permdock 0.3.1 → 0.4.0

package/dist/index.d.ts

@@ -1,16 +1,18 @@
-import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-IB6yxpC3.js";
-import { A as listPermissions, C as ResourceRelationInput, D as formerKeys, E as findPermission, M as resource, O as getResource, S as ResourceRelation, T as definePermissions, _ as ResourceLevel, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as MetaValue, f as Permission, g as ResourceInit, h as PrincipalRelation, i as DefinePermissionsOptions, j as mergePermissions, k as isPermission, l as FieldRelation, m as PermissionTree, n as ActionMeta, o as EdgeGroups, p as PermissionKind, r as ComputedRelation, s as EdgeMatch, v as ResourceLink, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permissions-DttnqqxC.js";
-import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-DA8a8zif.js";
-import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-BNc7Wer_.js";
-import { n as PermDockValidationError } from "./validation-error-Ba264OaJ.js";
-import { n as requiredPlans } from "./problem-details-DX075l9V.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DPdqI50v.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
+import { $ as RelationGroup, $n as inherit, $t as validateApprovalPolicy, A as PolicyScopes, An as ArazzoFinding, Ar as VerifiedClaims, At as DeriveOptions, B as ValidateMode, Bn as UserApprover, Br as SqlFunctionArg, Bt as HostedGrantDropped, C as HostedGrantRef, Cn as MembershipEvent, Cr as CustomRoleGrant, Ct as DecideCredentialOptions, D as PolicyAppDataSchemas, Dn as ActivateInput, Dr as Membership, Dt as decideCredential, E as Policy, En as WireDenial, Et as credentialSubject, F as RoleScope, Fn as simulateArazzo, Fr as MemberOfParent, Ft as SnapshotOptions, G as EntitlementSource, Gn as Grantee, Gr as isConditionRef, Gt as mergeHostedGrants, H as CredentialVerifier, Hn as anyOf, Hr as hasConditionOp, Ht as PolicySource, I as SeparationConflict, In as AnyOfApprover, It as WhereResult, J as LimitRemaining, Jn as RelationGrantee, Jt as ApprovalPolicy, Kn as GranteeInput, Kr as isSqlFunctionField, Kt as parsePolicyDocument, L as SubjectOf, Ln as Approver, Lr as RelatedCondition, Lt as createPermDock, M as PrincipalOf, Mn as ArazzoSimulateInput, Mr as ConditionRef, Mt as PermDockOptions, N as RoleBinding, Nn as ArazzoStepResult, Nr as ConditionValue, Nt as RowPair, O as PolicyDelegation, On as breakGlass, Or as Principal, Ot as parseCredential, P as RoleOptions, Pn as arazzoFindings, Pr as MemberOfCondition, Pt as SimulateOptions, Q as RelationChain, Qn as authenticated, Qt as memoryApprovalPolicies, R as SupportAccessOptions, Rn as ApproverInput, Rr as RelatedHop, Rt as HostedGrant, S as GrantValidity, Sn as DirectoryEvent, Sr as CustomRole, St as CredentialRequest, T as ObligationInput, Tn as WireDecision, Tr as GnapAccess, Tt as credentialPolicyViolation, U as DecisionProvider, Un as holder, Ur as isCondition, Ut as isPortableCondition, Vn as allOf, Vr as SqlFunctionCondition, Vt as PolicyDocument, W as DecisionSink, Wn as user, Wr as isConditionDate, Wt as memoryPolicySource, X as MemberEntry, Xn as anyone, Xt as ApprovalPolicySource, Y as LimitStore, Yn as actor, Yt as ApprovalPolicyProblem, Z as MembershipSource, Zn as assurance, Zt as ApprovalPolicyValidation, _ as GrantCondition, _n as ScopeNames, _r as TraceSkipReason, _t as CredentialPermission, a as ApprovalRequirement, an as Snapshot, ar as Denial, at as SnapshotSource, b as GrantOptions, bn as CredentialEvent, br as AuthorizationDetail, bt as CredentialPolicyViolation, c as BreakGlassOptions, cn as SnapshotNotEntitled, cr as DeniedDecision, ct as TokenFailureCause, d as ClosureContext, dn as RoleChangeDecision, dr as LimitDetail, dt as VerificationFailure, en as Holder, er as plan, et as RelationHolder, f as ClosureGrantFn, fn as RoleChangeOptions, fr as MatchedGrant, ft as VerifiedToken, g as Grant, gn as ScopeDeclaration, gr as TraceSkip, gt as CredentialKind, h as DelegationTarget, hn as Scope, hr as Trace, ht as CredentialDecision, i as ApprovalOption, in as LocalSnapshotManifest, ir as Decision, it as SettingsSource, jn as ArazzoPlan, jr as Condition, jt as PermDock, k as PolicyOAuthScope, kn as supportAccess, kr as Subject, kt as DecideOptions, l as BreakGlassRequirements, ln as SnapshotScope, lr as ExplainedDecision, lt as TokenSigner, m as DelegationInput, mn as PolicyScopesInput, mr as Quota, mt as Credential, n as ApprovalEscalation, nn as WhoCan, nr as AppObligation, nt as RoleSource, o as ApprovalStage, on as SnapshotAssignable, or as DenialDetails, ot as SubjectResolver, pn as RoleChangeTarget, pr as Obligation, pt as WhereCompiler, q as LimitConsumeInput, qn as InheritGrantee, qt as APPROVAL_POLICY_UNAVAILABLE, r as ApprovalMode, rn as LocalCustomRoleTable, rr as ApprovalRequiredDecision, rt as RoleSourceFactory, s as AssuranceRequirement, sn as SnapshotGrant, sr as DenialReason, st as TenantSettings, t as ActivationOption, tn as HoldingVia, tr as relation, tt as RelationSource, u as BreakGlassSpec, un as RoleChange, ur as GrantedDecision, ut as TokenVerifier, v as GrantLimit, vn as AccessEvent, vr as Actor, vt as CredentialPermissionInput, w as MembershipFixture, wn as SinkEvent, wr as Delegation, wt as credentialDelegation, x as GrantScope, xn as DecisionEvent, xr as Binding, xt as CredentialPrincipal, y as GrantMeta, yn as AuthEvent, yr as Assurance, yt as CredentialPolicy, z as SupportConsent, zn as PermissionApprover, zr as RestrictedAncestors, zt as HostedGrantDropReason } from "./policy-types-sp9P1iIV.js";
+import { C as ResourceRelationInput, D as AppData, E as RESOURCE_X, O as AppDataSchema, S as ResourceRelation, T as ResourceXTree, _ as ResourceLink, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as Permission, f as PermissionKind, g as ResourceLevel, h as ResourceInit, i as DefinePermissionsOptions, k as MetaValue, l as FieldRelation, m as PrincipalRelation, n as ActionMeta, o as EdgeGroups, p as PermissionTree, r as ComputedRelation, s as EdgeMatch, v as ResourceMeta, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permission-types-Dg39z9Kv.js";
+import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-hhEFLFoL.js";
+import { $ as sqlFunction, A as CustomRoleReader, B as memoryRelations, C as getResource, D as definePermissions, E as mergePermissions, F as permittedIds, G as composeMemberships, H as StripeEntitlementsClient, I as mayAccess, J as memoryEntitlementSource, K as countHolders, L as localSnapshotManifest, M as customRoleSource, N as PermittedIdsOptions, O as SnapshotForOptions, P as mayUse, Q as memorySnapshotSource, R as MemoryEdge, S as findPermission, T as listPermissions, U as fromStripeEntitlements, V as memoryLimitStore, W as claimsFirst, X as memoryRoleSource, Y as memoryMembershipSource, Z as memorySettings, _ as crud, a as toCsvRow, at as fromSnapshot, b as formerKeys, c as OcsfAuthorizeSession, ct as CustomRoleDropReason, d as parseDuration, dt as ResolvedCustomRole, et as opaque, f as normalizeApproval, ft as customRoleClaim, g as role, gt as principal, h as normalizeAssurance, ht as context, i as CSV_COLUMNS, it as emptySnapshot, j as CustomRoleSourceOptions, k as snapshotFor, l as accessToOcsf, lt as CustomRoleRename, m as deny, mt as validateCustomRole, n as delegatedPermissions, nt as separationConflicts, o as OCSF_VERSION, ot as parseSnapshot, p as allow, pt as resolveCustomRole, q as isExternallyManaged, r as catalogFingerprint, rt as requiresApproval, s as OcsfAccountChange, st as CustomRoleDrop, t as coveredByDelegation, tt as definePolicy, u as toOcsf, ut as CustomRoleValidation, v as readable, w as isPermission, x as resource, y as writable, z as MemoryRelationsData } from "./index-UdVQgq48.js";
+import { n as PermDockValidationError } from "./validation-error-BSSw0l_8.js";
+import { n as requiredPlans } from "./problem-details-rIIo8B2C.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-OD_4c__H.js";
+import { t as InstanceOptions } from "./instance-options-plkrsAog.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-Cr93qqdP.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-B1fZzIMf.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-DMYiCjJV.js";
+import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-CPN4zLfs.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-C3ldA9os.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-JLnaBH0S.js";
-import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-2kYTMWDv.js";
-export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DvYUR0QL.js";
+import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-CksyCWDH.js";
+export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type AppData, type AppDataSchema, type AppObligation, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type ObligationInput, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, wrapPermDock, writable };

package/dist/index.js

@@ -1,26 +1,26 @@
-import { _ as listPermissions, a as formerKeys, b as resource, c as getResource, i as findPermission, n as definePermissions, p as isPermission, v as mergePermissions } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-KYb4ntaz.js";
-import { S as opaque, _ as memoryLimitStore, a as definePolicy, d as normalizeApproval, f as normalizeAssurance, h as separationConflicts, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
-import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-BDwEZWrZ.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-DT4AVyIg.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
-import { t as describe } from "./describe-B_gVZEVi.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-f3imMjNW.js";
+import { a as deny, n as role, p as normalizeApproval, r as allow, t as normalizeAssurance, u as memoryLimitStore, v as opaque } from "./role-builder-B4GbKM-i.js";
+import { _ as memorySettings, a as readable, c as snapshotFor, d as localSnapshotManifest, f as memoryRelations, g as memoryRoleSource, h as memoryMembershipSource, i as crud, l as customRoleSource, m as memoryEntitlementSource, n as CSV_COLUMNS, o as writable, p as fromStripeEntitlements, r as toCsvRow, s as definePermissions, t as catalogFingerprint, u as mayAccess, v as memorySnapshotSource, y as sqlFunction } from "./src-Bb7no-hS.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { r as requiredPlans } from "./problem-details-DECUnXAn.js";
+import { t as describe } from "./describe-Cgkp7eP0.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-drnfxYtm.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
-import { f as simulateArazzo, n as parseSnapshot, u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
+import { g as simulateArazzo, l as delegatedPermissions, m as arazzoFindings, n as parseSnapshot, s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
 import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { C as isPlan, E as listRoles, S as findRole, T as listPlans, a as authenticated, b as definePlans, c as inherit, f as plan, i as assurance, n as anyone, p as relation, t as actor, w as isRole, x as defineRoles } from "./grantee-Cv5Sogfv.js";
+import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-BsblpB-z.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-CXY-0C87.js";
+import { d as separationConflicts, i as parsePolicyDocument, n as memoryPolicySource, o as definePolicy, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-CBHgkzDl.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
-import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
-import { t as memoryRelations } from "./relations-cjOL01hZ.js";
-import { r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BrMozJCo.js";
-import { n as permittedIds, t as mayUse } from "./may-use-DndQ5tQ-.js";
-import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";
-import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-4qPdO9gk.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, t as credentialDelegation } from "./credential-8P81ff4u.js";
-export { APPROVAL_POLICY_UNAVAILABLE, CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };
+import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-L26udHSk.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-C-q02Pal.js";
+import { n as wrapPermDock } from "./wrap-DWsU_5Bd.js";
+import { n as permittedIds, t as mayUse } from "./may-use-BOn_dR_w.js";
+import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-BTtmfPnE.js";
+import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-uYFXGVw2.js";
+import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-txATtKV4.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, t as credentialDelegation } from "./credential-kue0qpbm.js";
+export { APPROVAL_POLICY_UNAVAILABLE, CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, wrapPermDock, writable };

package/dist/{instance-options-jARdwfPN.d.ts → instance-options-plkrsAog.d.ts}

@@ -1,4 +1,4 @@
-import { un as PermDockOptions } from "./policy-IB6yxpC3.js";
+import { Mt as PermDockOptions } from "./policy-types-sp9P1iIV.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits";
 /**

package/dist/{json-schema-BsAflUGW.js → json-schema-DBkdUuCO.js}

@@ -1,3 +1,4 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 //#region src/core/json-schema.ts
 function issue(issues, path, message) {
 	issues.push({
@@ -5,9 +6,6 @@ function issue(issues, path, message) {
 		path: [...path]
 	});
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
 * A plain-data copy built from own enumerable keys, so `__proto__` stays an
 * ordinary key and nothing the input inherits is read. Anything JSON cannot

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, Pt as TokenSigner, ct as JwtClaims, et as AuthEvent } from "../policy-IB6yxpC3.js";
-import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-Cq_H8N_X.js";
-import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-2kYTMWDv.js";
-import { t as memoryReplayStore } from "../replay-CYyiLiwO.js";
+import { K as JwtClaims, Or as Principal, ct as TokenFailureCause, kr as Subject, lt as TokenSigner, ut as TokenVerifier, yn as AuthEvent } from "../policy-types-sp9P1iIV.js";
+import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-C0dee0Qf.js";
+import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-CksyCWDH.js";
+import { t as memoryReplayStore } from "../replay-COpmZUfx.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /** `on('auth')` causes: a verification failure, or one of the three capability checks. */

package/dist/jwt/index.js

@@ -1,11 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { n as sha256, t as bytesToBase64Url } from "../sha256-BO0swRXL.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { i as linkPolicyViolation, o as parseCapability, s as redeemerAllows, t as capabilitySubject } from "../capability-4qPdO9gk.js";
-import { a as decodeHeader, i as issuerFromDiscovery, n as assertSubjectConfig, o as normalizeTyp, r as fail, t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
+import { i as linkPolicyViolation, o as parseCapability, s as redeemerAllows, t as capabilitySubject } from "../capability-txATtKV4.js";
+import { a as decodeHeader, i as issuerFromDiscovery, n as assertSubjectConfig, o as normalizeTyp, r as fail, t as joseTokenVerifier } from "../verifier-DMr_Zmb_.js";
 import { t as loadJose } from "../load-jose-BL6LH4bL.js";
-import { n as mapClaimsToSubject, r as validateCustomClaims, t as acceptMismatch } from "../map-claims-Z4QZOiFF.js";
+import { n as mapClaimsToSubject, r as validateCustomClaims, t as acceptMismatch } from "../map-claims-AVlBaJoa.js";
 import { t as memoryReplayStore } from "../replay-BsOyTrdV.js";
 //#region src/jwt/capability.ts
 function emit(options, reason, cause, token) {
@@ -329,12 +329,9 @@ function emitAuth$1(options, cause) {
 		requestId: options.requestId
 	}));
 }
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function keyToCnf(key) {
-	if (!isRecord$1(key)) return;
-	if (isRecord$1(key["jwk"])) return { jwk: key["jwk"] };
+	if (!isRecord(key)) return;
+	if (isRecord(key["jwk"])) return { jwk: key["jwk"] };
 	return { jwk: key };
 }
 function introspectionToClaims(body) {
@@ -401,7 +398,7 @@ function boundToConfig(body, options) {
 }
 function subjectFromIntrospection(response, options = {}) {
 	try {
-		if (!isRecord$1(response) || response["active"] !== true || !boundToConfig(response, options)) return anonymousSubject();
+		if (!isRecord(response) || response["active"] !== true || !boundToConfig(response, options)) return anonymousSubject();
 		const mapped = mapClaimsToSubject(introspectionToClaims(response), options);
 		if (mapped.invalidChain) {
 			emitAuth$1(options, "invalid-chain");
@@ -421,9 +418,6 @@ const SIGNING_ALGS = /* @__PURE__ */ new Set([
 	"Ed25519",
 	"RS256"
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function publicJwk(key) {
 	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, k: _k, ...pub } = key;
 	return pub;
@@ -507,6 +501,12 @@ async function extraMemberships(options, subject, tenant) {
 			}
 		});
 	} catch {
+		options.onAuth?.(compact({
+			reason: "source-threw",
+			source: "memberships",
+			issuer: options.issuer,
+			requestId: options.requestId
+		}));
 		return subject;
 	}
 }

package/dist/{kernel-_RRHmnMY.js → kernel-CB3LrIJM.js}

@@ -1,12 +1,27 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as describe } from "./describe-B_gVZEVi.js";
-import { a as deniedMessage } from "./errors-Cz5zn0mW.js";
-import { t as createPermDock } from "./permdock-CbgvLnuo.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as describe } from "./describe-Cgkp7eP0.js";
+import { a as deniedMessage } from "./errors-drnfxYtm.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { t as mayUse } from "./may-use-DndQ5tQ-.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-H_KARDVC.js";
-import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
+import { t as mayUse } from "./may-use-BOn_dR_w.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-C9YmyBIa.js";
+import { n as resolveOrNull } from "./build-instance-DIIV9DbC.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-BVM7aWNs.js";
+//#region src/agent/denied-text.ts
+/** The hook's text, or `event.text` when there is no hook or it throws or returns no string. */
+function deniedText(hook, event, report) {
+	if (hook === void 0) return event.text;
+	try {
+		const text = hook(event);
+		if (text === void 0) return event.text;
+		if (typeof text !== "string" || text === "") throw new TypeError("PermDock: onDenied must return a non-empty string or undefined");
+		return text;
+	} catch (error) {
+		report(error);
+		return event.text;
+	}
+}
+//#endregion
 //#region src/agent/reason.ts
 function modelReason(decision, permission, subjectId) {
 	if (decision.outcome === "denied") return deniedMessage(permission?.key ?? "unknown", subjectId, decision.denials, decision.alternatives.map((leaf) => leaf.key));
@@ -31,33 +46,40 @@ function runDecide(permdock, permission, data, how) {
 }
 function createAgentKernel(policy, options) {
 	const cache = /* @__PURE__ */ new WeakMap();
+	const reporters = /* @__PURE__ */ new WeakMap();
+	const report = (permdock, error) => {
+		if (permdock !== void 0) reporters.get(permdock)?.(error);
+	};
 	const instance = (context) => {
 		if (typeof context === "object" && context !== null) {
 			const hit = cache.get(context);
 			if (hit !== void 0) return hit;
 		}
 		const built = (async () => {
-			let user = null;
-			try {
-				user = await options.subject(context);
-			} catch {
-				user = null;
-			}
+			const user = await resolveOrNull(() => options.subject(context));
 			const actor = await actorFrom(options.actor, context);
-			let delegation;
-			if (options.delegation !== void 0) try {
-				delegation = await options.delegation(context);
-			} catch {
-				delegation = void 0;
-			}
+			const delegate = options.delegation;
+			const delegation = delegate === void 0 ? void 0 : await resolveOrNull(() => delegate(context)) ?? void 0;
 			const { tenant } = await tenantScope(options.tenant, context);
-			const created = await createPermDock(policy, user, compact({
-				tenant,
-				actor,
-				delegation,
-				...instanceOptions(options)
-			}));
-			return options.wrap?.(created) ?? created;
+			const errors = [];
+			const requestValues = await requestContext(options.context, context, errors);
+			const wrap = options.wrap;
+			const typedWrap = (created) => wrap === void 0 ? created : wrap(created);
+			const { permdock, report: reportTo } = await buildReportingInstance({
+				policy,
+				user,
+				sources: options,
+				scope: {
+					tenant,
+					actor,
+					delegation,
+					context: requestValues
+				},
+				errors,
+				wrap: typedWrap
+			});
+			reporters.set(permdock, reportTo);
+			return permdock;
 		})();
 		if (typeof context === "object" && context !== null) {
 			cache.set(context, built);
@@ -125,8 +147,7 @@ function createAgentKernel(policy, options) {
 		source: checkOptions.simulate === true ? "simulate" : "adapter",
 		decideOptions: checkOptions
 	});
-	const evaluate = async (binding, toolName, args, context, decideOptions = {}) => {
-		const checked = await check(binding, args, context, decideOptions);
+	const verdictOf = (checked, binding, toolName) => {
 		if (!checked.ok) {
 			if (checked.failure !== "no-data" || checked.permdock === void 0) return {
 				outcome: "denied",
@@ -171,6 +192,33 @@ function createAgentKernel(policy, options) {
 			reason: modelReason(decision, binding.permission, permdock.subject.principal?.id)
 		};
 	};
+	const evaluate = async (binding, toolName, args, context, decideOptions = {}) => {
+		const checked = await check(binding, args, context, decideOptions);
+		return relabel(verdictOf(checked, binding, toolName), checked.permdock);
+	};
+	const relabel = (verdict, permdock) => {
+		const hook = options.onDenied;
+		if (hook === void 0 || verdict.outcome === "granted") return verdict;
+		const onError = (error) => {
+			report(permdock, error);
+		};
+		if (verdict.outcome === "denied") return {
+			...verdict,
+			reason: deniedText(hook, {
+				decision: verdict.decision,
+				permission: verdict.permission,
+				text: verdict.reason
+			}, onError)
+		};
+		return {
+			...verdict,
+			summary: deniedText(hook, {
+				decision: verdict.decision,
+				permission: verdict.permission,
+				text: verdict.summary
+			}, onError)
+		};
+	};
 	const tokenFor = async (binding, args, context) => {
 		const checked = await run(binding, args, context, {
 			resume: false,
@@ -181,12 +229,12 @@ function createAgentKernel(policy, options) {
 	};
 	const decideTool = (toolName, args, context, decideOptions = {}) => {
 		const binding = Object.hasOwn(tools, toolName) ? tools[toolName] : void 0;
-		if (binding === void 0) return Promise.resolve({
+		if (binding === void 0) return Promise.resolve(relabel({
 			outcome: "denied",
 			decision: null,
 			permission: void 0,
 			reason: unmappedReason(toolName)
-		});
+		}, void 0));
 		return evaluate(binding, toolName, args, context, decideOptions);
 	};
 	const allowedToolNames = async (context) => {
@@ -201,8 +249,9 @@ function createAgentKernel(policy, options) {
 		evaluate,
 		check,
 		tokenFor,
-		allowedToolNames
+		allowedToolNames,
+		report
 	};
 }
 //#endregion
-export { createAgentKernel as n, approvalTokenOf as t };
+export { createAgentKernel as n, deniedText as r, approvalTokenOf as t };

package/dist/kysely/index.d.ts

@@ -1,6 +1,6 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
+import { It as WhereResult, jr as Condition, kr as Subject } from "../policy-types-sp9P1iIV.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
+import { s as MembershipsMapping } from "../compile-CtTP7eur.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/kysely/index.js

@@ -1,7 +1,7 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
-import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
-import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-BwBmCdTR.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { a as assertSafeKey } from "../thenable-QSmvt-vZ.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CcEu2ZQ1.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/kysely/to-where.ts
 function ident(name) {
 	assertSafeKey(name, "sql identifier");
@@ -34,13 +34,7 @@ function containsExpr(eb, column, field, value, options) {
 }
 function loadSql(injected) {
 	if (injected !== void 0) return injected;
-	const loader = globalThis.process?.getBuiltinModule?.("node:module");
-	try {
-		if (loader === void 0) throw new Error("no module loader");
-		return loader.createRequire(import.meta.url)("kysely").sql;
-	} catch {
-		throw new Error("PermDock: graph grants and withSubject in permdock/kysely need the kysely peer; pass `sql` on runtimes without require");
-	}
+	return loadPeer("kysely", "PermDock: graph grants and withSubject in permdock/kysely need the kysely peer; pass `sql` on runtimes without require").sql;
 }
 function graphExpr(node, table, options) {
 	const sql = loadSql(options.sql);
@@ -54,9 +48,7 @@ function graphExpr(node, table, options) {
 		values.push("column" in part ? sql.ref(col(table, part.column, options.columns)) : "subject" in part ? node.subject : part.value);
 		strings.push("");
 	}
-	const template = strings;
-	Object.defineProperty(template, "raw", { value: strings });
-	return sql(template, ...values);
+	return sql(templateOf(strings), ...values);
 }
 function render(eb, node, table, options) {
 	switch (node.kind) {

package/dist/{live-options-H2eG8dfJ.js → live-options-BaAFCIiu.js}

@@ -1,6 +1,7 @@
 import { createContext, useLayoutEffect, useRef, useState } from "react";
 //#region src/react/context.ts
 const PermDockStoreContext = createContext(null);
+const PermDockUiContext = createContext({});
 const PermDockSnapshotPromiseContext = createContext(null);
 //#endregion
 //#region src/react/keyed.ts
@@ -34,7 +35,8 @@ function sameHeaders(a, b) {
 * Store options whose identity survives a re-render, so an inline `headers`
 * object or `fetch` arrow does not rebuild the store and drop its snapshot.
 * `headers` compare by value, unless `headersByValue` is `false` for a store
-* that only reads `readHeaders`; `fetch` and `verifier` call the latest prop.
+* that only reads `readHeaders`; `fetch`, `verifier`, `onSnapshot` and
+* `onClear` call the latest prop.
 */
 function useLiveOptions(props, headersByValue = true) {
 	const latest = useRef(props);
@@ -49,12 +51,23 @@ function useLiveOptions(props, headersByValue = true) {
 		const verifier = latest.current.verifier;
 		return verifier === void 0 ? Promise.reject(/* @__PURE__ */ new Error("PermDock: the verifier prop was removed.")) : verifier.verify(token, expectations);
 	} }));
+	const [liveOnSnapshot] = useState(() => {
+		const call = (snapshot, tenant, raw) => {
+			latest.current.onSnapshot?.(snapshot, tenant, raw);
+		};
+		return call;
+	});
+	const [liveOnClear] = useState(() => () => {
+		latest.current.onClear?.();
+	});
 	return {
 		headers,
 		readHeaders,
 		fetch: liveFetch,
-		verifier: props.verifier === void 0 ? void 0 : liveVerifier
+		verifier: props.verifier === void 0 ? void 0 : liveVerifier,
+		onSnapshot: props.onSnapshot === void 0 ? void 0 : liveOnSnapshot,
+		onClear: props.onClear === void 0 ? void 0 : liveOnClear
 	};
 }
 //#endregion
-export { PermDockStoreContext as i, useKeyed as n, PermDockSnapshotPromiseContext as r, useLiveOptions as t };
+export { PermDockUiContext as a, PermDockStoreContext as i, useKeyed as n, PermDockSnapshotPromiseContext as r, useLiveOptions as t };

package/dist/load-B_shHrmd.js

@@ -0,0 +1,2 @@
+import { a as loadModule, s as pickNamed } from "./load-C3_oTHyO.js";
+export { loadModule, pickNamed };

package/dist/{load-DhWEB9P1.js → load-C3_oTHyO.js}

@@ -1,4 +1,4 @@
-import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
@@ -62,14 +62,22 @@ function asPolicy(value) {
 function leavesOf(tree) {
 	return listPermissions(tree);
 }
+/** The `policy` export of the module at `path`. */
+async function loadPolicyAt(cwd, path, options) {
+	return asPolicy(pickNamed(await loadModule(resolve(cwd, path), options), ["policy"]));
+}
+/** The `policy` export at `path`; without one, throws `PermDock CLI: <missing>`. */
+function requirePolicy(cwd, path, missing) {
+	return path === void 0 ? Promise.reject(/* @__PURE__ */ new Error(`PermDock CLI: ${missing}`)) : loadPolicyAt(cwd, path);
+}
 /** The configured policy export, or `undefined` when unset or unloadable. */
 async function loadConfiguredPolicy(cwd, path, options) {
 	if (path === void 0) return;
 	try {
-		return asPolicy(pickNamed(await loadModule(resolve(cwd, path), options), ["policy"]));
+		return await loadPolicyAt(cwd, path, options);
 	} catch {
 		return;
 	}
 }
 //#endregion
-export { loadModule as a, loadConfiguredPolicy as i, asPolicy as n, pickNamed as o, leavesOf as r, asPermissionTree as t };
+export { loadModule as a, requirePolicy as c, loadConfiguredPolicy as i, asPolicy as n, loadPolicyAt as o, leavesOf as r, pickNamed as s, asPermissionTree as t };

package/dist/{manifest-iaoBXHKc.js → manifest-BngWKryL.js}

@@ -1,11 +1,11 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { r as validateRecord } from "./thenable-QSmvt-vZ.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
 import { t as clientNameOf } from "./clients-DjU5ABMy.js";
 import "./budget-NbEtbJC_.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-BsAflUGW.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-DBkdUuCO.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -28,9 +28,6 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"client_id",
 	"scope"
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
 function readClaim(claims, name) {
 	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
@@ -247,16 +244,6 @@ function emit(options, reason, cause) {
 		});
 	} catch {}
 }
-function validateClaims(extra, schema) {
-	const result = schema["~standard"].validate(extra);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return;
-	}
-	if ("issues" in result && result.issues !== void 0) return;
-	const value = result.value;
-	return isRecord(value) ? value : void 0;
-}
 function extraClaims(claims) {
 	const extra = {};
 	const meta = claims["app_metadata"];
@@ -292,7 +279,7 @@ function mapClaims(claims, options) {
 	const tenantClaim = options.tenant ?? "tenant_id";
 	const membershipsClaim = options.memberships ?? "memberships";
 	let extra = extraClaims(claims);
-	if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
+	if (options.schema !== void 0) extra = validateRecord(options.schema, extra) ?? {};
 	const include = new Set(options.include ?? []);
 	const tenantValue = readClaim(claims, tenantClaim);
 	const version = readClaim(claims, "authz_ver");