@owlmeans/server-iam 0.1.18-rc.53 → 0.1.18-rc.54

package/README.md

@@ -14,7 +14,7 @@ One-call OIDC RP wiring and IAM gate for OwlMeans servers — `appendIam()` and
 ## Installation
 
 ```bash
-bun add @owlmeans/server-iam@^0.1.18-rc.53
+bun add @owlmeans/server-iam@^0.1.18-rc.54
 ```
 
 ## Usage
@@ -47,7 +47,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.45
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-iam",
-  "version": "0.1.18-rc.53",
-  "generatedAt": "2026-10-01T23:27:48.727Z",
+  "version": "0.1.18-rc.54",
+  "generatedAt": "2026-10-03T11:19:50.777Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-iam/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 
 # Using `@owlmeans/server-iam`
 
-**Install:** `"@owlmeans/server-iam": "^0.1.18-rc.53"` in `dependencies`
+**Install:** `"@owlmeans/server-iam": "^0.1.18-rc.54"` in `dependencies`
 
 Boilerplate-less server-side consumer of the OwlMeans IAM. One call wires the OIDC RP stack and the
 IAM gate; the consumer never knows which IAM backend (Keycloak or integrated) is active. For a
@@ -109,12 +109,9 @@ await ctx.service<GateService>(OIDC_GATE).assert(req, res, ['article--modify'])
    from `@owlmeans/server-oidc-rp` (`createGateModel().loadPermissions`) — exactly the check
    `makeOidcGate` performs, which is what a Keycloak-backed deployment gets.
 
-In claims mode the four permission kinds (`iam` skill, "Permission kinds") are all decided locally:
-an unbound set applies everywhere, a set bound to an organization (`entitySlug`) only in that one, a
-set with `resources` only for those ids. The relying party already strips the binding of the acting
-organization's sets and drops every other bound set, so a bound set reaching the gate is a leak —
-and `hasPermission` refuses it unless the request acts in exactly its organization, including when
-nothing names an organization at all.
+In claims mode all four permission kinds (`iam` skill, "Permission kinds") are decided locally by
+`hasPermission`; a bound set reaching the gate is a leak the relying party should have stripped, and
+it counts only when the request acts in exactly its organization.
 
 Which branch runs is decided per request by the token alone: a conforming `permissions` claim selects
 claims mode, its absence selects the fallback. Nothing configures it, and there is no environment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-iam",
-  "version": "0.1.18-rc.53",
+  "version": "0.1.18-rc.54",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,14 +22,14 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.37",
+    "@owlmeans/auth": "^0.1.18-rc.38",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.38",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
     "@owlmeans/error": "^0.1.18-rc.36",
-    "@owlmeans/iam": "^0.1.18-rc.46",
-    "@owlmeans/oidc": "^0.1.18-rc.51",
-    "@owlmeans/server-context": "^0.1.18-rc.39",
-    "@owlmeans/server-oidc-rp": "^0.1.18-rc.51"
+    "@owlmeans/iam": "^0.1.18-rc.47",
+    "@owlmeans/oidc": "^0.1.18-rc.52",
+    "@owlmeans/server-context": "^0.1.18-rc.40",
+    "@owlmeans/server-oidc-rp": "^0.1.18-rc.52"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",