permdock 0.6.0 → 0.7.0

package/dist/index-CMiPH2Tv.d.ts

@@ -0,0 +1,206 @@
+import { T as Policy, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-cTos-H7p.js";
+//#region src/ssf/create.d.ts
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
+//#endregion
+//#region src/ssf/poll-client.d.ts
+type PollSetsOptions = {
+  /** The transmitter's RFC 8936 poll endpoint, the stream's `delivery.endpoint_url`. */
+  readonly endpoint: string;
+  /** The `Authorization` header value. */
+  readonly authorization?: string;
+  /** `jti` values of SETs the receiver accepted. */
+  readonly acks?: readonly string[];
+  /** SETs the receiver refused, by `jti`. */
+  readonly setErrs?: Readonly<Record<string, SetError>>;
+  /** At most this many SETs in the response; default 100. `0` only acknowledges. */
+  readonly maxEvents?: number;
+  /** Default `true`: answer at once rather than wait for a SET. */
+  readonly returnImmediately?: boolean;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+/** One SET from a poll response: its `jti` and the compact JWS, not yet verified. */
+type PolledSet = {
+  readonly jti: string;
+  readonly set: string;
+};
+type PollSetsResult = {
+  readonly ok: true;
+  readonly sets: readonly PolledSet[];
+  readonly moreAvailable: boolean;
+} | Extract<SetDelivery, {
+  readonly ok: false;
+}>;
+/**
+ * One RFC 8936 poll request: sends `acks` and `setErrs` and answers the SETs
+ * the transmitter returns, unverified. A failure maps as `pushSet`'s does; a
+ * `2xx` body without a `sets` object is `invalid-request`. Never throws.
+ */
+declare function pollSets(options: PollSetsOptions): Promise<PollSetsResult>;
+//#endregion
+//#region src/ssf/set-queue.d.ts
+/**
+ * An in-process `SetQueue`: pending SETs per stream in insertion order. A
+ * process restart loses them; a deployment with more than one instance needs
+ * a shared queue.
+ */
+declare function memorySetQueue(): SetQueue;
+/**
+ * The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's
+ * `acks` and `setErrs`, then answers `{ sets, moreAvailable }` with up to
+ * `maxEvents` pending SETs. It answers at once whatever `returnImmediately`
+ * says, which RFC 8936 section 2.4 allows.
+ */
+declare function setPollHandler(options: SetPollHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/ssf/streams.d.ts
+/** One stream a transmitter holds and the receiver that created it. */
+type SsfStream = {
+  /** The receiver `ssfTransmitter`'s `authorize` answered when the stream was created. */
+  readonly owner: string;
+  readonly configuration: SsfStreamConfiguration;
+};
+/**
+ * The streams an SSF 1.0 transmitter serves (section 8.1). A new stream is
+ * `enabled`; `status` answers `null` for a stream that does not exist.
+ */
+type SsfStreamStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  create(owner: string, configuration: SsfStreamConfiguration): void | Promise<void>;
+  get(streamId: string): SsfStream | null | Promise<SsfStream | null>;
+  /** Every stream of `owner`, or every stream when `owner` is absent, oldest first. */
+  list(owner?: string): readonly SsfStream[] | Promise<readonly SsfStream[]>;
+  /** Replaces the configuration of the stream `configuration.stream_id`; the owner and status stay. */
+  update(configuration: SsfStreamConfiguration): void | Promise<void>;
+  delete(streamId: string): void | Promise<void>;
+  status(streamId: string): SsfStreamStatus | null | Promise<SsfStreamStatus | null>;
+  setStatus(status: SsfStreamStatus): void | Promise<void>;
+};
+/**
+ * An in-process `SsfStreamStore`. A process restart loses every stream; a
+ * deployment with more than one instance needs a shared store.
+ */
+declare function memorySsfStreamStore(): SsfStreamStore;
+//#endregion
+//#region src/ssf/transmitter-handler.d.ts
+type SsfTransmitterOptions = {
+  /** `iss` of every stream and of the metadata; the `iss` the signer writes. */
+  readonly issuer: string;
+  /** The URL the handler is mounted at; endpoints are `<endpoint>/stream`, `/status`, `/verify` and `/poll`. Default `issuer`. */
+  readonly endpoint?: string;
+  readonly streams: SsfStreamStore;
+  readonly queue: SetQueue;
+  readonly signer: TokenSigner;
+  /** The receiver the request's credentials authenticate, or `null` to refuse it with `401`. */
+  readonly authorize: (request: Request) => string | null | Promise<string | null>;
+  /** `aud` of a receiver's streams; default the receiver itself. */
+  readonly audience?: (receiver: string) => string | readonly string[];
+  readonly jwksUri?: string;
+  /** Default every CAEP and RISC event PermDock's receiver handles. */
+  readonly eventsSupported?: readonly string[];
+  /** The largest `maxEvents` a poll is answered with; default 100. */
+  readonly maxEvents?: number;
+  readonly fetch?: typeof fetch;
+};
+type FanOutSetOptions = {
+  readonly streams: SsfStreamStore;
+  readonly queue: SetQueue;
+  readonly signer: TokenSigner;
+  readonly fetch?: typeof fetch;
+};
+/** How one stream took a SET. `queued` is `true` for a poll stream and for a paused push stream. */
+type SsfFanOut = {
+  readonly stream: string;
+  readonly jti: string;
+  readonly queued: boolean;
+  readonly delivery: SetDelivery;
+};
+/**
+ * Signs `event` once per distinct stream audience and delivers it to every
+ * stream that is not disabled and has the event in `events_delivered`: a
+ * push stream through `pushSet`, a poll stream or a paused stream into the
+ * queue. Answers one row per stream that took the event.
+ */
+declare function fanOutSet(event: SetEvent, options: FanOutSetOptions): Promise<readonly SsfFanOut[]>;
+/**
+ * An SSF 1.0 transmitter as one Fetch handler, routed by path suffix:
+ * `/.well-known/ssf-configuration` (section 7.1), `/stream` (8.1.1),
+ * `/status` (8.1.2), `/verify` (8.1.4) and `/poll` (RFC 8936). Each receiver
+ * sees only the streams it created. Disabling or deleting a stream drops its
+ * pending SETs; a paused stream holds them until it is enabled again.
+ */
+declare function ssfTransmitter(options: SsfTransmitterOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/ssf/transmitter.d.ts
+/** SSF 1.0 delivery method URN for RFC 8935 push. */
+declare const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
+/** SSF 1.0 delivery method URN for RFC 8936 poll. */
+declare const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
+/**
+ * Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
+ * `sub_id` is the event's subject and `events` holds exactly one entry, as
+ * SSF 1.0 requires. `iss` is the signer's own.
+ */
+declare function signSet(event: SetEvent, signer: TokenSigner, options: SignSetOptions): Promise<string>;
+/**
+ * Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
+ * maps the receiver's `err` to a cause; `401` and `403` are
+ * `authentication-failed` and `access-denied`; a network failure, a timeout,
+ * a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+ */
+declare function pushSet(set: string, options: PushSetOptions): Promise<SetDelivery>;
+type CaepCredentialChange = CaepCommon & {
+  readonly credentialType: string;
+  readonly changeType: "create" | "revoke" | "update" | "delete";
+  readonly friendlyName?: string;
+  readonly x509Issuer?: string;
+  readonly x509Serial?: string;
+  readonly fido2Aaguid?: string;
+};
+type CaepTokenClaimsChange = CaepCommon & {
+  readonly claims: Readonly<Record<string, unknown>>;
+};
+type CaepAssuranceLevelChange = CaepCommon & {
+  readonly namespace: string;
+  readonly currentLevel: string;
+  readonly previousLevel?: string;
+  readonly changeDirection?: "increase" | "decrease";
+};
+type CaepDeviceComplianceChange = CaepCommon & {
+  readonly previousStatus: "compliant" | "not-compliant";
+  readonly currentStatus: "compliant" | "not-compliant";
+};
+type CaepEvents = {
+  readonly sessionRevoked: (input: CaepCommon) => SetEvent;
+  readonly credentialChange: (input: CaepCredentialChange) => SetEvent;
+  readonly tokenClaimsChange: (input: CaepTokenClaimsChange) => SetEvent;
+  readonly assuranceLevelChange: (input: CaepAssuranceLevelChange) => SetEvent;
+  readonly deviceComplianceChange: (input: CaepDeviceComplianceChange) => SetEvent;
+};
+/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
+declare const caepEvents: CaepEvents;
+type RiscAccountDisabled = {
+  readonly subject: SetSubject;
+  readonly reason?: "hijacking" | "bulk-account";
+};
+type RiscCredentialCompromise = CaepCommon & {
+  readonly credentialType: string;
+};
+type RiscEvents = {
+  readonly accountDisabled: (input: RiscAccountDisabled) => SetEvent;
+  readonly accountPurged: (input: {
+    readonly subject: SetSubject;
+  }) => SetEvent;
+  readonly credentialCompromise: (input: RiscCredentialCompromise) => SetEvent;
+};
+/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
+declare const riscEvents: RiscEvents;
+/**
+ * The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
+ * receiver's `state`. Its subject is the stream, never a principal.
+ */
+declare function streamVerificationEvent(stream: string, state?: string): SetEvent;
+//#endregion
+export { createPermDock as A, memorySsfStreamStore as C, PollSetsResult as D, PollSetsOptions as E, PolledSet as O, SsfStreamStore as S, setPollHandler as T, SsfFanOut as _, CaepTokenClaimsChange as a, ssfTransmitter as b, RiscEvents as c, caepEvents as d, pushSet as f, FanOutSetOptions as g, streamVerificationEvent as h, CaepEvents as i, pollSets as k, SSF_POLL_DELIVERY as l, signSet as m, CaepCredentialChange as n, RiscAccountDisabled as o, riscEvents as p, CaepDeviceComplianceChange as r, RiscCredentialCompromise as s, CaepAssuranceLevelChange as t, SSF_PUSH_DELIVERY as u, SsfTransmitterOptions as v, memorySetQueue as w, SsfStream as x, fanOutSet as y };

package/dist/{index-Ch8LpNDp.d.ts → index-DH9DUDEM.d.ts}

@@ -1,7 +1,8 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-n0uRTsW8.js";
-import { V as AppData } from "./vocabulary-CN8H_9UF.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-B-F-qAZk.js";
+import { O as AppData } from "./permission-types-DhNEmoRG.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
+import { t as SqlQuery } from "./sql-CDEPCA0g.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -192,4 +193,18 @@ declare function directoryMembershipSource(store: DirectoryStore, options?: Dire
 //#region src/scim/store.d.ts
 declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
-export { ScimPage as A, GROUP_SCHEMA as C, SCIM_CONTENT_TYPE as D, ROLES_EXTENSION as E, isDirectoryNotFoundError as F, isDirectoryUniquenessError as I, ScimPatchOp as M, ScimTokenOptions as N, ScimFilter as O, USER_SCHEMA as P, ERROR_SCHEMA as S, PATCH_SCHEMA as T, DirectoryMembershipSourceOptions as _, scimHandler as a, DirectoryUniquenessError as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryGroup as g, DirectoryChange as h, tenantFromPath as i, ScimPageResult as j, ScimHandlerOptions as k, resourceTypes as l, APP_DATA_EXTENSION as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryNotFoundError as v, LIST_SCHEMA as w, DirectoryUser as x, DirectoryStore as y };
+//#region src/scim/postgres-store.d.ts
+type PostgresDirectoryStoreOptions = {
+  /** Schema of the generated tables (`permdock scim generate --schema`). Default `permdock`. */
+  readonly schema?: string;
+};
+/**
+ * A `DirectoryStore` over the tables `permdock scim generate` writes, called
+ * through a `SqlQuery` that may read and write them (the table owner, or a
+ * role granted on them). Every method is one statement, so a pool needs no
+ * transaction: a group and its members change together, and a PATCH that
+ * races another write re-reads the row and applies its operations again.
+ */
+declare function postgresDirectoryStore(query: SqlQuery, options?: PostgresDirectoryStoreOptions): DirectoryStore;
+//#endregion
+export { ScimFilter as A, DirectoryUser as C, PATCH_SCHEMA as D, LIST_SCHEMA as E, ScimTokenOptions as F, USER_SCHEMA as I, isDirectoryNotFoundError as L, ScimPage as M, ScimPageResult as N, ROLES_EXTENSION as O, ScimPatchOp as P, isDirectoryUniquenessError as R, DirectoryUniquenessError as S, GROUP_SCHEMA as T, DirectoryChange as _, normalizePatchOps as a, DirectoryNotFoundError as b, filterSupported as c, resourceTypes as d, schemas as f, APP_DATA_EXTENSION as g, sha256Hex as h, directoryMembershipSource as i, ScimHandlerOptions as j, SCIM_CONTENT_TYPE as k, matchFilter as l, authenticateScim as m, postgresDirectoryStore as n, tenantFromPath as o, serviceProviderConfig as p, memoryDirectoryStore as r, scimHandler as s, PostgresDirectoryStoreOptions as t, parseScimFilter as u, DirectoryGroup as v, ERROR_SCHEMA as w, DirectoryStore as x, DirectoryMembershipSourceOptions as y };

package/dist/{index-CueFnxQc.d.ts → index-DLwcuCN_.d.ts}

@@ -1,9 +1,10 @@
-import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { t as Operation } from "./operations-X0VM7F3m.js";
-import { p as PrincipalSource, r as PermDock } from "./permdock-SV8ZINYT.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-BtHtcKMr.js";
-import { l as WebhookSigner } from "./standard-webhooks-rbD7LS6h.js";
+import { T as Policy, j as PolicyVocabulary, q as DecisionSink, sr as Principal, tn as DeliveryChannel } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { t as Operation } from "./operations-BNLes61x.js";
+import { a as PermDock, h as PrincipalSource } from "./permdock-Dco6dyCK.js";
+import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-g7Oy6Zg4.js";
+import { l as WebhookSigner } from "./standard-webhooks-B_qRg0ws.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
   /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
@@ -37,6 +38,84 @@ declare function subscribersFor<S extends {
   readonly principal: string;
 }>(permdock: PermDock, event: SubscriberEvent, subscribers: readonly S[]): Promise<S[]>;
 //#endregion
+//#region src/delivery/connector.d.ts
+type Https = `https://${string}`;
+type ConnectorBase<K extends string, C> = {
+  readonly id?: string;
+  readonly kind: K;
+  readonly name: string;
+  readonly config: C;
+};
+type SiemDestination = "splunk-hec" | "sentinel" | "security-lake" | "google-secops" | "elastic" | "datadog";
+/** A connector body in wire format v1 (`schemas/connector-v1.json`), one member per kind. */
+type Connector = ConnectorBase<"webhook", {
+  readonly url: Https;
+  readonly types?: readonly string[];
+}> | ConnectorBase<"otlp", {
+  readonly endpoint: Https;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signals?: readonly ("logs" | "traces")[];
+}> | ConnectorBase<"siem", {
+  readonly destination: SiemDestination;
+  readonly endpoint: Https;
+  readonly headers?: Readonly<Record<string, string>>;
+}> | ConnectorBase<"evidence", {
+  readonly format: "jws" | "ocsf" | "csv";
+  readonly destination: Https;
+  readonly schedule?: "hourly" | "daily";
+}> | ConnectorBase<"scim", {
+  readonly tenant: string;
+  readonly target: Https;
+  readonly groupRoles?: Readonly<Record<string, string>>;
+}> | ConnectorBase<"caep-transmitter", {
+  readonly issuer: Https;
+  readonly jwks_uri?: Https;
+  readonly delivery: "push" | "poll";
+  readonly poll_endpoint?: Https;
+}> | ConnectorBase<"federated-upstream", {
+  readonly discovery: Https;
+  readonly client_id: string;
+  readonly scopes?: readonly string[];
+}> | ConnectorBase<"chat", {
+  readonly platform: "slack" | "teams";
+  readonly workspace: string;
+}> | ConnectorBase<"email", {
+  readonly from: string;
+}> | ConnectorBase<"vercel-oidc", {
+  readonly team_id: string;
+  readonly project_id?: string;
+  readonly environment?: "production" | "preview" | "development";
+}>;
+type ConnectorKind = Connector["kind"];
+/** One problem with a connector body; `path` is an RFC 6901 JSON pointer into it. */
+type ConnectorIssue = {
+  readonly path: string;
+  readonly message: string;
+};
+type ParseConnectorResult = {
+  readonly ok: true;
+  readonly connector: Connector;
+} | {
+  readonly ok: false;
+  readonly issues: readonly ConnectorIssue[];
+};
+/** The kinds `connector-v1` lists, in schema order. */
+declare const CONNECTOR_KINDS: readonly ConnectorKind[];
+/**
+ * Checks `input` against `connector-v1.json` and answers a frozen copy, or
+ * every issue with a JSON pointer. The branch is chosen by `kind`, so an
+ * issue names the field rather than "no branch matched".
+ */
+declare function parseConnector(input: unknown): ParseConnectorResult;
+//#endregion
+//#region src/delivery/connector-schema.d.ts
+/**
+ * `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
+ * `oneOf` branch per kind with a closed `config`. Only the `otlp` and `siem`
+ * `headers` maps hold a secret; a store seals their values and lists names only.
+ */
+declare const CONNECTOR_SCHEMA: JsonSchemaNode;
+//#endregion
 //#region src/delivery/memory-transport.d.ts
 type MemoryDelivery<C extends DeliveryChannel> = {
   readonly target: DeliveryTarget<C>;
@@ -107,4 +186,4 @@ type WebhookTransportOptions = {
  */
 declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
 //#endregion
-export { DeliveryPermDock as a, MemoryDelivery as c, memoryDeliveryTransport as d, Audience as f, subscribersFor as g, audience as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, SubscriberEvent as m, webhookTransport as n, DeliveryPermDockOptions as o, AudienceOptions as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u };
+export { audience as C, SubscriberEvent as S, ParseConnectorResult as _, DeliveryPermDock as a, Audience as b, MemoryDelivery as c, memoryDeliveryTransport as d, CONNECTOR_SCHEMA as f, ConnectorKind as g, ConnectorIssue as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, Connector as m, webhookTransport as n, DeliveryPermDockOptions as o, CONNECTOR_KINDS as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u, SiemDestination as v, subscribersFor as w, AudienceOptions as x, parseConnector as y };

package/dist/index.d.ts

@@ -1,22 +1,23 @@
-import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionDate, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isCondition, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tr as isSqlFunctionField, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RelatedHop, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as Subject, at as SettingsSource, b as GrantScope, bn as Grantee, br as SqlFunctionCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as AdapterId, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionRef, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as ConditionValue, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedCondition, gt as SupportSession, h as Grant, hn as UserApprover, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as SharedCustomRole, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as MembershipVia, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mr as MemberOfParent, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as VerifiedClaims, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfCondition, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as ActorKind, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as Condition, ut as TokenSigner, v as GrantMeta, vn as holder, vr as RestrictedAncestors, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isConditionRef, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as hasConditionOp, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionArg, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-n0uRTsW8.js";
-import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-CN8H_9UF.js";
-import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as context, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as validateCustomRole, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as customRoleClaim, nt as defineApp, o as OCSF_VERSION, on as principal, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as resolveCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as ValidateCustomRoleOptions, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DuWxc5dt.js";
-import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-X0VM7F3m.js";
-import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-SV8ZINYT.js";
-import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-BPk51-kX.js";
-import { n as PermDockValidationError } from "./validation-error-DHUrAkku.js";
-import { n as requiredPlans } from "./problem-details-B45V5d2b.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
+import { $ as MemberEntry, $n as AuthorizationDetail, $t as CredentialEvent, A as PolicyScopes, An as assurance, At as CredentialRequest, B as ValidateMode, Bn as DenialReason, Bt as LocalMembershipRows, C as MembershipFixture, Cn as user, Cr as SqlFunctionArg, Ct as Credential, D as PolicyDelegation, Dn as RelationGrantee, Dr as isConditionDate, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as InheritGrantee, Er as isCondition, Et as CredentialPermission, F as RoleScope, Fn as AppObligation, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as MatchedGrant, Gt as Snapshot, H as WireValidity, Hn as ExplainedDecision, Ht as LocalRowValue, I as SeparationConflict, In as ApprovalRequiredDecision, It as parseCredential, J as EntitlementSource, Jn as Trace, Jt as SnapshotNotEntitled, K as DecisionProvider, Kn as Obligation, Kt as SnapshotAssignable, L as SubjectOf, Ln as Decision, M as PrincipalOf, Mn as inherit, Mt as credentialDelegation, N as RoleBinding, Nn as plan, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as actor, Or as isConditionRef, Ot as CredentialPolicy, P as RoleOptions, Pn as relation, Pt as decideCredential, Q as LimitStore, Qn as Assurance, Qt as AutomationEvent, R as SupportAccessOptions, Rn as Denial, S as HostedGrantRef, Sn as holder, Sr as RestrictedAncestors, St as ApiKeyPrincipal, T as Policy, Tn as GranteeInput, Tr as hasConditionOp, Tt as CredentialKind, U as CredentialVerifier, Un as GrantedDecision, Ut as LocalSnapshotManifest, Vn as DeniedDecision, Vt as LocalRowColumn, W as CustomRoleSource, Wn as LimitDetail, Wt as LocalSnapshotRows, X as LimitConsumeInput, Xn as TraceSkipReason, Xt as AccessEvent, Yn as TraceSkip, Yt as SnapshotScope, Z as LimitRemaining, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, _n as ApproverInput, _r as MemberOfCondition, _t as SupportSessionDecision, a as ApprovalRequirement, an as EmailCategory, at as SettingsSource, b as GrantScope, bn as allOf, br as RelatedCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as WireDecision, cr as SharedCustomRole, ct as TenantSettings, d as ClosureContext, dn as PolicyScopesInput, dr as ActorKind, dt as TokenVerifier, en as DecisionEvent, er as Binding, et as MembershipSource, f as ClosureGrantFn, fn as Scope, fr as AdapterId, ft as VerificationFailure, g as GrantCondition, gn as Approver, gr as ConditionValue, gt as SupportSession, h as Grant, hn as AnyOfApprover, hr as ConditionRef, ht as DecideSupportSessionOptions, i as ApprovalOption, in as DirectoryEvent, ir as GnapAccess, it as RelationSource, jn as authenticated, jt as DecideCredentialOptions, kn as anyone, kr as isSqlFunctionField, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as WireDenial, lr as Subject, lt as TokenFailureCause, m as DelegationTarget, mn as ScopeNames, mr as Condition, mt as WhereCompiler, n as ApprovalEscalation, nn as DeliveryEvent, nr as CustomRoleGrant, nt as RelationGroup, o as ApprovalStage, on as MembershipEvent, or as Membership, ot as SnapshotSource, p as DelegationInput, pn as ScopeDeclaration, pr as MembershipVia, pt as VerifiedToken, q as DecisionSink, qn as Quota, qt as SnapshotGrant, r as ApprovalMode, rn as DeliveryFailureCause, rr as Delegation, rt as RelationHolder, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, st as SubjectResolver, t as ActivationOption, tn as DeliveryChannel, tr as CustomRole, tt as RelationChain, u as BreakGlassSpec, ur as VerifiedClaims, ut as TokenSigner, v as GrantMeta, vn as PermissionApprover, vr as MemberOfParent, vt as SupportSessionPolicy, w as ObligationInput, wn as Grantee, wr as SqlFunctionCondition, wt as CredentialDecision, x as GrantValidity, xn as anyOf, xr as RelatedHop, xt as parseSupportSession, y as GrantOptions, yn as UserApprover, yt as SupportSessionRequest, z as SupportConsent, zn as DenialDetails, zt as LocalCustomRoleTable } from "./policy-types-B-F-qAZk.js";
+import { A as MetaValue, C as ResourceRelation, D as RESOURCE_X, E as ResourceXTree, O as AppData, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, k as AppDataSchema, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-Bg3eeT2H.js";
+import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-BTkwrK7v.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-BNLes61x.js";
+import { C as ApprovalPolicy, D as approvalPolicies, E as ApprovalPolicyValidation, O as memoryApprovalPolicySource, S as ApprovalPolicies, T as ApprovalPolicySource, _ as PermittedIdsOptions, a as PermDock, b as memoryLimitStore, c as SimulateOptions, d as getPermDock, f as getPermDockSync, g as memoryPrincipalSource, h as PrincipalSource, i as LoadedRows, k as validateApprovalPolicy, l as SnapshotOptions, m as PrincipalIdentityLink, n as DecideOptions, o as PermDockOptions, p as PrincipalIdentity, r as DeriveOptions, s as RowPair, t as DecideIdsOptions, u as WhereResult, v as Limits, w as ApprovalPolicyProblem, x as PermissionCheck, y as limits } from "./permdock-Dco6dyCK.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-BmjzxQhp.js";
+import { n as PermDockValidationError } from "./validation-error-CQpoquwj.js";
+import { n as requiredPlans } from "./problem-details-Tcfmj3bV.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-C5jC6sKI.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-B6R0cMRL.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Drg-1YhL.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BNM3TtDo.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-4-eQIRWf.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-D4UC9TTW.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-DOtAFWdy.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Cp_Eot9W.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-5ODwqu8b.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-e4mdwAKd.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,36 +1,38 @@
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-K6eWUJ0H.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
-import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-Cu2m75uo.js";
+import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-CNJBiTFo.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-C1VJzvcr.js";
+import { A as memoryCustomRoleSource, C as stripeEntitlementSource, D as validateApprovalPolicy, E as memoryApprovalPolicySource, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as defineOperations, P as memorySnapshotSource, S as memoryLimitStore, _ as arazzoFindings, a as normalizeMembership, b as memoryRelationSource, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as approvalPolicies, x as limits, y as signPolicyDocument } from "./src-DLFrtrrC.js";
 import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-BybMRY7A.js";
+import { t as describe } from "./describe-DZlnEtLy.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
 import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
-import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-DVjOckjV.js";
-import { n as parseSupportSession, t as decideSupportSession } from "./support-session-C6xJQYut.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
-import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-hxrUsbpM.js";
-import { c as separationConflicts, n as definePolicy } from "./policy-DbM5YYtV.js";
+import { a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission, v as resource } from "./permission-registry-DpPtSKNZ.js";
+import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-ySsxp_Yp.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as parseSupportSession, t as decideSupportSession } from "./support-session-Cna49-3f.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-BrRANrpT.js";
+import { a as isRoleName, l as separationConflicts, n as definePolicy } from "./policy-DaJy4nK4.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-B46-5LYE.js";
-import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-B-wCP5ZC.js";
-import { C as validateCustomRole, D as activate, N as APPROVAL_POLICY_UNAVAILABLE, O as breakGlass, b as resolveCustomRole, d as customRoleClaim, k as supportAccess } from "./evaluate-CNClBvcj.js";
-import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-BOEhcqIF.js";
-import { t as whoCan } from "./who-can-DWBAcaCQ.js";
-import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
-import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-C9vfEphl.js";
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
+import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CyH2MV_B.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
+import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-CjcwnEiV.js";
+import { t as whoCan } from "./who-can-BwNsI_Js.js";
+import { n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-wq2coopv.js";
 import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CVSs6J9I.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-BrAscV28.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-T1Q8X3A2.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
-import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-N1K9IpqS.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-BcoiejpY.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-L7NnfhiE.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CIM7wHwA.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-GG6Jh8HD.js → init-5TXNji88.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-DZdU0tne.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-CHTbd-DQ.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-C3DktBDY.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeMYsnYJ.js"), import("./peer-CRvC7Hg1.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-B-4t1NzC.js"), import("./peer-DOzzMfZL.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-B-4t1NzC.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-B-4t1NzC.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-DeMYsnYJ.js → init-B-4t1NzC.js}

@@ -1,7 +1,7 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-DZdU0tne.js";
-import { t as addLine } from "./peer-C8swJ2GH.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-CHTbd-DQ.js";
+import { t as addLine } from "./peer-12Q5I_RH.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts