permdock 0.5.0 → 0.6.0

package/dist/{index-DOVf7RJv.d.ts → index-DuWxc5dt.d.ts}

@@ -1,12 +1,12 @@
-import { $n as Delegation, Bt as LocalSnapshotManifest, C as MembershipFixture, D as PolicyDelegation, I as SeparationConflict, In as DenialReason, J as EntitlementSource, Kt as AccessEvent, Lt as InstanceHandle, N as RoleBinding, Nn as Decision, P as RoleOptions, Pn as Denial, Qt as DeliveryEvent, R as SupportAccessOptions, Rt as Instant, T as Policy, V as VocabularyFromInput, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, Y as JwtClaims, Zn as CustomRole, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, et as MembershipSource, g as GrantCondition, h as Grant, i as ApprovalOption, ir as Subject, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, mr as OpaqueCondition, nr as Membership, nt as RelationGroup, ot as SnapshotSource, rn as SinkEvent, rr as Principal, s as AssuranceRequirement, sn as PolicyScopesInput, ur as ConditionRef, ut as TokenSigner, vr as SqlFunctionArg, yr as SqlFunctionCondition } from "./policy-types-DzwivBgR.js";
-import { C as InferPermissionTree, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, P as ResourceOptions, R as ResourceRestricted, T as PermissionKind, g as ActionMeta, h as ActionList, k as ResourceInit, r as Role, w as Permission, z as ResourceXTree } from "./vocabulary-D6lPdb4Z.js";
-import { i as PermDockOptions, r as PermDock } from "./permdock-D7eeLJER.js";
-import { a as PolicyDocument } from "./hosted-DBDX0M-P.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { $n as Delegation, Bt as LocalSnapshotManifest, C as MembershipFixture, D as PolicyDelegation, I as SeparationConflict, In as DenialReason, J as EntitlementSource, Kt as AccessEvent, Lt as InstanceHandle, N as RoleBinding, Nn as Decision, P as RoleOptions, Pn as Denial, Qt as DeliveryEvent, R as SupportAccessOptions, Rt as Instant, T as Policy, V as VocabularyFromInput, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, Y as JwtClaims, Zn as CustomRole, ar as Subject, at as SettingsSource, br as SqlFunctionCondition, c as BreakGlassOptions, ct as TenantSettings, dr as ConditionRef, et as MembershipSource, g as GrantCondition, h as Grant, hr as OpaqueCondition, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, nr as Membership, nt as RelationGroup, ot as SnapshotSource, rn as SinkEvent, rr as Principal, s as AssuranceRequirement, sn as PolicyScopesInput, ut as TokenSigner, yr as SqlFunctionArg } from "./policy-types-n0uRTsW8.js";
+import { C as InferPermissionTree, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, P as ResourceOptions, R as ResourceRestricted, T as PermissionKind, g as ActionMeta, h as ActionList, k as ResourceInit, r as Role, w as Permission, z as ResourceXTree } from "./vocabulary-CN8H_9UF.js";
+import { i as PermDockOptions, r as PermDock } from "./permdock-SV8ZINYT.js";
+import { a as PolicyDocument } from "./hosted-BPk51-kX.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
+import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-Bj_lDUDq.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-4-eQIRWf.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
 type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
@@ -27,6 +27,9 @@ type CustomRoleDrop = {
 } | {
   readonly role: string;
   readonly reason: "unknown-role";
+} | {
+  readonly role: string;
+  readonly reason: "name-taken";
 };
 /** A stored grant that named a permission by a key it was renamed from. */
 type CustomRoleRename = {
@@ -57,7 +60,11 @@ type CustomRoleValidation = {
  * together with the denies of the roles those grants belong to.
  */
 declare function resolveCustomRole(policy: Policy, role: CustomRole): ResolvedCustomRole;
-declare function validateCustomRole(policy: Policy, role: CustomRole): CustomRoleValidation;
+type ValidateCustomRoleOptions = {
+  /** The shared custom roles: a tenant role with one of their names is dropped as `name-taken`. */
+  readonly shared?: readonly CustomRole[];
+};
+declare function validateCustomRole(policy: Policy, role: CustomRole, options?: ValidateCustomRoleOptions): CustomRoleValidation;
 /**
  * The compact JWT form of custom roles for the `memberships[].grants` claim
  * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
@@ -433,6 +440,8 @@ type CustomRoleReader = {
   assignable?(tenant: string): string[] | Promise<string[]>;
   /** Platform custom roles (`scope: 'global'`). */
   globalRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  /** Shared custom roles (`shared: true`), the same for every tenant. */
+  sharedRoles?(): CustomRole[] | Promise<CustomRole[]>;
 };
 type CustomRoleSourceOptions = {
   /** `'all'` (default): read every custom role of each tenant, so `assignableRoles` and `decideRoleChange` see them all. */
@@ -445,8 +454,8 @@ type CustomRoleSourceOptions = {
 /**
  * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
  * It keeps only the roles of the requested tenant. With `read: 'held'` it
- * skips a tenant's read, and `globalRoles`, when the subject holds only
- * declared roles there.
+ * skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+ * subject holds only declared roles there.
  */
 declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): CustomRoleSource;
 //#endregion
@@ -897,4 +906,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { ShadowMismatch as $, CustomRoleValidation as $t, decideRoleChange as A, isExternallyManaged as At, crud as B, getResource as Bt, parseCloudEventBatch as C, MemoryRelationSourceData as Ct, RoleChangeDecision as D, claimsFirst as Dt, RoleChange as E, stripeEntitlementSource as Et, normalizeApproval as F, memorySettingsSource as Ft, definePermissions as G, separationConflicts as Gt, writable as H, listPermissions as Ht, allow as I, memorySnapshotSource as It, CustomRoleReader as J, fromSnapshot as Jt, SnapshotForOptions as K, requiresApproval as Kt, deny as L, sqlFunction as Lt, activate as M, memoryCustomRoleSource as Mt, breakGlass as N, memoryEntitlementSource as Nt, RoleChangeOptions as O, composeMemberships as Ot, supportAccess as P, memoryMembershipSource as Pt, LegacyCheck as Q, CustomRoleRename as Qt, normalizeAssurance as R, opaque as Rt, parseCloudEvent as S, MemoryEdge as St, parseSinkEvents as T, StripeEntitlementsClient as Tt, formerKeys as U, mergePermissions as Ut, readable as V, isPermission as Vt, resource as W, definePolicy as Wt, customRoleSource as X, CustomRoleDrop as Xt, CustomRoleSourceOptions as Y, parseSnapshot as Yt, mayAccess as Z, CustomRoleDropReason as Zt, DIRECTORY_EVENT_SCHEMA as _, signPolicyDocument as _t, toCsvRow as a, principal as an, localSnapshotManifest as at, SINK_EVENT_SCHEMAS as b, WhoCan as bt, OcsfUserManagement as c, ArazzoSimulateInput as ct, ACCESS_EVENT_SCHEMA as d, simulateArazzo as dt, ResolvedCustomRole as en, ShadowOptions as et, AUTOMATION_EVENT_SCHEMA as f, deliveryEvent as ft, DELIVERY_EVENT_SCHEMA as g, SignPolicyDocumentOptions as gt, DECISION_EVENT_SCHEMA as h, snapshotFromClaims as ht, CSV_COLUMNS as i, context as in, AppProfile as it, ActivateInput as j, APPROVAL_POLICY_UNAVAILABLE as jt, RoleChangeTarget as k, countHolders as kt, accessToOcsf as l, ArazzoStepResult as lt, CREDENTIAL_EVENT_SCHEMA as m, signSnapshot as mt, delegatedPermissions as n, resolveCustomRole as nn, defineApp as nt, OCSF_VERSION as o, ArazzoFinding as ot, CATALOG_EVENT_SCHEMA as p, SignSnapshotOptions as pt, snapshotFor as q, emptySnapshot as qt, catalogFingerprint as r, validateCustomRole as rn, AppOptions as rt, OcsfAuthorizeSession as s, ArazzoPlan as st, coveredByDelegation as t, customRoleClaim as tn, shadowMode as tt, toOcsf as u, arazzoFindings as ut, EVENT_SCHEMA_IDS as v, Holder as vt, parseSinkEvent as w, memoryRelationSource as wt, parseCatalogEventData as x, whoCan as xt, MEMBERSHIP_EVENT_SCHEMA as y, HoldingVia as yt, role as z, findPermission as zt };
+export { ShadowMismatch as $, CustomRoleValidation as $t, decideRoleChange as A, isExternallyManaged as At, crud as B, getResource as Bt, parseCloudEventBatch as C, MemoryRelationSourceData as Ct, RoleChangeDecision as D, claimsFirst as Dt, RoleChange as E, stripeEntitlementSource as Et, normalizeApproval as F, memorySettingsSource as Ft, definePermissions as G, separationConflicts as Gt, writable as H, listPermissions as Ht, allow as I, memorySnapshotSource as It, CustomRoleReader as J, fromSnapshot as Jt, SnapshotForOptions as K, requiresApproval as Kt, deny as L, sqlFunction as Lt, activate as M, memoryCustomRoleSource as Mt, breakGlass as N, memoryEntitlementSource as Nt, RoleChangeOptions as O, composeMemberships as Ot, supportAccess as P, memoryMembershipSource as Pt, LegacyCheck as Q, CustomRoleRename as Qt, normalizeAssurance as R, opaque as Rt, parseCloudEvent as S, MemoryEdge as St, parseSinkEvents as T, StripeEntitlementsClient as Tt, formerKeys as U, mergePermissions as Ut, readable as V, isPermission as Vt, resource as W, definePolicy as Wt, customRoleSource as X, CustomRoleDrop as Xt, CustomRoleSourceOptions as Y, parseSnapshot as Yt, mayAccess as Z, CustomRoleDropReason as Zt, DIRECTORY_EVENT_SCHEMA as _, signPolicyDocument as _t, toCsvRow as a, context as an, localSnapshotManifest as at, SINK_EVENT_SCHEMAS as b, WhoCan as bt, OcsfUserManagement as c, ArazzoSimulateInput as ct, ACCESS_EVENT_SCHEMA as d, simulateArazzo as dt, ResolvedCustomRole as en, ShadowOptions as et, AUTOMATION_EVENT_SCHEMA as f, deliveryEvent as ft, DELIVERY_EVENT_SCHEMA as g, SignPolicyDocumentOptions as gt, DECISION_EVENT_SCHEMA as h, snapshotFromClaims as ht, CSV_COLUMNS as i, validateCustomRole as in, AppProfile as it, ActivateInput as j, APPROVAL_POLICY_UNAVAILABLE as jt, RoleChangeTarget as k, countHolders as kt, accessToOcsf as l, ArazzoStepResult as lt, CREDENTIAL_EVENT_SCHEMA as m, signSnapshot as mt, delegatedPermissions as n, customRoleClaim as nn, defineApp as nt, OCSF_VERSION as o, principal as on, ArazzoFinding as ot, CATALOG_EVENT_SCHEMA as p, SignSnapshotOptions as pt, snapshotFor as q, emptySnapshot as qt, catalogFingerprint as r, resolveCustomRole as rn, AppOptions as rt, OcsfAuthorizeSession as s, ArazzoPlan as st, coveredByDelegation as t, ValidateCustomRoleOptions as tn, shadowMode as tt, toOcsf as u, arazzoFindings as ut, EVENT_SCHEMA_IDS as v, Holder as vt, parseSinkEvent as w, memoryRelationSource as wt, parseCatalogEventData as x, whoCan as xt, MEMBERSHIP_EVENT_SCHEMA as y, HoldingVia as yt, role as z, findPermission as zt };

package/dist/index.d.ts

@@ -1,22 +1,22 @@
-import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionRef, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isConditionDate, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RestrictedAncestors, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as VerifiedClaims, at as SettingsSource, b as GrantScope, bn as Grantee, br as hasConditionOp, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as MembershipVia, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionValue, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as MemberOfCondition, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedHop, gt as SupportSession, h as Grant, hn as UserApprover, hr as RelatedCondition, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as Subject, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as Condition, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as ActorKind, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfParent, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as AdapterId, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as ConditionRef, ut as TokenSigner, v as GrantMeta, vn as holder, vr as SqlFunctionArg, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isSqlFunctionField, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as isCondition, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionCondition, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-DzwivBgR.js";
-import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-D6lPdb4Z.js";
-import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as principal, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as context, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as resolveCustomRole, nt as defineApp, o as OCSF_VERSION, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as validateCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as customRoleClaim, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DOVf7RJv.js";
-import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-CxybZErY.js";
-import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-D7eeLJER.js";
-import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-DBDX0M-P.js";
-import { n as PermDockValidationError } from "./validation-error-Bg5Tpluk.js";
-import { n as requiredPlans } from "./problem-details-DXlt-vks.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionDate, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isCondition, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tr as isSqlFunctionField, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RelatedHop, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as Subject, at as SettingsSource, b as GrantScope, bn as Grantee, br as SqlFunctionCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as AdapterId, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionRef, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as ConditionValue, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedCondition, gt as SupportSession, h as Grant, hn as UserApprover, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as SharedCustomRole, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as MembershipVia, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mr as MemberOfParent, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as VerifiedClaims, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfCondition, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as ActorKind, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as Condition, ut as TokenSigner, v as GrantMeta, vn as holder, vr as RestrictedAncestors, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isConditionRef, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as hasConditionOp, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionArg, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-n0uRTsW8.js";
+import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-CN8H_9UF.js";
+import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as context, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as validateCustomRole, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as customRoleClaim, nt as defineApp, o as OCSF_VERSION, on as principal, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as resolveCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as ValidateCustomRoleOptions, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DuWxc5dt.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-X0VM7F3m.js";
+import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-SV8ZINYT.js";
+import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-BPk51-kX.js";
+import { n as PermDockValidationError } from "./validation-error-DHUrAkku.js";
+import { n as requiredPlans } from "./problem-details-B45V5d2b.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-Bd1Tejur.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-C5jC6sKI.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-BSslw1QV.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BMZPIVUM.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Bj_lDUDq.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Drg-1YhL.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BNM3TtDo.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-4-eQIRWf.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DgqtruPn.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-5ODwqu8b.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-K6eWUJ0H.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-CXbis5-X.js";
-import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-DLfUWFAI.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
+import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-Cu2m75uo.js";
 import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
@@ -12,25 +12,25 @@ import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
 import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
 import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-DVjOckjV.js";
 import { n as parseSupportSession, t as decideSupportSession } from "./support-session-C6xJQYut.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
-import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Cn1HyUsI.js";
-import { c as separationConflicts, n as definePolicy } from "./policy-DLZJ5gAp.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { c as separationConflicts, n as definePolicy } from "./policy-DbM5YYtV.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-BZIAYvon.js";
+import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-B46-5LYE.js";
 import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-B-wCP5ZC.js";
-import { D as supportAccess, E as breakGlass, T as activate, d as customRoleClaim, j as APPROVAL_POLICY_UNAVAILABLE, v as resolveCustomRole, x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
-import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-Cxq4ygFc.js";
-import { t as whoCan } from "./who-can-D0QoYbEb.js";
-import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
-import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-Dv-WTP-w.js";
+import { C as validateCustomRole, D as activate, N as APPROVAL_POLICY_UNAVAILABLE, O as breakGlass, b as resolveCustomRole, d as customRoleClaim, k as supportAccess } from "./evaluate-CNClBvcj.js";
+import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-BOEhcqIF.js";
+import { t as whoCan } from "./who-can-DWBAcaCQ.js";
+import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
+import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-C9vfEphl.js";
 import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
 import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CVSs6J9I.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-BrAscV28.js";
 import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
 import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
 import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-N1K9IpqS.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-DM2um3ha.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-BcoiejpY.js";
 export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{instance-options-Omfd793B.d.ts → instance-options-BsVpyGIk.d.ts}

@@ -1,4 +1,4 @@
-import { i as PermDockOptions } from "./permdock-D7eeLJER.js";
+import { i as PermDockOptions } from "./permdock-SV8ZINYT.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**

package/dist/{instance-snapshot-Cxq4ygFc.js → instance-snapshot-BOEhcqIF.js}

@@ -8,14 +8,14 @@ import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { p as nowSeconds, s as instantAt } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { c as rootScope, d as scopeList, i as keepsPermission, m as tenantOf, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-DaXVdDhM.js";
-import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Cn1HyUsI.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-j6-rc37o.js";
+import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-hxrUsbpM.js";
 import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { a as levelCondition, o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { C as emptyListeners, O as contactMayUse, a as expandRoleNames, b as tenantCustomRoles, h as holdsGlobalCustomRole, l as ceilingGrants, m as holdsCustomRole, n as requirementCondition, p as customRoleScope, t as evaluate, u as customGrantsFor, v as resolveCustomRole, y as roleAllowKeys } from "./evaluate-_R8QkWaf.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DHArqY82.js";
-import { t as buildSnapshot } from "./snapshot-CXUWfsNy.js";
+import { A as contactMayUse, S as tenantCustomRoles, T as emptyListeners, _ as isSharedCustomRole, a as expandRoleNames, b as resolveCustomRole, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as roleAllowKeys } from "./evaluate-CNClBvcj.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
+import { t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -520,7 +520,7 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 	const out = /* @__PURE__ */ new Map();
 	const inert = /* @__PURE__ */ new Set();
 	for (const role of tenantCustomRoles(policy, customRoles)) {
-		if (role.tenant !== tenant || out.has(role.name)) continue;
+		if (!customRoleOf(role, tenant) || out.has(role.name)) continue;
 		const at = customRoleScope(role, scopes);
 		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
 		const { grants } = resolveCustomRole(policy, role);
@@ -531,11 +531,12 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, compact({
 			on: at,
 			assignable: true,
-			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles))
+			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles)),
+			shared: isSharedCustomRole(role) ? true : void 0
 		})));
 	}
 	return {
-		roles: [...out.values()].toSorted((a, b) => byCodePoint(a.key, b.key)),
+		roles: [...out.values()].toSorted((a, b) => Number(a.shared !== true) - Number(b.shared !== true) || byCodePoint(a.key, b.key)),
 		inert: [...inert].filter((name) => !out.has(name)).toSorted()
 	};
 }

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Y as JwtClaims, dt as TokenVerifier, ir as Subject, lt as TokenFailureCause, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BSslw1QV.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DiQjupG2.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
+import { Y as JwtClaims, ar as Subject, dt as TokenVerifier, lt as TokenFailureCause, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "../policy-types-n0uRTsW8.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Drg-1YhL.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-C791HFu9.js";
+import { t as memoryReplayStore } from "../replay-Bkm-Ne4l.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /** `on('auth')` causes: a verification failure, or one of the three capability checks. */

package/dist/{kernel-5JatXyND.js → kernel-D0NVb1cK.js}

@@ -1,13 +1,13 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { t as describe } from "./describe-BybMRY7A.js";
 import { a as deniedMessage } from "./errors-BKy0EfhN.js";
-import { t as actorMayCallTool } from "./delegation-DaXVdDhM.js";
+import { t as actorMayCallTool } from "./delegation-j6-rc37o.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { c as withApp } from "./permdock-B9JxkBwC.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DTcZOzhF.js";
-import { n as resolveOrNull } from "./build-instance-BMnAudHn.js";
+import { c as withApp } from "./permdock-BrAscV28.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-CBYVMjwh.js";
+import { n as resolveOrNull } from "./build-instance-Bu_eDqYw.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-BTRTG7OT.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-C81Pip9n.js";
 //#region src/agent/denied-text.ts
 /** The hook's text, or `event.text` when there is no hook or it throws or returns no string. */
 function refusalText(hook, event, report) {

package/dist/kysely/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
-import { c as WhereResult } from "../permdock-D7eeLJER.js";
+import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
+import { c as WhereResult } from "../permdock-SV8ZINYT.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-Ckm2HqBZ.js";
+import { s as MembershipsMapping } from "../compile-1bsAezL0.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/{manifest-CtKR3GXL.js → manifest-dvL2XEe1.js}

@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-CxiwSfqH.js")).doctor
+				load: async () => (await import("./doctor-3ZqNHX_G.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-BqhRBJD8.js")).completion
+				load: async () => (await import("./completion-BTFrHZhX.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-DloHbDVa.js")).collect
+				load: async () => (await import("./collect-Ci6akVwH.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-R_A__RsH.js")).catalog
+				load: async () => (await import("./catalog-DZVbrF-z.js")).catalog
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -121,14 +121,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-DHtE8j4E.js")).usage
+				load: async () => (await import("./usage-CRVl9V3t.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CxZo9pTq.js")).diff
+				load: async () => (await import("./diff-CmuSD3vc.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -136,7 +136,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-B46rm9sc.js")).config
+				load: async () => (await import("./config-Bj2Ixq3d.js")).config
 			})
 		]
 	},
@@ -153,14 +153,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).generate
+					load: async () => (await import("./rls-BAqP4q66.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).importPolicies
+					load: async () => (await import("./rls-BAqP4q66.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -171,14 +171,14 @@ const SECTIONS = [
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).verify
+					load: async () => (await import("./rls-BAqP4q66.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).migrate
+					load: async () => (await import("./rls-BAqP4q66.js")).migrate
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -186,26 +186,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-9pqI57pW.js")).hookGenerate
+				load: async () => (await import("./supabase-By_frk3U.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-9pqI57pW.js")).inspect
+				load: async () => (await import("./supabase-By_frk3U.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-BHfuehf3.js")).generate
+				load: async () => (await import("./powersync-DISt6SUe.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-BHfuehf3.js")).verify
+				load: async () => (await import("./powersync-DISt6SUe.js")).verify
 			})])
 		]
 	},
@@ -217,13 +217,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-ahr8rHu3.js")).emit
+				load: async () => (await import("./openapi-C4dDTVEd.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-ahr8rHu3.js")).importDocument
+				load: async () => (await import("./openapi-C4dDTVEd.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -231,7 +231,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-B6lebmiQ.js")).check
+				load: async () => (await import("./arazzo-41WuzHou.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -239,7 +239,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-BOI5tJ-6.js")).scan
+				load: async () => (await import("./scan-qvOe0hS3.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -286,13 +286,13 @@ const SECTIONS = [
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-CIoHNevm.js")).push
+				load: async () => (await import("./cloud-ytQ3uviA.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-CIoHNevm.js")).pull
+				load: async () => (await import("./cloud-ytQ3uviA.js")).pull
 			})])
 		]
 	},
@@ -303,7 +303,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-Bmj9dWMH.js")).codemod
+			load: async () => (await import("./codemod-5mpSpnUY.js")).codemod
 		})]
 	}
 ];
@@ -315,7 +315,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-BqhRBJD8.js")).complete
+	load: async () => (await import("./completion-BTFrHZhX.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{map-error-TCAdw-eW.js → map-error-Dr70oA_3.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { c as problemResponse, i as decisionResponse } from "./problem-CTviyH5L.js";
-import { u as InvalidSignatureError } from "./evaluations-DZ2CbV5k.js";
+import { u as InvalidSignatureError } from "./evaluations-beAooV0n.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { $n as Delegation, T as Policy, ir as Subject, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { t as ApprovalHint } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { $n as Delegation, T as Policy, ar as Subject, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { t as ApprovalHint } from "../errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-Bd1Tejur.js";
-import { o as OtelWrap } from "../types-BqAKcRNW.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
+import { n as PermDockWrap } from "../wrap-C5jC6sKI.js";
+import { o as OtelWrap } from "../types-lUlG3TVd.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
 import { t as ClientNames } from "../clients-C7zLFuWT.js";
-import { U as JwtSubjectOptions } from "../types-DiQjupG2.js";
+import { U as JwtSubjectOptions } from "../types-C791HFu9.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */