permdock 0.2.0 → 0.3.1

package/dist/convex/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DAqevpNk.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DPdqI50v.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 //#region src/convex/types.d.ts
 type ConvexCtxLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
 import { n as tenantScope, t as actorFrom } from "../adapter-context-mlWsVGGg.js";
 //#region src/convex/create.ts

package/dist/{create-BWyx3jua.d.ts → create-B1d519XK.d.ts}

@@ -1,9 +1,9 @@
-import { C as Policy, Cr as Actor, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Tt as Snapshot, Yn as Decision, jr as JsonWebKeyLike, ln as PermDock, pn as SnapshotOptions } from "./policy-CFZAr_Al.js";
+import { C as Policy, Cr as Actor, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Tt as Snapshot, Yn as Decision, jr as JsonWebKeyLike, ln as PermDock, pn as SnapshotOptions } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "./types-vKyAMtcX.js";
-import { t as ApprovalHint } from "./errors-DAqevpNk.js";
-import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
-import { r as PdpFactory } from "./types-BVyImy5I.js";
+import { f as ApprovalStore } from "./types-aqOHTHcp.js";
+import { t as ApprovalHint } from "./errors-DPdqI50v.js";
+import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
+import { r as PdpFactory } from "./types-DxiCGmmd.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);

package/dist/{create-CPhDL6qx.js → create-CMwIl-w2.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
 import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
 import { n as problemDetails } from "./problem-details-_AMOYz-w.js";
-import { r as challengeScope, t as createPermDock$1 } from "./permdock-CzqXjCpU.js";
+import { r as challengeScope, t as createPermDock$1 } from "./permdock-CbgvLnuo.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as hasCredentials } from "./http-SO7qGttf.js";
 import { a as notFoundProblem, l as unauthenticatedProblem, o as problemFromDecision, r as decisionResponse } from "./problem-B43ztKIm.js";

package/dist/{describe-PdoqESvg.d.ts → describe-DMYiCjJV.d.ts}

@@ -1,4 +1,4 @@
-import { Qn as DeniedDecision, Yn as Decision, Zn as DenialReason } from "./policy-CFZAr_Al.js";
+import { Qn as DeniedDecision, Yn as Decision, Zn as DenialReason } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {

package/dist/{diff-B8Tunc3o.js → diff-2VaeChzX.js}

@@ -1,9 +1,9 @@
 import { i as findPermission } from "./permissions-DVoF6dMt.js";
-import { _ as memoryRoleSource } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource } from "./src-BDwEZWrZ.js";
 import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { t as createPermDock } from "./permdock-CbgvLnuo.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import { t as parseCatalog } from "./parse-BuyjxhZV.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";

package/dist/{diff-CzqLxZ77.js → diff-C9RDjjhs.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/diff.ts
 function diff(ctx) {
@@ -30,7 +30,7 @@ function diff(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./diff-B8Tunc3o.js")).runDiff({
+			const result = await (await import("./diff-2VaeChzX.js")).runDiff({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				sources: parsed._,

package/dist/{doctor-rOr-4ZfS.js → doctor-Djh6JDEk.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { n as ask, t as CANCELLED } from "./prompt-CXYhLfsS.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/doctor.ts
@@ -34,7 +34,7 @@ function doctor(ctx) {
 				}
 				fix = answer;
 			}
-			const result = await (await import("./doctor-WpvG6p4k.js")).runDoctor({
+			const result = await (await import("./doctor-DvH0IQff.js")).runDoctor({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				only: listArg(rawArgs, "only"),

package/dist/{doctor-WpvG6p4k.js → doctor-DvH0IQff.js}

@@ -6,20 +6,20 @@ import { i as describeError } from "./errors-CWfoNg9N.js";
 import { r as DOCTOR_REPORT_SCHEMA } from "./version-BvacVTZR.js";
 import { a as sqlFiles, i as rel, n as doctorSrcPath, r as listSourceFiles } from "./files-DWUN9PzI.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { r as runCollect } from "./collect-DSTE3ml9.js";
 import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { l as keptKeys, n as PERMDOCK_SCHEMA } from "./sources-B0UvrJ21.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-4p0-4xQm.js";
 import "./markers-B0hYLvMD.js";
 import { t as createStyle } from "./style-CTm1AXDT.js";
 import { i as runSkillsInstall } from "./skills-Biq5uup3.js";
-import { a as pd006, c as pd022, d as group, h as tableKey, i as pd005, l as pd028, n as supabaseConfig, o as pd009, p as sqlStatements, r as MIGRATION_DIRS, s as pd012, t as pd045, u as pd040 } from "./supabase-config-Bs44dare.js";
-import { m as compileGrants } from "./rls-fields-BMasREhR.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, u as pd036 } from "./usage-DG1oeCca.js";
-import { C as pd035, E as policyOf, S as pd034, T as pd055, _ as pd029, a as pd004, b as pd032, c as pd018, d as pd021, f as pd023, g as pd027, h as pd026, i as pd003, l as pd019, m as pd025, n as collectedOf, o as pd016, p as pd024, r as pd002, s as pd017, u as pd020, v as pd030, w as pd037, x as pd033, y as pd031 } from "./doctor-collect-ByfYlNv1.js";
-import { a as ownershipRules, i as guardedTables } from "./rls-ownership-B5Lkq62W.js";
-import { a as supabaseHookManifest, c as attrsPlan, h as partPath, n as hookOut, s as pd039 } from "./supabase-hook-BuxLQLpU.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-C7kLglqX.js";
-import { t as supautilsRejections } from "./supautils-DYZnzRWV.js";
+import { a as pd006, c as pd022, d as group, h as tableKey, i as pd005, l as pd028, n as supabaseConfig, o as pd009, p as sqlStatements, r as MIGRATION_DIRS, s as pd012, t as pd045, u as pd040 } from "./supabase-config-Bj3iDH2I.js";
+import { m as compileGrants } from "./rls-fields-CZOMlwHl.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, u as pd036 } from "./usage-ItS7nLcl.js";
+import { C as pd035, E as policyOf, S as pd034, T as pd055, _ as pd029, a as pd004, b as pd032, c as pd018, d as pd021, f as pd023, g as pd027, h as pd026, i as pd003, l as pd019, m as pd025, n as collectedOf, o as pd016, p as pd024, r as pd002, s as pd017, u as pd020, v as pd030, w as pd037, x as pd033, y as pd031 } from "./doctor-collect-CjdO0wQX.js";
+import { a as ownershipRules, i as guardedTables } from "./rls-ownership-DcYlZ09B.js";
+import { a as supabaseHookManifest, c as attrsPlan, h as partPath, n as hookOut, s as pd039 } from "./supabase-hook-ntETYCQu.js";
+import { r as staleFiles, t as powersyncFiles } from "./powersync-Dv1_aWF7.js";
+import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/cli/doctor-assignments.ts

package/dist/{doctor-collect-ByfYlNv1.js → doctor-collect-CjdO0wQX.js}

@@ -1,19 +1,20 @@
 import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
 import { h as separationConflicts } from "./policy-xyWg7QdR.js";
 import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { b as validateCustomRole } from "./permdock-CzqXjCpU.js";
+import { b as validateCustomRole } from "./permdock-CbgvLnuo.js";
 import { o as parseCredential } from "./credential-8P81ff4u.js";
-import { o as jsonSchemaOf, s as policyRowConditionKeys } from "./catalog-doc-Dsc9y7sd.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
 import { a as sqlFiles, n as doctorSrcPath } from "./files-DWUN9PzI.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { r as runCollect } from "./collect-DSTE3ml9.js";
 import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
-import { n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
-import { w as graphSqlName } from "./rls-shared-aOQ4hGTO.js";
-import { W as contextRefs, h as tableFor, p as commandFor } from "./rls-fields-BMasREhR.js";
-import { d as rowConditionMessage, l as helperTablePolicies, n as graphPlan, o as ROW_CONDITION_FIX } from "./rls-graph-pc9fuXYm.js";
-import { t as runUsage } from "./usage-DG1oeCca.js";
+import "./sources-4p0-4xQm.js";
+import { n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
+import { T as graphSqlName } from "./rls-shared-Cewd_-zI.js";
+import { W as contextRefs, h as tableFor, p as commandFor } from "./rls-fields-CZOMlwHl.js";
+import { d as rowConditionMessage, l as helperTablePolicies, n as graphPlan, o as ROW_CONDITION_FIX } from "./rls-graph-CHwx0V8q.js";
+import { t as runUsage } from "./usage-ItS7nLcl.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/doctor-collect.ts

package/dist/drizzle/index.d.ts

@@ -1,6 +1,6 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-CNnl6uIt.js";
+import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/elysia/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaCtx = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { i as parsedBody, n as hasCredentials } from "../http-SO7qGttf.js";
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-DAqevpNk.d.ts → errors-DPdqI50v.d.ts}

@@ -1,5 +1,5 @@
-import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-CFZAr_Al.js";
-import { t as Disclosure } from "./problem-details-CkL50EEf.js";
+import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-IB6yxpC3.js";
+import { t as Disclosure } from "./problem-details-DX075l9V.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */

package/dist/eve/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */

package/dist/eve/index.js

@@ -3,7 +3,7 @@ import { n as isApprovalError } from "../errors-DRnGZHzF.js";
 import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
 import { o as resolveApproval } from "../helpers-H_KARDVC.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { a as toRequest, i as sendResponse } from "../http-DPuDaChb.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,6 +1,6 @@
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as toRequest, r as sendResponse } from "../http-BIhmLfCc.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/fastify/create.d.ts
 type FastifyPermDockOptions<TUser = unknown> = ServerAdapterOptions<FastifyRequest, TUser>;

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { i as parsedBody, r as headersFrom, t as firstHeader } from "../http-SO7qGttf.js";
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{from-snapshot-C3sHpZNS.js → from-snapshot-CTLijvdm.js}

@@ -531,6 +531,7 @@ function fromSnapshot(snapshot, options = {}) {
 			});
 		},
 		assignableRoles(query) {
+			if (query?.scope === "global") return [];
 			const tenant = query?.tenant ?? subject.principal?.tenant;
 			const tree = snapshot.vocabulary?.roles;
 			if (snapshot.assignable !== void 0) return (assignableEntry(snapshot, tenant)?.roles ?? []).map((name) => findRole(tree, name) ?? synthesiseRole(name, { assignable: true }));

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { r as PermDockRevokedError } from "../errors-Cz5zn0mW.js";
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { r as bindKernel } from "../bind-VnYn2HKq.js";
+import { r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{index-CtE07CBF.d.ts → index-0nNqHspG.d.ts}

@@ -1,5 +1,5 @@
-import { C as Policy, Nr as Principal } from "./policy-CFZAr_Al.js";
-import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-9AWO9EGt.js";
+import { C as Policy, Nr as Principal } from "./policy-IB6yxpC3.js";
+import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-Cq_H8N_X.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-D3vbkoSI.d.ts → index-BNc7Wer_.d.ts}

@@ -1,4 +1,4 @@
-import { $ as AccessEvent, C as Policy, D as PolicyVocabulary, Dr as CustomRole, Gr as SqlFunctionArg, Kr as SqlFunctionCondition, Lr as ConditionRef, Mr as Membership, Nr as Principal, Pr as Subject, Tt as Snapshot, Vr as OpaqueCondition, Zn as DenialReason, bt as RelationSource, dt as LimitStore, gt as MembershipSource, h as Grant, kr as Delegation, ln as PermDock, pt as LocalSnapshotManifest, rt as DecisionEvent, st as EntitlementSource, w as PolicyDelegation, xt as RoleSource } from "./policy-CFZAr_Al.js";
+import { $ as AccessEvent, C as Policy, D as PolicyVocabulary, Dr as CustomRole, Gr as SqlFunctionArg, Kr as SqlFunctionCondition, Lr as ConditionRef, Mr as Membership, Nr as Principal, Pr as Subject, Tt as Snapshot, Vr as OpaqueCondition, Zn as DenialReason, bt as RelationSource, dt as LimitStore, gt as MembershipSource, h as Grant, kr as Delegation, ln as PermDock, pt as LocalSnapshotManifest, rt as DecisionEvent, st as EntitlementSource, w as PolicyDelegation, xt as RoleSource } from "./policy-IB6yxpC3.js";
 import { C as ResourceRelationInput, f as Permission, m as PermissionTree, n as ActionMeta, t as ActionList, w as ResourceRestricted, x as ResourceParent } from "./permissions-DttnqqxC.js";
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";

package/dist/{index-D6_cSa1z.d.ts → index-C7Tw7MaW.d.ts}

@@ -1,6 +1,6 @@
-import { Mr as Membership, Pr as Subject, Pt as TokenSigner, Yn as Decision, bt as RelationSource, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { Mr as Membership, Pr as Subject, Pt as TokenSigner, Yn as Decision, bt as RelationSource, ln as PermDock } from "./policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
-import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-vKyAMtcX.js";
+import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-aqOHTHcp.js";
 //#region src/approvals/errors.d.ts
 type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
 declare class ApprovalError extends Error {

package/dist/{index-A0YNL8jZ.d.ts → index-C8z4RjQV.d.ts}

@@ -1,4 +1,4 @@
-import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-CFZAr_Al.js";
+import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-IB6yxpC3.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";

package/dist/index.d.ts

@@ -1,16 +1,16 @@
-import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-CFZAr_Al.js";
+import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-IB6yxpC3.js";
 import { A as listPermissions, C as ResourceRelationInput, D as formerKeys, E as findPermission, M as resource, O as getResource, S as ResourceRelation, T as definePermissions, _ as ResourceLevel, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as MetaValue, f as Permission, g as ResourceInit, h as PrincipalRelation, i as DefinePermissionsOptions, j as mergePermissions, k as isPermission, l as FieldRelation, m as PermissionTree, n as ActionMeta, o as EdgeGroups, p as PermissionKind, r as ComputedRelation, s as EdgeMatch, v as ResourceLink, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permissions-DttnqqxC.js";
 import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-DA8a8zif.js";
-import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-D3vbkoSI.js";
-import { n as PermDockValidationError } from "./validation-error-CtF23SrC.js";
-import { n as requiredPlans } from "./problem-details-CkL50EEf.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DAqevpNk.js";
-import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
+import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-BNc7Wer_.js";
+import { n as PermDockValidationError } from "./validation-error-Ba264OaJ.js";
+import { n as requiredPlans } from "./problem-details-DX075l9V.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DPdqI50v.js";
+import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-Gs6TTVa-.js";
+import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-B1fZzIMf.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-PdoqESvg.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-DMYiCjJV.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BkGQNzAh.js";
-import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-Dq43tT1u.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-JLnaBH0S.js";
+import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-2kYTMWDv.js";
 export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { _ as listPermissions, a as formerKeys, b as resource, c as getResource, i as findPermission, n as definePermissions, p as isPermission, v as mergePermissions } from "./permissions-DVoF6dMt.js";
 import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-KYb4ntaz.js";
 import { S as opaque, _ as memoryLimitStore, a as definePolicy, d as normalizeApproval, f as normalizeAssurance, h as separationConflicts, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
-import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-BDwEZWrZ.js";
 import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-DT4AVyIg.js";
 import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
 import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
@@ -14,10 +14,10 @@ import { t as parseDuration } from "./duration-xK2jGFVc.js";
 import { C as isPlan, E as listRoles, S as findRole, T as listPlans, a as authenticated, b as definePlans, c as inherit, f as plan, i as assurance, n as anyone, p as relation, t as actor, w as isRole, x as defineRoles } from "./grantee-Cv5Sogfv.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
-import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CzqXjCpU.js";
+import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
 import { t as memoryRelations } from "./relations-cjOL01hZ.js";
 import { r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
 import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BrMozJCo.js";
 import { n as permittedIds, t as mayUse } from "./may-use-DndQ5tQ-.js";
 import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";

package/dist/{instance-options-BK_rNOSC.d.ts → instance-options-jARdwfPN.d.ts}

@@ -1,4 +1,4 @@
-import { un as PermDockOptions } from "./policy-CFZAr_Al.js";
+import { un as PermDockOptions } from "./policy-IB6yxpC3.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits";
 /**

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, Pt as TokenSigner, ct as JwtClaims, et as AuthEvent } from "../policy-CFZAr_Al.js";
-import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-9AWO9EGt.js";
-import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-Dq43tT1u.js";
-import { t as memoryReplayStore } from "../replay-sqBGMnNs.js";
+import { Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, Pt as TokenSigner, ct as JwtClaims, et as AuthEvent } from "../policy-IB6yxpC3.js";
+import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-Cq_H8N_X.js";
+import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-2kYTMWDv.js";
+import { t as memoryReplayStore } from "../replay-CYyiLiwO.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /** `on('auth')` causes: a verification failure, or one of the three capability checks. */

package/dist/{kernel-GSQnMz3O.js → kernel-_RRHmnMY.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
 import { t as describe } from "./describe-B_gVZEVi.js";
 import { a as deniedMessage } from "./errors-Cz5zn0mW.js";
-import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { t as createPermDock } from "./permdock-CbgvLnuo.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { t as mayUse } from "./may-use-DndQ5tQ-.js";
 import { l as storedApprovalToken, s as resumeDecision } from "./helpers-H_KARDVC.js";

package/dist/kysely/index.d.ts

@@ -1,6 +1,6 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-CNnl6uIt.js";
+import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/mcp/index.d.ts

@@ -1,11 +1,11 @@
-import { C as Policy, Nr as Principal, Pr as Subject } from "../policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, Pr as Subject } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as ApprovalHint } from "../errors-DAqevpNk.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as ApprovalHint } from "../errors-DPdqI50v.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ClientNames } from "../clients-C7zLFuWT.js";
-import { u as JwtSubjectOptions } from "../types-9AWO9EGt.js";
-import { o as OtelWrap } from "../types-vNSDF7Dq.js";
+import { u as JwtSubjectOptions } from "../types-Cq_H8N_X.js";
+import { o as OtelWrap } from "../types-QCuYJh4q.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */

package/dist/mcp/index.js

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { t as annotationsFor } from "../permissions-DVoF6dMt.js";
 import { a as wireDenials, i as stepUpOf } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
-import { i as scopesReaching, r as challengeScope } from "../permdock-CzqXjCpU.js";
+import { i as scopesReaching, r as challengeScope } from "../permdock-CbgvLnuo.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
 import { t as mayUse } from "../may-use-DndQ5tQ-.js";
@@ -11,7 +11,7 @@ import { c as protectedResourceMetadataUrl, n as bearerChallenge } from "../prob
 import { t as clientNameOf } from "../clients-DjU5ABMy.js";
 import { n as mapClaimsToSubject } from "../map-claims-Z4QZOiFF.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/mcp/subject.ts
 const DEFAULT_MCP_ACTOR_KIND = "mcp-client";

package/dist/nest/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { i as sendResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts

package/dist/nest/index.js

@@ -3,7 +3,7 @@ import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { a as socketConnection, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { a as socketConnection, r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
 import { i as toRequest$1, n as isServerResponse, r as sendResponse } from "../http-BIhmLfCc.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";

package/dist/next/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Tt as Snapshot, Yn as Decision, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Tt as Snapshot, Yn as Decision, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
-import { o as OtelWrap } from "../types-vNSDF7Dq.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DwQH8ufx.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { o as OtelWrap } from "../types-QCuYJh4q.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-B-LxUahj.js";
 import { ReactElement, ReactNode } from "react";
 //#region src/next/types.d.ts
 type NextSubjectInput = unknown;

package/dist/next/index.js

@@ -1,5 +1,5 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
 import { c as NO_GRANT, n as createEvaluationsHandler } from "../evaluations-tz6D9A2G.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-BPxgszlT.js";
+import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;