permdock 0.7.0 → 0.9.0

package/dist/{index-DLwcuCN_.d.ts → index-ymept53A.d.ts}

@@ -1,15 +1,21 @@
-import { T as Policy, j as PolicyVocabulary, q as DecisionSink, sr as Principal, tn as DeliveryChannel } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { t as Operation } from "./operations-BNLes61x.js";
-import { a as PermDock, h as PrincipalSource } from "./permdock-Dco6dyCK.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-g7Oy6Zg4.js";
-import { l as WebhookSigner } from "./standard-webhooks-B_qRg0ws.js";
+import { J as DecisionSink, T as Policy, j as PolicyVocabulary, pr as Principal, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { t as Operation } from "./operations-Ci_rT6Uo.js";
+import { _ as PrincipalSource, a as PermDock } from "./permdock-CprAPN3w.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-CN0LsqbK.js";
+import { l as WebhookSigner } from "./standard-webhooks-DOYEuOLx.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
-  /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
+  /**
+   * Principal ids `decideFor` grants, in discovery or candidate order, each
+   * once.
+   */
   readonly principals: readonly string[];
-  /** `false` when `whoCan` could not list every holder: someone granted may be missing. */
+  /**
+   * `false` when `whoCan` could not list every holder: someone granted may be
+   * missing.
+   */
   readonly complete: boolean;
 };
 type AudienceOptions = {
@@ -19,8 +25,8 @@ type AudienceOptions = {
 /**
  * Who may receive a delivery about `row`: the holders `whoCan` lists (or
  * `candidates`), kept only where `decideFor` grants `permission` in the
- * sender's active tenant. A collection permission has no holders to list,
- * so it needs `candidates`; without them it is empty and incomplete.
+ * sender's active tenant. A collection permission has no holders to list, so it
+ * needs `candidates`; without them it is empty and incomplete.
  */
 declare function audience(permdock: PermDock, permission: Permission, row: unknown, options?: AudienceOptions): Promise<Audience>;
 /** One event a subscriber may receive: the permission its row needs. */
@@ -29,10 +35,9 @@ type SubscriberEvent = {
   readonly row?: unknown;
 };
 /**
- * The subscribers whose principal `decideFor` grants the event's
- * permission on its row, in their order: the per-event filter for webhook
- * endpoints and realtime channels. A subscriber without a string
- * `principal` is dropped.
+ * The subscribers whose principal `decideFor` grants the event's permission on
+ * its row, in their order: the per-event filter for webhook endpoints and
+ * realtime channels. A subscriber without a string `principal` is dropped.
  */
 declare function subscribersFor<S extends {
   readonly principal: string;
@@ -47,7 +52,10 @@ type ConnectorBase<K extends string, C> = {
   readonly config: C;
 };
 type SiemDestination = "splunk-hec" | "sentinel" | "security-lake" | "google-secops" | "elastic" | "datadog";
-/** A connector body in wire format v1 (`schemas/connector-v1.json`), one member per kind. */
+/**
+ * A connector body in wire format v1 (`schemas/connector-v1.json`), one member
+ * per kind.
+ */
 type Connector = ConnectorBase<"webhook", {
   readonly url: Https;
   readonly types?: readonly string[];
@@ -87,7 +95,10 @@ type Connector = ConnectorBase<"webhook", {
   readonly environment?: "production" | "preview" | "development";
 }>;
 type ConnectorKind = Connector["kind"];
-/** One problem with a connector body; `path` is an RFC 6901 JSON pointer into it. */
+/**
+ * One problem with a connector body; `path` is an RFC 6901 JSON pointer into
+ * it.
+ */
 type ConnectorIssue = {
   readonly path: string;
   readonly message: string;
@@ -103,8 +114,8 @@ type ParseConnectorResult = {
 declare const CONNECTOR_KINDS: readonly ConnectorKind[];
 /**
  * Checks `input` against `connector-v1.json` and answers a frozen copy, or
- * every issue with a JSON pointer. The branch is chosen by `kind`, so an
- * issue names the field rather than "no branch matched".
+ * every issue with a JSON pointer. The branch is chosen by `kind`, so an issue
+ * names the field rather than "no branch matched".
  */
 declare function parseConnector(input: unknown): ParseConnectorResult;
 //#endregion
@@ -112,7 +123,8 @@ declare function parseConnector(input: unknown): ParseConnectorResult;
 /**
  * `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
  * `oneOf` branch per kind with a closed `config`. Only the `otlp` and `siem`
- * `headers` maps hold a secret; a store seals their values and lists names only.
+ * `headers` maps hold a secret; a store seals their values and lists names
+ * only.
  */
 declare const CONNECTOR_SCHEMA: JsonSchemaNode;
 //#endregion
@@ -127,10 +139,16 @@ type MemoryDeliveryTransport<C extends DeliveryChannel> = DeliveryTransport<C> &
   readonly deliveries: readonly MemoryDelivery<C>[];
 };
 type MemoryDeliveryTransportOptions<C extends DeliveryChannel> = {
-  /** The result per delivery; defaults to `sent`. A throw propagates, as from a provider client. */
+  /**
+   * The result per delivery; defaults to `sent`. A throw propagates, as from a
+   * provider client.
+   */
   readonly respond?: (target: DeliveryTarget<C>, message: TransportMessages[C]) => DeliveryResult;
 };
-/** An in-process transport for tests and examples: it records what it would have sent. */
+/**
+ * An in-process transport for tests and examples: it records what it would have
+ * sent.
+ */
 declare function memoryDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: MemoryDeliveryTransportOptions<C>): MemoryDeliveryTransport<C>;
 //#endregion
 //#region src/delivery/router.d.ts
@@ -149,12 +167,15 @@ type DeliveryPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   /**
    * Checks every recipient against `target`'s permission on `row` with
    * `permdock.decideFor`, routes the granted ones to the transport of their
-   * channel, and writes one `delivery` event per recipient. Never rejects:
-   * a refused recipient or a transport error is a `failed` event.
+   * channel, and writes one `delivery` event per recipient. Never rejects: a
+   * refused recipient or a transport error is a `failed` event.
    */
   readonly deliver: (permdock: PermDock<V>, target: Permission | Pick<Operation, "name" | "permission">, row: unknown, recipients: readonly Recipient[], messages: Partial<DeliveryMessages>, options?: DeliverOptions) => Promise<DeliveryReport>;
 };
-/** Routes checked recipients to channel transports and records a delivery event for each. */
+/**
+ * Routes checked recipients to channel transports and records a delivery event
+ * for each.
+ */
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(_policy: Policy<TUser, TPrincipal, V>, options: DeliveryPermDockOptions): DeliveryPermDock<V>;
 //#endregion
 //#region src/delivery/target.d.ts
@@ -166,8 +187,8 @@ declare function createPermDock<TUser, TPrincipal extends Principal = Principal,
 declare function isDeliveryTarget<C extends DeliveryChannel>(value: unknown, channel: C): value is DeliveryTarget<C>;
 /**
  * An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
- * characters (RFC 5321 path limit). Quoted local parts, comments and
- * domain literals are refused.
+ * characters (RFC 5321 path limit). Quoted local parts, comments and domain
+ * literals are refused.
  */
 declare function isAddrSpec(value: string): boolean;
 //#endregion
@@ -180,9 +201,9 @@ type WebhookTransportOptions = {
 };
 /**
  * Posts each CloudEvent to the target's https endpoint as
- * `application/cloudevents+json`, signed with the Standard Webhooks
- * headers. `webhook-id` is the idempotency key, so a retry repeats it and
- * the receiver drops the duplicate. Redirects are not followed.
+ * `application/cloudevents+json`, signed with the Standard Webhooks headers.
+ * `webhook-id` is the idempotency key, so a retry repeats it and the receiver
+ * drops the duplicate. Redirects are not followed.
  */
 declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
 //#endregion

package/dist/index.d.ts

@@ -1,23 +1,23 @@
-import { $ as MemberEntry, $n as AuthorizationDetail, $t as CredentialEvent, A as PolicyScopes, An as assurance, At as CredentialRequest, B as ValidateMode, Bn as DenialReason, Bt as LocalMembershipRows, C as MembershipFixture, Cn as user, Cr as SqlFunctionArg, Ct as Credential, D as PolicyDelegation, Dn as RelationGrantee, Dr as isConditionDate, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as InheritGrantee, Er as isCondition, Et as CredentialPermission, F as RoleScope, Fn as AppObligation, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as MatchedGrant, Gt as Snapshot, H as WireValidity, Hn as ExplainedDecision, Ht as LocalRowValue, I as SeparationConflict, In as ApprovalRequiredDecision, It as parseCredential, J as EntitlementSource, Jn as Trace, Jt as SnapshotNotEntitled, K as DecisionProvider, Kn as Obligation, Kt as SnapshotAssignable, L as SubjectOf, Ln as Decision, M as PrincipalOf, Mn as inherit, Mt as credentialDelegation, N as RoleBinding, Nn as plan, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as actor, Or as isConditionRef, Ot as CredentialPolicy, P as RoleOptions, Pn as relation, Pt as decideCredential, Q as LimitStore, Qn as Assurance, Qt as AutomationEvent, R as SupportAccessOptions, Rn as Denial, S as HostedGrantRef, Sn as holder, Sr as RestrictedAncestors, St as ApiKeyPrincipal, T as Policy, Tn as GranteeInput, Tr as hasConditionOp, Tt as CredentialKind, U as CredentialVerifier, Un as GrantedDecision, Ut as LocalSnapshotManifest, Vn as DeniedDecision, Vt as LocalRowColumn, W as CustomRoleSource, Wn as LimitDetail, Wt as LocalSnapshotRows, X as LimitConsumeInput, Xn as TraceSkipReason, Xt as AccessEvent, Yn as TraceSkip, Yt as SnapshotScope, Z as LimitRemaining, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, _n as ApproverInput, _r as MemberOfCondition, _t as SupportSessionDecision, a as ApprovalRequirement, an as EmailCategory, at as SettingsSource, b as GrantScope, bn as allOf, br as RelatedCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as WireDecision, cr as SharedCustomRole, ct as TenantSettings, d as ClosureContext, dn as PolicyScopesInput, dr as ActorKind, dt as TokenVerifier, en as DecisionEvent, er as Binding, et as MembershipSource, f as ClosureGrantFn, fn as Scope, fr as AdapterId, ft as VerificationFailure, g as GrantCondition, gn as Approver, gr as ConditionValue, gt as SupportSession, h as Grant, hn as AnyOfApprover, hr as ConditionRef, ht as DecideSupportSessionOptions, i as ApprovalOption, in as DirectoryEvent, ir as GnapAccess, it as RelationSource, jn as authenticated, jt as DecideCredentialOptions, kn as anyone, kr as isSqlFunctionField, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as WireDenial, lr as Subject, lt as TokenFailureCause, m as DelegationTarget, mn as ScopeNames, mr as Condition, mt as WhereCompiler, n as ApprovalEscalation, nn as DeliveryEvent, nr as CustomRoleGrant, nt as RelationGroup, o as ApprovalStage, on as MembershipEvent, or as Membership, ot as SnapshotSource, p as DelegationInput, pn as ScopeDeclaration, pr as MembershipVia, pt as VerifiedToken, q as DecisionSink, qn as Quota, qt as SnapshotGrant, r as ApprovalMode, rn as DeliveryFailureCause, rr as Delegation, rt as RelationHolder, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, st as SubjectResolver, t as ActivationOption, tn as DeliveryChannel, tr as CustomRole, tt as RelationChain, u as BreakGlassSpec, ur as VerifiedClaims, ut as TokenSigner, v as GrantMeta, vn as PermissionApprover, vr as MemberOfParent, vt as SupportSessionPolicy, w as ObligationInput, wn as Grantee, wr as SqlFunctionCondition, wt as CredentialDecision, x as GrantValidity, xn as anyOf, xr as RelatedHop, xt as parseSupportSession, y as GrantOptions, yn as UserApprover, yt as SupportSessionRequest, z as SupportConsent, zn as DenialDetails, zt as LocalCustomRoleTable } from "./policy-types-B-F-qAZk.js";
-import { A as MetaValue, C as ResourceRelation, D as RESOURCE_X, E as ResourceXTree, O as AppData, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, k as AppDataSchema, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
-import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-Bg3eeT2H.js";
-import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-BTkwrK7v.js";
-import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-BNLes61x.js";
-import { C as ApprovalPolicy, D as approvalPolicies, E as ApprovalPolicyValidation, O as memoryApprovalPolicySource, S as ApprovalPolicies, T as ApprovalPolicySource, _ as PermittedIdsOptions, a as PermDock, b as memoryLimitStore, c as SimulateOptions, d as getPermDock, f as getPermDockSync, g as memoryPrincipalSource, h as PrincipalSource, i as LoadedRows, k as validateApprovalPolicy, l as SnapshotOptions, m as PrincipalIdentityLink, n as DecideOptions, o as PermDockOptions, p as PrincipalIdentity, r as DeriveOptions, s as RowPair, t as DecideIdsOptions, u as WhereResult, v as Limits, w as ApprovalPolicyProblem, x as PermissionCheck, y as limits } from "./permdock-Dco6dyCK.js";
-import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-BmjzxQhp.js";
-import { n as PermDockValidationError } from "./validation-error-CQpoquwj.js";
-import { n as requiredPlans } from "./problem-details-Tcfmj3bV.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
+import { $ as LimitRemaining, $n as Quota, $t as SnapshotGrant, A as PolicyScopes, An as Grantee, Ar as SqlFunctionCondition, At as CredentialDecision, B as ValidateMode, Bn as relation, Bt as decideCredential, C as MembershipFixture, Cn as ApproverInput, Cr as MemberOfCondition, Ct as SupportSessionDecision, D as PolicyDelegation, Dn as anyOf, Dr as RelatedHop, Dt as parseSupportSession, E as PolicyAppDataSchemas, En as allOf, Er as RelatedCondition, Et as decideSupportSession, F as RoleScope, Fn as anyone, Fr as isSqlFunctionField, Ft as CredentialPolicyViolation, G as CustomRoleSource, Gn as DenialDetails, Gt as LocalCustomRoleTable, H as WireValidity, Hn as ApprovalRequiredDecision, Ht as parseCredential, I as SeparationConflict, In as assurance, It as CredentialRequest, J as DecisionSink, Jn as ExplainedDecision, Jt as LocalRowValue, K as CustomRoleSourceFactory, Kn as DenialReason, Kt as LocalMembershipRows, L as SubjectOf, Ln as authenticated, Lt as DecideCredentialOptions, M as PrincipalOf, Mn as InheritGrantee, Mr as isCondition, Mt as CredentialPermission, N as RoleBinding, Nn as RelationGrantee, Nr as isConditionDate, Nt as CredentialPermissionInput, O as PolicyOAuthScope, On as holder, Or as RestrictedAncestors, Ot as ApiKeyPrincipal, P as RoleOptions, Pn as actor, Pr as isConditionRef, Pt as CredentialPolicy, Q as LimitConsumeInput, Qn as Obligation, Qt as SnapshotAssignable, R as SupportAccessOptions, Rn as inherit, Rt as credentialDelegation, S as HostedGrantRef, Sn as Approver, Sr as ConditionValue, St as SupportSession, T as Policy, Tn as UserApprover, Tt as SupportSessionRequest, U as CredentialVerifier, Un as Decision, Vn as AppObligation, Vt as isFeedId, W as CustomRoleContext, Wn as Denial, X as Intent, Xn as LimitDetail, Xt as LocalSnapshotRows, Y as EntitlementSource, Yn as GrantedDecision, Yt as LocalSnapshotManifest, Zn as MatchedGrant, Zt as Snapshot, _ as GrantLimit, _n as PolicyScopesInput, _r as ActorKind, _t as VerifiedToken, a as ApprovalRequirement, an as CredentialEvent, ar as AuthorizationDetail, at as RelationHolder, b as GrantScope, bn as ScopeNames, br as Condition, bt as WhereCompiler, c as BreakGlassOptions, cn as DeliveryEvent, cr as CustomRoleGrant, ct as SnapshotSource, d as ClosureContext, dn as EmailCategory, dt as SubjectResolver, en as SnapshotNotEntitled, er as Trace, et as LimitStore, f as ClosureGrantFn, fn as MembershipEvent, fr as Membership, ft as TenantSettings, g as GrantCondition, gr as VerifiedClaims, gt as VerificationFailure, h as Grant, hn as WireDenial, hr as Subject, ht as TokenVerifier, i as ApprovalOption, in as AutomationEvent, ir as Assurance, it as RelationGroup, jn as GranteeInput, jr as hasConditionOp, jt as CredentialKind, kn as user, kr as SqlFunctionArg, kt as Credential, l as BreakGlassRequirements, ln as DeliveryFailureCause, lr as Delegation, lt as SourceContext, m as DelegationTarget, mn as WireDecision, mr as SharedCustomRole, mt as TokenSigner, n as ApprovalEscalation, nn as AccessEvent, nr as TraceSkipReason, nt as MembershipSource, o as ApprovalStage, on as DecisionEvent, or as Binding, ot as RelationSource, p as DelegationInput, pn as SinkEvent, pr as Principal, pt as TokenFailureCause, q as DecisionProvider, qn as DeniedDecision, qt as LocalRowColumn, r as ApprovalMode, rn as AuthEvent, rr as Actor, rt as RelationChain, s as AssuranceRequirement, sn as DeliveryChannel, sr as CustomRole, st as SettingsSource, t as ActivationOption, tn as SnapshotScope, tr as TraceSkip, tt as MemberEntry, u as BreakGlassSpec, un as DirectoryEvent, ur as GnapAccess, ut as SourceMemo, v as GrantMeta, vn as Scope, vr as AdapterId, vt as VersionContext, w as ObligationInput, wn as PermissionApprover, wr as MemberOfParent, wt as SupportSessionPolicy, x as GrantValidity, xn as AnyOfApprover, xr as ConditionRef, xt as DecideSupportSessionOptions, y as GrantOptions, yn as ScopeDeclaration, yr as MembershipVia, yt as VersionQuery, z as SupportConsent, zn as plan, zt as credentialPolicyViolation } from "./policy-types-DGIO_gxq.js";
+import { A as RESOURCE_NAME, C as ResourceRelation, D as RowOf, E as ResourceXTree, M as AppData, N as AppDataSchema, O as PERMISSION_ROW, P as MetaValue, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, j as RESOURCE_X, k as POLICY_SCOPES, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
+import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-DEJ5j4mR.js";
+import { $ as resource, $t as opaque, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Cn as validateCustomRole, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, En as principal, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryVersionCache, H as breakGlass, Ht as MemoryVersionCacheOptions, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as memoryEntitlementSource, K as deny, Kt as APPROVAL_POLICY_UNAVAILABLE, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as sqlFunction, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as resolveCustomRole, St as SignSnapshotOptions, T as parseCloudEventBatch, Tn as context, Tt as snapshotClaims, U as supportAccess, Ut as VersionCache, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as VersionCacheStats, X as readable, Xt as memorySettingsSource, Y as crud, Yt as memoryMembershipSource, Z as writable, Zt as memorySnapshotSource, _ as DECISION_EVENT_SCHEMA, _n as CustomRoleValidation, _t as ArazzoSimulateInput, a as catalogFingerprint, an as RoleNameOf, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as customRoleClaim, bt as simulateArazzo, c as OCSF_VERSION, cn as separationConflicts, ct as ShadowMismatch, d as accessToOcsf, dn as fromSnapshot, dt as defineApp, en as findPermission, et as definePermissions, f as toOcsf, fn as parseSnapshot, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as CustomRoleRename, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as CustomRoleEntry, ht as ArazzoFinding, i as canonicalJson, in as mergePermissions, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as requiresApproval, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as CustomRoleDropReason, mt as localSnapshotManifest, n as delegatedPermissions, nn as isPermission, nt as snapshotFor, o as CSV_COLUMNS, on as definePolicy, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleDrop, pt as AppProfile, q as normalizeAssurance, qt as memoryCustomRoleSource, r as sha256Digest, rn as listPermissions, rt as CustomRoleReader, s as toCsvRow, sn as isRoleName, st as LegacyCheck, t as coveredByDelegation, tn as getResource, tt as SnapshotForOptions, u as OcsfUserManagement, un as emptySnapshot, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as ResolvedCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wn as claim, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as parseCustomRoleEntry, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as ValidateCustomRoleOptions, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-vYjMrXyK.js";
+import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-Ci_rT6Uo.js";
+import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-CprAPN3w.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-DVxlLZMe.js";
+import { n as PermDockValidationError } from "./validation-error-uvp-kyfO.js";
+import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-B6R0cMRL.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-R07lFBnX.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-D4UC9TTW.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-DOtAFWdy.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Cp_Eot9W.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
-import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-e4mdwAKd.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationRisk, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-DxXB54Wu.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-BaUXHM1N.js";
+import { t as ClientNames } from "./clients-C_NOET3z.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Di9tiUvi.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-C6Jg75xq.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-B5zoUW_O.js";
+import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-c7Xo_2Cu.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-8Yx2CchM.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CCmbhnxP.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleContext, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type Intent, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MemoryVersionCacheOptions, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SourceContext, type SourceMemo, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type VersionCache, type VersionCacheStats, type VersionContext, type VersionQuery, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,38 +1,38 @@
-import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-CNJBiTFo.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-C1VJzvcr.js";
-import { A as memoryCustomRoleSource, C as stripeEntitlementSource, D as validateApprovalPolicy, E as memoryApprovalPolicySource, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as defineOperations, P as memorySnapshotSource, S as memoryLimitStore, _ as arazzoFindings, a as normalizeMembership, b as memoryRelationSource, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as approvalPolicies, x as limits, y as signPolicyDocument } from "./src-DLFrtrrC.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-DZlnEtLy.js";
+import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
+import { C as memoryLimitStore, D as memoryApprovalPolicySource, F as memorySnapshotSource, I as sqlFunction, M as memoryEntitlementSource, N as memoryMembershipSource, O as validateApprovalPolicy, P as memorySettingsSource, S as limits, T as approvalPolicies, _ as arazzoFindings, a as normalizeMembership, b as signPolicyDocument, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryCustomRoleSource, k as defineOperations, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as stripeEntitlementSource, x as memoryRelationSource, y as memoryVersionCache } from "./src-C_pi2Rnh.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-B4r0N_Uz.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
-import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
-import { a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission, v as resource } from "./permission-registry-DpPtSKNZ.js";
-import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-ySsxp_Yp.js";
+import { r as memoryPrincipalSource } from "./principal-source-C6N60GtM.js";
+import { a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission, v as resource } from "./permission-registry-B8tYxPIt.js";
+import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-x3KEUusw.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as parseSupportSession, t as decideSupportSession } from "./support-session-Cna49-3f.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
-import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-BrRANrpT.js";
-import { a as isRoleName, l as separationConflicts, n as definePolicy } from "./policy-DaJy4nK4.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as parseSupportSession, t as decideSupportSession } from "./support-session-BsmPCbz8.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
-import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CyH2MV_B.js";
-import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
-import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-CjcwnEiV.js";
-import { t as whoCan } from "./who-can-BwNsI_Js.js";
-import { n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
-import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-wq2coopv.js";
-import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-T1Q8X3A2.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
-import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
-import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
-import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-L7NnfhiE.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CIM7wHwA.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CVXmRILq.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
+import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-DuWf1cT3.js";
+import { t as whoCan } from "./who-can-BoDJm0Nc.js";
+import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-DlCdCM_8.js";
+import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DEiCF4ah.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-BvjivVb9.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-D9_vh372.js";
+import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-TcjRBgIs.js";
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-BqX94r07.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CyyyvCsL.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-B-4t1NzC.js → init-BjuFDYT1.js}

@@ -1,7 +1,8 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-CHTbd-DQ.js";
-import { t as addLine } from "./peer-12Q5I_RH.js";
-import { t as applyFiles } from "./files-acUbNwWt.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { t as addLine } from "./peer-Q0fuZ6hx.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts
@@ -13,11 +14,10 @@ function decoded(code, command) {
 	return preset;
 }
 /**
-* Writes the preset's owned files into `cwd` and lists what to install.
-* An existing file is kept unless `force` is set, so `init` never
-* overwrites code the application already changed. It installs nothing
-* and calls no network: the package manager and shadcn commands are
-* printed for the person to run.
+* Writes the preset's owned files into `cwd` and lists what to install. An
+* existing file is kept unless `force` is set, so `init` never overwrites code
+* the application already changed. It installs nothing and calls no network:
+* the package manager and shadcn commands are printed for the person to run.
 */
 function runInit(options) {
 	const preset = typeof options.preset === "string" ? decoded(options.preset, "init") : resolvePreset(options.preset);
@@ -85,7 +85,7 @@ function runPreset(action, code) {
 	return {
 		code: 0,
 		output: `${[
-			...Object.entries(preset).map(([key, value]) => `  ${key.padEnd(12)} ${Array.isArray(value) ? value.join(", ") || "none" : String(value)}`),
+			...Object.entries(preset).map(([key, value]) => `  ${key.padEnd(12)} ${Array.isArray(value) ? nonEmptyOr(value.join(", "), "none") : String(value)}`),
 			"",
 			`  permdock init ${presetFlags(preset).join(" ")}`
 		].join("\n")}\n`,

package/dist/{init-5TXNji88.js → init-txYTuW9u.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-CHTbd-DQ.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-BjLzeFpp.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-aaeRAdiD.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-B-4t1NzC.js"), import("./peer-DOzzMfZL.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BjuFDYT1.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-B-4t1NzC.js");
+		const { runPreset } = await import("./init-BjuFDYT1.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-B-4t1NzC.js");
+		const { runPreset } = await import("./init-BjuFDYT1.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{instance-options-CU0YQCLH.d.ts → instance-options-CoHn-0e8.d.ts}

@@ -1,10 +1,10 @@
-import { o as PermDockOptions } from "./permdock-Dco6dyCK.js";
+import { o as PermDockOptions } from "./permdock-CprAPN3w.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**
- * The data sources an adapter passes through to every instance it creates.
- * Each adapter's options type extends this, so a source added to core
- * reaches every adapter without a per-adapter change.
+ * The data sources an adapter passes through to every instance it creates. Each
+ * adapter's options type extends this, so a source added to core reaches every
+ * adapter without a per-adapter change.
  */
 type InstanceOptions = Pick<PermDockOptions, InstanceKey>;
 //#endregion