permdock 0.6.0 → 0.8.0

package/dist/{index-C-6Letxg.d.ts → index-_9UiQIkt.d.ts}

@@ -1,9 +1,9 @@
-import { Nn as Decision, Rt as Instant, T as Policy, Yn as AuthorizationDetail, ar as Subject, et as MembershipSource, fn as Approver, it as RelationSource, nr as Membership, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { E as PermissionTree, V as AppData, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-BdtSDbBO.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-C_IiEs64.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { $n as AuthorizationDetail, Ln as Decision, Rt as Instant, T as Policy, et as MembershipSource, gn as Approver, it as RelationSource, lr as Subject, or as Membership, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { M as AppData, f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-B2mlGuhW.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {
   readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
@@ -15,8 +15,8 @@ type AccessReviewsHandlerOptions = {
 };
 /**
  * HTTP for one access-review store: `GET` a review and its items, `POST`
- * `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is
- * not a reviewer and did not open the review gets 404.
+ * `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is not
+ * a reviewer and did not open the review gets 404.
  */
 declare function accessReviewsHandler(store: AccessReviewStore, options: AccessReviewsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
@@ -31,11 +31,14 @@ type AccessReviewVerdict = {
    */
   readonly permissions?: readonly string[];
 };
-/** Whether `by` is named as a reviewer. A link, a feed or a contact is never a reviewer. */
+/**
+ * Whether `by` is named as a reviewer. A link, a feed or a contact is never a
+ * reviewer.
+ */
 declare function accessReviewerEligible(review: AccessReview, by: Subject, permissions?: readonly string[], now?: Instant): boolean;
 /**
- * The decision to persist, or throws. A reviewer cannot decide a holding
- * of their own principal. `holder()` matches only through `permissions`.
+ * The decision to persist, or throws. A reviewer cannot decide a holding of
+ * their own principal. `holder()` matches only through `permissions`.
  */
 declare function decideAccessReviewItem(review: AccessReview, item: AccessReviewItem, verdict: AccessReviewVerdict, at?: Instant): AccessReviewDecision;
 //#endregion
@@ -78,16 +81,16 @@ type AccessReviewOptions = {
   readonly permdockFor?: (principalId: string) => PermDock | Promise<PermDock>;
   /**
    * When set, a global role, a plan, a relation or an inherit grant on a
-   * reviewed permission makes `complete` false. Without it the membership
-   * path is incomplete, because those holders cannot be listed from a tenant.
+   * reviewed permission makes `complete` false. Without it the membership path
+   * is incomplete, because those holders cannot be listed from a tenant.
    */
   readonly policy?: Policy;
   readonly now?: Instant;
 };
 /**
- * Opens a review of who holds `permissions` in the caller's active tenant.
- * The caller must be signed in. PermDock stores the population and does not
- * revoke anything: the application changes the source, then `markApplied`.
+ * Opens a review of who holds `permissions` in the caller's active tenant. The
+ * caller must be signed in. PermDock stores the population and does not revoke
+ * anything: the application changes the source, then `markApplied`.
  */
 declare function startAccessReview(permdock: PermDock, input: StartAccessReviewInput, options: AccessReviewOptions): Promise<AccessReview>;
 //#endregion
@@ -102,9 +105,9 @@ declare function memoryAccessReviewStore(): MemoryAccessReviewStore;
 //#endregion
 //#region src/approvals/delegation.d.ts
 /**
- * A frozen copy of a delegation with only the known fields, or `undefined`
- * when a known field has the wrong type, `until` is not after `from`, or
- * the delegate and the delegator are the same principal.
+ * A frozen copy of a delegation with only the known fields, or `undefined` when
+ * a known field has the wrong type, `until` is not after `from`, or the
+ * delegate and the delegator are the same principal.
  */
 declare function parseApprovalDelegation(input: unknown): ApprovalDelegation | undefined;
 /** In-process delegations. An entry that does not parse is dropped. */
@@ -126,8 +129,8 @@ type MatchDelegationOptions = {
   }>;
 };
 /**
- * The first active delegation under which `delegate` may approve `request`,
- * or `undefined`. The delegator is resolved by `subjectFor` and checked with
+ * The first active delegation under which `delegate` may approve `request`, or
+ * `undefined`. The delegator is resolved by `subjectFor` and checked with
  * `assertApprover`, so relation and permission approvers use the delegator's
  * facts. A throw, a missing option or a delegator the source does not name
  * matches nobody. The delegator's own delegations are never read.
@@ -135,9 +138,31 @@ type MatchDelegationOptions = {
 declare function matchDelegation(request: ApprovalRequest, delegate: Subject, options: MatchDelegationOptions): Promise<ApprovalDelegationMatch | undefined>;
 //#endregion
 //#region src/approvals/idempotency.d.ts
+/** The approve or reject call a key was first used for. */
+type IdempotentCall = {
+  readonly action: "approve" | "reject";
+  /** The approval id in the path. */
+  readonly id: string;
+  /** The request body text as read; `""` without a body. */
+  readonly body: string;
+};
+/** One `Idempotency-Key` entry as `approvalsHandler` stores it. */
+type IdempotencyRecord = {
+  /**
+   * The store key: the approver's principal id and the field value, joined by a
+   * newline.
+   */
+  readonly key: string;
+  readonly response: IdempotentResponse;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+};
 /** A response the approvals handler replays for a repeated `Idempotency-Key`. */
 type IdempotentResponse = {
-  /** Which request produced it: a reused key with another fingerprint is refused with `422`. */
+  /**
+   * Which request produced it: a reused key with another fingerprint is refused
+   * with `422`.
+   */
   readonly fingerprint: string;
   readonly status: number;
   readonly headers: readonly (readonly [name: string, value: string])[];
@@ -152,28 +177,60 @@ type IdempotentResponse = {
 type IdempotencyStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  get(key: string): IdempotentResponse | undefined | Promise<IdempotentResponse | undefined>;
+  get: (key: string) => IdempotentResponse | undefined | Promise<IdempotentResponse | undefined>;
   /** `expiresAt` is epoch milliseconds; the store may drop the entry after it. */
-  set(key: string, response: IdempotentResponse, expiresAt: number): void | Promise<void>;
+  set: (key: string, response: IdempotentResponse, expiresAt: number) => void | Promise<void>;
 };
+/**
+ * The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never
+ * cross approvers.
+ */
+declare function idempotencyRecordKey(principalId: string, key: string): string;
+/**
+ * The record `approvalsHandler` stores after `call` answered `response`: the
+ * status, headers and body text, the call's fingerprint, and an expiry 24 hours
+ * after `now` (epoch milliseconds, default the clock).
+ */
+declare function idempotencyRecord(input: {
+  readonly principalId: string;
+  readonly key: string;
+  readonly call: IdempotentCall;
+  readonly response: Response;
+  readonly now?: number;
+}): Promise<IdempotencyRecord>;
+/**
+ * Whether a stored response came from the same call: a reused key with another
+ * call is refused with `422`.
+ */
+declare function matchesIdempotencyRecord(response: IdempotentResponse, call: IdempotentCall): boolean;
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 declare function memoryIdempotencyStore(): IdempotencyStore;
 //#endregion
 //#region src/approvals/handler.d.ts
 type ApprovalsHandlerOptions = {
   readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
-  /** Refuse the principal even on grants that set `approval: { distinct: false }`. */
+  /**
+   * Refuse the principal even on grants that set `approval: { distinct: false
+   * }`.
+   */
   readonly requireDistinctApprover?: boolean;
   readonly signer?: TokenSigner;
   readonly audience?: string | readonly string[];
-  /** Where `relation()` approvers are read, by the request's resource id; without it they match nobody. */
+  /**
+   * Where `relation()` approvers are read, by the request's resource id;
+   * without it they match nobody.
+   */
   readonly relations?: RelationSource;
-  /** The policy's permission tree, for `through` links and `includes` on relation approvers. */
+  /**
+   * The policy's permission tree, for `through` links and `includes` on
+   * relation approvers.
+   */
   readonly permissions?: PermissionTree;
   /**
    * The approver's own instance in the request's tenant, for
    * `holder(permission)` approvers (custom roles included when the instance
-   * reads a `CustomRoleSource`). Without it, or when it throws, they match nobody.
+   * reads a `CustomRoleSource`). Without it, or when it throws, they match
+   * nobody.
    */
   readonly permdockFor?: (approver: Subject, request: ApprovalRequest) => PermDock | Promise<PermDock>;
   /**
@@ -183,8 +240,8 @@ type ApprovalsHandlerOptions = {
    */
   readonly approvalDelegations?: ApprovalDelegationSource;
   /**
-   * Resolves a delegator's subject from their principal id. Server-side:
-   * never from the request body. A throw matches nobody.
+   * Resolves a delegator's subject from their principal id. Server-side: never
+   * from the request body. A throw matches nobody.
    */
   readonly subjectFor?: (principalId: string, request: ApprovalRequest) => Subject | null | undefined | Promise<Subject | null | undefined>;
   /**
@@ -193,17 +250,14 @@ type ApprovalsHandlerOptions = {
    */
   readonly idempotency?: IdempotencyStore;
 };
-/** An approval as the approvals API shows it: never the resume `token`. */
-type ApprovalView = Omit<ApprovalRequest, "token">;
 declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
 //#region src/approvals/parse-request.d.ts
 /**
- * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store
- * or the Cloud returns it, validated against
- * `schemas/approval-request-v1.json`. Returns a deep-frozen copy, or `null`
- * for anything that does not match, including a `__proto__`, `constructor`
- * or `prototype` key.
+ * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or
+ * the Cloud returns it, validated against `schemas/approval-request-v1.json`.
+ * Returns a deep-frozen copy, or `null` for anything that does not match,
+ * including a `__proto__`, `constructor` or `prototype` key.
  */
 declare function parseApprovalRequest(value: unknown): ApprovalRequest | null;
 //#endregion
@@ -216,7 +270,10 @@ declare function parseApprovalRequest(value: unknown): ApprovalRequest | null;
 declare const APPROVAL_REQUEST_SCHEMA: JsonSchemaNode;
 //#endregion
 //#region src/approvals/signature.d.ts
-/** One recorded approval as the `approvals` claim of a `vnd.permdock.approval+jwt` carries it. */
+/**
+ * One recorded approval as the `approvals` claim of a
+ * `vnd.permdock.approval+jwt` carries it.
+ */
 type ApprovalSignatureEntry = {
   readonly by: string;
   /** RFC 3339. */
@@ -227,9 +284,9 @@ type ApprovalSignatureEntry = {
   readonly delegation?: string;
 };
 /**
- * The claims of a `vnd.permdock.approval+jwt` other than `iss`, `aud`,
- * `iat`, `exp` and `jti`, which the signer sets: `jti` is the request `id`,
- * `iat` its `resolvedAt` and `exp` its `expiresAt`.
+ * The claims of a `vnd.permdock.approval+jwt` other than `iss`, `aud`, `iat`,
+ * `exp` and `jti`, which the signer sets: `jti` is the request `id`, `iat` its
+ * `resolvedAt` and `exp` its `expiresAt`.
  */
 type ApprovalSignatureClaims = {
   readonly sub?: string;
@@ -256,11 +313,29 @@ type SignApprovalOptions = {
  */
 declare function signApproval(request: ApprovalRequest, signer: TokenSigner | undefined, options?: SignApprovalOptions): Promise<string | undefined>;
 //#endregion
+//#region src/approvals/entity-tag.d.ts
+/** An approval as the approvals API shows it: never the resume `token`. */
+type ApprovalView = Omit<ApprovalRequest, "token">;
+/** The request without its resume `token`; every other field stays. */
+declare function approvalView(request: ApprovalRequest): ApprovalView;
+/**
+ * A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
+ * `approvalView(request)` as RFC 8785 JSON. A field outside `ApprovalRequest`
+ * changes the tag, so hash the stored request as is.
+ */
+declare function approvalEntityTag(request: ApprovalRequest): string;
+//#endregion
 //#region src/approvals/relations.d.ts
 type ApproverRelationsOptions = {
-  /** The object graph relation approvers are read from; without it they match nobody. */
+  /**
+   * The object graph relation approvers are read from; without it they match
+   * nobody.
+   */
   readonly relations?: RelationSource;
-  /** The permission tree the policy declares; needed to follow `through` links and `includes`. */
+  /**
+   * The permission tree the policy declares; needed to follow `through` links
+   * and `includes`.
+   */
   readonly permissions?: PermissionTree;
   /** The clock relation expiry is read at; defaults to the current time. */
   readonly now?: Instant;
@@ -268,8 +343,8 @@ type ApproverRelationsOptions = {
 /**
  * The relation approvers of `request` that `subject` holds on its resource,
  * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
- * through `relations` by the request's resource id; a request without an id,
- * a missing source or a read that fails holds nothing.
+ * through `relations` by the request's resource id; a request without an id, a
+ * missing source or a read that fails holds nothing.
  */
 declare function approverRelations(request: ApprovalRequest, subject: Subject, options: ApproverRelationsOptions): Promise<readonly string[]>;
 //#endregion
@@ -336,18 +411,24 @@ declare function resumeDecision(input: {
   };
   readonly adapter: string;
   readonly token: string | undefined;
-  /** `false` for checks that do not run the action, such as the decision endpoint. */
+  /**
+   * `false` for checks that do not run the action, such as the decision
+   * endpoint.
+   */
   readonly consume?: boolean;
   readonly now?: Instant;
   /**
-   * Seconds a request this call opens stays open; absent means the
-   * store's `ttl`, else `DEFAULT_APPROVAL_TTL`. The grant's `approval.ttl`
-   * still caps it.
+   * Seconds a request this call opens stays open; absent means the store's
+   * `ttl`, else `DEFAULT_APPROVAL_TTL`. The grant's `approval.ttl` still caps
+   * it.
    */
   readonly ttl?: number;
 }): Promise<Decision>;
 declare function cancelApprovals(store: ApprovalStore, filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number>;
-/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
+/**
+ * The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no
+ * parameters, else `undefined`.
+ */
 declare function readApprovalHeader(headers: Headers | {
   readonly get: (name: string) => string | null;
 }): string | undefined;
@@ -356,14 +437,14 @@ declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
 }, now?: Instant): Promise<ApprovalInspectResult>;
 /**
  * The token to resume `decision` with when the caller carries none: the
- * decision's own token when the store holds an approved or rejected request
- * for it, so `resumeDecision` resumes (or denies) the call without the
- * caller passing the token back. The token already binds permission,
- * resource (or the call's data when there is no row id), subject and actor.
- * A pending request counts only with `denyPending: true`, which makes the
- * call deny with `approval-pending` instead of asking again. `undefined` when
- * the decision needs no approval, there is no store, or the store has no
- * unexpired request for the token; a store that throws counts as none.
+ * decision's own token when the store holds an approved or rejected request for
+ * it, so `resumeDecision` resumes (or denies) the call without the caller
+ * passing the token back. The token already binds permission, resource (or the
+ * call's data when there is no row id), subject and actor. A pending request
+ * counts only with `denyPending: true`, which makes the call deny with
+ * `approval-pending` instead of asking again. `undefined` when the decision
+ * needs no approval, there is no store, or the store has no unexpired request
+ * for the token; a store that throws counts as none.
  */
 declare function storedApprovalToken(store: ApprovalStore | undefined, decision: Decision, options?: {
   readonly denyPending?: boolean;
@@ -377,16 +458,22 @@ declare function approvalPageSize(limit: number | undefined): number;
 type ApprovalCursorPosition = readonly [createdAt: string, token: string];
 /** The `next` cursor after `request`, for a store that pages in its own query. */
 declare function encodeApprovalCursor(request: ApprovalRequest): string;
-/** The `(createdAt, token)` position a `next` cursor names, or `null` for one that does not parse. */
+/**
+ * The `(createdAt, token)` position a `next` cursor names, or `null` for one
+ * that does not parse.
+ */
 declare function decodeApprovalCursor(cursor: string): ApprovalCursorPosition | null;
 /**
  * Pages already-filtered requests in `(createdAt, token)` order, as the
  * built-in stores do: `limit` within 1 to 200 (50 when absent), `cursor` from
- * the previous page's `next`, and no items for a cursor that does not parse.
- * A custom `ApprovalStore` that filters in memory returns it from `list`.
+ * the previous page's `next`, and no items for a cursor that does not parse. A
+ * custom `ApprovalStore` that filters in memory returns it from `list`.
  */
 declare function pageApprovals(matching: readonly ApprovalRequest[], query: ApprovalListQuery): ApprovalPage;
-/** Every matching request of `store`, following `next` until the last page (at most 1000 pages of 200). */
+/**
+ * Every matching request of `store`, following `next` until the last page (at
+ * most 1000 pages of 200).
+ */
 declare function listAllApprovals(store: ApprovalStore, filter: ApprovalListFilter): Promise<ApprovalRequest[]>;
 //#endregion
 //#region src/approvals/permissions.d.ts
@@ -401,23 +488,23 @@ declare function approverPermissions(request: ApprovalRequest, approver: PermDoc
 //#endregion
 //#region src/approvals/store.d.ts
 /**
- * Refuses `by` as an approver of `request`, or returns the index of the
- * stage the approval counts for (`undefined` without `stages`). Eligibility
- * is `approvers.by` or, under `stages`, the first incomplete stage
- * (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
- * is eligible too once the request has waited `escalation.after`. A
- * principal who already approved is refused, so one person never completes
- * two stages. `relations` are the relation approvers `by` holds on the
- * request's resource (see `ApprovalVerdict.relations`).
+ * Refuses `by` as an approver of `request`, or returns the index of the stage
+ * the approval counts for (`undefined` without `stages`). Eligibility is
+ * `approvers.by` or, under `stages`, the first incomplete stage (`sequential`)
+ * or any incomplete stage (`all`); `approvers.escalation.to` is eligible too
+ * once the request has waited `escalation.after`. A principal who already
+ * approved is refused, so one person never completes two stages. `relations`
+ * are the relation approvers `by` holds on the request's resource (see
+ * `ApprovalVerdict.relations`).
  */
 declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, at?: Instant, relations?: readonly string[], permissions?: readonly string[]): number | undefined;
 /**
- * The request after `verdict`, for a store to persist: a rejection resolves
- * it; an approval is appended to `approvals` and resolves it once there are
- * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
- * is not pending, has expired or `verdict.by` may not approve it. Stores
- * should write the result only when the stored row is still pending with the
- * same number of approvals, so two approvers racing both count.
+ * The request after `verdict`, for a store to persist: a rejection resolves it;
+ * an approval is appended to `approvals` and resolves it once there are
+ * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request is
+ * not pending, has expired or `verdict.by` may not approve it. Stores should
+ * write the result only when the stored row is still pending with the same
+ * number of approvals, so two approvers racing both count.
  */
 declare function applyApprovalVerdict(request: ApprovalRequest, verdict: ApprovalVerdict, at?: Instant): ApprovalRequest;
 type MemoryApprovalStore = ApprovalStore & {
@@ -428,4 +515,4 @@ declare function memoryApprovalStore(options?: {
   readonly now?: () => Instant;
 }): MemoryApprovalStore;
 //#endregion
-export { AccessReviewVerdict as $, APPROVAL_REQUEST_SCHEMA as A, matchDelegation as B, ApproverRelationsOptions as C, SignApprovalOptions as D, ApprovalSignatureEntry as E, IdempotencyStore as F, pageAccessReviewItems as G, parseApprovalDelegation as H, IdempotentResponse as I, StartAccessReviewInput as J, AccessReviewHolder as K, memoryIdempotencyStore as L, ApprovalView as M, ApprovalsHandlerOptions as N, approvalSignatureClaims as O, approvalsHandler as P, isAccessReviewError as Q, ApprovalDelegationMatch as R, vouchApproval as S, ApprovalSignatureClaims as T, MemoryAccessReviewStore as U, memoryApprovalDelegationSource as V, memoryAccessReviewStore as W, AccessReviewError as X, startAccessReview as Y, AccessReviewErrorCode as Z, resolveApproval as _, approverPermissions as a, storedApprovalToken as b, decodeApprovalCursor as c, pageApprovals as d, accessReviewerEligible as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, parseApprovalRequest as j, signApproval as k, encodeApprovalCursor as l, inspectApproval as m, applyApprovalVerdict as n, AccessReviewsHandlerOptions as nt, ApprovalCursorPosition as o, consumeApproval as p, AccessReviewOptions as q, assertApprover as r, accessReviewsHandler as rt, approvalPageSize as s, MemoryApprovalStore as t, decideAccessReviewItem as tt, listAllApprovals as u, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, MatchDelegationOptions as z };
+export { AccessReviewHolder as $, SignApprovalOptions as A, IdempotentResponse as B, ApproverRelationsOptions as C, approvalView as D, approvalEntityTag as E, ApprovalsHandlerOptions as F, ApprovalDelegationMatch as G, idempotencyRecordKey as H, approvalsHandler as I, memoryApprovalDelegationSource as J, MatchDelegationOptions as K, IdempotencyRecord as L, signApproval as M, APPROVAL_REQUEST_SCHEMA as N, ApprovalSignatureClaims as O, parseApprovalRequest as P, pageAccessReviewItems as Q, IdempotencyStore as R, vouchApproval as S, ApprovalView as T, matchesIdempotencyRecord as U, idempotencyRecord as V, memoryIdempotencyStore as W, MemoryAccessReviewStore as X, parseApprovalDelegation as Y, memoryAccessReviewStore as Z, resolveApproval as _, approverPermissions as a, isAccessReviewError as at, storedApprovalToken as b, decodeApprovalCursor as c, decideAccessReviewItem as ct, pageApprovals as d, AccessReviewOptions as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, AccessReviewErrorCode as it, approvalSignatureClaims as j, ApprovalSignatureEntry as k, encodeApprovalCursor as l, AccessReviewsHandlerOptions as lt, inspectApproval as m, applyApprovalVerdict as n, startAccessReview as nt, ApprovalCursorPosition as o, AccessReviewVerdict as ot, consumeApproval as p, matchDelegation as q, assertApprover as r, AccessReviewError as rt, approvalPageSize as s, accessReviewerEligible as st, MemoryApprovalStore as t, StartAccessReviewInput as tt, listAllApprovals as u, accessReviewsHandler as ut, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, IdempotentCall as z };

package/dist/index.d.ts

@@ -1,22 +1,23 @@
-import { $ as MemberEntry, $n as Delegation, $t as DeliveryFailureCause, A as PolicyScopes, An as relation, At as CredentialRequest, B as ValidateMode, Bn as LimitDetail, Bt as LocalSnapshotManifest, C as MembershipFixture, Cn as RelationGrantee, Cr as isConditionDate, Ct as Credential, D as PolicyDelegation, Dn as authenticated, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as assurance, Et as CredentialPermission, F as RoleScope, Fn as DenialDetails, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as TraceSkip, Gt as SnapshotScope, H as WireValidity, Hn as Obligation, Ht as SnapshotAssignable, I as SeparationConflict, In as DenialReason, It as parseCredential, J as EntitlementSource, Jn as Assurance, Jt as AutomationEvent, K as DecisionProvider, Kn as TraceSkipReason, Kt as AccessEvent, L as SubjectOf, Ln as DeniedDecision, M as PrincipalOf, Mn as ApprovalRequiredDecision, Mt as credentialDelegation, N as RoleBinding, Nn as Decision, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as inherit, Ot as CredentialPolicy, P as RoleOptions, Pn as Denial, Pt as decideCredential, Q as LimitStore, Qn as CustomRoleGrant, Qt as DeliveryEvent, R as SupportAccessOptions, Rn as ExplainedDecision, S as HostedGrantRef, Sn as InheritGrantee, Sr as isCondition, St as ApiKeyPrincipal, T as Policy, Tn as anyone, Tr as isSqlFunctionField, Tt as CredentialKind, U as CredentialVerifier, Un as Quota, Ut as SnapshotGrant, Vn as MatchedGrant, Vt as Snapshot, W as CustomRoleSource, Wn as Trace, Wt as SnapshotNotEntitled, X as LimitConsumeInput, Xn as Binding, Xt as DecisionEvent, Yn as AuthorizationDetail, Yt as CredentialEvent, Z as LimitRemaining, Zn as CustomRole, Zt as DeliveryChannel, _ as GrantLimit, _n as anyOf, _r as RelatedHop, _t as SupportSessionDecision, a as ApprovalRequirement, an as WireDenial, ar as Subject, at as SettingsSource, b as GrantScope, bn as Grantee, br as SqlFunctionCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as Scope, cr as AdapterId, ct as TenantSettings, d as ClosureContext, dn as AnyOfApprover, dr as ConditionRef, dt as TokenVerifier, en as DirectoryEvent, er as GnapAccess, et as MembershipSource, f as ClosureGrantFn, fn as Approver, fr as ConditionValue, ft as VerificationFailure, g as GrantCondition, gn as allOf, gr as RelatedCondition, gt as SupportSession, h as Grant, hn as UserApprover, ht as DecideSupportSessionOptions, i as ApprovalOption, in as WireDecision, ir as SharedCustomRole, it as RelationSource, jn as AppObligation, jt as DecideCredentialOptions, kn as plan, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as ScopeDeclaration, lr as MembershipVia, lt as TokenFailureCause, m as DelegationTarget, mn as PermissionApprover, mr as MemberOfParent, mt as WhereCompiler, n as ApprovalEscalation, nn as MembershipEvent, nr as Membership, nt as RelationGroup, o as ApprovalStage, or as VerifiedClaims, ot as SnapshotSource, p as DelegationInput, pn as ApproverInput, pr as MemberOfCondition, pt as VerifiedToken, q as DecisionSink, qn as Actor, qt as AuthEvent, r as ApprovalMode, rn as SinkEvent, rr as Principal, rt as RelationHolder, s as AssuranceRequirement, sn as PolicyScopesInput, sr as ActorKind, st as SubjectResolver, t as ActivationOption, tn as EmailCategory, tt as RelationChain, u as BreakGlassSpec, un as ScopeNames, ur as Condition, ut as TokenSigner, v as GrantMeta, vn as holder, vr as RestrictedAncestors, vt as SupportSessionPolicy, w as ObligationInput, wn as actor, wr as isConditionRef, wt as CredentialDecision, x as GrantValidity, xn as GranteeInput, xr as hasConditionOp, xt as parseSupportSession, y as GrantOptions, yn as user, yr as SqlFunctionArg, yt as SupportSessionRequest, z as SupportConsent, zn as GrantedDecision, zt as LocalCustomRoleTable } from "./policy-types-n0uRTsW8.js";
-import { A as ResourceLevel, B as RESOURCE_X, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, H as AppDataSchema, I as ResourceRelation, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, O as PrincipalRelation, P as ResourceOptions, R as ResourceRestricted, S as FieldRelation, T as PermissionKind, U as MetaValue, V as AppData, _ as ComputedRelation, a as RoleTree, b as EdgeMatch, c as definePlans, d as isPlan, f as isRole, g as ActionMeta, i as RoleMeta, j as ResourceLink, k as ResourceInit, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole, v as EdgeGroup, w as Permission, x as EdgeRelation, y as EdgeGroups, z as ResourceXTree } from "./vocabulary-CN8H_9UF.js";
-import { $ as ShadowMismatch, $t as CustomRoleValidation, A as decideRoleChange, At as isExternallyManaged, B as crud, Bt as getResource, C as parseCloudEventBatch, Ct as MemoryRelationSourceData, D as RoleChangeDecision, Dt as claimsFirst, E as RoleChange, Et as stripeEntitlementSource, F as normalizeApproval, Ft as memorySettingsSource, G as definePermissions, Gt as separationConflicts, H as writable, Ht as listPermissions, I as allow, It as memorySnapshotSource, J as CustomRoleReader, Jt as fromSnapshot, K as SnapshotForOptions, Kt as requiresApproval, L as deny, Lt as sqlFunction, M as activate, Mt as memoryCustomRoleSource, N as breakGlass, Nt as memoryEntitlementSource, O as RoleChangeOptions, Ot as composeMemberships, P as supportAccess, Pt as memoryMembershipSource, Q as LegacyCheck, Qt as CustomRoleRename, R as normalizeAssurance, Rt as opaque, S as parseCloudEvent, St as MemoryEdge, T as parseSinkEvents, Tt as StripeEntitlementsClient, U as formerKeys, Ut as mergePermissions, V as readable, Vt as isPermission, W as resource, Wt as definePolicy, X as customRoleSource, Xt as CustomRoleDrop, Y as CustomRoleSourceOptions, Yt as parseSnapshot, Z as mayAccess, Zt as CustomRoleDropReason, _ as DIRECTORY_EVENT_SCHEMA, _t as signPolicyDocument, a as toCsvRow, an as context, at as localSnapshotManifest, b as SINK_EVENT_SCHEMAS, bt as WhoCan, c as OcsfUserManagement, ct as ArazzoSimulateInput, d as ACCESS_EVENT_SCHEMA, dt as simulateArazzo, en as ResolvedCustomRole, et as ShadowOptions, f as AUTOMATION_EVENT_SCHEMA, ft as deliveryEvent, g as DELIVERY_EVENT_SCHEMA, gt as SignPolicyDocumentOptions, h as DECISION_EVENT_SCHEMA, ht as snapshotFromClaims, i as CSV_COLUMNS, in as validateCustomRole, it as AppProfile, j as ActivateInput, jt as APPROVAL_POLICY_UNAVAILABLE, k as RoleChangeTarget, kt as countHolders, l as accessToOcsf, lt as ArazzoStepResult, m as CREDENTIAL_EVENT_SCHEMA, mt as signSnapshot, n as delegatedPermissions, nn as customRoleClaim, nt as defineApp, o as OCSF_VERSION, on as principal, ot as ArazzoFinding, p as CATALOG_EVENT_SCHEMA, pt as SignSnapshotOptions, q as snapshotFor, qt as emptySnapshot, r as catalogFingerprint, rn as resolveCustomRole, rt as AppOptions, s as OcsfAuthorizeSession, st as ArazzoPlan, t as coveredByDelegation, tn as ValidateCustomRoleOptions, tt as shadowMode, u as toOcsf, ut as arazzoFindings, v as EVENT_SCHEMA_IDS, vt as Holder, w as parseSinkEvent, wt as memoryRelationSource, x as parseCatalogEventData, xt as whoCan, y as MEMBERSHIP_EVENT_SCHEMA, yt as HoldingVia, z as role, zt as findPermission } from "./index-DuWxc5dt.js";
-import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-X0VM7F3m.js";
-import { C as ApprovalPolicyValidation, E as validateApprovalPolicy, S as ApprovalPolicySource, T as memoryApprovalPolicySource, _ as limits, a as RowPair, b as ApprovalPolicy, c as WhereResult, d as PrincipalIdentity, f as PrincipalIdentityLink, g as Limits, h as PermittedIdsOptions, i as PermDockOptions, l as getPermDock, m as memoryPrincipalSource, n as DeriveOptions, o as SimulateOptions, p as PrincipalSource, r as PermDock, s as SnapshotOptions, t as DecideOptions, u as getPermDockSync, v as memoryLimitStore, w as approvalPolicies, x as ApprovalPolicyProblem, y as ApprovalPolicies } from "./permdock-SV8ZINYT.js";
-import { a as PolicyDocument, c as isPortableCondition, d as parsePolicyDocument, f as policyDocumentFromClaims, l as memoryPolicySource, n as HostedGrantDropReason, o as PolicySource, r as HostedGrantDropped, s as hostedPolicies, t as HostedGrant, u as mergeHostedGrants } from "./hosted-BPk51-kX.js";
-import { n as PermDockValidationError } from "./validation-error-DHUrAkku.js";
-import { n as requiredPlans } from "./problem-details-B45V5d2b.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
+import { $ as MemberEntry, $n as AuthorizationDetail, $t as CredentialEvent, A as PolicyScopes, An as assurance, At as CredentialRequest, B as ValidateMode, Bn as DenialReason, Bt as LocalMembershipRows, C as MembershipFixture, Cn as user, Cr as SqlFunctionArg, Ct as Credential, D as PolicyDelegation, Dn as RelationGrantee, Dr as isConditionDate, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as InheritGrantee, Er as isCondition, Et as CredentialPermission, F as RoleScope, Fn as AppObligation, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as MatchedGrant, Gt as Snapshot, H as WireValidity, Hn as ExplainedDecision, Ht as LocalRowValue, I as SeparationConflict, In as ApprovalRequiredDecision, It as parseCredential, J as EntitlementSource, Jn as Trace, Jt as SnapshotNotEntitled, K as DecisionProvider, Kn as Obligation, Kt as SnapshotAssignable, L as SubjectOf, Ln as Decision, M as PrincipalOf, Mn as inherit, Mt as credentialDelegation, N as RoleBinding, Nn as plan, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as actor, Or as isConditionRef, Ot as CredentialPolicy, P as RoleOptions, Pn as relation, Pt as decideCredential, Q as LimitStore, Qn as Assurance, Qt as AutomationEvent, R as SupportAccessOptions, Rn as Denial, S as HostedGrantRef, Sn as holder, Sr as RestrictedAncestors, St as ApiKeyPrincipal, T as Policy, Tn as GranteeInput, Tr as hasConditionOp, Tt as CredentialKind, U as CredentialVerifier, Un as GrantedDecision, Ut as LocalSnapshotManifest, Vn as DeniedDecision, Vt as LocalRowColumn, W as CustomRoleSource, Wn as LimitDetail, Wt as LocalSnapshotRows, X as LimitConsumeInput, Xn as TraceSkipReason, Xt as AccessEvent, Yn as TraceSkip, Yt as SnapshotScope, Z as LimitRemaining, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, _n as ApproverInput, _r as MemberOfCondition, _t as SupportSessionDecision, a as ApprovalRequirement, an as EmailCategory, at as SettingsSource, b as GrantScope, bn as allOf, br as RelatedCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as WireDecision, cr as SharedCustomRole, ct as TenantSettings, d as ClosureContext, dn as PolicyScopesInput, dr as ActorKind, dt as TokenVerifier, en as DecisionEvent, er as Binding, et as MembershipSource, f as ClosureGrantFn, fn as Scope, fr as AdapterId, ft as VerificationFailure, g as GrantCondition, gn as Approver, gr as ConditionValue, gt as SupportSession, h as Grant, hn as AnyOfApprover, hr as ConditionRef, ht as DecideSupportSessionOptions, i as ApprovalOption, in as DirectoryEvent, ir as GnapAccess, it as RelationSource, jn as authenticated, jt as DecideCredentialOptions, kn as anyone, kr as isSqlFunctionField, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as WireDenial, lr as Subject, lt as TokenFailureCause, m as DelegationTarget, mn as ScopeNames, mr as Condition, mt as WhereCompiler, n as ApprovalEscalation, nn as DeliveryEvent, nr as CustomRoleGrant, nt as RelationGroup, o as ApprovalStage, on as MembershipEvent, or as Membership, ot as SnapshotSource, p as DelegationInput, pn as ScopeDeclaration, pr as MembershipVia, pt as VerifiedToken, q as DecisionSink, qn as Quota, qt as SnapshotGrant, r as ApprovalMode, rn as DeliveryFailureCause, rr as Delegation, rt as RelationHolder, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, st as SubjectResolver, t as ActivationOption, tn as DeliveryChannel, tr as CustomRole, tt as RelationChain, u as BreakGlassSpec, ur as VerifiedClaims, ut as TokenSigner, v as GrantMeta, vn as PermissionApprover, vr as MemberOfParent, vt as SupportSessionPolicy, w as ObligationInput, wn as Grantee, wr as SqlFunctionCondition, wt as CredentialDecision, x as GrantValidity, xn as anyOf, xr as RelatedHop, xt as parseSupportSession, y as GrantOptions, yn as UserApprover, yt as SupportSessionRequest, z as SupportConsent, zn as DenialDetails, zt as LocalCustomRoleTable } from "./policy-types-CCiDRZBH.js";
+import { A as RESOURCE_NAME, C as ResourceRelation, D as RowOf, E as ResourceXTree, M as AppData, N as AppDataSchema, O as PERMISSION_ROW, P as MetaValue, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, j as RESOURCE_X, k as POLICY_SCOPES, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-DEJ5j4mR.js";
+import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-BW_0MZOS.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-Ci_rT6Uo.js";
+import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-B6Sf4T_S.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-Cmtxogd0.js";
+import { n as PermDockValidationError } from "./validation-error-YGg2mXyH.js";
+import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-zi_4T-rx.js";
+import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-C5jC6sKI.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Drg-1YhL.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-BNM3TtDo.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-4-eQIRWf.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
-import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-5ODwqu8b.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LocalCustomRoleTable, type LocalSnapshotManifest, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-DlJE3gS_.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-BaUXHM1N.js";
+import { t as ClientNames } from "./clients-C_NOET3z.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-ChuiONQU.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-DqEoWHBc.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Dvi7YZG_.js";
+import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-BIPIDa6a.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
+import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-8Yx2CchM.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BQhTlLQS.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };