permdock 0.15.0 → 0.17.0

package/dist/{manifest-CbEyvPN2.js → manifest-Dij1U0hx.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-Buibrl9h.js")).init
+				load: async () => (await import("./init-Dr1qAStu.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Buibrl9h.js")).presetDecode
+				load: async () => (await import("./init-Dr1qAStu.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Buibrl9h.js")).presetUrl
+				load: async () => (await import("./init-Dr1qAStu.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BIsm1n26.js")).install
+					load: async () => (await import("./skills-a4N6Y2Xm.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BIsm1n26.js")).update
+					load: async () => (await import("./skills-a4N6Y2Xm.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-BIsm1n26.js")).list
+					load: async () => (await import("./skills-a4N6Y2Xm.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-gIO9WTYo.js")).doctor
+				load: async () => (await import("./doctor-BNRhJegR.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-DCza8aQY.js")).completion
+				load: async () => (await import("./completion-pwVjJlek.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-DnXL4B8c.js")).collect
+				load: async () => (await import("./collect-C44RrKCI.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-amPDr0JQ.js")).catalog
+				load: async () => (await import("./catalog-DJJIkR9P.js")).catalog
 			}),
 			leaf("gen", "Write typed constants, schemas, factories, hooks and messages from the policy", {
 				examples: [
@@ -124,7 +124,7 @@ const SECTIONS = [
 				docs: "gen",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./gen-DwgCSC6V.js")).gen
+				load: async () => (await import("./gen-CNCzG4sB.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -132,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-DBNrpwoT.js")).usage
+				load: async () => (await import("./usage-CqcMeQgX.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CxtbOi2l.js")).diff
+				load: async () => (await import("./diff-CcxYooMu.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-BAM3a3z8.js")).config
+				load: async () => (await import("./config-DnfH6_eT.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-yK2nZUcm.js")).generate
+					load: async () => (await import("./rls-BVzoZCn3.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-yK2nZUcm.js")).importPolicies
+					load: async () => (await import("./rls-BVzoZCn3.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-yK2nZUcm.js")).verify
+					load: async () => (await import("./rls-BVzoZCn3.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-yK2nZUcm.js")).migrate
+					load: async () => (await import("./rls-BVzoZCn3.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-yK2nZUcm.js")).explain
+					load: async () => (await import("./rls-BVzoZCn3.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-DYWnT800.js")).hookGenerate
+				load: async () => (await import("./supabase-C6FyUeSh.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-DYWnT800.js")).inspect
+				load: async () => (await import("./supabase-C6FyUeSh.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-CFWILHjb.js")).generate
+				load: async () => (await import("./powersync-BZxw_v-A.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-CFWILHjb.js")).verify
+				load: async () => (await import("./powersync-BZxw_v-A.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -235,7 +235,7 @@ const SECTIONS = [
 				docs: "scim",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./scim-D8YupzX1.js")).generate
+				load: async () => (await import("./scim-CovliQUg.js")).generate
 			})])
 		]
 	},
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-eHZ5hwUJ.js")).emit
+				load: async () => (await import("./openapi-D3wkvOoU.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-eHZ5hwUJ.js")).importDocument
+				load: async () => (await import("./openapi-D3wkvOoU.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-CL8CZnpL.js")).check
+				load: async () => (await import("./arazzo-7kbeh1yi.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,21 +269,21 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-CzdMtHnq.js")).scan
+				load: async () => (await import("./scan-CepUXrFt.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
 				docs: "casl",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casl-C4OINZHI.js")).caslImport
+				load: async () => (await import("./casl-CjBVJj8R.js")).caslImport
 			})]),
 			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
 				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-DRFwgVIP.js")).casbinImport
+				load: async () => (await import("./casbin-DFzk_so3.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-VVpkkund.js")).login
+				load: async () => (await import("./login-DEVXDTX8.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-VVpkkund.js")).logout
+				load: async () => (await import("./login-DEVXDTX8.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-VVpkkund.js")).whoami
+				load: async () => (await import("./login-DEVXDTX8.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-eOtmuonF.js")).push
+				load: async () => (await import("./cloud-DYqzmh5i.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-eOtmuonF.js")).pull
+				load: async () => (await import("./cloud-DYqzmh5i.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-D6NYu4AK.js")).codemod
+			load: async () => (await import("./codemod-DqB9klYI.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-DCza8aQY.js")).complete
+	load: async () => (await import("./completion-pwVjJlek.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{map-claims-C-nv08_n.js → map-claims-PQwHynxV.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey, o as readPath } from "./paths-CUvURzHp.js";
 import { n as expirySeconds } from "./expiry-6XByK0dm.js";
 import { r as validateRecord } from "./thenable-BNSM1U2R.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 import { t as readClaim } from "./claims-map-CKkoAAYF.js";
 import { t as clientNameOf } from "./clients-DYr3U86j.js";
 //#region src/jwt/map-claims.ts
@@ -107,7 +107,8 @@ function bindingOf(claims) {
 function membershipsFromGroups(groups, groupRoles, tenant) {
 	if (tenant === void 0) return [];
 	return groups.map((group) => compact({
-		tenant,
+		scope: "tenant",
+		id: tenant,
 		roles: groupRoles?.[group] ?? [],
 		via: `group:${group}`
 	}));
@@ -142,18 +143,29 @@ function membershipsFromClaim(value) {
 		roles: asStringArray(record["roles"]),
 		...claimExtras(record)
 	})];
-	if (typeof record["tenant"] === "string" || typeof record["org_id"] === "string") return [compact({
-		tenant: typeof record["tenant"] === "string" ? record["tenant"] : String(record["org_id"]),
-		roles: asStringArray(record["roles"]),
-		team: typeof record["team"] === "string" ? record["team"] : void 0,
-		...claimExtras(record)
-	})];
+	if (typeof record["tenant"] === "string" || typeof record["org_id"] === "string") {
+		const tenant = typeof record["tenant"] === "string" ? record["tenant"] : String(record["org_id"]);
+		const located = typeof record["team"] === "string" ? {
+			scope: "team",
+			id: record["team"],
+			within: { tenant }
+		} : {
+			scope: "tenant",
+			id: tenant
+		};
+		return [compact({
+			...located,
+			roles: asStringArray(record["roles"]),
+			...claimExtras(record)
+		})];
+	}
 	const out = [];
 	const byOrganisation = /* @__PURE__ */ new Map();
 	for (const [tenant, entry] of Object.entries(record)) {
 		if (Array.isArray(entry)) {
 			out.push(compact({
-				tenant,
+				scope: "tenant",
+				id: tenant,
 				roles: asStringArray(entry)
 			}));
 			continue;
@@ -169,13 +181,15 @@ function membershipsFromClaim(value) {
 				continue;
 			}
 			out.push(compact({
-				tenant,
+				scope: "tenant",
+				id: tenant,
 				roles: asStringArray(nested["roles"] ?? nested)
 			}));
 		}
 	}
 	for (const [tenant, roles] of byOrganisation) out.push({
-		tenant,
+		scope: "tenant",
+		id: tenant,
 		roles
 	});
 	return out;

package/dist/{map-error-pasIGqMT.js → map-error-B_f3C5cs.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
 import { a as decisionResponse, l as problemResponse } from "./problem-BVLHFK33.js";
-import { l as InvalidSignatureError } from "./evaluations-IBceAeKT.js";
+import { l as InvalidSignatureError } from "./evaluations-DG40eSJa.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { T as Policy, Z as JwtClaims, hr as Subject, ht as TokenVerifier, lr as Delegation, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, Q as JwtClaims, _r as Principal, _t as TokenVerifier, pr as Delegation, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { t as ApprovalHint } from "../errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { m as ApprovalStore } from "../types-BvBbkAu1.js";
+import { t as ApprovalHint } from "../errors-Dc9FdamT.js";
+import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
-import { o as OtelWrap } from "../types-B6ExllNo.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DHldhVUv.js";
+import { n as PermDockWrap } from "../wrap-DpZAbxuD.js";
+import { o as OtelWrap } from "../types-Sj1U8HMm.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DyzWwxEB.js";
 import { t as ClientNames } from "../clients-C_NOET3z.js";
-import { U as JwtSubjectOptions } from "../types-DsHGPtkR.js";
+import { U as JwtSubjectOptions } from "../types-CJC1aaoJ.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /**

package/dist/mcp/index.js

@@ -1,21 +1,21 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { i as stepUpOf, o as statusProblem } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { m as annotationsFor } from "../permission-registry-B8tYxPIt.js";
-import { t as actorMayCallTool } from "../delegation-CDB6_keF.js";
+import { t as actorMayCallTool } from "../delegation-aK4T_5WU.js";
+import { t as anonymousSubject } from "../subject-C7RddW0G.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BvjivVb9.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { t as composeWraps } from "../wrap-B2wziJI_.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-DdzMv5-F.js";
+import { t as composeWraps } from "../wrap-C5PWzgkq.js";
 import { l as problemResponse, o as methodNotAllowed, r as bearerChallenge, u as protectedResourceMetadataUrl } from "../problem-BVLHFK33.js";
 import { t as clientNameOf } from "../clients-DYr3U86j.js";
-import { r as mapClaimsToSubject } from "../map-claims-C-nv08_n.js";
-import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
-import { i as refusalText, n as createAgentKernel } from "../kernel-BD8QuMnv.js";
+import { r as mapClaimsToSubject } from "../map-claims-PQwHynxV.js";
+import { r as instanceOptions } from "../build-instance-lye7oEqf.js";
+import { i as refusalText, n as createAgentKernel } from "../kernel-CDDU93dI.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-C1UlhU0V.js";
 //#region src/mcp/mcp-auth.ts
 /**
 * `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an

package/dist/{migrate-BJHxQqT5.js → migrate-BbY5-Khy.js}

@@ -1,13 +1,13 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import "./sources-C4vkzZJV.js";
 import { a as RETIRE_MARKER } from "./markers-BeHZ4x9Q.js";
-import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
-import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-BIQ_9pIs.js";
-import { r as HELPERS } from "./shared-DrGLwM3s.js";
+import { i as refuseDirty, t as applyFiles } from "./files-CfiRtQ-m.js";
+import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-CM0BnH05.js";
+import { r as HELPERS } from "./shared-DyYVEjKC.js";
 import { o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { i as retireSql, r as retirePlan } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{module-values-B1EVTkHP.js → module-values-B8tNIxdd.js}

@@ -1,6 +1,6 @@
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
-import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
 import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-tsxHx71E.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";

package/dist/nest/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
 import { r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts

package/dist/nest/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { c as writeReply, r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { a as socketConnection, r as bindKernel } from "../bind-BJFeLX1V.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-DH94eh6f.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";

package/dist/next/index.d.ts

@@ -1,13 +1,14 @@
-import { Kn as DenialReason, T as Policy, Un as Decision, X as Intent, Zt as Snapshot, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, Xn as DenialReason, Z as Intent, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
-import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
-import { o as OtelWrap } from "../types-B6ExllNo.js";
-import { n as DescribeMessages } from "../describe-BbFPBSms.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { O as PermissionCheck, a as PermDock, d as UncheckedData, k as PermissionState, s as RowData } from "../permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "../types-BvBbkAu1.js";
+import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
+import { n as PermDockWrap } from "../wrap-DpZAbxuD.js";
+import { o as OtelWrap } from "../types-Sj1U8HMm.js";
+import { n as DescribeMessages } from "../describe-nalX_HHE.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotKey, r as SnapshotHeadersOptions, s as snapshotTag, t as CacheLifeForOptions } from "../snapshot-cache-Dbk-Gnij.js";
+import { v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { n as PermDockProviderProps } from "../types-e82uzrTn.js";
 import { ReactElement, ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/types.d.ts
@@ -52,6 +53,11 @@ type GetSnapshotQuery = GetPermDockQuery & {
    * tag.
    */
   readonly tags?: readonly string[];
+  /**
+   * `cacheLifeFor` options; `{ capToToken: true }` caps the entry at the
+   * token's expiry. Default 300 seconds.
+   */
+  readonly cacheLife?: CacheLifeForOptions;
 };
 type PermissionRequirementOptions = GetPermDockQuery & {
   /**
@@ -82,7 +88,12 @@ type NextPermDockProviderProps = NextPermDockProviderDisplay & ({
   })[];
   readonly tenants?: "all";
 });
-type NextPermDockProviderDisplay = {
+/**
+ * Function props of the React provider: a Server Component cannot pass them to
+ * the client, so `useRefreshOn` from `permdock/react` adds triggers instead.
+ */
+type ClientOnlyProp = "fetch" | "verifier" | "onSnapshot" | "onClear" | "refreshOn";
+type NextPermDockProviderDisplay = Omit<PermDockProviderProps, "snapshot" | "snapshotPromise" | "children" | "defaults" | "messages" | ClientOnlyProp> & {
   readonly children: ReactNode;
   readonly tenant?: string;
   /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
@@ -139,10 +150,18 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
     <D>(permission: Permission, data?: UncheckedData<D>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
     <P extends Permission>(permission: P, data?: RowData<P>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
   };
+  /**
+   * One `{ allowed, outcome, reason? }` per named check, from one instance:
+   * frozen plain JSON an island can return from `'use cache: private'`. A check
+   * that throws denies its entry; an instance that cannot be built denies them
+   * all.
+   */
+  readonly getPermissions: <K extends string>(checks: Readonly<Record<K, PermissionCheck>>, query?: GetPermDockQuery) => Promise<Readonly<Record<K, PermissionState>>>;
   /**
    * The session's snapshot for a `'use cache: private'` function the app owns:
-   * calls `cacheLife(cacheLifeFor(snapshot))` and `cacheTag(snapshotTag(sub),
-   * ...tags)` in that scope, and throws outside one.
+   * calls `cacheLife(cacheLifeFor(snapshot, query.cacheLife))` and
+   * `cacheTag(snapshotTag(sub), ...tags)` in that scope, and throws outside
+   * one.
    */
   readonly getSnapshot: (query?: GetSnapshotQuery) => Promise<Snapshot>;
   /**
@@ -176,4 +195,4 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 //#region src/next/create.d.ts
 export declare function createPermDock<TUser = NextSubjectInput, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: NextPermDockOptions<TUser>): NextPermDock<V>;
 //#endregion
-export { type ActionResult, type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ProtectAction, type ProtectActionOptions, type ProtectedAction, type ProtectedActionContext, type ProtectedActionHandler, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotTag };
+export { type ActionResult, type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ProtectAction, type ProtectActionOptions, type ProtectedAction, type ProtectedActionContext, type ProtectedActionHandler, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotKey, snapshotTag };