permdock 0.3.1 → 0.5.0

package/dist/{index-C8z4RjQV.d.ts → index-SGdIQyzc.d.ts}

@@ -1,5 +1,7 @@
-import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-IB6yxpC3.js";
-import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-DzwivBgR.js";
+import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
+import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -7,7 +9,10 @@ declare const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
 declare const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
 declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
-declare const ROLES_EXTENSION = "urn:permdock:scim:schemas:extension:roles:1.0";
+/** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
+declare const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
+/** The extension that carries the application's own data (`x`) on a User or a Group. */
+declare const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 type DirectoryMeta = {
   readonly created: string;
   readonly lastModified: string;
@@ -25,6 +30,8 @@ type DirectoryUser = {
   readonly userName: string;
   readonly active: boolean;
   readonly emails?: readonly DirectoryEmail[];
+  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
 type DirectoryGroupMember = {
@@ -36,6 +43,8 @@ type DirectoryGroup = {
   readonly displayName: string;
   readonly members: readonly DirectoryGroupMember[];
   readonly roles?: readonly string[];
+  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
 type ScimCompareOp = "eq" | "ne" | "co" | "sw";
@@ -68,17 +77,19 @@ type ScimPatchOp = {
   readonly value?: unknown;
 };
 type DirectoryStore = {
-  getUser(tenant: string, id: string): Promise<DirectoryUser | null>;
-  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryUser>>;
-  putUser(tenant: string, user: DirectoryUser): Promise<DirectoryUser>;
-  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryUser>;
-  deleteUser(tenant: string, id: string): Promise<void>;
-  getGroup(tenant: string, id: string): Promise<DirectoryGroup | null>;
-  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryGroup>>;
-  putGroup(tenant: string, group: DirectoryGroup): Promise<DirectoryGroup>;
-  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryGroup>;
-  deleteGroup(tenant: string, id: string): Promise<void>;
-  groupsFor(tenant: string, userId: string): Promise<readonly DirectoryGroup[]>;
+  /** Shown in errors and events; optional, as on every extension interface. */
+  readonly name?: string;
+  getUser(tenant: string, id: string): DirectoryUser | null | Promise<DirectoryUser | null>;
+  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
+  putUser(tenant: string, user: DirectoryUser): DirectoryUser | Promise<DirectoryUser>;
+  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryUser | Promise<DirectoryUser>;
+  deleteUser(tenant: string, id: string): void | Promise<void>;
+  getGroup(tenant: string, id: string): DirectoryGroup | null | Promise<DirectoryGroup | null>;
+  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup(tenant: string, group: DirectoryGroup): DirectoryGroup | Promise<DirectoryGroup>;
+  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryGroup | Promise<DirectoryGroup>;
+  deleteGroup(tenant: string, id: string): void | Promise<void>;
+  groupsFor(tenant: string, userId: string): readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
 };
 type ScimTokenOptions = {
   readonly hash: "sha256";
@@ -91,11 +102,13 @@ type DirectoryChange = {
   readonly kind: "session-revoked" | "changed";
 };
 type ScimHandlerOptions = {
-  readonly store: DirectoryStore;
+  readonly directory: DirectoryStore;
   readonly tenant: string | ((request: Request) => string | Promise<string>);
   readonly token?: ScimTokenOptions;
   readonly verifier?: TokenVerifier;
   readonly audience?: string;
+  /** With `verifier`: where the JWT names its tenant (`claims.tenant`); default `tenant`, then `tid`. */
+  readonly claims?: Pick<ClaimsMap, "tenant">;
   readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
   readonly assignable?: readonly string[];
   readonly sink?: DecisionSink;
@@ -125,6 +138,10 @@ declare class DirectoryNotFoundError extends Error {
   readonly code: "not-found";
   constructor(message?: string);
 }
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+declare function isDirectoryUniquenessError(error: unknown): error is DirectoryUniquenessError;
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+declare function isDirectoryNotFoundError(error: unknown): error is DirectoryNotFoundError;
 //#endregion
 //#region src/scim/auth.d.ts
 type ScimCredential = {
@@ -146,6 +163,7 @@ declare function authenticateScim(input: {
   readonly audience?: string;
   readonly token?: ScimTokenOptions;
   readonly verifier?: TokenVerifier;
+  readonly claims?: Pick<ClaimsMap, "tenant">;
 }): Promise<ScimAuthResult>;
 declare function sha256Hex(value: string): string;
 //#endregion
@@ -174,4 +192,4 @@ declare function directoryMembershipSource(store: DirectoryStore, options?: Dire
 //#region src/scim/store.d.ts
 declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
-export { ScimPageResult as A, LIST_SCHEMA as C, ScimFilter as D, SCIM_CONTENT_TYPE as E, ScimTokenOptions as M, USER_SCHEMA as N, ScimHandlerOptions as O, GROUP_SCHEMA as S, ROLES_EXTENSION as T, DirectoryNotFoundError as _, scimHandler as a, DirectoryUser as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryMembershipSourceOptions as g, DirectoryGroup as h, tenantFromPath as i, ScimPatchOp as j, ScimPage as k, resourceTypes as l, DirectoryChange as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryStore as v, PATCH_SCHEMA as w, ERROR_SCHEMA as x, DirectoryUniquenessError as y };
+export { ScimPage as A, GROUP_SCHEMA as C, SCIM_CONTENT_TYPE as D, ROLES_EXTENSION as E, isDirectoryNotFoundError as F, isDirectoryUniquenessError as I, ScimPatchOp as M, ScimTokenOptions as N, ScimFilter as O, USER_SCHEMA as P, ERROR_SCHEMA as S, PATCH_SCHEMA as T, DirectoryMembershipSourceOptions as _, scimHandler as a, DirectoryUniquenessError as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryGroup as g, DirectoryChange as h, tenantFromPath as i, ScimPageResult as j, ScimHandlerOptions as k, resourceTypes as l, APP_DATA_EXTENSION as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryNotFoundError as v, LIST_SCHEMA as w, DirectoryUser as x, DirectoryStore as y };

package/dist/index.d.ts

@@ -1,16 +1,22 @@
-import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-IB6yxpC3.js";
-import { A as listPermissions, C as ResourceRelationInput, D as formerKeys, E as findPermission, M as resource, O as getResource, S as ResourceRelation, T as definePermissions, _ as ResourceLevel, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as MetaValue, f as Permission, g as ResourceInit, h as PrincipalRelation, i as DefinePermissionsOptions, j as mergePermissions, k as isPermission, l as FieldRelation, m as PermissionTree, n as ActionMeta, o as EdgeGroups, p as PermissionKind, r as ComputedRelation, s as EdgeMatch, v as ResourceLink, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permissions-DttnqqxC.js";
-import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-DA8a8zif.js";
-import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-BNc7Wer_.js";
-import { n as PermDockValidationError } from "./validation-error-Ba264OaJ.js";
-import { n as requiredPlans } from "./problem-details-DX075l9V.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DPdqI50v.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
+import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionRef, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isConditionDate, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RestrictedAncestors, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as VerifiedClaims, at as SettingsSource, b as GrantScope, bn as Grantee, br as hasConditionOp, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as MembershipVia, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionValue, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as MemberOfCondition, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedHop, gt as SupportSession, h as Grant, hn as UserApprover, hr as RelatedCondition, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as Subject, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as Condition, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as ActorKind, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfParent, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as AdapterId, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as ConditionRef, ut as TokenSigner, v as GrantMeta, vn as holder, vr as SqlFunctionArg, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isSqlFunctionField, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as isCondition, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionCondition, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-DzwivBgR.js";
+import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-D6lPdb4Z.js";
+import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as principal, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as context, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as resolveCustomRole, nt as defineApp, o as OCSF_VERSION, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as validateCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as customRoleClaim, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DOVf7RJv.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-CxybZErY.js";
+import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-D7eeLJER.js";
+import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-DBDX0M-P.js";
+import { n as PermDockValidationError } from "./validation-error-Bg5Tpluk.js";
+import { n as requiredPlans } from "./problem-details-DXlt-vks.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-C2PXIv4c.js";
+import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-Bd1Tejur.js";
+import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-B1fZzIMf.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-DMYiCjJV.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-BSslw1QV.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BMZPIVUM.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Bj_lDUDq.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-JLnaBH0S.js";
-import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-2kYTMWDv.js";
-export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DgqtruPn.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,26 +1,36 @@
-import { _ as listPermissions, a as formerKeys, b as resource, c as getResource, i as findPermission, n as definePermissions, p as isPermission, v as mergePermissions } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-KYb4ntaz.js";
-import { S as opaque, _ as memoryLimitStore, a as definePolicy, d as normalizeApproval, f as normalizeAssurance, h as separationConflicts, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
-import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-BDwEZWrZ.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-DT4AVyIg.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
-import { t as describe } from "./describe-B_gVZEVi.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-K6eWUJ0H.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-CXbis5-X.js";
+import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-DLfUWFAI.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
+import { t as describe } from "./describe-BybMRY7A.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
-import { f as simulateArazzo, n as parseSnapshot, u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { C as isPlan, E as listRoles, S as findRole, T as listPlans, a as authenticated, b as definePlans, c as inherit, f as plan, i as assurance, n as anyone, p as relation, t as actor, w as isRole, x as defineRoles } from "./grantee-Cv5Sogfv.js";
+import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
+import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-DVjOckjV.js";
+import { n as parseSupportSession, t as decideSupportSession } from "./support-session-C6xJQYut.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { c as separationConflicts, n as definePolicy } from "./policy-DLZJ5gAp.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
-import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
-import { t as memoryRelations } from "./relations-cjOL01hZ.js";
-import { r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BrMozJCo.js";
-import { n as permittedIds, t as mayUse } from "./may-use-DndQ5tQ-.js";
-import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";
-import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-4qPdO9gk.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, t as credentialDelegation } from "./credential-8P81ff4u.js";
-export { APPROVAL_POLICY_UNAVAILABLE, CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };
+import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-BZIAYvon.js";
+import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-B-wCP5ZC.js";
+import { D as supportAccess, E as breakGlass, T as activate, d as customRoleClaim, j as APPROVAL_POLICY_UNAVAILABLE, v as resolveCustomRole, x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
+import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-Cxq4ygFc.js";
+import { t as whoCan } from "./who-can-D0QoYbEb.js";
+import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-Dv-WTP-w.js";
+import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CVSs6J9I.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
+import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-N1K9IpqS.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-DM2um3ha.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/init-DeMYsnYJ.js

@@ -0,0 +1,96 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-DZdU0tne.js";
+import { t as addLine } from "./peer-C8swJ2GH.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+//#region src/cli/init.ts
+/** The page a preset code opens in the builder. */
+const CREATE_URL = "https://permdock.com/create";
+function decoded(code, command) {
+	const preset = decodePreset(code);
+	if (preset === void 0) throw new CliError("usage", `${command}: '${code}' is not a preset code this version reads; build one at ${CREATE_URL}`, { code: "invalid_value" });
+	return preset;
+}
+/**
+* Writes the preset's owned files into `cwd` and lists what to install.
+* An existing file is kept unless `force` is set, so `init` never
+* overwrites code the application already changed. It installs nothing
+* and calls no network: the package manager and shadcn commands are
+* printed for the person to run.
+*/
+function runInit(options) {
+	const preset = typeof options.preset === "string" ? decoded(options.preset, "init") : resolvePreset(options.preset);
+	const generated = generatePreset(preset, options.src === void 0 ? {} : { src: options.src });
+	const writes = generated.files.filter((file) => options.force === true || !existsSync(join(options.cwd, file.path)));
+	const written = writes.map((file) => file.path);
+	const kept = generated.files.filter((file) => !writes.includes(file)).map((file) => file.path);
+	const dryRun = options.dryRun === true;
+	applyFiles(options.cwd, writes.map((file) => ({
+		path: file.path,
+		text: file.contents
+	})), { dryRun });
+	const install = addLine(options.agent, generated.dependencies);
+	const shadcn = generated.recipes.length === 0 ? null : `npx shadcn@latest add ${generated.recipes.join(" ")}`;
+	const next = [
+		{
+			command: install,
+			when: "to add the dependencies the files import"
+		},
+		...shadcn === null ? [] : [{
+			command: shadcn,
+			when: "to add the @permdock UI recipes"
+		}],
+		{
+			command: "npx permdock doctor",
+			when: "after the install, to check the policy and the wiring"
+		}
+	];
+	const data = {
+		preset: generated.code,
+		written,
+		kept,
+		dryRun,
+		install,
+		shadcn,
+		docs: generated.docs
+	};
+	return {
+		code: 0,
+		output: `${[
+			`Preset ${generated.code} (${preset.archetype}, ${preset.framework}, ${preset.auth}, ${preset.backend})${dryRun ? " — dry run, nothing written" : ""}`,
+			"",
+			...written.map((path) => `  ${dryRun ? "would write" : "wrote"} ${path}`),
+			...kept.map((path) => `  kept ${path} (exists; --force overwrites)`),
+			"",
+			"Next:",
+			...next.map((step) => `  ${step.command}`),
+			"",
+			`Read: ${generated.docs.map((page) => `https://permdock.com${page}`).join(", ")}`,
+			`Edit this preset: ${CREATE_URL}?preset=${generated.code}`
+		].join("\n")}\n`,
+		data,
+		next
+	};
+}
+/** `permdock preset decode|url <code>`: what a code holds, or its builder link. */
+function runPreset(action, code) {
+	const preset = decoded(code, `preset ${action}`);
+	const url = `${CREATE_URL}?preset=${encodePreset(preset)}`;
+	if (action === "url") return {
+		code: 0,
+		output: `${url}\n`,
+		data: { url }
+	};
+	return {
+		code: 0,
+		output: `${[
+			...Object.entries(preset).map(([key, value]) => `  ${key.padEnd(12)} ${Array.isArray(value) ? value.join(", ") || "none" : String(value)}`),
+			"",
+			`  permdock init ${presetFlags(preset).join(" ")}`
+		].join("\n")}\n`,
+		data: preset
+	};
+}
+//#endregion
+export { runInit, runPreset };

package/dist/init-GG6Jh8HD.js

@@ -0,0 +1,95 @@
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-DZdU0tne.js";
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/init.ts
+function optionsOf(key) {
+	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
+}
+function one(key, description) {
+	return {
+		type: "enum",
+		options: optionsOf(key),
+		description: `Without --preset: ${description}`,
+		default: PRESET_DEFAULTS[key]
+	};
+}
+function many(key, description) {
+	return {
+		type: "enum",
+		options: optionsOf(key),
+		description: `Without --preset: ${description}`,
+		repeatable: true,
+		valueHint: "id"
+	};
+}
+const init = defineLeaf({
+	flags: {
+		preset: {
+			type: "string",
+			description: "A preset code from permdock.com/create",
+			valueHint: "code"
+		},
+		archetype: {
+			...one("archetype", "the kind of app"),
+			valueHint: "id"
+		},
+		framework: one("framework", "where requests arrive"),
+		auth: one("auth", "who signs users in"),
+		backend: one("backend", "where data lives"),
+		feature: many("features", "a feature beyond the archetype's"),
+		integration: many("integrations", "an agent runtime or a set of UI recipes"),
+		service: many("services", "a PermDock Cloud service"),
+		"out-dir": {
+			type: "string",
+			description: "Source directory the files go in (default src)",
+			valueHint: "dir"
+		},
+		...dryRunFlag,
+		...forceFlag
+	},
+	async run(ctx, { flags }) {
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeMYsnYJ.js"), import("./peer-CRvC7Hg1.js")]);
+		const agent = await packageManagerOf(ctx.cwd);
+		const selection = {
+			archetype: flags.archetype,
+			framework: flags.framework,
+			auth: flags.auth,
+			backend: flags.backend,
+			features: flags.feature,
+			integrations: flags.integration,
+			services: flags.service
+		};
+		const outDir = given(flags["out-dir"]);
+		return runInit({
+			cwd: ctx.cwd,
+			preset: given(flags.preset) ?? selection,
+			...outDir === void 0 ? {} : { src: outDir },
+			dryRun: flags["dry-run"],
+			force: flags.force,
+			...agent === void 0 ? {} : { agent }
+		});
+	}
+});
+const presetCode = [{
+	name: "code",
+	description: "The preset code",
+	required: true
+}];
+const presetDecode = defineLeaf({
+	positionals: presetCode,
+	flags: {},
+	async run(_ctx, { args }) {
+		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		return runPreset("decode", args["code"] ?? "");
+	}
+});
+const presetUrl = defineLeaf({
+	positionals: presetCode,
+	flags: {},
+	async run(_ctx, { args }) {
+		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		return runPreset("url", args["code"] ?? "");
+	}
+});
+//#endregion
+export { init, presetDecode, presetUrl };

package/dist/{instance-options-jARdwfPN.d.ts → instance-options-Omfd793B.d.ts}

@@ -1,6 +1,6 @@
-import { un as PermDockOptions } from "./policy-IB6yxpC3.js";
+import { i as PermDockOptions } from "./permdock-D7eeLJER.js";
 //#region src/core/instance-options.d.ts
-type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits";
+type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**
  * The data sources an adapter passes through to every instance it creates.
  * Each adapter's options type extends this, so a source added to core