permdock 0.16.0 → 0.18.0

package/dist/{index-DJwEgYzA.d.ts → index-CdMOd-GY.d.ts}

@@ -1,8 +1,8 @@
-import { Sn as Approver, T as Policy, Un as Decision, Wt as Instant, ar as AuthorizationDetail, fr as Membership, hr as Subject, mt as TokenSigner, nt as MembershipSource, ot as RelationSource } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, Kt as Instant, gr as Membership, gt as TokenSigner, lr as AuthorizationDetail, qn as Decision, rt as MembershipSource, st as RelationSource, wn as Approver, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { M as AppData, f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DLvhVm1r.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-B2efzoSX.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-CqcsNCaN.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-CDVXR6YD.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {
@@ -210,7 +210,7 @@ declare function memoryIdempotencyStore(): IdempotencyStore;
 type ApprovalsHandlerOptions = {
   readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
   /**
-   * Refuse the principal even on grants that set `approval: { distinct: false
+   * Refuse the principal even on grants that set `approval: { mode: "confirm"
    * }`.
    */
   readonly requireDistinctApprover?: boolean;
@@ -341,10 +341,11 @@ type ApproverRelationsOptions = {
   readonly now?: Instant;
 };
 /**
- * The relation approvers of `request` that `subject` holds on its resource,
- * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
- * through `relations` by the request's resource id; a request without an id, a
- * missing source or a read that fails holds nothing.
+ * The relation and `manager()` approvers of `request` that `subject` holds,
+ * keyed by `approverRelationKey` and `approverManagerKey`, for
+ * `ApprovalVerdict.relations`. Relation reads go through `relations` by the
+ * request's resource id, manager reads by the requester's principal id; a
+ * request without an id, a missing source or a read that fails holds nothing.
  */
 declare function approverRelations(request: ApprovalRequest, subject: Subject, options: ApproverRelationsOptions): Promise<readonly string[]>;
 //#endregion
@@ -386,8 +387,13 @@ declare function vouchApproval(store: ApprovalStore, token: string, verdict: {
   readonly note?: string;
 }): Promise<ApprovalRequest>;
 declare function inspectApproval(store: ApprovalStore, token: string, at?: Instant): Promise<ApprovalInspectResult>;
-/** Inspects `token` and, when it is approved, consumes it so it resumes once. */
-declare function consumeApproval(store: ApprovalStore, token: string, at?: Instant): Promise<ApprovalInspectResult>;
+/**
+ * Inspects `token` and, when it is approved, consumes it so it resumes once. A
+ * request opened under a `fingerprint` is consumed only under the same one.
+ */
+declare function consumeApproval(store: ApprovalStore, token: string, at?: Instant, options?: {
+  readonly fingerprint?: string | undefined;
+}): Promise<ApprovalInspectResult>;
 /**
  * Applies a resume token to a decision. The token only matters when the
  * decision is `approval-required` and the token is the one this call was

package/dist/{index-Cay5-Kvx.d.ts → index-CdUTE6qd.d.ts}

@@ -1,14 +1,14 @@
-import { Ar as SqlFunctionCondition, C as MembershipFixture, D as PolicyDelegation, G as CustomRoleSource, I as SeparationConflict, Kn as DenialReason, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, T as Policy, Tr as OpaqueCondition, Un as Decision, Ut as InstanceHandle, V as VocabularyFromInput, Wn as Denial, Wt as Instant, Y as EntitlementSource, Yt as LocalSnapshotManifest, Z as JwtClaims, Zt as Snapshot, _n as PolicyScopesInput, c as BreakGlassOptions, cn as DeliveryEvent, ct as SnapshotSource, fr as Membership, ft as TenantSettings, g as GrantCondition, h as Grant, hr as Subject, i as ApprovalOption, it as RelationGroup, j as PolicyVocabulary, k as PolicyOptions, kr as SqlFunctionArg, lr as Delegation, mt as TokenSigner, nn as AccessEvent, nt as MembershipSource, on as DecisionEvent, ot as RelationSource, pn as SinkEvent, pr as Principal, s as AssuranceRequirement, sr as CustomRole, st as SettingsSource, vn as Scope, xr as ConditionRef } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, A as PolicyOptions, E as Policy, F as RoleOptions, Gt as InstanceHandle, H as VocabularyFromInput, Jn as Denial, K as CustomRoleSource, Kt as Instant, L as SeparationConflict, M as PolicyVocabulary, Nr as SqlFunctionArg, O as PolicyDelegation, P as RoleBinding, Pr as SqlFunctionCondition, Q as JwtClaims, Tr as ConditionRef, X as EntitlementSource, Xn as DenialReason, Zt as LocalSnapshotManifest, _ as GrantCondition, _r as Principal, a as ApprovalOption, at as RelationGroup, bn as Scope, c as AssuranceRequirement, cn as DecisionEvent, ct as SettingsSource, dr as CustomRole, g as Grant, gr as Membership, gt as TokenSigner, hn as SinkEvent, in as AccessEvent, kr as OpaqueCondition, l as BreakGlassOptions, lt as SnapshotSource, mt as TenantSettings, pr as Delegation, qn as Decision, rt as MembershipSource, st as RelationSource, un as DeliveryEvent, w as MembershipFixture, yn as PolicyScopesInput, yr as Subject, z as SupportAccessOptions } from "./policy-types-D-GwfQTc.js";
 import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
-import { o as PolicyDocument } from "./hosted-DVxlLZMe.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
-import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-ffY4CMd9.js";
+import { o as PolicyDocument } from "./hosted-BFNXwcjd.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
+import { n as PermDockWrap } from "./wrap-BHGA-SMM.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
-import { n as VersionCache } from "./version-cache-Df11C2Qp.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-B5zoUW_O.js";
+import { n as VersionCache } from "./version-cache-DzNKWiI6.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-ogbVkyeo.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
 type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
@@ -206,8 +206,9 @@ declare function composeMemberships(sources: readonly MembershipSource[]): Membe
  * latest membership change is stale for the policy's `fresh` permissions, or
  * with `onStale: 'reread'` has its memberships read from `source` instead. With
  * `versions`, an instance with intent `read` takes the version from that
- * process-wide cache, so concurrent instances share one read and a token issued
- * within its `maxStaleMs` needs none; intent `write` always reads.
+ * process-wide cache, so concurrent instances share one read; a token's
+ * `authz_ver` seeds it dated by `iat`, so a token issued within its
+ * `maxStaleMs` needs none. Intent `write` always reads.
  */
 declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
   readonly version?: MembershipSource["version"];

package/dist/{index-Dj2qF9VC.d.ts → index-Dfv9Toct.d.ts}

@@ -1,4 +1,4 @@
-import { J as DecisionSink, ht as TokenVerifier, nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
+import { Y as DecisionSink, _t as TokenVerifier, rt as MembershipSource } from "./policy-types-D-GwfQTc.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";

package/dist/{index-CV-7DWeD.d.ts → index-rFp6X_QP.d.ts}

@@ -1,8 +1,8 @@
-import { J as DecisionSink, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Un as Decision, hr as Subject, ht as TokenVerifier, j as PolicyVocabulary, jt as CredentialKind, kt as Credential, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, st as SettingsSource } from "./policy-types-DGIO_gxq.js";
+import { At as ApiKeyPrincipal, E as Policy, M as PolicyVocabulary, Nt as CredentialKind, W as CredentialVerifier, Y as DecisionSink, _r as Principal, _t as TokenVerifier, an as AuthEvent, ct as SettingsSource, gt as TokenSigner, ht as TokenFailureCause, jt as Credential, qn as Decision, wt as SupportSession, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
-import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CyRN0-Cd.js";
+import { _ as PrincipalSource } from "./permdock-ffY4CMd9.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-TpzkEKgJ.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-3OnXjZ2D.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are

package/dist/index.d.ts

@@ -1,24 +1,26 @@
-import { $ as LimitRemaining, $n as Quota, $t as SnapshotGrant, A as PolicyScopes, An as Grantee, Ar as SqlFunctionCondition, At as CredentialDecision, B as ValidateMode, Bn as relation, Bt as decideCredential, C as MembershipFixture, Cn as ApproverInput, Cr as MemberOfCondition, Ct as SupportSessionDecision, D as PolicyDelegation, Dn as anyOf, Dr as RelatedHop, Dt as parseSupportSession, E as PolicyAppDataSchemas, En as allOf, Er as RelatedCondition, Et as decideSupportSession, F as RoleScope, Fn as anyone, Fr as isSqlFunctionField, Ft as CredentialPolicyViolation, G as CustomRoleSource, Gn as DenialDetails, Gt as LocalCustomRoleTable, H as WireValidity, Hn as ApprovalRequiredDecision, Ht as parseCredential, I as SeparationConflict, In as assurance, It as CredentialRequest, J as DecisionSink, Jn as ExplainedDecision, Jt as LocalRowValue, K as CustomRoleSourceFactory, Kn as DenialReason, Kt as LocalMembershipRows, L as SubjectOf, Ln as authenticated, Lt as DecideCredentialOptions, M as PrincipalOf, Mn as InheritGrantee, Mr as isCondition, Mt as CredentialPermission, N as RoleBinding, Nn as RelationGrantee, Nr as isConditionDate, Nt as CredentialPermissionInput, O as PolicyOAuthScope, On as holder, Or as RestrictedAncestors, Ot as ApiKeyPrincipal, P as RoleOptions, Pn as actor, Pr as isConditionRef, Pt as CredentialPolicy, Q as LimitConsumeInput, Qn as Obligation, Qt as SnapshotAssignable, R as SupportAccessOptions, Rn as inherit, Rt as credentialDelegation, S as HostedGrantRef, Sn as Approver, Sr as ConditionValue, St as SupportSession, T as Policy, Tn as UserApprover, Tt as SupportSessionRequest, U as CredentialVerifier, Un as Decision, Vn as AppObligation, Vt as isFeedId, W as CustomRoleContext, Wn as Denial, X as Intent, Xn as LimitDetail, Xt as LocalSnapshotRows, Y as EntitlementSource, Yn as GrantedDecision, Yt as LocalSnapshotManifest, Zn as MatchedGrant, Zt as Snapshot, _ as GrantLimit, _n as PolicyScopesInput, _r as ActorKind, _t as VerifiedToken, a as ApprovalRequirement, an as CredentialEvent, ar as AuthorizationDetail, at as RelationHolder, b as GrantScope, bn as ScopeNames, br as Condition, bt as WhereCompiler, c as BreakGlassOptions, cn as DeliveryEvent, cr as CustomRoleGrant, ct as SnapshotSource, d as ClosureContext, dn as EmailCategory, dt as SubjectResolver, en as SnapshotNotEntitled, er as Trace, et as LimitStore, f as ClosureGrantFn, fn as MembershipEvent, fr as Membership, ft as TenantSettings, g as GrantCondition, gr as VerifiedClaims, gt as VerificationFailure, h as Grant, hn as WireDenial, hr as Subject, ht as TokenVerifier, i as ApprovalOption, in as AutomationEvent, ir as Assurance, it as RelationGroup, jn as GranteeInput, jr as hasConditionOp, jt as CredentialKind, kn as user, kr as SqlFunctionArg, kt as Credential, l as BreakGlassRequirements, ln as DeliveryFailureCause, lr as Delegation, lt as SourceContext, m as DelegationTarget, mn as WireDecision, mr as SharedCustomRole, mt as TokenSigner, n as ApprovalEscalation, nn as AccessEvent, nr as TraceSkipReason, nt as MembershipSource, o as ApprovalStage, on as DecisionEvent, or as Binding, ot as RelationSource, p as DelegationInput, pn as SinkEvent, pr as Principal, pt as TokenFailureCause, q as DecisionProvider, qn as DeniedDecision, qt as LocalRowColumn, r as ApprovalMode, rn as AuthEvent, rr as Actor, rt as RelationChain, s as AssuranceRequirement, sn as DeliveryChannel, sr as CustomRole, st as SettingsSource, t as ActivationOption, tn as SnapshotScope, tr as TraceSkip, tt as MemberEntry, u as BreakGlassSpec, un as DirectoryEvent, ur as GnapAccess, ut as SourceMemo, v as GrantMeta, vn as Scope, vr as AdapterId, vt as VersionContext, w as ObligationInput, wn as PermissionApprover, wr as MemberOfParent, wt as SupportSessionPolicy, x as GrantValidity, xn as AnyOfApprover, xr as ConditionRef, xt as DecideSupportSessionOptions, y as GrantOptions, yn as ScopeDeclaration, yr as MembershipVia, yt as VersionQuery, z as SupportConsent, zn as plan, zt as credentialPolicyViolation } from "./policy-types-DGIO_gxq.js";
+import { $ as LimitConsumeInput, $n as GrantedDecision, $t as Snapshot, An as anyOf, Ar as RelatedCondition, At as ApiKeyPrincipal, B as SupportConsent, Bn as assurance, Bt as credentialDelegation, C as HostedGrantRef, Cn as AnyOfApprover, Cr as MembershipVia, Ct as DecideSupportSessionOptions, D as PolicyAppDataSchemas, Dn as PermissionApprover, Dr as MemberOfCondition, Dt as SupportSessionRequest, E as Policy, En as ManagerApprover, Er as ConditionValue, Et as SupportSessionPolicy, F as RoleOptions, Fn as GranteeInput, Fr as hasConditionOp, Ft as CredentialPermissionInput, G as CustomRoleContext, Gn as AppObligation, Hn as inherit, Ht as decideCredential, I as RoleScope, In as InheritGrantee, Ir as isCondition, It as CredentialPolicy, J as DecisionProvider, Jn as Denial, Jt as LocalMembershipRows, K as CustomRoleSource, Kn as ApprovalRequiredDecision, L as SeparationConflict, Ln as RelationGrantee, Lr as isConditionDate, Lt as CredentialPolicyViolation, Mn as manager, Mr as RestrictedAncestors, Mt as CredentialDecision, N as PrincipalOf, Nn as user, Nr as SqlFunctionArg, Nt as CredentialKind, O as PolicyDelegation, On as UserApprover, Or as MemberOfParent, Ot as decideSupportSession, P as RoleBinding, Pn as Grantee, Pr as SqlFunctionCondition, Pt as CredentialPermission, Qn as ExplainedDecision, Qt as LocalSnapshotRows, R as SubjectOf, Rn as actor, Rr as isConditionRef, Rt as CredentialRequest, S as GrantValidity, Sn as ScopeNames, Sr as AdapterId, St as WhereCompiler, T as ObligationInput, Tn as ApproverInput, Tr as ConditionRef, Tt as SupportSessionDecision, U as WireValidity, Un as plan, Ut as isFeedId, V as ValidateMode, Vn as authenticated, Vt as credentialPolicyViolation, W as CredentialVerifier, Wn as relation, Wt as parseCredential, X as EntitlementSource, Xn as DenialReason, Xt as LocalRowValue, Y as DecisionSink, Yn as DenialDetails, Yt as LocalRowColumn, Z as Intent, Zn as DeniedDecision, Zt as LocalSnapshotManifest, _ as GrantCondition, _n as WireDenial, _r as Principal, _t as TokenVerifier, a as ApprovalOption, an as AuthEvent, ar as TraceSkip, at as RelationGroup, b as GrantOptions, bn as Scope, br as VerifiedClaims, bt as VersionContext, c as AssuranceRequirement, cn as DecisionEvent, cr as Assurance, ct as SettingsSource, d as BreakGlassSpec, dn as DeliveryFailureCause, dr as CustomRole, dt as SourceContext, en as SnapshotAssignable, er as LimitDetail, et as LimitRemaining, f as ClosureContext, fn as DirectoryEvent, fr as CustomRoleGrant, ft as SourceMemo, g as Grant, gn as WireDecision, gr as Membership, gt as TokenSigner, h as DelegationTarget, hn as SinkEvent, ht as TokenFailureCause, i as ApprovalMode, in as AccessEvent, ir as Trace, it as RelationChain, j as PolicyScopes, jn as holder, jr as RelatedHop, jt as Credential, k as PolicyOAuthScope, kn as allOf, kt as parseSupportSession, l as BreakGlassOptions, ln as DeliveryChannel, lr as AuthorizationDetail, lt as SnapshotSource, m as DelegationInput, mn as MembershipEvent, mr as GnapAccess, mt as TenantSettings, n as ApprovalCombine, nn as SnapshotNotEntitled, nr as Obligation, nt as MemberEntry, o as ApprovalRequirement, on as AutomationEvent, or as TraceSkipReason, ot as RelationHolder, p as ClosureGrantFn, pn as EmailCategory, pr as Delegation, pt as SubjectResolver, q as CustomRoleSourceFactory, qn as Decision, qt as LocalCustomRoleTable, r as ApprovalEscalation, rn as SnapshotScope, rr as Quota, rt as MembershipSource, s as ApprovalStage, sn as CredentialEvent, sr as Actor, st as RelationSource, t as ActivationOption, tn as SnapshotGrant, tr as MatchedGrant, tt as LimitStore, u as BreakGlassRequirements, un as DeliveryEvent, ur as Binding, ut as SourceCall, v as GrantLimit, vr as SharedCustomRole, vt as VerificationFailure, w as MembershipFixture, wn as Approver, wr as Condition, wt as SupportSession, x as GrantScope, xn as ScopeDeclaration, xr as ActorKind, xt as VersionQuery, y as GrantMeta, yn as PolicyScopesInput, yr as Subject, yt as VerifiedToken, z as SupportAccessOptions, zn as anyone, zr as isSqlFunctionField, zt as DecideCredentialOptions } from "./policy-types-D-GwfQTc.js";
 import { A as RESOURCE_NAME, C as ResourceRelation, D as RowOf, E as ResourceXTree, M as AppData, N as AppDataSchema, O as PERMISSION_ROW, P as MetaValue, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, j as RESOURCE_X, k as POLICY_SCOPES, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-DEJ5j4mR.js";
-import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-Cay5-Kvx.js";
+import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-CdUTE6qd.js";
 import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-CprAPN3w.js";
-import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-DVxlLZMe.js";
-import { n as PermDockValidationError } from "./validation-error-uvp-kyfO.js";
-import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { a as ApprovalPolicyValidation, c as validateApprovalPolicy, i as ApprovalPolicySource, n as ApprovalPolicy, o as approvalPolicies, r as ApprovalPolicyProblem, s as memoryApprovalPolicySource, t as ApprovalPolicies } from "./approval-policies-oNnckT12.js";
+import { A as PermissionState, C as CustomRoleOwner, D as InstanceCacheStats, E as InstanceCacheOptions, O as instanceCache, S as memoryLimitStore, T as InstanceCacheKey, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, k as PermissionCheck, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as InstanceCache, x as limits, y as PermittedIdsOptions } from "./permdock-ffY4CMd9.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-BFNXwcjd.js";
+import { n as PermDockValidationError } from "./validation-error-Dx8PipbO.js";
+import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-DxXB54Wu.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-BHGA-SMM.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { t as approvalFingerprint } from "./token-D6pWn8Uj.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-BaUXHM1N.js";
+import { i as memoryVersionCache, n as VersionCache, r as VersionCacheStats, t as MemoryVersionCacheOptions } from "./version-cache-DzNKWiI6.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
-import { i as memoryVersionCache, n as VersionCache, r as VersionCacheStats, t as MemoryVersionCacheOptions } from "./version-cache-Df11C2Qp.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Di9tiUvi.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-C6Jg75xq.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-B5zoUW_O.js";
-import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-c7Xo_2Cu.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-BZ_veK9o.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-Bfa_wD1h.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-ogbVkyeo.js";
+import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-i1EJ3Eb1.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BKtC_8PG.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-8Yx2CchM.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CCmbhnxP.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleContext, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type Intent, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MemoryVersionCacheOptions, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SourceContext, type SourceMemo, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type VersionCache, type VersionCacheStats, type VersionContext, type VersionQuery, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DvjTQNuO.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalCombine, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleContext, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleOwner, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceCache, type InstanceCacheKey, type InstanceCacheOptions, type InstanceCacheStats, type InstanceOptions, type Intent, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type ManagerApprover, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MemoryVersionCacheOptions, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionState, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SourceCall, type SourceContext, type SourceMemo, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type VersionCache, type VersionCacheStats, type VersionContext, type VersionQuery, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalFingerprint, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, instanceCache, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, manager, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,10 +1,10 @@
 import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
-import { C as memoryLimitStore, D as memoryApprovalPolicySource, F as memorySnapshotSource, I as sqlFunction, M as memoryEntitlementSource, N as memoryMembershipSource, O as validateApprovalPolicy, P as memorySettingsSource, S as limits, T as approvalPolicies, _ as arazzoFindings, a as normalizeMembership, b as signPolicyDocument, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryCustomRoleSource, k as defineOperations, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as stripeEntitlementSource, x as memoryRelationSource, y as memoryVersionCache } from "./src-C_pi2Rnh.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-B4r0N_Uz.js";
+import { a as deny, n as role, p as opaque, r as allow, t as normalizeAssurance } from "./role-builder-CMW4wWzn.js";
+import { A as memoryCustomRoleSource, C as limits, E as approvalPolicies, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as memoryApprovalPolicySource, P as memorySnapshotSource, S as memoryRelationSource, T as stripeEntitlementSource, _ as arazzoFindings, a as normalizeMembership, b as instanceCache, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, k as validateApprovalPolicy, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as memoryLimitStore, x as signPolicyDocument, y as memoryVersionCache } from "./src-Brzq_0in.js";
+import { d as manager, f as user, n as anyOf, o as holder, t as allOf } from "./approvers-BaNwKYgd.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
@@ -14,25 +14,29 @@ import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomatio
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 import { n as parseSupportSession, t as decideSupportSession } from "./support-session-BsmPCbz8.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Dke-9rd1.js";
-import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-CLQ8__GF.js";
+import { a as normalizeApproval } from "./approval-normalize-CUjgSsOl.js";
+import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
-import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CVXmRILq.js";
-import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-DuWf1cT3.js";
-import { t as whoCan } from "./who-can-BoDJm0Nc.js";
-import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
-import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-DlCdCM_8.js";
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-waouw2V-.js";
+import { n as isOperationRisk, t as OPERATION_RISKS } from "./operation-risks-BKOcTv8J.js";
+import { t as defineOperations } from "./operations-Bm9HFecz.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-Czbj7thS.js";
+import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-BWa71my8.js";
+import { t as approvalFingerprint } from "./token-DaMnIU9O.js";
+import { t as whoCan } from "./who-can-KhVWMxtf.js";
+import { n as parseSnapshot } from "./snapshot-DN_8J27z.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-BKrqUDVk.js";
 import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DEiCF4ah.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-BvjivVb9.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CxcSMQgl.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-D-_WrdKu.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
+import { t as definePermissions } from "./permissions-BaoLxy66.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-D9_vh372.js";
 import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-TcjRBgIs.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-BqX94r07.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CyyyvCsL.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-zN6T9fxe.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-B3Hj4puZ.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalFingerprint, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, instanceCache, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, manager, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-BUo2G-FI.js → init-CNJ8lLjo.js}

@@ -1,8 +1,8 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { t as addLine } from "./peer-Q0fuZ6hx.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-pPrVyGU5.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
+import { t as addLine } from "./peer-BuK9F53f.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts

package/dist/{init-C6cWP3xW.js → init-DS3PEsCG.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-BjLzeFpp.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-pPrVyGU5.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-DXjoTVbS.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BUo2G-FI.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-CNJ8lLjo.js"), import("./peer-n-swIV4H.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BUo2G-FI.js");
+		const { runPreset } = await import("./init-CNJ8lLjo.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BUo2G-FI.js");
+		const { runPreset } = await import("./init-CNJ8lLjo.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{instance-options-CoHn-0e8.d.ts → instance-options-2sFGSdsf.d.ts}

@@ -1,6 +1,6 @@
-import { o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { o as PermDockOptions } from "./permdock-ffY4CMd9.js";
 //#region src/core/instance-options.d.ts
-type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
+type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals" | "instances";
 /**
  * The data sources an adapter passes through to every instance it creates. Each
  * adapter's options type extends this, so a source added to core reaches every

package/dist/{instance-snapshot-DuWf1cT3.js → instance-snapshot-BWa71my8.js}

@@ -7,15 +7,15 @@ import { n as isThenable } from "./thenable-BNSM1U2R.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { p as nowSeconds, s as instantAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-CDB6_keF.js";
+import { c as rootScope, d as scopeList, i as keepsPermission, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-aK4T_5WU.js";
 import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-CLQ8__GF.js";
-import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
-import { t as buildSnapshot } from "./snapshot-CXlzi69u.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-cV_wwPb8.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-Czbj7thS.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-BP-k4vRJ.js";
+import { t as buildSnapshot } from "./snapshot-DN_8J27z.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -25,8 +25,6 @@ function identity(membership) {
 		membership.id ?? null,
 		within,
 		membership.on ?? null,
-		membership.tenant ?? null,
-		membership.team ?? null,
 		membership.via ?? null,
 		membership.expiresAt ?? null,
 		membership.grantedBy ?? null,
@@ -114,14 +112,19 @@ function asMembershipSource(input) {
 * latest membership change is stale for the policy's `fresh` permissions, or
 * with `onStale: 'reread'` has its memberships read from `source` instead. With
 * `versions`, an instance with intent `read` takes the version from that
-* process-wide cache, so concurrent instances share one read and a token issued
-* within its `maxStaleMs` needs none; intent `write` always reads.
+* process-wide cache, so concurrent instances share one read; a token's
+* `authz_ver` seeds it dated by `iat`, so a token issued within its
+* `maxStaleMs` needs none. Intent `write` always reads.
 */
 function claimsFirst(source, options = {}) {
 	const inner = asMembershipSource(source);
 	const read = options.version ?? inner.version?.bind(inner);
 	const versions = options.versions;
-	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => versions.current(principal, () => read(principal, context), { live: context?.intent !== "read" });
+	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => {
+		const live = context?.intent !== "read";
+		if (!live && typeof principal.authzVersion === "number") versions.seed(principal.id, principal.authzVersion, instantAt(principal.issuedAt ?? 0));
+		return versions.current(principal, () => read(principal, context), { live });
+	};
 	return {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Z as JwtClaims, _t as VerifiedToken, hr as Subject, ht as TokenVerifier, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DsHGPtkR.js";
-import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { Q as JwtClaims, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, ht as TokenFailureCause, yr as Subject, yt as VerifiedToken } from "../policy-types-D-GwfQTc.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BZ_veK9o.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-Ck1KOfug.js";
+import { t as memoryReplayStore } from "../replay-E5X9E1lC.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /**

package/dist/jwt/index.js

@@ -2,11 +2,11 @@ import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { o as epochSeconds, p as nowSeconds } from "../time-nR1JesoH.js";
 import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-BqX94r07.js";
+import { t as anonymousSubject } from "../subject-C7RddW0G.js";
+import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-zN6T9fxe.js";
 import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as loadJose } from "../load-jose-DZ4dnjri.js";
-import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-C-nv08_n.js";
+import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-PQwHynxV.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 //#region src/jwt/dpop.ts
 const DPOP_WINDOW_SECONDS = 60;

package/dist/{kernel-BD8QuMnv.js → kernel-30Z2zM_d.js}

@@ -1,17 +1,17 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { i as stepUpOf } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 import { a as deniedMessage } from "./errors-B6R_lg2a.js";
-import { t as actorMayCallTool } from "./delegation-CDB6_keF.js";
-import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { k as activate } from "./evaluate-BAmf_AQd.js";
+import { t as actorMayCallTool } from "./delegation-aK4T_5WU.js";
+import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { k as activate } from "./evaluate-Czbj7thS.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as delegationAllows } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-BvjivVb9.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DJicaG6f.js";
-import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
+import { n as delegationAllows } from "./where-scope-BKrqUDVk.js";
+import { l as withApp } from "./permdock-D-_WrdKu.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DmqGy63f.js";
+import { n as resolveOrNull } from "./build-instance-BFMFQdE_.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-OHikyRqV.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-DM6_jY1n.js";
 //#region src/agent/denied-text.ts
 /**
 * The hook's text, or `event.text` when there is no hook or it throws or

package/dist/kysely/index.d.ts

@@ -1,7 +1,7 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { f as WhereResult } from "../permdock-ffY4CMd9.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
+import { s as MembershipsMapping } from "../compile-DBm0ub4p.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/kysely/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
-import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { n as compileWhere, r as escapeLike } from "../compile-B_oJqmIg.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/kysely/to-where.ts
 function ident(name) {

package/dist/{load-DjSU5KXO.js → load-BaEamml-.js}

@@ -1,5 +1,5 @@
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";

package/dist/load-CjnlPxpL.js

@@ -0,0 +1 @@
+export { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";

package/dist/{login-D1MHOomI.js → login-BgK5Jloo.js}

@@ -1,11 +1,11 @@
 import { h as secondsAt, i as dateAt, s as instantAt } from "./time-nR1JesoH.js";
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { n as httpRequest } from "./http-DOL33cO0.js";
-import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
+import { n as httpRequest } from "./http-DhMWeB_h.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-j3Eu-j4h.js";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 //#region src/cli/cloud/loopback.ts