: true` it also lists the instances where a conditioned allow
+ * applies, minus only unconditional denies, as
+ * `permitted_<scope>_ids_by_permission(p_permission, true)` does. A listing,
+ * never a decision: a row's own check still runs `can`.
+ */
+declare function permittedIds(permdock: PermDock, permission: Permission, scope: string, options?: PermittedIdsOptions): readonly string[];
+//#endregion
+//#region src/core/custom-role-source.d.ts
+/** Reads custom roles from the application's store, as `customRoleSource` takes them. */
+type CustomRoleReader = {
+  /** Every custom role of `tenant`, whether or not anyone in the request holds it. */
+  rolesOf(tenant: string): CustomRole[] | Promise<CustomRole[]>;
+  assignable?(tenant: string): string[] | Promise<string[]>;
+  /** Platform custom roles (`scope: 'global'`). */
+  globalRoles?(): CustomRole[] | Promise<CustomRole[]>;
+};
+type CustomRoleSourceOptions = {
+  /** `'all'` (default): read every custom role of each tenant, so `assignableRoles` and `decideRoleChange` see them all. */
+  readonly read?: "all";
+} | {
+  /** `'held'`: skip a tenant's read, and the platform read, when every role the subject holds there is declared in `policy`. For requests that never manage roles. */
+  readonly read: "held";
+  readonly policy: Policy;
+};
+/**
+ * A `RoleSource` over a reader that returns every custom role of a tenant.
+ * It keeps only the roles of the requested tenant. With `read: 'held'` it
+ * skips a tenant's read, and `globalRoles`, when the subject holds only
+ * declared roles there.
+ */
+declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): RoleSource;
 //#endregion
 //#region src/core/instance.d.ts
 type SnapshotInclude = readonly (Permission | {
@@ -256,7 +324,7 @@ type PresetOptions<A extends ActionList | undefined = undefined, C extends Actio
   readonly id?: string;
   readonly parent?: ResourceParent;
   readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
-  readonly restricted?: string;
+  readonly restricted?: string | ResourceRestricted;
   readonly disclosure?: "hide" | "reveal";
   readonly actions?: A;
   readonly collection?: C;
@@ -265,7 +333,7 @@ type PresetResult<BaseA extends Record<string, ActionMeta>, BaseC extends Record
   readonly id?: string;
   readonly parent?: ResourceParent;
   readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
-  readonly restricted?: string;
+  readonly restricted?: string | ResourceRestricted;
   readonly disclosure?: "hide" | "reveal";
   readonly actions: MergeActionRecords<BaseA, ToActionRecord<A>>;
   readonly collection?: MergeActionRecords<BaseC, ToActionRecord<C>>;
@@ -412,4 +480,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { emptySnapshot as A, ResolvedCustomRole as B, composeMemberships as C, requiresApproval as D, opaque as E, memoryRelations as F, resolveCustomRole as H, CustomRoleDrop as I, CustomRoleDropReason as L, parseSnapshot as M, MemoryEdge as N, context as O, MemoryRelationsData as P, CustomRoleRename as R, claimsFirst as S, sqlFunction as T, validateCustomRole as U, customRoleClaim as V, mayUse as _, toCsvRow as a, StripeEntitlementsClient as b, OcsfAuthorizeSession as c, parseDuration as d, crud as f, snapshotFor as g, SnapshotForOptions as h, CSV_COLUMNS as i, fromSnapshot as j, principal as k, accessToOcsf as l, writable as m, delegatedPermissions as n, OCSF_VERSION as o, readable as p, catalogFingerprint as r, OcsfAccountChange as s, coveredByDelegation as t, toOcsf as u, mayAccess as v, isExternallyManaged as w, fromStripeEntitlements as x, memoryLimitStore as y, CustomRoleValidation as z };
+export { countHolders as A, MemoryEdge as B, mayAccess as C, fromStripeEntitlements as D, StripeEntitlementsClient as E, context as F, CustomRoleRename as G, memoryRelations as H, principal as I, customRoleClaim as J, CustomRoleValidation as K, emptySnapshot as L, sqlFunction as M, opaque as N, claimsFirst as O, requiresApproval as P, fromSnapshot as R, permittedIds as S, memoryLimitStore as T, CustomRoleDrop as U, MemoryRelationsData as V, CustomRoleDropReason as W, validateCustomRole as X, resolveCustomRole as Y, CustomRoleReader as _, toCsvRow as a, PermittedIdsOptions as b, OcsfAuthorizeSession as c, parseDuration as d, crud as f, snapshotFor as g, SnapshotForOptions as h, CSV_COLUMNS as i, isExternallyManaged as j, composeMemberships as k, accessToOcsf as l, writable as m, delegatedPermissions as n, OCSF_VERSION as o, readable as p, ResolvedCustomRole as q, catalogFingerprint as r, OcsfAccountChange as s, coveredByDelegation as t, toOcsf as u, CustomRoleSourceOptions as v, localSnapshotManifest as w, mayUse as x, customRoleSource as y, parseSnapshot as z };

package/dist/{index-CltcQ4Bf.d.ts → index-D6_cSa1z.d.ts}

@@ -1,6 +1,6 @@
-import { Mn as Decision, Tt as TokenSigner, ft as RelationSource, hr as Subject, pr as Membership } from "./policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
-import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, r as ApprovalCancelMeta } from "./types-B8w5PFtS.js";
+import { Mr as Membership, Pr as Subject, Pt as TokenSigner, Yn as Decision, bt as RelationSource, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
+import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-vKyAMtcX.js";
 //#region src/approvals/errors.d.ts
 type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
 declare class ApprovalError extends Error {
@@ -22,6 +22,12 @@ type ApprovalsHandlerOptions = {
   readonly relations?: RelationSource;
   /** The policy's permission tree, for `through` links and `includes` on relation approvers. */
   readonly permissions?: PermissionTree;
+  /**
+   * The approver's own instance in the request's tenant, for
+   * `holder(permission)` approvers (custom roles included when the instance
+   * reads a `RoleSource`). Without it, or when it throws, they match nobody.
+   */
+  readonly permdockFor?: (approver: Subject, request: ApprovalRequest) => PermDock | Promise<PermDock>;
 };
 declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
@@ -68,6 +74,13 @@ declare function requestApproval(store: ApprovalStore, decision: Extract<Decisio
  */
 declare function resolveApproval(store: ApprovalStore, token: string, verdict: ApprovalVerdict, options?: ApproverRelationsOptions & {
   readonly requireDistinctApprover?: boolean;
+  readonly permdockFor?: ApprovalsHandlerOptions["permdockFor"];
+}): Promise<ApprovalRequest>;
+declare function vouchApproval(store: ApprovalStore, token: string, verdict: {
+  readonly status: "approved" | "rejected";
+  readonly by: Subject;
+  readonly rule: string;
+  readonly note?: string;
 }): Promise<ApprovalRequest>;
 declare function inspectApproval(store: ApprovalStore, token: string, now?: Date): Promise<ApprovalInspectResult>;
 /** Inspects `token` and, when it is approved, consumes it so it resumes once. */
@@ -98,6 +111,12 @@ declare function resumeDecision(input: {
   /** `false` for checks that do not run the action, such as the decision endpoint. */
   readonly consume?: boolean;
   readonly now?: Date;
+  /**
+   * How long a request this call opens stays open, in milliseconds; absent
+   * means the store's `ttl`, else `DEFAULT_APPROVAL_TTL_MS`. The grant's
+   * `approval.ttl` still caps it.
+   */
+  readonly ttl?: number;
 }): Promise<Decision>;
 declare function cancelApprovals(store: ApprovalStore, filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number>;
 declare function readApprovalHeader(headers: Headers | {
@@ -106,6 +125,50 @@ declare function readApprovalHeader(headers: Headers | {
 declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
   readonly get: (name: string) => string | null;
 }, now?: Date): Promise<ApprovalInspectResult>;
+/**
+ * The token to resume `decision` with when the caller carries none: the
+ * decision's own token when the store holds an approved or rejected request
+ * for it, so `resumeDecision` resumes (or denies) the call without the
+ * caller passing the token back. The token already binds permission,
+ * resource (or the call's data when there is no row id), subject and actor.
+ * A pending request counts only with `denyPending: true`, which makes the
+ * call deny with `approval-pending` instead of asking again. `undefined` when
+ * the decision needs no approval, there is no store, or the store has no
+ * unexpired request for the token; a store that throws counts as none.
+ */
+declare function storedApprovalToken(store: ApprovalStore | undefined, decision: Decision, options?: {
+  readonly denyPending?: boolean;
+  readonly now?: Date;
+}): Promise<string | undefined>;
+//#endregion
+//#region src/approvals/page.d.ts
+/** The page size of a query: `limit` within 1 to 200, 50 when absent. */
+declare function approvalPageSize(limit: number | undefined): number;
+/** Where a page starts: the `(createdAt, token)` of the last request before it. */
+type ApprovalCursorPosition = readonly [createdAt: string, token: string];
+/** The `next` cursor after `request`, for a store that pages in its own query. */
+declare function encodeApprovalCursor(request: ApprovalRequest): string;
+/** The `(createdAt, token)` position a `next` cursor names, or `null` for one that does not parse. */
+declare function decodeApprovalCursor(cursor: string): ApprovalCursorPosition | null;
+/**
+ * Pages already-filtered requests in `(createdAt, token)` order, as the
+ * built-in stores do: `limit` within 1 to 200 (50 when absent), `cursor` from
+ * the previous page's `next`, and no items for a cursor that does not parse.
+ * A custom `ApprovalStore` that filters in memory returns it from `list`.
+ */
+declare function pageApprovals(matching: readonly ApprovalRequest[], query: ApprovalListQuery): ApprovalPage;
+/** Every matching request of `store`, following `next` until the last page (at most 1000 pages of 200). */
+declare function listAllApprovals(store: ApprovalStore, filter: ApprovalListFilter): Promise<ApprovalRequest[]>;
+//#endregion
+//#region src/approvals/permissions.d.ts
+/**
+ * The `holder(permission)` approvers of `request` that `approver` holds, for
+ * `ApprovalVerdict.permissions`: each permission key the approver's own
+ * instance grants without a row. `approver` must be an instance for the
+ * approving principal in the request's tenant; for any other tenant, or an
+ * anonymous instance, it holds nothing. A check that throws holds nothing.
+ */
+declare function approverPermissions(request: ApprovalRequest, approver: PermDock): readonly string[];
 //#endregion
 //#region src/approvals/store.d.ts
 /**
@@ -118,7 +181,7 @@ declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
  * two stages. `relations` are the relation approvers `by` holds on the
  * request's resource (see `ApprovalVerdict.relations`).
  */
-declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, now?: Date, relations?: readonly string[]): number | undefined;
+declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, now?: Date, relations?: readonly string[], permissions?: readonly string[]): number | undefined;
 /**
  * The request after `verdict`, for a store to persist: a rejection resolves
  * it; an approval is appended to `approvals` and resolves it once there are
@@ -135,4 +198,4 @@ declare function memoryApprovalStore(options?: {
   readonly ttl?: number;
 }): MemoryApprovalStore;
 //#endregion
-export { approvalsHandler as _, cancelApprovals as a, isApprovalError as b, readApprovalHeader as c, resumeDecision as d, resumeFromHeader as f, ApprovalsHandlerOptions as g, approverRelations as h, memoryApprovalStore as i, requestApproval as l, ApproverRelationsOptions as m, applyApprovalVerdict as n, consumeApproval as o, summariseSubject as p, assertApprover as r, inspectApproval as s, MemoryApprovalStore as t, resolveApproval as u, ApprovalError as v, ApprovalErrorCode as y };
+export { ApproverRelationsOptions as C, ApprovalError as D, approvalsHandler as E, ApprovalErrorCode as O, vouchApproval as S, ApprovalsHandlerOptions as T, resolveApproval as _, approverPermissions as a, storedApprovalToken as b, decodeApprovalCursor as c, pageApprovals as d, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, isApprovalError as k, encodeApprovalCursor as l, inspectApproval as m, applyApprovalVerdict as n, ApprovalCursorPosition as o, consumeApproval as p, assertApprover as r, approvalPageSize as s, MemoryApprovalStore as t, listAllApprovals as u, resumeDecision as v, approverRelations as w, summariseSubject as x, resumeFromHeader as y };

package/dist/index.d.ts

@@ -1,11 +1,16 @@
-import { $ as DecisionSink, $n as relation, $t as RowPair, A as RoleScope, An as memoryApprovalPolicies, Ar as isConditionRef, At as memoryEntitlementSource, B as normalizeAssurance, Bn as Obligation, Bt as CredentialPolicy, C as Policy, Cn as ArazzoPlan, Cr as RelatedCondition, Ct as TenantSettings, D as PrincipalOf, Dn as simulateArazzo, Dr as hasConditionOp, Dt as VerificationFailure, En as arazzoFindings, Er as SqlFunctionCondition, Et as TokenVerifier, F as ValidateMode, Fn as DeniedDecision, Ft as Credential, G as UserApprover, Gn as Grantee, Gt as credentialDelegation, H as separationConflicts, Hn as Trace, Ht as CredentialPrincipal, I as allow, In as ExplainedDecision, It as CredentialDecision, J as AuthEvent, Jn as actor, Jt as decideCredential, K as user, Kn as GranteeInput, Kt as credentialPolicyViolation, L as definePolicy, Ln as GrantedDecision, Lt as CredentialKind, M as SubjectOf, Mn as Decision, Mt as memorySettings, N as SupportAccessOptions, Nn as Denial, Nt as WireDecision, O as RoleBinding, On as ApprovalPolicy, Or as isCondition, Ot as VerifiedToken, P as SupportConsent, Pn as DenialReason, Pt as WireDenial, Q as DecisionProvider, Qn as plan, Qt as PermDockOptions, R as deny, Rn as LimitDetail, Rt as CredentialPermission, S as MembershipFixture, Sn as ArazzoFinding, St as SubjectResolver, T as PolicyScopes, Tn as ArazzoStepResult, Tr as SqlFunctionArg, Tt as TokenSigner, U as Approver, Un as TraceSkip, Ut as CredentialRequest, V as role, Vn as Quota, Vt as CredentialPolicyViolation, W as ApproverInput, Wn as TraceSkipReason, Wt as DecideCredentialOptions, X as CredentialVerifier, Xn as assurance, Xt as DecideOptions, Y as CredentialEvent, Yn as anyone, Yt as parseCredential, Z as DecisionEvent, Zn as authenticated, Zt as PermDock, _ as GrantLimit, _n as RoleChangeOptions, _r as Condition, _t as SnapshotAssignable, a as ApprovalRequirement, an as HostedGrantDropped, ar as Assurance, at as LimitStore, b as GrantValidity, bn as breakGlass, br as MemberOfCondition, bt as SnapshotScope, c as BreakGlassOptions, cn as isPortableCondition, cr as CustomRole, ct as MembershipSource, d as ClosureContext, dn as parsePolicyDocument, dr as GnapAccess, dt as RelationHolder, en as SimulateOptions, er as PolicyScopesInput, et as DirectoryEvent, f as ClosureGrantFn, fn as Holder, ft as RelationSource, g as GrantCondition, gn as RoleChangeDecision, gr as VerifiedClaims, gt as Snapshot, h as Grant, hn as RoleChange, hr as Subject, ht as SinkEvent, i as ApprovalOption, in as HostedGrantDropReason, ir as Actor, it as LimitRemaining, j as SeparationConflict, jn as ApprovalRequiredDecision, jr as isSqlFunctionField, jt as memoryRoleSource, k as RoleOptions, kn as ApprovalPolicySource, kr as isConditionDate, kt as WhereCompiler, l as BreakGlassRequirements, ln as memoryPolicySource, lr as CustomRoleGrant, lt as RelationChain, m as DelegationTarget, mn as WhoCan, mr as Principal, mt as SettingsSource, n as ApprovalEscalation, nn as createPermDock, nr as ScopeDeclaration, o as ApprovalStage, on as PolicyDocument, or as AuthorizationDetail, ot as MemberEntry, p as DelegationInput, pn as HoldingVia, pr as Membership, pt as RoleSource, q as AccessEvent, qn as RelationGrantee, qt as credentialSubject, r as ApprovalMode, rn as HostedGrant, rr as ScopeNames, rt as LimitConsumeInput, s as AssuranceRequirement, sn as PolicySource, sr as Binding, st as MembershipEvent, t as ActivationOption, tn as WhereResult, tr as Scope, tt as EntitlementSource, u as BreakGlassSpec, un as mergeHostedGrants, ur as Delegation, ut as RelationGroup, v as GrantOptions, vn as RoleChangeTarget, vr as ConditionRef, vt as SnapshotGrant, w as PolicyDelegation, wn as ArazzoSimulateInput, wr as RelatedHop, wt as TokenFailureCause, x as HostedGrantRef, xn as supportAccess, xr as MemberOfParent, xt as SnapshotSource, y as GrantScope, yn as ActivateInput, yr as ConditionValue, yt as SnapshotNotEntitled, z as normalizeApproval, zn as MatchedGrant, zt as CredentialPermissionInput } from "./policy-CInmNGkM.js";
-import { C as findPermission, D as listPermissions, E as isPermission, O as mergePermissions, S as definePermissions, T as getResource, _ as ResourceNode, a as EdgeGroups, b as ResourceRelation, c as FieldRelation, d as Permission, f as PermissionKind, g as ResourceLink, h as ResourceInit, i as DefinePermissionsOptions, k as resource, m as PrincipalRelation, n as ActionMeta, o as EdgeMatch, p as PermissionTree, r as ComputedRelation, s as EdgeRelation, u as MetaValue, v as ResourceOptions, w as formerKeys, x as ResourceRelationInput, y as ResourceParent } from "./permissions-B4apnahQ.js";
-import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-Dk0fs-Jk.js";
-import { A as emptySnapshot, B as ResolvedCustomRole, C as composeMemberships, D as requiresApproval, E as opaque, F as memoryRelations, H as resolveCustomRole, I as CustomRoleDrop, L as CustomRoleDropReason, M as parseSnapshot, N as MemoryEdge, O as context, P as MemoryRelationsData, R as CustomRoleRename, S as claimsFirst, T as sqlFunction, U as validateCustomRole, V as customRoleClaim, _ as mayUse, a as toCsvRow, b as StripeEntitlementsClient, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as fromSnapshot, k as principal, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as mayAccess, w as isExternallyManaged, x as fromStripeEntitlements, y as memoryLimitStore, z as CustomRoleValidation } from "./index-xIxJLwOQ.js";
-import { a as PermDockValidationError, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as ProblemDetails, r as PermDockDeniedError, s as RevokedCode } from "./errors-DbZ1YOnb.js";
-import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-Cfr9-7YC.js";
+import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-CFZAr_Al.js";
+import { A as listPermissions, C as ResourceRelationInput, D as formerKeys, E as findPermission, M as resource, O as getResource, S as ResourceRelation, T as definePermissions, _ as ResourceLevel, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as MetaValue, f as Permission, g as ResourceInit, h as PrincipalRelation, i as DefinePermissionsOptions, j as mergePermissions, k as isPermission, l as FieldRelation, m as PermissionTree, n as ActionMeta, o as EdgeGroups, p as PermissionKind, r as ComputedRelation, s as EdgeMatch, v as ResourceLink, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-DA8a8zif.js";
+import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-D3vbkoSI.js";
+import { n as PermDockValidationError } from "./validation-error-CtF23SrC.js";
+import { n as requiredPlans } from "./problem-details-CkL50EEf.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DAqevpNk.js";
+import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-Gs6TTVa-.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
-import { a as requiredPlans, i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-DernyItf.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-PdoqESvg.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-BDG_nkxt.js";
-export { type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicySource, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleRename, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionKind, type PermissionTree, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allow, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parsePermDockDigest, parsePolicyDocument, parseSnapshot, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateCustomRole, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BkGQNzAh.js";
+import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-Dq43tT1u.js";
+export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };

package/dist/index.js

@@ -1,21 +1,26 @@
-import { _ as mergePermissions, a as formerKeys, c as getResource, f as isPermission, g as listPermissions, i as findPermission, n as definePermissions, y as resource } from "./permissions-DC7GROPA.js";
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-ChLSxbST.js";
-import { a as definePolicy, d as role, f as separationConflicts, l as normalizeApproval, m as memoryLimitStore, o as deny, t as allow, u as normalizeAssurance, y as opaque } from "./policy-ANp36PnI.js";
-import { a as accessToOcsf, c as readable, d as mayAccess, f as fromStripeEntitlements, g as sqlFunction, h as memorySettings, i as OCSF_VERSION, l as writable, m as memoryRoleSource, n as CSV_COLUMNS, o as toOcsf, p as memoryEntitlementSource, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor } from "./src-CTNT-PBW.js";
-import { r as user } from "./approvers-aH0PJkmf.js";
-import { C as listPlans, S as isRole, a as authenticated, b as findRole, d as relation, i as assurance, n as anyone, t as actor, u as plan, v as definePlans, w as listRoles, x as isPlan, y as defineRoles } from "./grantee-Bv04_Vzf.js";
-import { n as requiredPlans, t as describe } from "./describe-Bt1YD5uS.js";
+import { _ as listPermissions, a as formerKeys, b as resource, c as getResource, i as findPermission, n as definePermissions, p as isPermission, v as mergePermissions } from "./permissions-DVoF6dMt.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-KYb4ntaz.js";
+import { S as opaque, _ as memoryLimitStore, a as definePolicy, d as normalizeApproval, f as normalizeAssurance, h as separationConflicts, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
+import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-CSbUiozF.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-DT4AVyIg.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
+import { t as describe } from "./describe-B_gVZEVi.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
-import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, s as memoryRevocationFeed, t as credentialDelegation } from "./credential-B_rkUNlY.js";
-import { d as delegatedPermissions, h as simulateArazzo, n as parseSnapshot, p as arazzoFindings, u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
+import { f as simulateArazzo, n as parseSnapshot, u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
 import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { C as isPlan, E as listRoles, S as findRole, T as listPlans, a as authenticated, b as definePlans, c as inherit, f as plan, i as assurance, n as anyone, p as relation, t as actor, w as isRole, x as defineRoles } from "./grantee-Cv5Sogfv.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-BwKQ1BTA.js";
-import { c as supportAccess, f as resolveCustomRole, g as isExternallyManaged, h as composeMemberships, l as customRoleClaim, m as claimsFirst, p as validateCustomRole, s as breakGlass, t as createPermDock, v as memoryApprovalPolicies } from "./permdock-yoZ7EjxX.js";
-import { t as memoryRelations } from "./relations-r4soIFZB.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
-import { t as mayUse } from "./may-use-CnFEjVEp.js";
+import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
+import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CzqXjCpU.js";
+import { t as memoryRelations } from "./relations-cjOL01hZ.js";
+import { r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BrMozJCo.js";
+import { n as permittedIds, t as mayUse } from "./may-use-DndQ5tQ-.js";
 import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";
-import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-B68OFnZx.js";
-export { CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allow, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parsePermDockDigest, parsePolicyDocument, parseSnapshot, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateCustomRole, writable };
+import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-4qPdO9gk.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, t as credentialDelegation } from "./credential-8P81ff4u.js";
+export { APPROVAL_POLICY_UNAVAILABLE, CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };

package/dist/instance-options-BK_rNOSC.d.ts

@@ -0,0 +1,11 @@
+import { un as PermDockOptions } from "./policy-CFZAr_Al.js";
+//#region src/core/instance-options.d.ts
+type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits";
+/**
+ * The data sources an adapter passes through to every instance it creates.
+ * Each adapter's options type extends this, so a source added to core
+ * reaches every adapter without a per-adapter change.
+ */
+type InstanceOptions = Pick<PermDockOptions, InstanceKey>;
+//#endregion
+export { InstanceOptions as t };

package/dist/instance-options-Dhhcnm3y.js

@@ -0,0 +1,22 @@
+//#region src/core/instance-options.ts
+const INSTANCE_KEYS = {
+	memberships: true,
+	relations: true,
+	entitlements: true,
+	customRoles: true,
+	policies: true,
+	approvalPolicies: true,
+	sink: true,
+	limits: true
+};
+/** The `InstanceOptions` set on `options`, without the adapter's own keys. */
+function instanceOptions(options) {
+	const picked = {};
+	for (const key of Object.keys(INSTANCE_KEYS)) {
+		const name = key;
+		if (options[name] !== void 0) picked[name] = options[name];
+	}
+	return picked;
+}
+//#endregion
+export { instanceOptions as t };

package/dist/{parse-DPfIvFMU.js → json-schema-BsAflUGW.js}

@@ -1,7 +1,4 @@
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { i as PermDockValidationError } from "./errors-Iy71s7Oj.js";
-import { t as catalogSchema } from "./schema-P8yoma__.js";
-//#region src/catalog/parse.ts
+//#region src/core/json-schema.ts
 function issue(issues, path, message) {
 	issues.push({
 		message,
@@ -53,8 +50,19 @@ function typeMatches(type, value) {
 		default: return type;
 	}
 }
-/** The subset of JSON Schema 2020-12 `CatalogSchemaNode` names, over a `copyJson` result. */
-function checkSchema(node, value, path, issues) {
+const DEF_REF = /^#\/\$defs\/([^/]+)$/u;
+function resolveRef(root, ref) {
+	const name = DEF_REF.exec(ref)?.[1];
+	const target = name !== void 0 && root.$defs !== void 0 && Object.hasOwn(root.$defs, name) ? root.$defs[name] : void 0;
+	if (target === void 0) throw new TypeError(`Unsupported or unknown $ref ${ref}`);
+	return target;
+}
+/** Validates a `copyJson` result against `node`, reading `$ref` targets from `root`. */
+function checkSchema(node, value, path, issues, root = node) {
+	if (node.$ref !== void 0) {
+		checkSchema(resolveRef(root, node.$ref), value, path, issues, root);
+		return;
+	}
 	if ("const" in node && value !== node.const) {
 		issue(issues, path, `Expected ${JSON.stringify(node.const)}`);
 		return;
@@ -72,64 +80,27 @@ function checkSchema(node, value, path, issues) {
 	if (node.oneOf !== void 0) {
 		if (node.oneOf.filter((option) => {
 			const scratch = [];
-			checkSchema(option, value, path, scratch);
+			checkSchema(option, value, path, scratch, root);
 			return scratch.length === 0;
 		}).length !== 1) issue(issues, path, "Expected exactly one matching form");
 	}
-	if (Array.isArray(value) && node.items !== void 0) for (const [index, item] of value.entries()) checkSchema(node.items, item, [...path, index], issues);
+	if (Array.isArray(value)) {
+		if (node.minItems !== void 0 && value.length < node.minItems) issue(issues, path, `Expected at least ${String(node.minItems)} items`);
+		if (node.uniqueItems === true && new Set(value.map((item) => JSON.stringify(item))).size !== value.length) issue(issues, path, "Expected unique items");
+		if (node.items !== void 0) for (const [index, item] of value.entries()) checkSchema(node.items, item, [...path, index], issues, root);
+	}
 	if (!isRecord(value)) return;
 	for (const key of node.required ?? []) if (!Object.hasOwn(value, key)) issue(issues, [...path, key], "Required");
 	const properties = node.properties ?? {};
 	for (const key of Object.keys(value)) {
-		const child = Object.hasOwn(properties, key) ? properties[key] : node.additionalProperties;
-		if (child !== void 0) checkSchema(child, value[key], [...path, key], issues);
-	}
-}
-function invalid(issues) {
-	const [first] = issues;
-	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
-	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
-	throw new PermDockValidationError({
-		code: "invalid-data",
-		permission: "",
-		resource: "",
-		boundary: "catalog",
-		issues,
-		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
-	});
-}
-/**
-* Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
-* validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
-* built from own keys; throws `PermDockValidationError` with every issue.
-*/
-function parseCatalog(json) {
-	const issues = [];
-	let input = json;
-	if (typeof json === "string") try {
-		input = JSON.parse(json);
-	} catch (error) {
-		invalid([{
-			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
-			path: []
-		}]);
-	}
-	let copy;
-	try {
-		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
-	} catch (error) {
-		invalid([{
-			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
-			path: []
-		}]);
+		if (Object.hasOwn(properties, key)) {
+			const child = properties[key];
+			if (child !== void 0) checkSchema(child, value[key], [...path, key], issues, root);
+			continue;
+		}
+		if (node.additionalProperties === false) issue(issues, [...path, key], "Unexpected property");
+		else if (node.additionalProperties !== void 0) checkSchema(node.additionalProperties, value[key], [...path, key], issues, root);
 	}
-	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
-	if (issues.length > 0) invalid(issues);
-	return freezeDeep(copy);
-}
-/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
-function rowConditionKeys(catalog) {
-	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
 }
 //#endregion
-export { rowConditionKeys as n, parseCatalog as t };
+export { copyJson as n, checkSchema as t };