permdock 0.8.0 → 0.9.0

package/dist/{gen-B5kvbAoZ.js → gen-BFfzZSLH.js}

@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-DWCYcMQM.js");
+		const { runGen } = await import("./gen-BtfFWGbz.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{gen-DWCYcMQM.js → gen-BtfFWGbz.js}

@@ -7,10 +7,10 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { n as fileSummary, r as planFiles } from "./files-B3AA05f1.js";
 import { f as writeOutputFiles, r as driftOf } from "./output-files-BIQ_9pIs.js";
-import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-D_sZSVA3.js";
-import { t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { i as decorate } from "../bind-BNQA9JK9.js";
+import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-Cmtxogd0.d.ts → hosted-DVxlLZMe.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-CCiDRZBH.js";
+import { An as Grantee, T as Policy, a as ApprovalRequirement, br as Condition } from "./policy-types-DGIO_gxq.js";
 //#region src/core/hosted.d.ts
 /**
  * One grant authored in PermDock Cloud; its grantee is a declared role, plan or

package/dist/{import-_YqhhwvX.js → import-ACkOrv6g.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-Dst9I9Gs.js";
+import { t as validateOpenapi } from "./schema-BTsE1WRT.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-BhxEUY9J.d.ts → index-BinlXeU-.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DjuMBNF9.js";
+import { T as Policy, mt as TokenSigner, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DsHGPtkR.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-B8s204GL.d.ts → index-CV-7DWeD.d.ts}

@@ -1,8 +1,8 @@
-import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Un as Decision, hr as Subject, ht as TokenVerifier, j as PolicyVocabulary, jt as CredentialKind, kt as Credential, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, st as SettingsSource } from "./policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
-import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-zi_4T-rx.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CIlpSA2G.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CyRN0-Cd.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are

package/dist/{index-_9UiQIkt.d.ts → index-DJwEgYzA.d.ts}

@@ -1,8 +1,8 @@
-import { $n as AuthorizationDetail, Ln as Decision, Rt as Instant, T as Policy, et as MembershipSource, gn as Approver, it as RelationSource, lr as Subject, or as Membership, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { Sn as Approver, T as Policy, Un as Decision, Wt as Instant, ar as AuthorizationDetail, fr as Membership, hr as Subject, mt as TokenSigner, nt as MembershipSource, ot as RelationSource } from "./policy-types-DGIO_gxq.js";
 import { M as AppData, f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-B_tiYvk8.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-B2mlGuhW.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DLvhVm1r.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-B2efzoSX.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {

package/dist/{index-BT5-1VsX.d.ts → index-Dj2qF9VC.d.ts}

@@ -1,4 +1,4 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, ht as TokenVerifier, nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";

package/dist/{index-BW_0MZOS.d.ts → index-vYjMrXyK.d.ts}

@@ -1,13 +1,13 @@
-import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-CCiDRZBH.js";
+import { Ar as SqlFunctionCondition, C as MembershipFixture, D as PolicyDelegation, G as CustomRoleSource, I as SeparationConflict, Kn as DenialReason, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, T as Policy, Tr as OpaqueCondition, Un as Decision, Ut as InstanceHandle, V as VocabularyFromInput, Wn as Denial, Wt as Instant, Y as EntitlementSource, Yt as LocalSnapshotManifest, Z as JwtClaims, Zt as Snapshot, _n as PolicyScopesInput, c as BreakGlassOptions, cn as DeliveryEvent, ct as SnapshotSource, fr as Membership, ft as TenantSettings, g as GrantCondition, h as Grant, hr as Subject, i as ApprovalOption, it as RelationGroup, j as PolicyVocabulary, k as PolicyOptions, kr as SqlFunctionArg, lr as Delegation, mt as TokenSigner, nn as AccessEvent, nt as MembershipSource, on as DecisionEvent, ot as RelationSource, pn as SinkEvent, pr as Principal, s as AssuranceRequirement, sr as CustomRole, st as SettingsSource, vn as Scope, xr as ConditionRef, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
 import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { a as PermDock, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
-import { o as PolicyDocument } from "./hosted-Cmtxogd0.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
-import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { o as PolicyDocument } from "./hosted-DVxlLZMe.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-Dvi7YZG_.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-B5zoUW_O.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
 type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
@@ -191,6 +191,55 @@ declare function memoryCustomRoleSource(customRoles: readonly CustomRole[]): Cus
  */
 declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
 //#endregion
+//#region src/core/version-cache.d.ts
+type VersionCacheStats = {
+  /** Version reads the cache started. */
+  readonly reads: number;
+  /** Calls answered by a read already in flight. */
+  readonly shared: number;
+  /** Calls answered from an entry or a token claim, with no read. */
+  readonly hits: number;
+  readonly evictions: number;
+  readonly size: number;
+};
+/**
+ * Current authorization versions shared by every instance in a process:
+ * `claimsFirst(source, { versions })` reads through it.
+ */
+type VersionCache = {
+  readonly name?: string;
+  /** How old an entry may be when an instance with intent `read` uses it. */
+  readonly maxStaleMs: number;
+  /**
+   * The current version of `principal`. With `live: false`, an entry at most
+   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
+   * newer than the entry raises it; with `live: true`, `read` runs.
+   */
+  current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
+    readonly live: boolean;
+  }) => number | undefined | Promise<number | undefined>;
+  /** Drops `principal`'s entry, so the next instance reads the version. */
+  evict: (principal: string) => void;
+  stats: () => VersionCacheStats;
+};
+type MemoryVersionCacheOptions = {
+  /**
+   * How stale a read may be, in milliseconds: the entry lifetime and the
+   * longest a removed member keeps read access. Clamped to 0 to 60,000.
+   */
+  readonly maxStaleMs: number;
+  /** Principals kept; the least recently used goes first. Default 10,000. */
+  readonly maxEntries?: number;
+  /** The clock, read only when an instance asks for a version. */
+  readonly now?: () => Instant;
+};
+/**
+ * An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+ * resolved versions and shares reads in flight. Create it once at module
+ * scope.
+ */
+declare function memoryVersionCache(options: MemoryVersionCacheOptions): VersionCache;
+//#endregion
 //#region src/core/memberships.d.ts
 /**
  * One `MembershipSource` over several: memberships are merged and
@@ -203,11 +252,15 @@ declare function composeMemberships(sources: readonly MembershipSource[]): Membe
  * Trust the memberships the verified token carries, and read `source` only when
  * the token marks them truncated. With `version`, a token minted before the
  * latest membership change is stale for the policy's `fresh` permissions, or
- * with `onStale: 'reread'` has its memberships read from `source` instead.
+ * with `onStale: 'reread'` has its memberships read from `source` instead. With
+ * `versions`, an instance with intent `read` takes the version from that
+ * process-wide cache, so concurrent instances share one read and a token issued
+ * within its `maxStaleMs` needs none; intent `write` always reads.
  */
 declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
   readonly version?: MembershipSource["version"];
   readonly onStale?: "deny" | "reread";
+  readonly versions?: VersionCache;
 }): MembershipSource;
 /**
  * Whether the identity provider owns `membership`: the application must not
@@ -1145,4 +1198,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { resource as $, listPermissions as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryMembershipSource as Gt, breakGlass as H, APPROVAL_POLICY_UNAVAILABLE as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, sqlFunction as Jt, deny as K, memorySettingsSource as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, isPermission as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, principal as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, snapshotClaims as Tt, supportAccess as U, memoryCustomRoleSource as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, memoryEntitlementSource as Wt, readable as X, findPermission as Xt, crud as Y, opaque as Yt, writable as Z, getResource as Zt, DECISION_EVENT_SCHEMA as _, parseCustomRoleEntry as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, requiresApproval as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, claim as bn, simulateArazzo as bt, OCSF_VERSION as c, parseSnapshot as cn, ShadowMismatch as ct, accessToOcsf as d, CustomRoleEntry as dn, defineApp as dt, mergePermissions as en, definePermissions as et, toOcsf as f, CustomRoleRename as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, customRoleClaim as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, ValidateCustomRoleOptions as hn, ArazzoFinding as ht, canonicalJson as i, separationConflicts as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, CustomRoleDrop as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, ResolvedCustomRole as mn, localSnapshotManifest as mt, delegatedPermissions as n, definePolicy as nn, snapshotFor as nt, CSV_COLUMNS as o, emptySnapshot as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleValidation as pn, AppProfile as pt, normalizeAssurance as q, memorySnapshotSource as qt, sha256Digest as r, isRoleName as rn, CustomRoleReader as rt, toCsvRow as s, fromSnapshot as sn, LegacyCheck as st, coveredByDelegation as t, RoleNameOf as tn, SnapshotForOptions as tt, OcsfUserManagement as u, CustomRoleDropReason as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, resolveCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, context as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, validateCustomRole as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };
+export { resource as $, opaque as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, validateCustomRole as Cn, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, principal as En, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryVersionCache as Gt, breakGlass as H, MemoryVersionCacheOptions as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, memoryEntitlementSource as Jt, deny as K, APPROVAL_POLICY_UNAVAILABLE as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, sqlFunction as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, resolveCustomRole as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, context as Tn, snapshotClaims as Tt, supportAccess as U, VersionCache as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, VersionCacheStats as Wt, readable as X, memorySettingsSource as Xt, crud as Y, memoryMembershipSource as Yt, writable as Z, memorySnapshotSource as Zt, DECISION_EVENT_SCHEMA as _, CustomRoleValidation as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, RoleNameOf as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, customRoleClaim as bn, simulateArazzo as bt, OCSF_VERSION as c, separationConflicts as cn, ShadowMismatch as ct, accessToOcsf as d, fromSnapshot as dn, defineApp as dt, findPermission as en, definePermissions as et, toOcsf as f, parseSnapshot as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, CustomRoleRename as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, CustomRoleEntry as hn, ArazzoFinding as ht, canonicalJson as i, mergePermissions as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, requiresApproval as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, CustomRoleDropReason as mn, localSnapshotManifest as mt, delegatedPermissions as n, isPermission as nn, snapshotFor as nt, CSV_COLUMNS as o, definePolicy as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleDrop as pn, AppProfile as pt, normalizeAssurance as q, memoryCustomRoleSource as qt, sha256Digest as r, listPermissions as rn, CustomRoleReader as rt, toCsvRow as s, isRoleName as sn, LegacyCheck as st, coveredByDelegation as t, getResource as tn, SnapshotForOptions as tt, OcsfUserManagement as u, emptySnapshot as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, ResolvedCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, claim as wn, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, parseCustomRoleEntry as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, ValidateCustomRoleOptions as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };

package/dist/{index-Bv5iXPqU.d.ts → index-ymept53A.d.ts}

@@ -1,10 +1,10 @@
-import { T as Policy, j as PolicyVocabulary, q as DecisionSink, sr as Principal, tn as DeliveryChannel } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, T as Policy, j as PolicyVocabulary, pr as Principal, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { _ as PrincipalSource, a as PermDock } from "./permdock-CprAPN3w.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-yUuPR5Hy.js";
-import { l as WebhookSigner } from "./standard-webhooks-C-qX4mJW.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-CN0LsqbK.js";
+import { l as WebhookSigner } from "./standard-webhooks-DOYEuOLx.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
   /**

package/dist/index.d.ts

@@ -1,23 +1,23 @@
-import { $ as MemberEntry, $n as AuthorizationDetail, $t as CredentialEvent, A as PolicyScopes, An as assurance, At as CredentialRequest, B as ValidateMode, Bn as DenialReason, Bt as LocalMembershipRows, C as MembershipFixture, Cn as user, Cr as SqlFunctionArg, Ct as Credential, D as PolicyDelegation, Dn as RelationGrantee, Dr as isConditionDate, Dt as CredentialPermissionInput, E as PolicyAppDataSchemas, En as InheritGrantee, Er as isCondition, Et as CredentialPermission, F as RoleScope, Fn as AppObligation, Ft as isFeedId, G as CustomRoleSourceFactory, Gn as MatchedGrant, Gt as Snapshot, H as WireValidity, Hn as ExplainedDecision, Ht as LocalRowValue, I as SeparationConflict, In as ApprovalRequiredDecision, It as parseCredential, J as EntitlementSource, Jn as Trace, Jt as SnapshotNotEntitled, K as DecisionProvider, Kn as Obligation, Kt as SnapshotAssignable, L as SubjectOf, Ln as Decision, M as PrincipalOf, Mn as inherit, Mt as credentialDelegation, N as RoleBinding, Nn as plan, Nt as credentialPolicyViolation, O as PolicyOAuthScope, On as actor, Or as isConditionRef, Ot as CredentialPolicy, P as RoleOptions, Pn as relation, Pt as decideCredential, Q as LimitStore, Qn as Assurance, Qt as AutomationEvent, R as SupportAccessOptions, Rn as Denial, S as HostedGrantRef, Sn as holder, Sr as RestrictedAncestors, St as ApiKeyPrincipal, T as Policy, Tn as GranteeInput, Tr as hasConditionOp, Tt as CredentialKind, U as CredentialVerifier, Un as GrantedDecision, Ut as LocalSnapshotManifest, Vn as DeniedDecision, Vt as LocalRowColumn, W as CustomRoleSource, Wn as LimitDetail, Wt as LocalSnapshotRows, X as LimitConsumeInput, Xn as TraceSkipReason, Xt as AccessEvent, Yn as TraceSkip, Yt as SnapshotScope, Z as LimitRemaining, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, _n as ApproverInput, _r as MemberOfCondition, _t as SupportSessionDecision, a as ApprovalRequirement, an as EmailCategory, at as SettingsSource, b as GrantScope, bn as allOf, br as RelatedCondition, bt as decideSupportSession, c as BreakGlassOptions, cn as WireDecision, cr as SharedCustomRole, ct as TenantSettings, d as ClosureContext, dn as PolicyScopesInput, dr as ActorKind, dt as TokenVerifier, en as DecisionEvent, er as Binding, et as MembershipSource, f as ClosureGrantFn, fn as Scope, fr as AdapterId, ft as VerificationFailure, g as GrantCondition, gn as Approver, gr as ConditionValue, gt as SupportSession, h as Grant, hn as AnyOfApprover, hr as ConditionRef, ht as DecideSupportSessionOptions, i as ApprovalOption, in as DirectoryEvent, ir as GnapAccess, it as RelationSource, jn as authenticated, jt as DecideCredentialOptions, kn as anyone, kr as isSqlFunctionField, kt as CredentialPolicyViolation, l as BreakGlassRequirements, ln as WireDenial, lr as Subject, lt as TokenFailureCause, m as DelegationTarget, mn as ScopeNames, mr as Condition, mt as WhereCompiler, n as ApprovalEscalation, nn as DeliveryEvent, nr as CustomRoleGrant, nt as RelationGroup, o as ApprovalStage, on as MembershipEvent, or as Membership, ot as SnapshotSource, p as DelegationInput, pn as ScopeDeclaration, pr as MembershipVia, pt as VerifiedToken, q as DecisionSink, qn as Quota, qt as SnapshotGrant, r as ApprovalMode, rn as DeliveryFailureCause, rr as Delegation, rt as RelationHolder, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, st as SubjectResolver, t as ActivationOption, tn as DeliveryChannel, tr as CustomRole, tt as RelationChain, u as BreakGlassSpec, ur as VerifiedClaims, ut as TokenSigner, v as GrantMeta, vn as PermissionApprover, vr as MemberOfParent, vt as SupportSessionPolicy, w as ObligationInput, wn as Grantee, wr as SqlFunctionCondition, wt as CredentialDecision, x as GrantValidity, xn as anyOf, xr as RelatedHop, xt as parseSupportSession, y as GrantOptions, yn as UserApprover, yt as SupportSessionRequest, z as SupportConsent, zn as DenialDetails, zt as LocalCustomRoleTable } from "./policy-types-CCiDRZBH.js";
+import { $ as LimitRemaining, $n as Quota, $t as SnapshotGrant, A as PolicyScopes, An as Grantee, Ar as SqlFunctionCondition, At as CredentialDecision, B as ValidateMode, Bn as relation, Bt as decideCredential, C as MembershipFixture, Cn as ApproverInput, Cr as MemberOfCondition, Ct as SupportSessionDecision, D as PolicyDelegation, Dn as anyOf, Dr as RelatedHop, Dt as parseSupportSession, E as PolicyAppDataSchemas, En as allOf, Er as RelatedCondition, Et as decideSupportSession, F as RoleScope, Fn as anyone, Fr as isSqlFunctionField, Ft as CredentialPolicyViolation, G as CustomRoleSource, Gn as DenialDetails, Gt as LocalCustomRoleTable, H as WireValidity, Hn as ApprovalRequiredDecision, Ht as parseCredential, I as SeparationConflict, In as assurance, It as CredentialRequest, J as DecisionSink, Jn as ExplainedDecision, Jt as LocalRowValue, K as CustomRoleSourceFactory, Kn as DenialReason, Kt as LocalMembershipRows, L as SubjectOf, Ln as authenticated, Lt as DecideCredentialOptions, M as PrincipalOf, Mn as InheritGrantee, Mr as isCondition, Mt as CredentialPermission, N as RoleBinding, Nn as RelationGrantee, Nr as isConditionDate, Nt as CredentialPermissionInput, O as PolicyOAuthScope, On as holder, Or as RestrictedAncestors, Ot as ApiKeyPrincipal, P as RoleOptions, Pn as actor, Pr as isConditionRef, Pt as CredentialPolicy, Q as LimitConsumeInput, Qn as Obligation, Qt as SnapshotAssignable, R as SupportAccessOptions, Rn as inherit, Rt as credentialDelegation, S as HostedGrantRef, Sn as Approver, Sr as ConditionValue, St as SupportSession, T as Policy, Tn as UserApprover, Tt as SupportSessionRequest, U as CredentialVerifier, Un as Decision, Vn as AppObligation, Vt as isFeedId, W as CustomRoleContext, Wn as Denial, X as Intent, Xn as LimitDetail, Xt as LocalSnapshotRows, Y as EntitlementSource, Yn as GrantedDecision, Yt as LocalSnapshotManifest, Zn as MatchedGrant, Zt as Snapshot, _ as GrantLimit, _n as PolicyScopesInput, _r as ActorKind, _t as VerifiedToken, a as ApprovalRequirement, an as CredentialEvent, ar as AuthorizationDetail, at as RelationHolder, b as GrantScope, bn as ScopeNames, br as Condition, bt as WhereCompiler, c as BreakGlassOptions, cn as DeliveryEvent, cr as CustomRoleGrant, ct as SnapshotSource, d as ClosureContext, dn as EmailCategory, dt as SubjectResolver, en as SnapshotNotEntitled, er as Trace, et as LimitStore, f as ClosureGrantFn, fn as MembershipEvent, fr as Membership, ft as TenantSettings, g as GrantCondition, gr as VerifiedClaims, gt as VerificationFailure, h as Grant, hn as WireDenial, hr as Subject, ht as TokenVerifier, i as ApprovalOption, in as AutomationEvent, ir as Assurance, it as RelationGroup, jn as GranteeInput, jr as hasConditionOp, jt as CredentialKind, kn as user, kr as SqlFunctionArg, kt as Credential, l as BreakGlassRequirements, ln as DeliveryFailureCause, lr as Delegation, lt as SourceContext, m as DelegationTarget, mn as WireDecision, mr as SharedCustomRole, mt as TokenSigner, n as ApprovalEscalation, nn as AccessEvent, nr as TraceSkipReason, nt as MembershipSource, o as ApprovalStage, on as DecisionEvent, or as Binding, ot as RelationSource, p as DelegationInput, pn as SinkEvent, pr as Principal, pt as TokenFailureCause, q as DecisionProvider, qn as DeniedDecision, qt as LocalRowColumn, r as ApprovalMode, rn as AuthEvent, rr as Actor, rt as RelationChain, s as AssuranceRequirement, sn as DeliveryChannel, sr as CustomRole, st as SettingsSource, t as ActivationOption, tn as SnapshotScope, tr as TraceSkip, tt as MemberEntry, u as BreakGlassSpec, un as DirectoryEvent, ur as GnapAccess, ut as SourceMemo, v as GrantMeta, vn as Scope, vr as AdapterId, vt as VersionContext, w as ObligationInput, wn as PermissionApprover, wr as MemberOfParent, wt as SupportSessionPolicy, x as GrantValidity, xn as AnyOfApprover, xr as ConditionRef, xt as DecideSupportSessionOptions, y as GrantOptions, yn as ScopeDeclaration, yr as MembershipVia, yt as VersionQuery, z as SupportConsent, zn as plan, zt as credentialPolicyViolation } from "./policy-types-DGIO_gxq.js";
 import { A as RESOURCE_NAME, C as ResourceRelation, D as RowOf, E as ResourceXTree, M as AppData, N as AppDataSchema, O as PERMISSION_ROW, P as MetaValue, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, j as RESOURCE_X, k as POLICY_SCOPES, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-DEJ5j4mR.js";
-import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-BW_0MZOS.js";
+import { $ as resource, $t as opaque, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Cn as validateCustomRole, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, En as principal, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryVersionCache, H as breakGlass, Ht as MemoryVersionCacheOptions, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as memoryEntitlementSource, K as deny, Kt as APPROVAL_POLICY_UNAVAILABLE, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as sqlFunction, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as resolveCustomRole, St as SignSnapshotOptions, T as parseCloudEventBatch, Tn as context, Tt as snapshotClaims, U as supportAccess, Ut as VersionCache, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as VersionCacheStats, X as readable, Xt as memorySettingsSource, Y as crud, Yt as memoryMembershipSource, Z as writable, Zt as memorySnapshotSource, _ as DECISION_EVENT_SCHEMA, _n as CustomRoleValidation, _t as ArazzoSimulateInput, a as catalogFingerprint, an as RoleNameOf, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as customRoleClaim, bt as simulateArazzo, c as OCSF_VERSION, cn as separationConflicts, ct as ShadowMismatch, d as accessToOcsf, dn as fromSnapshot, dt as defineApp, en as findPermission, et as definePermissions, f as toOcsf, fn as parseSnapshot, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as CustomRoleRename, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as CustomRoleEntry, ht as ArazzoFinding, i as canonicalJson, in as mergePermissions, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as requiresApproval, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as CustomRoleDropReason, mt as localSnapshotManifest, n as delegatedPermissions, nn as isPermission, nt as snapshotFor, o as CSV_COLUMNS, on as definePolicy, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleDrop, pt as AppProfile, q as normalizeAssurance, qt as memoryCustomRoleSource, r as sha256Digest, rn as listPermissions, rt as CustomRoleReader, s as toCsvRow, sn as isRoleName, st as LegacyCheck, t as coveredByDelegation, tn as getResource, tt as SnapshotForOptions, u as OcsfUserManagement, un as emptySnapshot, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as ResolvedCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wn as claim, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as parseCustomRoleEntry, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as ValidateCustomRoleOptions, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-vYjMrXyK.js";
 import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-B6Sf4T_S.js";
-import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-Cmtxogd0.js";
-import { n as PermDockValidationError } from "./validation-error-YGg2mXyH.js";
-import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-CprAPN3w.js";
+import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-DVxlLZMe.js";
+import { n as PermDockValidationError } from "./validation-error-uvp-kyfO.js";
+import { a as ProblemDetails, c as requiredPlans, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-DlJE3gS_.js";
+import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./wrap-DxXB54Wu.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-BaUXHM1N.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
-import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-ChuiONQU.js";
-import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-DqEoWHBc.js";
-import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-Dvi7YZG_.js";
-import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-BIPIDa6a.js";
-import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
+import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Di9tiUvi.js";
+import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-C6Jg75xq.js";
+import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-B5zoUW_O.js";
+import { a as PlanNameOf, c as VocabularyOf, i as PermissionOf, n as OperationNameOf, s as ScopeNameOf } from "./type-helpers-c7Xo_2Cu.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
 import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-8Yx2CchM.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BQhTlLQS.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CCmbhnxP.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ActorKind, type AdapterId, type AnyOfApprover, type ApiKeyPrincipal, type AppData, type AppDataSchema, type AppObligation, type AppOptions, type AppProfile, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicies, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Automation, type AutomationDecision, type AutomationEvent, type AutomationMode, type AutomationRequest, type AutomationSource, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, type Capability, type CapabilityClaim, type CapabilityConfirmation, type CapabilityInput, type CapabilityOptions, type CapabilityPrincipal, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventOptions, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleContext, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleEntry, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSource, type CustomRoleSourceFactory, type CustomRoleSourceOptions, type CustomRoleValidation, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, type DecideAutomationOptions, type DecideCredentialOptions, type DecideIdsOptions, type DecideOptions, type DecideSupportSessionOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type Delegation, type DelegationInput, type DelegationTarget, type DeliveryChannel, type DeliveryEvent, type DeliveryFailureCause, type Denial, type DenialDetails, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, EVENT_SCHEMA_IDS, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EmailCategory, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantMeta, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type Intent, type JsonSchemaNode, type LegacyCheck, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type Limits, type LinkPolicy, type LinkPolicyViolation, type LoadedRows, type LocalCustomRoleTable, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotManifest, type LocalSnapshotRows, MEMBERSHIP_EVENT_SCHEMA, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MembershipVia, type MemoryAutomationSource, type MemoryDecisionSink, type MemoryDecisionSinkOptions, type MemoryEdge, type MemoryRelationSourceData, type MemoryVersionCacheOptions, type MetaValue, OCSF_VERSION, OPERATION_RISKS, type Obligation, type ObligationInput, type OcsfAuthorizeSession, type OcsfUserManagement, type Operation, type OperationData, type OperationDefinition, type OperationEffect, type OperationInput, type OperationMap, type OperationMeta, type OperationNameOf, type OperationRisk, type PERMISSION_ROW, type POLICY_SCOPES, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, type PermDockOverrides, PermDockRevokedError, PermDockValidationError, type PermDockWrap, type Permission, type PermissionApprover, type PermissionCheck, type PermissionKind, type PermissionOf, type PermissionTree, type PermissionsOf, type PermissionsOptions, type PermittedIdsOptions, type Plan, type PlanNameOf, type PlanTree, type Policy, type PolicyAppDataSchemas, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalIdentity, type PrincipalIdentityLink, type PrincipalOf, type PrincipalRelation, type PrincipalSource, type ProblemDetails, type Quota, RESERVED_CLOUD_EVENT_TYPES, type RESOURCE_NAME, type RESOURCE_X, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type RequestContext, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceMeta, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type ResourceXTree, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeCheck, type RoleChangeCheckInput, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleNameOf, type RoleOptions, type RoleRules, type RoleScope, type RoleTree, type RowData, type RowOf, type RowPair, SINK_EVENT_SCHEMAS, type Scope, type ScopeDeclaration, type ScopeNameOf, type ScopeNames, type SeparationConflict, type SettingsSource, type ShadowMismatch, type ShadowOptions, type SharedCustomRole, type SignDecisionBatchOptions, type SignPolicyDocumentOptions, type SignSnapshotOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotClaims, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SourceContext, type SourceMemo, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type SupportSession, type SupportSessionDecision, type SupportSessionPolicy, type SupportSessionRequest, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UncheckedData, type UserApprover, type ValidateCustomRoleOptions, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type VersionCache, type VersionCacheStats, type VersionContext, type VersionQuery, type Vocabulary, type VocabularyOf, type VocabularyOptions, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, type WireValidity, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
 import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
-import { A as memoryCustomRoleSource, C as stripeEntitlementSource, D as validateApprovalPolicy, E as memoryApprovalPolicySource, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as defineOperations, P as memorySnapshotSource, S as memoryLimitStore, _ as arazzoFindings, a as normalizeMembership, b as memoryRelationSource, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as approvalPolicies, x as limits, y as signPolicyDocument } from "./src-DZ0l9UAg.js";
+import { C as memoryLimitStore, D as memoryApprovalPolicySource, F as memorySnapshotSource, I as sqlFunction, M as memoryEntitlementSource, N as memoryMembershipSource, O as validateApprovalPolicy, P as memorySettingsSource, S as limits, T as approvalPolicies, _ as arazzoFindings, a as normalizeMembership, b as signPolicyDocument, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryCustomRoleSource, k as defineOperations, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as stripeEntitlementSource, x as memoryRelationSource, y as memoryVersionCache } from "./src-C_pi2Rnh.js";
 import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-B4r0N_Uz.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
@@ -20,19 +20,19 @@ import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
 import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CVXmRILq.js";
-import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
-import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot--JWiTrvO.js";
-import { t as whoCan } from "./who-can-rI7dCR9Q.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
+import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-DuWf1cT3.js";
+import { t as whoCan } from "./who-can-BoDJm0Nc.js";
 import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-DlCdCM_8.js";
 import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
 import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
 import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DEiCF4ah.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-BvjivVb9.js";
 import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-D9_vh372.js";
 import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-TcjRBgIs.js";
 import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-BqX94r07.js";
 import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CyyyvCsL.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-cE3A8aXq.js → init-BjuFDYT1.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{init-Dz_PsHdv.js → init-txYTuW9u.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-cE3A8aXq.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BjuFDYT1.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-cE3A8aXq.js");
+		const { runPreset } = await import("./init-BjuFDYT1.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-cE3A8aXq.js");
+		const { runPreset } = await import("./init-BjuFDYT1.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{instance-options-B0KXqTrJ.d.ts → instance-options-CoHn-0e8.d.ts}

@@ -1,4 +1,4 @@
-import { o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { o as PermDockOptions } from "./permdock-CprAPN3w.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**

package/dist/{instance-snapshot--JWiTrvO.js → instance-snapshot-DuWf1cT3.js}

@@ -13,7 +13,7 @@ import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
 import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-CLQ8__GF.js";
-import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
 import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
 import { t as buildSnapshot } from "./snapshot-CXlzi69u.js";
 //#region src/core/memberships.ts
@@ -73,8 +73,8 @@ function composeMemberships(sources) {
 	const versioned = sources.filter((source) => source.version !== void 0);
 	const rolesReaders = sources.filter((source) => source.globalRolesFor !== void 0);
 	return {
-		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal) {
-			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal) ?? [])), (lists) => [...new Set(lists.flat())]);
+		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal, context) {
+			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal, context) ?? [])), (lists) => [...new Set(lists.flat())]);
 		} },
 		membershipsFor(principal, options) {
 			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
@@ -96,8 +96,8 @@ function composeMemberships(sources) {
 				return [...seen.values()];
 			});
 		} },
-		...versioned.length === 0 ? {} : { version(principal) {
-			return then(all(versioned.map((source) => source.version?.(principal))), (versions) => {
+		...versioned.length === 0 ? {} : { version(principal, context) {
+			return then(all(versioned.map((source) => source.version?.(principal, context))), (versions) => {
 				const known = versions.filter((value) => typeof value === "number" && Number.isFinite(value));
 				return known.length === 0 ? void 0 : Math.max(...known);
 			});
@@ -112,16 +112,21 @@ function asMembershipSource(input) {
 * Trust the memberships the verified token carries, and read `source` only when
 * the token marks them truncated. With `version`, a token minted before the
 * latest membership change is stale for the policy's `fresh` permissions, or
-* with `onStale: 'reread'` has its memberships read from `source` instead.
+* with `onStale: 'reread'` has its memberships read from `source` instead. With
+* `versions`, an instance with intent `read` takes the version from that
+* process-wide cache, so concurrent instances share one read and a token issued
+* within its `maxStaleMs` needs none; intent `write` always reads.
 */
 function claimsFirst(source, options = {}) {
 	const inner = asMembershipSource(source);
-	const version = options.version ?? (inner.version === void 0 ? void 0 : (principal) => inner.version?.(principal));
+	const read = options.version ?? inner.version?.bind(inner);
+	const versions = options.versions;
+	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => versions.current(principal, () => read(principal, context), { live: context?.intent !== "read" });
 	return {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
 		...version === void 0 ? {} : { version },
-		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal) => inner.globalRolesFor?.(principal) ?? [] },
+		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal, context) => inner.globalRolesFor?.(principal, context) ?? [] },
 		...options.onStale === "reread" ? { onStale: "reread" } : {},
 		claimsFirst: true
 	};

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Y as JwtClaims, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, pt as VerifiedToken, sr as Principal, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-ChuiONQU.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DjuMBNF9.js";
-import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
+import { Z as JwtClaims, _t as VerifiedToken, hr as Subject, ht as TokenVerifier, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DsHGPtkR.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /**

package/dist/jwt/index.js

@@ -6,7 +6,7 @@ import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-BqX94r07.js";
 import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as loadJose } from "../load-jose-DZ4dnjri.js";
-import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-BNWCJtmP.js";
+import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-C-nv08_n.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 //#region src/jwt/dpop.ts
 const DPOP_WINDOW_SECONDS = 60;