permdock 0.5.0 → 0.7.0

package/dist/{index-BcHcPyIo.d.ts → index-DLwcuCN_.d.ts}

@@ -1,9 +1,10 @@
-import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { t as Operation } from "./operations-CxybZErY.js";
-import { p as PrincipalSource, r as PermDock } from "./permdock-D7eeLJER.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-DX0LaKTb.js";
-import { l as WebhookSigner } from "./standard-webhooks-6lg8v_is.js";
+import { T as Policy, j as PolicyVocabulary, q as DecisionSink, sr as Principal, tn as DeliveryChannel } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { t as Operation } from "./operations-BNLes61x.js";
+import { a as PermDock, h as PrincipalSource } from "./permdock-Dco6dyCK.js";
+import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-g7Oy6Zg4.js";
+import { l as WebhookSigner } from "./standard-webhooks-B_qRg0ws.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
   /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
@@ -37,6 +38,84 @@ declare function subscribersFor<S extends {
   readonly principal: string;
 }>(permdock: PermDock, event: SubscriberEvent, subscribers: readonly S[]): Promise<S[]>;
 //#endregion
+//#region src/delivery/connector.d.ts
+type Https = `https://${string}`;
+type ConnectorBase<K extends string, C> = {
+  readonly id?: string;
+  readonly kind: K;
+  readonly name: string;
+  readonly config: C;
+};
+type SiemDestination = "splunk-hec" | "sentinel" | "security-lake" | "google-secops" | "elastic" | "datadog";
+/** A connector body in wire format v1 (`schemas/connector-v1.json`), one member per kind. */
+type Connector = ConnectorBase<"webhook", {
+  readonly url: Https;
+  readonly types?: readonly string[];
+}> | ConnectorBase<"otlp", {
+  readonly endpoint: Https;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signals?: readonly ("logs" | "traces")[];
+}> | ConnectorBase<"siem", {
+  readonly destination: SiemDestination;
+  readonly endpoint: Https;
+  readonly headers?: Readonly<Record<string, string>>;
+}> | ConnectorBase<"evidence", {
+  readonly format: "jws" | "ocsf" | "csv";
+  readonly destination: Https;
+  readonly schedule?: "hourly" | "daily";
+}> | ConnectorBase<"scim", {
+  readonly tenant: string;
+  readonly target: Https;
+  readonly groupRoles?: Readonly<Record<string, string>>;
+}> | ConnectorBase<"caep-transmitter", {
+  readonly issuer: Https;
+  readonly jwks_uri?: Https;
+  readonly delivery: "push" | "poll";
+  readonly poll_endpoint?: Https;
+}> | ConnectorBase<"federated-upstream", {
+  readonly discovery: Https;
+  readonly client_id: string;
+  readonly scopes?: readonly string[];
+}> | ConnectorBase<"chat", {
+  readonly platform: "slack" | "teams";
+  readonly workspace: string;
+}> | ConnectorBase<"email", {
+  readonly from: string;
+}> | ConnectorBase<"vercel-oidc", {
+  readonly team_id: string;
+  readonly project_id?: string;
+  readonly environment?: "production" | "preview" | "development";
+}>;
+type ConnectorKind = Connector["kind"];
+/** One problem with a connector body; `path` is an RFC 6901 JSON pointer into it. */
+type ConnectorIssue = {
+  readonly path: string;
+  readonly message: string;
+};
+type ParseConnectorResult = {
+  readonly ok: true;
+  readonly connector: Connector;
+} | {
+  readonly ok: false;
+  readonly issues: readonly ConnectorIssue[];
+};
+/** The kinds `connector-v1` lists, in schema order. */
+declare const CONNECTOR_KINDS: readonly ConnectorKind[];
+/**
+ * Checks `input` against `connector-v1.json` and answers a frozen copy, or
+ * every issue with a JSON pointer. The branch is chosen by `kind`, so an
+ * issue names the field rather than "no branch matched".
+ */
+declare function parseConnector(input: unknown): ParseConnectorResult;
+//#endregion
+//#region src/delivery/connector-schema.d.ts
+/**
+ * `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
+ * `oneOf` branch per kind with a closed `config`. Only the `otlp` and `siem`
+ * `headers` maps hold a secret; a store seals their values and lists names only.
+ */
+declare const CONNECTOR_SCHEMA: JsonSchemaNode;
+//#endregion
 //#region src/delivery/memory-transport.d.ts
 type MemoryDelivery<C extends DeliveryChannel> = {
   readonly target: DeliveryTarget<C>;
@@ -107,4 +186,4 @@ type WebhookTransportOptions = {
  */
 declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
 //#endregion
-export { DeliveryPermDock as a, MemoryDelivery as c, memoryDeliveryTransport as d, Audience as f, subscribersFor as g, audience as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, SubscriberEvent as m, webhookTransport as n, DeliveryPermDockOptions as o, AudienceOptions as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u };
+export { audience as C, SubscriberEvent as S, ParseConnectorResult as _, DeliveryPermDock as a, Audience as b, MemoryDelivery as c, memoryDeliveryTransport as d, CONNECTOR_SCHEMA as f, ConnectorKind as g, ConnectorIssue as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, Connector as m, webhookTransport as n, DeliveryPermDockOptions as o, CONNECTOR_KINDS as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u, SiemDestination as v, subscribersFor as w, AudienceOptions as x, parseConnector as y };

package/dist/index.d.ts

@@ -1,22 +1,23 @@
-import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionRef, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isConditionDate, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RestrictedAncestors, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as VerifiedClaims, at as SettingsSource, b as GrantScope, bn as Grantee, br as hasConditionOp, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as MembershipVia, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionValue, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as MemberOfCondition, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedHop, gt as SupportSession, h as Grant, hn as UserApprover, hr as RelatedCondition, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as Subject, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as Condition, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as ActorKind, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfParent, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as AdapterId, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as ConditionRef, ut as TokenSigner, v as GrantMeta, vn as holder, vr as SqlFunctionArg, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isSqlFunctionField, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as isCondition, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionCondition, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-DzwivBgR.js";
-import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-D6lPdb4Z.js";
-import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as principal, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as context, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as resolveCustomRole, nt as defineApp, o as OCSF_VERSION, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as validateCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as customRoleClaim, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DOVf7RJv.js";
-import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-CxybZErY.js";
-import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-D7eeLJER.js";
-import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-DBDX0M-P.js";
-import { n as PermDockValidationError } from "./validation-error-Bg5Tpluk.js";
-import { n as requiredPlans } from "./problem-details-DXlt-vks.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { $ as MemberEntry, $n as AuthorizationDetail, $t as CredentialEvent, A as PolicyScopes, An as assurance, At as CredentialRequest, B as ValidateMode, Bn as DenialReason, Bt as LocalMembershipRows, C as MembershipFixture, Cn as user, Cr as SqlFunctionArg, Ct as Credential, D as PolicyDelegation, Dn as RelationGrantee, Dr as isConditionDate, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as InheritGrantee, Er as isCondition, Et as CredentialPermission, F as RoleScope, Fn as AppObligation, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as MatchedGrant, Gt as Snapshot, H as WireValidity, Hn as ExplainedDecision, Ht as LocalRowValue, I as SeparationConflict, In as ApprovalRequiredDecision, It as parseCredential, J as EntitlementSource, Jn as Trace, Jt as SnapshotNotEntitled, K as DecisionProvider, Kn as Obligation, Kt as SnapshotAssignable, L as SubjectOf, Ln as Decision, M as PrincipalOf, Mn as inherit, Mt as credentialDelegation, N as RoleBinding, Nn as plan, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as actor, Or as isConditionRef, Ot as CredentialPolicy, P as RoleOptions, Pn as relation, Pt as decideCredential, Q as LimitStore, Qn as Assurance, Qt as AutomationEvent, R as SupportAccessOptions, Rn as Denial, S as HostedGrantRef, Sn as holder, Sr as RestrictedAncestors, St as ApiKeyPrincipal, T as Policy, Tn as GranteeInput, Tr as hasConditionOp, Tt as CredentialKind, U as CredentialVerifier, Un as GrantedDecision, Ut as LocalSnapshotManifest, Vn as DeniedDecision, Vt as LocalRowColumn, W as CustomRoleSource, Wn as LimitDetail, Wt as LocalSnapshotRows, X as LimitConsumeInput, Xn as TraceSkipReason, Xt as AccessEvent, Yn as TraceSkip, Yt as SnapshotScope, Z as LimitRemaining, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, _n as ApproverInput, _r as MemberOfCondition, _t as SupportSessionDecision, a as ApprovalRequirement, an as EmailCategory, at as SettingsSource, b as GrantScope, bn as allOf, br as RelatedCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as WireDecision, cr as SharedCustomRole, ct as TenantSettings, d as ClosureContext, dn as PolicyScopesInput, dr as ActorKind, dt as TokenVerifier, en as DecisionEvent, er as Binding, et as MembershipSource, f as ClosureGrantFn, fn as Scope, fr as AdapterId, ft as VerificationFailure, g as GrantCondition, gn as Approver, gr as ConditionValue, gt as SupportSession, h as Grant, hn as AnyOfApprover, hr as ConditionRef, ht as DecideSupportSessionOptions, i as ApprovalOption, in as DirectoryEvent, ir as GnapAccess, it as RelationSource, jn as authenticated, jt as DecideCredentialOptions, kn as anyone, kr as isSqlFunctionField, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as WireDenial, lr as Subject, lt as TokenFailureCause, m as DelegationTarget, mn as ScopeNames, mr as Condition, mt as WhereCompiler, n as ApprovalEscalation, nn as DeliveryEvent, nr as CustomRoleGrant, nt as RelationGroup, o as ApprovalStage, on as MembershipEvent, or as Membership, ot as SnapshotSource, p as DelegationInput, pn as ScopeDeclaration, pr as MembershipVia, pt as VerifiedToken, q as DecisionSink, qn as Quota, qt as SnapshotGrant, r as ApprovalMode, rn as DeliveryFailureCause, rr as Delegation, rt as RelationHolder, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, st as SubjectResolver, t as ActivationOption, tn as DeliveryChannel, tr as CustomRole, tt as RelationChain, u as BreakGlassSpec, ur as VerifiedClaims, ut as TokenSigner, v as GrantMeta, vn as PermissionApprover, vr as MemberOfParent, vt as SupportSessionPolicy, w as ObligationInput, wn as Grantee, wr as SqlFunctionCondition, wt as CredentialDecision, x as GrantValidity, xn as anyOf, xr as RelatedHop, xt as parseSupportSession, y as GrantOptions, yn as UserApprover, yt as SupportSessionRequest, z as SupportConsent, zn as DenialDetails, zt as LocalCustomRoleTable } from "./policy-types-B-F-qAZk.js";
+import { A as MetaValue, C as ResourceRelation, D as RESOURCE_X, E as ResourceXTree, O as AppData, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, k as AppDataSchema, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-Bg3eeT2H.js";
+import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-BTkwrK7v.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-BNLes61x.js";
+import { C as ApprovalPolicy, D as approvalPolicies, E as ApprovalPolicyValidation, O as memoryApprovalPolicySource, S as ApprovalPolicies, T as ApprovalPolicySource, _ as PermittedIdsOptions, a as PermDock, b as memoryLimitStore, c as SimulateOptions, d as getPermDock, f as getPermDockSync, g as memoryPrincipalSource, h as PrincipalSource, i as LoadedRows, k as validateApprovalPolicy, l as SnapshotOptions, m as PrincipalIdentityLink, n as DecideOptions, o as PermDockOptions, p as PrincipalIdentity, r as DeriveOptions, s as RowPair, t as DecideIdsOptions, u as WhereResult, v as Limits, w as ApprovalPolicyProblem, x as PermissionCheck, y as limits } from "./permdock-Dco6dyCK.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-BmjzxQhp.js";
+import { n as PermDockValidationError } from "./validation-error-CQpoquwj.js";
+import { n as requiredPlans } from "./problem-details-Tcfmj3bV.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-Bd1Tejur.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-B6R0cMRL.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-BSslw1QV.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BMZPIVUM.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Bj_lDUDq.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-D4UC9TTW.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-DOtAFWdy.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Cp_Eot9W.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DgqtruPn.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-e4mdwAKd.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,36 +1,38 @@
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-K6eWUJ0H.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-CXbis5-X.js";
-import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-DLfUWFAI.js";
+import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-CNJBiTFo.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-C1VJzvcr.js";
+import { A as memoryCustomRoleSource, C as stripeEntitlementSource, D as validateApprovalPolicy, E as memoryApprovalPolicySource, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as defineOperations, P as memorySnapshotSource, S as memoryLimitStore, _ as arazzoFindings, a as normalizeMembership, b as memoryRelationSource, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as approvalPolicies, x as limits, y as signPolicyDocument } from "./src-DLFrtrrC.js";
 import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-BybMRY7A.js";
+import { t as describe } from "./describe-DZlnEtLy.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
 import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
-import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-DVjOckjV.js";
-import { n as parseSupportSession, t as decideSupportSession } from "./support-session-C6xJQYut.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
-import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Cn1HyUsI.js";
-import { c as separationConflicts, n as definePolicy } from "./policy-DLZJ5gAp.js";
+import { a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission, v as resource } from "./permission-registry-DpPtSKNZ.js";
+import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-ySsxp_Yp.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as parseSupportSession, t as decideSupportSession } from "./support-session-Cna49-3f.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-BrRANrpT.js";
+import { a as isRoleName, l as separationConflicts, n as definePolicy } from "./policy-DaJy4nK4.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-BZIAYvon.js";
-import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-B-wCP5ZC.js";
-import { D as supportAccess, E as breakGlass, T as activate, d as customRoleClaim, j as APPROVAL_POLICY_UNAVAILABLE, v as resolveCustomRole, x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
-import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-Cxq4ygFc.js";
-import { t as whoCan } from "./who-can-D0QoYbEb.js";
-import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
-import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-Dv-WTP-w.js";
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
+import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CyH2MV_B.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
+import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-CjcwnEiV.js";
+import { t as whoCan } from "./who-can-BwNsI_Js.js";
+import { n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-wq2coopv.js";
 import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CVSs6J9I.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-B9JxkBwC.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-T1Q8X3A2.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
-import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-N1K9IpqS.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-DM2um3ha.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-L7NnfhiE.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CIM7wHwA.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-GG6Jh8HD.js → init-5TXNji88.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-DZdU0tne.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-CHTbd-DQ.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-C3DktBDY.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeMYsnYJ.js"), import("./peer-CRvC7Hg1.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-B-4t1NzC.js"), import("./peer-DOzzMfZL.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-B-4t1NzC.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-B-4t1NzC.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-DeMYsnYJ.js → init-B-4t1NzC.js}

@@ -1,7 +1,7 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-DZdU0tne.js";
-import { t as addLine } from "./peer-C8swJ2GH.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-CHTbd-DQ.js";
+import { t as addLine } from "./peer-12Q5I_RH.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts

package/dist/{instance-options-Omfd793B.d.ts → instance-options-CU0YQCLH.d.ts}

@@ -1,4 +1,4 @@
-import { i as PermDockOptions } from "./permdock-D7eeLJER.js";
+import { o as PermDockOptions } from "./permdock-Dco6dyCK.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**

package/dist/{instance-snapshot-Cxq4ygFc.js → instance-snapshot-CjcwnEiV.js}

@@ -1,21 +1,21 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { a as getResource, c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { a as getResource, c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
 import { n as isThenable } from "./thenable-yD7SabqG.js";
 import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { p as nowSeconds, s as instantAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { c as rootScope, d as scopeList, i as keepsPermission, m as tenantOf, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-DaXVdDhM.js";
-import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Cn1HyUsI.js";
-import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-C5rOdTp5.js";
+import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-BrRANrpT.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
+import { o as levelCondition, r as grantList, s as levelNames, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { C as emptyListeners, O as contactMayUse, a as expandRoleNames, b as tenantCustomRoles, h as holdsGlobalCustomRole, l as ceilingGrants, m as holdsCustomRole, n as requirementCondition, p as customRoleScope, t as evaluate, u as customGrantsFor, v as resolveCustomRole, y as roleAllowKeys } from "./evaluate-_R8QkWaf.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DHArqY82.js";
-import { t as buildSnapshot } from "./snapshot-CXUWfsNy.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-0RtHWQDx.js";
+import { t as buildSnapshot } from "./snapshot-CbGmYiJx.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -71,7 +71,11 @@ function then(value, next) {
 function composeMemberships(sources) {
 	const listing = sources.filter((source) => source.list !== void 0);
 	const versioned = sources.filter((source) => source.version !== void 0);
+	const rolesReaders = sources.filter((source) => source.globalRolesFor !== void 0);
 	return {
+		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal) {
+			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal) ?? [])), (lists) => [...new Set(lists.flat())]);
+		} },
 		membershipsFor(principal, options) {
 			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
 		},
@@ -117,6 +121,7 @@ function claimsFirst(source, options = {}) {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
 		...version === void 0 ? {} : { version },
+		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal) => inner.globalRolesFor?.(principal) ?? [] },
 		...options.onStale === "reread" ? { onStale: "reread" } : {},
 		claimsFirst: true
 	};
@@ -520,7 +525,7 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 	const out = /* @__PURE__ */ new Map();
 	const inert = /* @__PURE__ */ new Set();
 	for (const role of tenantCustomRoles(policy, customRoles)) {
-		if (role.tenant !== tenant || out.has(role.name)) continue;
+		if (!customRoleOf(role, tenant) || out.has(role.name)) continue;
 		const at = customRoleScope(role, scopes);
 		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
 		const { grants } = resolveCustomRole(policy, role);
@@ -531,11 +536,12 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, compact({
 			on: at,
 			assignable: true,
-			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles))
+			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles)),
+			shared: isSharedCustomRole(role) ? true : void 0
 		})));
 	}
 	return {
-		roles: [...out.values()].toSorted((a, b) => byCodePoint(a.key, b.key)),
+		roles: [...out.values()].toSorted((a, b) => Number(a.shared !== true) - Number(b.shared !== true) || byCodePoint(a.key, b.key)),
 		inert: [...inert].filter((name) => !out.has(name)).toSorted()
 	};
 }

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Y as JwtClaims, dt as TokenVerifier, ir as Subject, lt as TokenFailureCause, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BSslw1QV.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DiQjupG2.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
+import { Y as JwtClaims, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, pt as VerifiedToken, sr as Principal, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-D4UC9TTW.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-cTos-H7p.js";
+import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /** `on('auth')` causes: a verification failure, or one of the three capability checks. */
@@ -82,6 +82,48 @@ type DpopProofOptions = {
 };
 export declare function verifyDpopProof(request: Request, claims: JwtClaims, accessToken?: string, options?: DpopProofOptions): Promise<DpopProofResult>;
 //#endregion
+//#region src/jwt/id-token.d.ts
+/** `TokenFailureCause` plus `nonce-mismatch`; a `TokenVerifier` never returns it. */
+type IdTokenFailureCause = TokenFailureCause | "nonce-mismatch";
+type VerifyIdTokenOptions = {
+  /** The OpenID Provider's issuer; `iss` must equal it. */
+  readonly issuer: string;
+  /** The relying party's `client_id`; `aud` must contain it and `azp`, when present, must equal it. */
+  readonly clientId: string;
+  /** The `nonce` sent in the authentication request; the token's must equal it. */
+  readonly nonce?: string;
+  readonly clockTolerance?: number;
+} & ({
+  /** A verifier the caller keeps, so its JWKS cache outlives one call. */
+  readonly verifier: TokenVerifier;
+  readonly jwks?: never;
+  readonly algorithms?: never;
+} | {
+  readonly jwks: JsonWebKeySet;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly verifier?: never;
+});
+type IdTokenClaims = JwtClaims & {
+  readonly iss: string;
+  readonly sub: string;
+  readonly iat: number;
+};
+type VerifyIdTokenResult = {
+  readonly ok: true;
+  readonly claims: IdTokenClaims;
+  readonly header: VerifiedToken["header"];
+} | {
+  readonly ok: false;
+  readonly cause: IdTokenFailureCause;
+};
+/**
+ * Verifies an OpenID Connect ID token for a relying party (Core section
+ * 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent,
+ * `azp` and, when `nonce` is given, `nonce`. It does not check `at_hash`,
+ * `c_hash`, `auth_time` or `acr`. Never throws.
+ */
+export declare function verifyIdToken(token: string, options: VerifyIdTokenOptions): Promise<VerifyIdTokenResult>;
+//#endregion
 //#region src/jwt/introspection.d.ts
 export declare function subjectFromIntrospection(response: unknown, options?: JwtSubjectOptions): Subject<IntrospectionPrincipal>;
 //#endregion
@@ -92,7 +134,43 @@ export declare function joseTokenSigner(options: JoseTokenSignerOptions): TokenS
 export declare function subjectFromJwt(token: string | undefined | null, options: JwtSubjectOptions, request?: Request): Promise<Subject<JwtPrincipal>>;
 export declare function jwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
 //#endregion
+//#region src/jwt/subject-token.d.ts
+/** `TokenFailureCause` plus the two checks `verifySubjectToken` adds; a `TokenVerifier` never returns them. */
+type SubjectTokenFailureCause = TokenFailureCause | "replayed" | "lifetime-exceeded";
+type VerifySubjectTokenOptions = {
+  /** Tried in order; the first that accepts the token wins. */
+  readonly verifiers: readonly TokenVerifier[];
+  readonly audience: string | readonly string[];
+  /** Records each `jti` once; `claim` when the store has it, else `seen` and `remember`. */
+  readonly replay: ReplayStore;
+  /** The largest `exp - iat`, in seconds; default 300. */
+  readonly maxLifetime?: number;
+  readonly clockTolerance?: number;
+};
+type SubjectTokenClaims = JwtClaims & {
+  readonly sub: string;
+  readonly jti: string;
+  readonly iat: number;
+  readonly exp: number;
+};
+type VerifySubjectTokenResult = {
+  readonly ok: true;
+  readonly claims: SubjectTokenClaims;
+  readonly header: VerifiedToken["header"];
+} | {
+  readonly ok: false;
+  readonly cause: SubjectTokenFailureCause;
+};
+/**
+ * Verifies a subject token: an RFC 9068 `at+jwt` naming one subject for one
+ * request, such as the `PermDock-Subject` header. The first of `verifiers`
+ * that accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`,
+ * live at most `maxLifetime` seconds, and present its `jti` once. A replay
+ * store that throws refuses the token as `replayed`. Never throws.
+ */
+export declare function verifySubjectToken(token: string, options: VerifySubjectTokenOptions): Promise<VerifySubjectTokenResult>;
+//#endregion
 //#region src/jwt/verifier.d.ts
 export declare function joseTokenVerifier(options: JoseTokenVerifierOptions): TokenVerifier;
 //#endregion
-export { type CapabilityFailureCause, type CapabilitySubjectOptions, type CiOidcPrincipal, type CiOidcProvider, type CiOidcSubjectOptions, type DiscoveryInput, type DpopProofOptions, type DpopProofResult, type IntrospectionPrincipal, type JoseTokenSignerOptions, type JoseTokenVerifierOptions, type JsonWebKeySet, type JwtAlgorithm, type JwtJwks, type JwtPrincipal, type JwtSubjectOptions, type ReplayStore, memoryReplayStore };
+export { type CapabilityFailureCause, type CapabilitySubjectOptions, type CiOidcPrincipal, type CiOidcProvider, type CiOidcSubjectOptions, type DiscoveryInput, type DpopProofOptions, type DpopProofResult, type IdTokenClaims, type IdTokenFailureCause, type IntrospectionPrincipal, type JoseTokenSignerOptions, type JoseTokenVerifierOptions, type JsonWebKeySet, type JwtAlgorithm, type JwtJwks, type JwtPrincipal, type JwtSubjectOptions, type ReplayStore, type SubjectTokenClaims, type SubjectTokenFailureCause, type VerifyIdTokenOptions, type VerifyIdTokenResult, type VerifySubjectTokenOptions, type VerifySubjectTokenResult, memoryReplayStore };