permdock 0.6.0 → 0.7.0

package/dist/{helpers-CBYVMjwh.js → helpers-DY3vXuGs.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
-import { t as describe } from "./describe-BybMRY7A.js";
-import { i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { t as describe } from "./describe-DZlnEtLy.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { t as assertAppData } from "./app-data-MuyzVqX8.js";
 import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
 import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
 import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { c as listAllApprovals, n as assertApprover } from "./store-BDutJkDL.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-DSP9oGvh.js";
 import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { r as bindKernel } from "../bind-CAvgUuKs.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { r as bindKernel } from "../bind-D1nO6fiC.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-BPk51-kX.d.ts → hosted-BmjzxQhp.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, a as ApprovalRequirement, bn as Grantee, ur as Condition } from "./policy-types-n0uRTsW8.js";
+import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-B-F-qAZk.js";
 //#region src/core/hosted.d.ts
 /** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
 type HostedGrant = {
@@ -51,6 +51,18 @@ declare function parsePolicyDocument(json: unknown): PolicyDocument;
 declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
 /** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
 declare function isPortableCondition(value: unknown): value is Condition;
+type HostedGrantCheck = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly reason: HostedGrantDropReason;
+};
+/**
+ * Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+ * drop reason it would report when not. Needs no `PolicyDocument`, so a
+ * grant form can check a grant before it publishes one.
+ */
+declare function checkHostedGrant(policy: Policy, grant: unknown): HostedGrantCheck;
 /**
  * The code policy plus the hosted grants that pass every rule. Hosted
  * allows OR with code allows and any deny still wins, so a hosted grant can
@@ -75,4 +87,4 @@ type HostedPolicies = {
 };
 declare function hostedPolicies(source: PolicySource): HostedPolicies;
 //#endregion
-export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };
+export { HostedPolicies as a, checkHostedGrant as c, memoryPolicySource as d, mergeHostedGrants as f, HostedGrantDropped as i, hostedPolicies as l, policyDocumentFromClaims as m, HostedGrantCheck as n, PolicyDocument as o, parsePolicyDocument as p, HostedGrantDropReason as r, PolicySource as s, HostedGrant as t, isPortableCondition as u };

package/dist/{hosted-B46-5LYE.js → hosted-XBgU6RGT.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-uWQZ4v84.js";
-import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-C1VJzvcr.js";
+import { a as getResource, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { i as indexPolicy, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { i as indexPolicy, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -124,6 +124,7 @@ function approvalAtLeast(hosted, code) {
 function undeclaredKind(_grantee) {
 	return false;
 }
+/** Whether a hosted grant may name `grantee` on a permission of `permissionResource`. */
 function declaredGrantee(policy, grantee, permissionResource) {
 	switch (grantee.kind) {
 		case "role": return declaredRoleNames(policy).has(grantee.role);
@@ -156,6 +157,10 @@ function granteesAcceptable(policy, raw, permissionResource) {
 	const items = flattenGrantee(raw);
 	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
 }
+/** The approvals the code allows on `key` carry; a hosted allow must meet each one. */
+function codeApprovals(policy, key) {
+	return policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === key).map((grant) => grant.approval);
+}
 function buildGrant(policy, document, raw) {
 	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
 		ok: false,
@@ -216,13 +221,10 @@ function buildGrant(policy, document, raw) {
 			reason: "invalid"
 		};
 	}
-	if (effect === "allow") {
-		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
-		if (!approvalAtLeast(built.approval, codeApprovals)) return {
-			ok: false,
-			reason: "weaker-approval"
-		};
-	}
+	if (effect === "allow" && !approvalAtLeast(built.approval, codeApprovals(policy, permission.key))) return {
+		ok: false,
+		reason: "weaker-approval"
+	};
 	return {
 		ok: true,
 		grant: freezeDeep({
@@ -234,6 +236,26 @@ function buildGrant(policy, document, raw) {
 		})
 	};
 }
+const CHECKED_DOCUMENT = Object.freeze({
+	v: 1,
+	id: "",
+	fingerprint: "",
+	catalog: "",
+	issuedAt: "",
+	grants: Object.freeze([])
+});
+/**
+* Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+* drop reason it would report when not. Needs no `PolicyDocument`, so a
+* grant form can check a grant before it publishes one.
+*/
+function checkHostedGrant(policy, grant) {
+	const result = buildGrant(policy, CHECKED_DOCUMENT, grant);
+	return result.ok ? { ok: true } : {
+		ok: false,
+		reason: result.reason
+	};
+}
 /** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
 function hostedGrantDrops(policy, document) {
 	return document.grants.flatMap((raw) => {
@@ -312,4 +334,4 @@ function hostedPolicies(source) {
 	});
 }
 //#endregion
-export { mergeHostedGrants as a, memoryPolicySource as i, hostedPolicies as n, parsePolicyDocument as o, isPortableCondition as r, policyDocumentFromClaims as s, hostedGrantDrops as t };
+export { hostedPolicies as a, mergeHostedGrants as c, hostedGrantDrops as i, parsePolicyDocument as l, codeApprovals as n, isPortableCondition as o, declaredGrantee as r, memoryPolicySource as s, checkHostedGrant as t, policyDocumentFromClaims as u };

package/dist/{http-DXJ37RDA.js → http-Ca3Sr5x1.js}

@@ -1,5 +1,5 @@
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
+import { a as describeError, n as CliError } from "./errors-DpP_U6Bf.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
 import "./device-BARQ8eYG.js";
 //#region src/cli/core/http.ts

package/dist/{import-wyqXUyjm.js → import-Bz0GefWg.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-BAK8t4Uo.js";
-import { f as pgConnector } from "./policies-DP2nqRoF.js";
-import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B96movIM.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-fMKOv8hP.js";
+import { f as pgConnector } from "./policies-B2lZIurj.js";
+import { t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{import-CNV7I2Dw.js → import-DB2EG_iy.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
-import { n as httpRequest } from "./http-DXJ37RDA.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
+import { n as httpRequest } from "./http-Ca3Sr5x1.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { t as validateOpenapi } from "./schema-yLuBWWsh.js";
+import { t as validateOpenapi } from "./schema-gIcCx7zM.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-C-6Letxg.d.ts → index-BE8y3moU.d.ts}

@@ -1,8 +1,8 @@
-import { Nn as Decision, Rt as Instant, T as Policy, Yn as AuthorizationDetail, ar as Subject, et as MembershipSource, fn as Approver, it as RelationSource, nr as Membership, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { E as PermissionTree, V as AppData, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-BdtSDbBO.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-C_IiEs64.js";
+import { $n as AuthorizationDetail, Ln as Decision, Rt as Instant, T as Policy, et as MembershipSource, gn as Approver, it as RelationSource, lr as Subject, or as Membership, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { O as AppData, f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DC44-hqb.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-CfiKC5aN.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {
@@ -135,6 +135,22 @@ type MatchDelegationOptions = {
 declare function matchDelegation(request: ApprovalRequest, delegate: Subject, options: MatchDelegationOptions): Promise<ApprovalDelegationMatch | undefined>;
 //#endregion
 //#region src/approvals/idempotency.d.ts
+/** The approve or reject call a key was first used for. */
+type IdempotentCall = {
+  readonly action: "approve" | "reject";
+  /** The approval id in the path. */
+  readonly id: string;
+  /** The request body text as read; `""` without a body. */
+  readonly body: string;
+};
+/** One `Idempotency-Key` entry as `approvalsHandler` stores it. */
+type IdempotencyRecord = {
+  /** The store key: the approver's principal id and the field value, joined by a newline. */
+  readonly key: string;
+  readonly response: IdempotentResponse;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+};
 /** A response the approvals handler replays for a repeated `Idempotency-Key`. */
 type IdempotentResponse = {
   /** Which request produced it: a reused key with another fingerprint is refused with `422`. */
@@ -156,6 +172,22 @@ type IdempotencyStore = {
   /** `expiresAt` is epoch milliseconds; the store may drop the entry after it. */
   set(key: string, response: IdempotentResponse, expiresAt: number): void | Promise<void>;
 };
+/** The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never cross approvers. */
+declare function idempotencyRecordKey(principalId: string, key: string): string;
+/**
+ * The record `approvalsHandler` stores after `call` answered `response`:
+ * the status, headers and body text, the call's fingerprint, and an expiry
+ * 24 hours after `now` (epoch milliseconds, default the clock).
+ */
+declare function idempotencyRecord(input: {
+  readonly principalId: string;
+  readonly key: string;
+  readonly call: IdempotentCall;
+  readonly response: Response;
+  readonly now?: number;
+}): Promise<IdempotencyRecord>;
+/** Whether a stored response came from the same call: a reused key with another call is refused with `422`. */
+declare function matchesIdempotencyRecord(response: IdempotentResponse, call: IdempotentCall): boolean;
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 declare function memoryIdempotencyStore(): IdempotencyStore;
 //#endregion
@@ -193,8 +225,6 @@ type ApprovalsHandlerOptions = {
    */
   readonly idempotency?: IdempotencyStore;
 };
-/** An approval as the approvals API shows it: never the resume `token`. */
-type ApprovalView = Omit<ApprovalRequest, "token">;
 declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
 //#region src/approvals/parse-request.d.ts
@@ -256,6 +286,18 @@ type SignApprovalOptions = {
  */
 declare function signApproval(request: ApprovalRequest, signer: TokenSigner | undefined, options?: SignApprovalOptions): Promise<string | undefined>;
 //#endregion
+//#region src/approvals/entity-tag.d.ts
+/** An approval as the approvals API shows it: never the resume `token`. */
+type ApprovalView = Omit<ApprovalRequest, "token">;
+/** The request without its resume `token`; every other field stays. */
+declare function approvalView(request: ApprovalRequest): ApprovalView;
+/**
+ * A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
+ * `approvalView(request)` as RFC 8785 JSON. A field outside
+ * `ApprovalRequest` changes the tag, so hash the stored request as is.
+ */
+declare function approvalEntityTag(request: ApprovalRequest): string;
+//#endregion
 //#region src/approvals/relations.d.ts
 type ApproverRelationsOptions = {
   /** The object graph relation approvers are read from; without it they match nobody. */
@@ -428,4 +470,4 @@ declare function memoryApprovalStore(options?: {
   readonly now?: () => Instant;
 }): MemoryApprovalStore;
 //#endregion
-export { AccessReviewVerdict as $, APPROVAL_REQUEST_SCHEMA as A, matchDelegation as B, ApproverRelationsOptions as C, SignApprovalOptions as D, ApprovalSignatureEntry as E, IdempotencyStore as F, pageAccessReviewItems as G, parseApprovalDelegation as H, IdempotentResponse as I, StartAccessReviewInput as J, AccessReviewHolder as K, memoryIdempotencyStore as L, ApprovalView as M, ApprovalsHandlerOptions as N, approvalSignatureClaims as O, approvalsHandler as P, isAccessReviewError as Q, ApprovalDelegationMatch as R, vouchApproval as S, ApprovalSignatureClaims as T, MemoryAccessReviewStore as U, memoryApprovalDelegationSource as V, memoryAccessReviewStore as W, AccessReviewError as X, startAccessReview as Y, AccessReviewErrorCode as Z, resolveApproval as _, approverPermissions as a, storedApprovalToken as b, decodeApprovalCursor as c, pageApprovals as d, accessReviewerEligible as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, parseApprovalRequest as j, signApproval as k, encodeApprovalCursor as l, inspectApproval as m, applyApprovalVerdict as n, AccessReviewsHandlerOptions as nt, ApprovalCursorPosition as o, consumeApproval as p, AccessReviewOptions as q, assertApprover as r, accessReviewsHandler as rt, approvalPageSize as s, MemoryApprovalStore as t, decideAccessReviewItem as tt, listAllApprovals as u, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, MatchDelegationOptions as z };
+export { AccessReviewHolder as $, SignApprovalOptions as A, IdempotentResponse as B, ApproverRelationsOptions as C, approvalView as D, approvalEntityTag as E, ApprovalsHandlerOptions as F, ApprovalDelegationMatch as G, idempotencyRecordKey as H, approvalsHandler as I, memoryApprovalDelegationSource as J, MatchDelegationOptions as K, IdempotencyRecord as L, signApproval as M, APPROVAL_REQUEST_SCHEMA as N, ApprovalSignatureClaims as O, parseApprovalRequest as P, pageAccessReviewItems as Q, IdempotencyStore as R, vouchApproval as S, ApprovalView as T, matchesIdempotencyRecord as U, idempotencyRecord as V, memoryIdempotencyStore as W, MemoryAccessReviewStore as X, parseApprovalDelegation as Y, memoryAccessReviewStore as Z, resolveApproval as _, approverPermissions as a, isAccessReviewError as at, storedApprovalToken as b, decodeApprovalCursor as c, decideAccessReviewItem as ct, pageApprovals as d, AccessReviewOptions as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, AccessReviewErrorCode as it, approvalSignatureClaims as j, ApprovalSignatureEntry as k, encodeApprovalCursor as l, AccessReviewsHandlerOptions as lt, inspectApproval as m, applyApprovalVerdict as n, startAccessReview as nt, ApprovalCursorPosition as o, AccessReviewVerdict as ot, consumeApproval as p, matchDelegation as q, assertApprover as r, AccessReviewError as rt, approvalPageSize as s, accessReviewerEligible as st, MemoryApprovalStore as t, StartAccessReviewInput as tt, listAllApprovals as u, accessReviewsHandler as ut, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, IdempotentCall as z };

package/dist/{index-B8YjkEZ4.d.ts → index-BSfRl0hZ.d.ts}

@@ -1,9 +1,9 @@
-import { Ct as Credential, Nn as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, ar as Subject, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lt as TokenFailureCause, q as DecisionSink, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
-import { t as Disclosure } from "./problem-details-B45V5d2b.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CKQiCnON.js";
+import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
+import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-C4gZUEZy.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are

package/dist/{index-DuWxc5dt.d.ts → index-BTkwrK7v.d.ts}

@@ -1,20 +1,27 @@
-import { $n as Delegation, Bt as LocalSnapshotManifest, C as MembershipFixture, D as PolicyDelegation, I as SeparationConflict, In as DenialReason, J as EntitlementSource, Kt as AccessEvent, Lt as InstanceHandle, N as RoleBinding, Nn as Decision, P as RoleOptions, Pn as Denial, Qt as DeliveryEvent, R as SupportAccessOptions, Rt as Instant, T as Policy, V as VocabularyFromInput, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, Y as JwtClaims, Zn as CustomRole, ar as Subject, at as SettingsSource, br as SqlFunctionCondition, c as BreakGlassOptions, ct as TenantSettings, dr as ConditionRef, et as MembershipSource, g as GrantCondition, h as Grant, hr as OpaqueCondition, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, nr as Membership, nt as RelationGroup, ot as SnapshotSource, rn as SinkEvent, rr as Principal, s as AssuranceRequirement, sn as PolicyScopesInput, ut as TokenSigner, yr as SqlFunctionArg } from "./policy-types-n0uRTsW8.js";
-import { C as InferPermissionTree, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, P as ResourceOptions, R as ResourceRestricted, T as PermissionKind, g as ActionMeta, h as ActionList, k as ResourceInit, r as Role, w as Permission, z as ResourceXTree } from "./vocabulary-CN8H_9UF.js";
-import { i as PermDockOptions, r as PermDock } from "./permdock-SV8ZINYT.js";
-import { a as PolicyDocument } from "./hosted-BPk51-kX.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
-import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
-import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
+import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-B-F-qAZk.js";
+import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, r as Role } from "./vocabulary-Bg3eeT2H.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-Dco6dyCK.js";
+import { o as PolicyDocument } from "./hosted-BmjzxQhp.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
+import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-4-eQIRWf.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-Cp_Eot9W.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
-type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
+type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
 type SubjectRef = ConditionRef & { readonly [K in KnownRefField]: SubjectRef; } & {
   readonly [key: string]: SubjectRef;
 };
 declare const principal: SubjectRef;
 declare const context: SubjectRef;
+/**
+ * `principal.claims.<path>` for a dot path such as `team_ids` or
+ * `attrs.region`, typed `SubjectRef` under `noUncheckedIndexedAccess` and
+ * `noPropertyAccessFromIndexSignature`.
+ */
+declare function claim(path: string): SubjectRef;
 //#endregion
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
@@ -65,6 +72,24 @@ type ValidateCustomRoleOptions = {
   readonly shared?: readonly CustomRole[];
 };
 declare function validateCustomRole(policy: Policy, role: CustomRole, options?: ValidateCustomRoleOptions): CustomRoleValidation;
+/** The outcome of one stored allow entry, `<permission>[@<level>]`. */
+type CustomRoleEntry = {
+  readonly ok: true;
+  /** The current key, after a `renamed` key resolves. */
+  readonly permission: string;
+  readonly level?: string;
+} | {
+  readonly ok: false;
+  readonly cause: "unknown-permission" | "outside-ceiling" | "unknown-level";
+};
+/**
+ * Checks one stored allow entry, `<permission>[@<level>]`, the way
+ * `permdock_custom_role_entry_problem` does in SQL. `scope` defaults to the
+ * first scope; its ceiling is the allows of that scope's assignable roles.
+ */
+declare function parseCustomRoleEntry(policy: Policy, entry: string, options?: {
+  readonly scope?: string;
+}): CustomRoleEntry;
 /**
  * The compact JWT form of custom roles for the `memberships[].grants` claim
  * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
@@ -88,6 +113,19 @@ declare function requiresApproval(approval: Grant["approval"] | undefined): bool
 //#endregion
 //#region src/core/policy.d.ts
 declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
+/** The role names a policy declares: the keys of its `defineRoles` vocabulary, else `string`. */
+type RoleNameOf<P> = P extends {
+  readonly vocabulary: infer V;
+} ? V extends {
+  readonly roles: infer R extends RoleTree;
+} ? R[keyof R]["key"] : string : string;
+/**
+ * Whether `value` names a role the policy declares, for a role read as a
+ * string from a database or a token. A name it rejects is an unknown role,
+ * which grants nothing (`unknown-role`). A tenant's custom roles are not
+ * declared; `CustomRoleSource` resolves them.
+ */
+declare function isRoleName<P extends Policy<never>>(policy: P, value: unknown): value is RoleNameOf<P>;
 declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
 //#endregion
 //#region src/core/permission-registry.d.ts
@@ -291,11 +329,23 @@ type SignSnapshotOptions = {
   /** `aud`; a signer with no default audience refuses to sign without one. */
   readonly audience?: string | readonly string[];
 };
+/** The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and `jti`. */
+type SnapshotClaims = {
+  readonly snapshot: Omit<Snapshot, "issuedAt" | "expiresAt">;
+  /** The principal's id; absent for an anonymous snapshot. */
+  readonly sub?: string;
+  /** `issuedAt` in NumericDate seconds; absent when it is not after the epoch. */
+  readonly iat?: number;
+  /** `expiresAt` in NumericDate seconds; absent when the snapshot has none, and the signer then sets its default. */
+  readonly exp?: number;
+};
 /**
- * Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
- * `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
- * registered claims are the only times a verifier reads.
+ * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`
+ * become `iat` and `exp` and leave the `snapshot` claim, so the registered
+ * claims are the only times a verifier reads.
  */
+declare function snapshotClaims(snapshot: Snapshot): SnapshotClaims;
+/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
 declare function signSnapshot(snapshot: Snapshot, signer: TokenSigner, options?: SignSnapshotOptions): Promise<string>;
 /**
  * The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
@@ -490,7 +540,7 @@ type SnapshotForOptions = {
 declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
 //#endregion
 //#region src/core/permissions.d.ts
-declare function definePermissions<const Input, PX = never, RX = never>(input: Input, options?: PermissionsOptions<PX, RX>): InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
+declare function definePermissions<const Input, PX = never, RX = never>(input: Input, options?: PermissionsOptions<PX, RX>): PermissionsOf<Input, PX, RX>;
 //#endregion
 //#region src/core/permission-leaf.d.ts
 /**
@@ -574,7 +624,15 @@ declare function normalizeAssurance(input: AssuranceRequirement | undefined): As
 //#endregion
 //#region src/core/grant-builders.d.ts
 declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+/**
+ * Every action of a resource (`permissions.post`), of several, or of the
+ * whole tree, unconditionally. Each grant is listed in the policy as if
+ * written out, and an action added to the resource later is granted too.
+ */
+declare function allow(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+/** Every action of a resource, of several, or of the whole tree, unconditionally. */
+declare function deny(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 //#endregion
 //#region src/core/approval-normalize.d.ts
 declare function normalizeApproval(approval: ApprovalOption | undefined, permission?: string): Grant["approval"];
@@ -624,6 +682,22 @@ type ActivateInput = {
  */
 declare function activate(permdock: InstanceHandle, input: ActivateInput): Decision;
 //#endregion
+//#region src/core/scope-helpers.d.ts
+/**
+ * The canonical form PermDock evaluates one membership in, or `undefined`
+ * when it is malformed and grants nothing. `scopes` is the policy's or the
+ * catalog's scope list; absent or empty means the implicit `tenant` and
+ * `team` pair.
+ */
+declare function normalizeMembership(input: unknown, scopes?: readonly Scope[]): Membership | undefined;
+/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[]): readonly Membership[];
+/**
+ * The declared scope `name` stands for: the name itself, or the scope the
+ * `tenant` (first) or `team` (second) alias names. `undefined` otherwise.
+ */
+declare function resolveScope(scopes: readonly Scope[] | undefined, name: unknown): string | undefined;
+//#endregion
 //#region src/core/ownership.d.ts
 /** Who a role change is about: their principal id and their membership in the scope instance. */
 type RoleChangeTarget = {
@@ -676,6 +750,44 @@ type RoleChangeDecision = {
   readonly change: RoleChange;
   readonly denials: readonly Denial[];
 };
+/** The holder-count, membership-kind, exclusivity and `assigns` rules of one role, as the catalog lists them (`CatalogRole`). */
+type RoleRules = {
+  readonly key: string;
+  readonly min?: number;
+  readonly max?: number;
+  readonly transferOnly?: boolean;
+  readonly assigns?: readonly string[];
+  readonly for?: readonly string[];
+  readonly exclusiveWith?: readonly string[];
+};
+type RoleChangeCheckInput = {
+  readonly change: {
+    readonly kind: "assign" | "revoke" | "transfer";
+    readonly target: Pick<RoleChangeTarget, "via" | "roles">;
+  };
+  /** How many principals hold the role in the instance now; without it a role with `min`, `max` or `transferOnly` is denied. */
+  readonly holders?: number;
+  /** Every declared role: adds the `exclusiveWith` other roles declare against this one, and with `actorRoles` the `assigns` rule. */
+  readonly roles?: readonly RoleRules[];
+  /** The roles the actor holds at the instance, highest rank first. With `roles` naming any `assigns`, one of them must assign this role. */
+  readonly actorRoles?: readonly string[];
+};
+/** `by` names the actor role whose `assigns` allowed the change, `null` when the rule did not apply. */
+type RoleChangeCheck = {
+  readonly ok: true;
+  readonly by: string | null;
+} | {
+  readonly ok: false;
+  readonly denials: readonly Denial[];
+};
+/**
+ * The rules of a role change that need no subject: `assigns`, `for`,
+ * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
+ * the target's roles alone. `decideRoleChange` runs the same function after
+ * its actor, tenant and ceiling checks; a service that holds only the
+ * catalog calls it with the `CatalogRole` entries.
+ */
+declare function checkRoleChange(role: RoleRules, input: RoleChangeCheckInput): RoleChangeCheck;
 type RoleChangeOptions = {
   /**
    * `true` when the application loaded `change.within` from its own store
@@ -888,6 +1000,23 @@ declare function toCsvRow(event: DecisionEvent): string;
  */
 declare function catalogFingerprint(catalog: unknown): string;
 //#endregion
+//#region src/core/canonical-json.d.ts
+/**
+ * RFC 8785 (JCS) output for I-JSON input: keys sorted by UTF-16 code units,
+ * ECMAScript number and string serialisation, no whitespace. `undefined`
+ * members are dropped. Outside I-JSON, Dates become ISO strings, bigints
+ * `"<n>n"`, and a repeated object on the current path `"[Circular]"`, so any
+ * validated row serialises.
+ */
+declare function canonicalJson(value: unknown): string;
+//#endregion
+//#region src/core/sha256.d.ts
+/**
+ * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
+ * of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+ */
+declare function sha256Digest(text: string): string;
+//#endregion
 //#region src/core/delegation.d.ts
 type DelegatedPermission = Pick<Permission, "scope" | "resource" | "action">;
 /**
@@ -906,4 +1035,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { ShadowMismatch as $, CustomRoleValidation as $t, decideRoleChange as A, isExternallyManaged as At, crud as B, getResource as Bt, parseCloudEventBatch as C, MemoryRelationSourceData as Ct, RoleChangeDecision as D, claimsFirst as Dt, RoleChange as E, stripeEntitlementSource as Et, normalizeApproval as F, memorySettingsSource as Ft, definePermissions as G, separationConflicts as Gt, writable as H, listPermissions as Ht, allow as I, memorySnapshotSource as It, CustomRoleReader as J, fromSnapshot as Jt, SnapshotForOptions as K, requiresApproval as Kt, deny as L, sqlFunction as Lt, activate as M, memoryCustomRoleSource as Mt, breakGlass as N, memoryEntitlementSource as Nt, RoleChangeOptions as O, composeMemberships as Ot, supportAccess as P, memoryMembershipSource as Pt, LegacyCheck as Q, CustomRoleRename as Qt, normalizeAssurance as R, opaque as Rt, parseCloudEvent as S, MemoryEdge as St, parseSinkEvents as T, StripeEntitlementsClient as Tt, formerKeys as U, mergePermissions as Ut, readable as V, isPermission as Vt, resource as W, definePolicy as Wt, customRoleSource as X, CustomRoleDrop as Xt, CustomRoleSourceOptions as Y, parseSnapshot as Yt, mayAccess as Z, CustomRoleDropReason as Zt, DIRECTORY_EVENT_SCHEMA as _, signPolicyDocument as _t, toCsvRow as a, context as an, localSnapshotManifest as at, SINK_EVENT_SCHEMAS as b, WhoCan as bt, OcsfUserManagement as c, ArazzoSimulateInput as ct, ACCESS_EVENT_SCHEMA as d, simulateArazzo as dt, ResolvedCustomRole as en, ShadowOptions as et, AUTOMATION_EVENT_SCHEMA as f, deliveryEvent as ft, DELIVERY_EVENT_SCHEMA as g, SignPolicyDocumentOptions as gt, DECISION_EVENT_SCHEMA as h, snapshotFromClaims as ht, CSV_COLUMNS as i, validateCustomRole as in, AppProfile as it, ActivateInput as j, APPROVAL_POLICY_UNAVAILABLE as jt, RoleChangeTarget as k, countHolders as kt, accessToOcsf as l, ArazzoStepResult as lt, CREDENTIAL_EVENT_SCHEMA as m, signSnapshot as mt, delegatedPermissions as n, customRoleClaim as nn, defineApp as nt, OCSF_VERSION as o, principal as on, ArazzoFinding as ot, CATALOG_EVENT_SCHEMA as p, SignSnapshotOptions as pt, snapshotFor as q, emptySnapshot as qt, catalogFingerprint as r, resolveCustomRole as rn, AppOptions as rt, OcsfAuthorizeSession as s, ArazzoPlan as st, coveredByDelegation as t, ValidateCustomRoleOptions as tn, shadowMode as tt, toOcsf as u, arazzoFindings as ut, EVENT_SCHEMA_IDS as v, Holder as vt, parseSinkEvent as w, memoryRelationSource as wt, parseCatalogEventData as x, whoCan as xt, MEMBERSHIP_EVENT_SCHEMA as y, HoldingVia as yt, role as z, findPermission as zt };
+export { resource as $, listPermissions as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryMembershipSource as Gt, breakGlass as H, APPROVAL_POLICY_UNAVAILABLE as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, sqlFunction as Jt, deny as K, memorySettingsSource as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, isPermission as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, principal as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, snapshotClaims as Tt, supportAccess as U, memoryCustomRoleSource as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, memoryEntitlementSource as Wt, readable as X, findPermission as Xt, crud as Y, opaque as Yt, writable as Z, getResource as Zt, DECISION_EVENT_SCHEMA as _, parseCustomRoleEntry as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, requiresApproval as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, claim as bn, simulateArazzo as bt, OCSF_VERSION as c, parseSnapshot as cn, ShadowMismatch as ct, accessToOcsf as d, CustomRoleEntry as dn, defineApp as dt, mergePermissions as en, definePermissions as et, toOcsf as f, CustomRoleRename as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, customRoleClaim as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, ValidateCustomRoleOptions as hn, ArazzoFinding as ht, canonicalJson as i, separationConflicts as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, CustomRoleDrop as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, ResolvedCustomRole as mn, localSnapshotManifest as mt, delegatedPermissions as n, definePolicy as nn, snapshotFor as nt, CSV_COLUMNS as o, emptySnapshot as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleValidation as pn, AppProfile as pt, normalizeAssurance as q, memorySnapshotSource as qt, sha256Digest as r, isRoleName as rn, CustomRoleReader as rt, toCsvRow as s, fromSnapshot as sn, LegacyCheck as st, coveredByDelegation as t, RoleNameOf as tn, SnapshotForOptions as tt, OcsfUserManagement as u, CustomRoleDropReason as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, resolveCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, context as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, validateCustomRole as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };