permdock 0.16.0 → 0.17.0

package/dist/index.js

@@ -1,10 +1,10 @@
 import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
-import { C as memoryLimitStore, D as memoryApprovalPolicySource, F as memorySnapshotSource, I as sqlFunction, M as memoryEntitlementSource, N as memoryMembershipSource, O as validateApprovalPolicy, P as memorySettingsSource, S as limits, T as approvalPolicies, _ as arazzoFindings, a as normalizeMembership, b as signPolicyDocument, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryCustomRoleSource, k as defineOperations, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as stripeEntitlementSource, x as memoryRelationSource, y as memoryVersionCache } from "./src-C_pi2Rnh.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-B4r0N_Uz.js";
+import { a as deny, n as role, p as opaque, r as allow, t as normalizeAssurance } from "./role-builder-BrmOcXch.js";
+import { A as defineOperations, C as limits, E as approvalPolicies, F as memorySettingsSource, I as memorySnapshotSource, L as sqlFunction, M as memoryCustomRoleSource, N as memoryEntitlementSource, O as memoryApprovalPolicySource, P as memoryMembershipSource, S as memoryRelationSource, T as stripeEntitlementSource, _ as arazzoFindings, a as normalizeMembership, b as instanceCache, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, k as validateApprovalPolicy, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as memoryLimitStore, x as signPolicyDocument, y as memoryVersionCache } from "./src-nYNBfmgq.js";
+import { d as manager, f as user, n as anyOf, o as holder, t as allOf } from "./approvers-CNtl4Vc5.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-CogP1loh.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
@@ -14,25 +14,27 @@ import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomatio
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 import { n as parseSupportSession, t as decideSupportSession } from "./support-session-BsmPCbz8.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Dke-9rd1.js";
-import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-CLQ8__GF.js";
+import { a as normalizeApproval } from "./approval-normalize-4KxMRdJC.js";
+import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-DxQyHKPB.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-tPZnyjQS.js";
 import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CVXmRILq.js";
-import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-DuWf1cT3.js";
-import { t as whoCan } from "./who-can-BoDJm0Nc.js";
-import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
-import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-DlCdCM_8.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-CsjXeLRo.js";
+import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot-BgOGtyCy.js";
+import { t as approvalFingerprint } from "./token-DaMnIU9O.js";
+import { t as whoCan } from "./who-can-BY5d3HPw.js";
+import { n as parseSnapshot } from "./snapshot-DN_8J27z.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-BKrqUDVk.js";
 import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
 import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DEiCF4ah.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-BvjivVb9.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
 import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-D9_vh372.js";
 import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-TcjRBgIs.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-BqX94r07.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CyyyvCsL.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-zN6T9fxe.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-B3Hj4puZ.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalFingerprint, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, instanceCache, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, manager, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, memoryVersionCache, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-C6cWP3xW.js → init-Dr1qAStu.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-BjLzeFpp.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-pPrVyGU5.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-DXjoTVbS.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BUo2G-FI.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-YSDySeMy.js"), import("./peer-n-swIV4H.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BUo2G-FI.js");
+		const { runPreset } = await import("./init-YSDySeMy.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BUo2G-FI.js");
+		const { runPreset } = await import("./init-YSDySeMy.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-BUo2G-FI.js → init-YSDySeMy.js}

@@ -1,8 +1,8 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { t as addLine } from "./peer-Q0fuZ6hx.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-pPrVyGU5.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { t as addLine } from "./peer-BuK9F53f.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts

package/dist/{instance-options-CoHn-0e8.d.ts → instance-options-BOCRxEFb.d.ts}

@@ -1,6 +1,6 @@
-import { o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { o as PermDockOptions } from "./permdock-DUWZEOLR.js";
 //#region src/core/instance-options.d.ts
-type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
+type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals" | "instances";
 /**
  * The data sources an adapter passes through to every instance it creates. Each
  * adapter's options type extends this, so a source added to core reaches every

package/dist/{instance-snapshot-DuWf1cT3.js → instance-snapshot-BgOGtyCy.js}

@@ -7,15 +7,15 @@ import { n as isThenable } from "./thenable-BNSM1U2R.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { p as nowSeconds, s as instantAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-CDB6_keF.js";
+import { c as rootScope, d as scopeList, i as keepsPermission, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-aK4T_5WU.js";
 import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-CLQ8__GF.js";
-import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
-import { t as buildSnapshot } from "./snapshot-CXlzi69u.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-DxQyHKPB.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-CsjXeLRo.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-BP-k4vRJ.js";
+import { t as buildSnapshot } from "./snapshot-DN_8J27z.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -25,8 +25,6 @@ function identity(membership) {
 		membership.id ?? null,
 		within,
 		membership.on ?? null,
-		membership.tenant ?? null,
-		membership.team ?? null,
 		membership.via ?? null,
 		membership.expiresAt ?? null,
 		membership.grantedBy ?? null,
@@ -114,14 +112,19 @@ function asMembershipSource(input) {
 * latest membership change is stale for the policy's `fresh` permissions, or
 * with `onStale: 'reread'` has its memberships read from `source` instead. With
 * `versions`, an instance with intent `read` takes the version from that
-* process-wide cache, so concurrent instances share one read and a token issued
-* within its `maxStaleMs` needs none; intent `write` always reads.
+* process-wide cache, so concurrent instances share one read; a token's
+* `authz_ver` seeds it dated by `iat`, so a token issued within its
+* `maxStaleMs` needs none. Intent `write` always reads.
 */
 function claimsFirst(source, options = {}) {
 	const inner = asMembershipSource(source);
 	const read = options.version ?? inner.version?.bind(inner);
 	const versions = options.versions;
-	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => versions.current(principal, () => read(principal, context), { live: context?.intent !== "read" });
+	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => {
+		const live = context?.intent !== "read";
+		if (!live && typeof principal.authzVersion === "number") versions.seed(principal.id, principal.authzVersion, instantAt(principal.issuedAt ?? 0));
+		return versions.current(principal, () => read(principal, context), { live });
+	};
 	return {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Z as JwtClaims, _t as VerifiedToken, hr as Subject, ht as TokenVerifier, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DsHGPtkR.js";
-import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { Q as JwtClaims, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, ht as TokenFailureCause, yr as Subject, yt as VerifiedToken } from "../policy-types-IRJVABmm.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BzjWdKmP.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-CJC1aaoJ.js";
+import { t as memoryReplayStore } from "../replay-Dc3d8LhG.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /**

package/dist/jwt/index.js

@@ -2,11 +2,11 @@ import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { o as epochSeconds, p as nowSeconds } from "../time-nR1JesoH.js";
 import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-BqX94r07.js";
+import { t as anonymousSubject } from "../subject-C7RddW0G.js";
+import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-zN6T9fxe.js";
 import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as loadJose } from "../load-jose-DZ4dnjri.js";
-import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-C-nv08_n.js";
+import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-PQwHynxV.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 //#region src/jwt/dpop.ts
 const DPOP_WINDOW_SECONDS = 60;

package/dist/{kernel-BD8QuMnv.js → kernel-CDDU93dI.js}

@@ -1,17 +1,17 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { i as stepUpOf } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-CogP1loh.js";
 import { a as deniedMessage } from "./errors-B6R_lg2a.js";
-import { t as actorMayCallTool } from "./delegation-CDB6_keF.js";
-import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { k as activate } from "./evaluate-BAmf_AQd.js";
+import { t as actorMayCallTool } from "./delegation-aK4T_5WU.js";
+import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { k as activate } from "./evaluate-CsjXeLRo.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as delegationAllows } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-BvjivVb9.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DJicaG6f.js";
-import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
+import { n as delegationAllows } from "./where-scope-BKrqUDVk.js";
+import { l as withApp } from "./permdock-DdzMv5-F.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DNnZffrI.js";
+import { n as resolveOrNull } from "./build-instance-lye7oEqf.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-OHikyRqV.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-Ch052blg.js";
 //#region src/agent/denied-text.ts
 /**
 * The hook's text, or `event.text` when there is no hook or it throws or

package/dist/kysely/index.d.ts

@@ -1,7 +1,7 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { f as WhereResult } from "../permdock-DUWZEOLR.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
+import { s as MembershipsMapping } from "../compile-BxiwRotu.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/kysely/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
-import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { n as compileWhere, r as escapeLike } from "../compile-B_oJqmIg.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/kysely/to-where.ts
 function ident(name) {

package/dist/{load-DjSU5KXO.js → load-BaEamml-.js}

@@ -1,5 +1,5 @@
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";

package/dist/load-CjnlPxpL.js

@@ -0,0 +1 @@
+export { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";

package/dist/{login-D1MHOomI.js → login-CXgEKLaW.js}

@@ -1,11 +1,11 @@
 import { h as secondsAt, i as dateAt, s as instantAt } from "./time-nR1JesoH.js";
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { n as httpRequest } from "./http-DOL33cO0.js";
-import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { n as httpRequest } from "./http-DhMWeB_h.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-j3Eu-j4h.js";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 //#region src/cli/cloud/loopback.ts

package/dist/{login-DCKE5pVy.js → login-DEVXDTX8.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-DXjoTVbS.js";
+import { c as given } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/login.ts
 const urlFlag = { url: {
 	type: "string",
@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-D1MHOomI.js");
+		const { runLogin } = await import("./login-CXgEKLaW.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-D1MHOomI.js");
+		const { runLogout } = await import("./login-CXgEKLaW.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-D1MHOomI.js");
+		const { runWhoami } = await import("./login-CXgEKLaW.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,