permdock 0.16.0 → 0.18.0

package/dist/next/index.d.ts

@@ -1,13 +1,14 @@
-import { Kn as DenialReason, T as Policy, Un as Decision, X as Intent, Zt as Snapshot, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, Xn as DenialReason, Z as Intent, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
-import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
-import { o as OtelWrap } from "../types-B6ExllNo.js";
-import { n as DescribeMessages } from "../describe-BbFPBSms.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { A as PermissionState, a as PermDock, d as UncheckedData, k as PermissionCheck, s as RowData } from "../permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
+import { n as PermDockWrap } from "../wrap-BHGA-SMM.js";
+import { o as OtelWrap } from "../types-DGf_cpKF.js";
+import { n as DescribeMessages } from "../describe-BKtC_8PG.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotKey, r as SnapshotHeadersOptions, s as snapshotTag, t as CacheLifeForOptions } from "../snapshot-cache-B4YvlGG_.js";
+import { v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { n as PermDockProviderProps } from "../types-DmbfLu2p.js";
 import { ReactElement, ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/types.d.ts
@@ -31,6 +32,14 @@ type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
    * those checks are denied with reason `server-only`.
    */
   readonly endpoint?: string | false;
+  /**
+   * The principal's authorization version this request already read, such as
+   * `bsb.bootstrap()`'s `authzVersion`. Called once per request; a read-intent
+   * instance takes it as `version: { known }` and skips the version read. A
+   * write-intent instance, `protectAction` included, reads the version live.
+   * Anything but a non-negative integer, or a throw, reads it as usual.
+   */
+  readonly version?: () => number | null | undefined | Promise<number | null | undefined>;
 };
 type GetPermDockQuery = {
   readonly tenant?: string;
@@ -41,6 +50,11 @@ type GetPermDockQuery = {
    * version live.
    */
   readonly intent?: Intent;
+  /**
+   * The known authorization version for this call, in place of the `version`
+   * option. Read intent only.
+   */
+  readonly version?: number;
 };
 type GetSnapshotQuery = GetPermDockQuery & {
   readonly include?: readonly (Permission | {
@@ -52,6 +66,11 @@ type GetSnapshotQuery = GetPermDockQuery & {
    * tag.
    */
   readonly tags?: readonly string[];
+  /**
+   * `cacheLifeFor` options; `{ capToToken: true }` caps the entry at the
+   * token's expiry. Default 300 seconds.
+   */
+  readonly cacheLife?: CacheLifeForOptions;
 };
 type PermissionRequirementOptions = GetPermDockQuery & {
   /**
@@ -82,7 +101,12 @@ type NextPermDockProviderProps = NextPermDockProviderDisplay & ({
   })[];
   readonly tenants?: "all";
 });
-type NextPermDockProviderDisplay = {
+/**
+ * Function props of the React provider: a Server Component cannot pass them to
+ * the client, so `useRefreshOn` from `permdock/react` adds triggers instead.
+ */
+type ClientOnlyProp = "fetch" | "verifier" | "onSnapshot" | "onClear" | "refreshOn";
+type NextPermDockProviderDisplay = Omit<PermDockProviderProps, "snapshot" | "snapshotPromise" | "children" | "defaults" | "messages" | ClientOnlyProp> & {
   readonly children: ReactNode;
   readonly tenant?: string;
   /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
@@ -139,10 +163,18 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
     <D>(permission: Permission, data?: UncheckedData<D>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
     <P extends Permission>(permission: P, data?: RowData<P>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
   };
+  /**
+   * One `{ allowed, outcome, reason? }` per named check, from one instance:
+   * frozen plain JSON an island can return from `'use cache: private'`. A check
+   * that throws denies its entry; an instance that cannot be built denies them
+   * all.
+   */
+  readonly getPermissions: <K extends string>(checks: Readonly<Record<K, PermissionCheck>>, query?: GetPermDockQuery) => Promise<Readonly<Record<K, PermissionState>>>;
   /**
    * The session's snapshot for a `'use cache: private'` function the app owns:
-   * calls `cacheLife(cacheLifeFor(snapshot))` and `cacheTag(snapshotTag(sub),
-   * ...tags)` in that scope, and throws outside one.
+   * calls `cacheLife(cacheLifeFor(snapshot, query.cacheLife))` and
+   * `cacheTag(snapshotTag(sub), ...tags)` in that scope, and throws outside
+   * one.
    */
   readonly getSnapshot: (query?: GetSnapshotQuery) => Promise<Snapshot>;
   /**
@@ -176,4 +208,4 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 //#region src/next/create.d.ts
 export declare function createPermDock<TUser = NextSubjectInput, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: NextPermDockOptions<TUser>): NextPermDock<V>;
 //#endregion
-export { type ActionResult, type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ProtectAction, type ProtectActionOptions, type ProtectedAction, type ProtectedActionContext, type ProtectedActionHandler, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotTag };
+export { type ActionResult, type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ProtectAction, type ProtectActionOptions, type ProtectedAction, type ProtectedActionContext, type ProtectedActionHandler, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotKey, snapshotTag };

package/dist/next/index.js

@@ -3,13 +3,15 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { o as statusProblem, t as notFoundDetails } from "../problem-details-CLDgX1KV.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { a as permissionStates } from "../checks-fyDOhcz0.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
+import { n as wrapPermDock } from "../wrap-C5PWzgkq.js";
 import { i as decisionProblem } from "../problem-BVLHFK33.js";
-import { s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
-import { _ as LOAD_FAILED, o as evaluationsHandler, v as NO_GRANT } from "../evaluations-IBceAeKT.js";
+import { s as resumeDecision } from "../helpers-DmqGy63f.js";
+import { i as snapshotTag, n as snapshotHeaders, r as snapshotKey, t as cacheLifeFor } from "../snapshot-cache-B66h7FBK.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BFMFQdE_.js";
+import { n as NO_GRANT, t as LOAD_FAILED } from "../decision-CaG5_eNJ.js";
+import { o as evaluationsHandler } from "../evaluations-h3KoJAPa.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
 import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
@@ -113,16 +115,10 @@ function protectActionOf(deps) {
 //#endregion
 //#region src/next/provider.tsx
 function renderClientProvider(options) {
+	const { children, ...props } = options;
 	return /* @__PURE__ */ jsx(PermDockProvider, {
-		...compact({
-			snapshotPromise: options.snapshotPromise,
-			endpoint: options.endpoint,
-			tenant: options.tenant,
-			suspend: options.suspend,
-			defaults: options.defaults,
-			messages: options.messages
-		}),
-		children: options.children
+		...compact(props),
+		children
 	});
 }
 //#endregion
@@ -148,6 +144,16 @@ function defer(task) {
 		return false;
 	}
 }
+/** Read through `globalThis` so the entry loads on runtimes without `process`. */
+function knownVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function isDevelopment() {
+	const proc = Reflect.get(globalThis, "process");
+	if (typeof proc !== "object" || proc === null) return false;
+	const env = Reflect.get(proc, "env");
+	return typeof env === "object" && env !== null && Reflect.get(env, "NODE_ENV") === "development";
+}
 function ignore() {}
 /**
 * Keeps the function alive until the sink has written and flushed: every
@@ -184,7 +190,17 @@ function createPermDock(policy, given) {
 		return wrapInstance(options.wrap === void 0 ? traced : options.wrap(traced), options.onDenied);
 	};
 	const resolveFallbackTenant = cache(() => readTenant(options.tenant));
-	const instantiate = cache(async (tenantKey, intent) => {
+	const resolveVersion = cache(async () => {
+		const read = options.version;
+		if (read === void 0) return;
+		try {
+			return knownVersion(await read());
+		} catch (error) {
+			unstable_rethrow(error);
+			return;
+		}
+	});
+	const instantiate = cache(async (tenantKey, intent, known) => {
 		const tenant = tenantKey === "" ? void 0 : tenantKey;
 		const user = await resolveSubject();
 		await io();
@@ -195,14 +211,17 @@ function createPermDock(policy, given) {
 			scope: {
 				tenant,
 				sink,
-				intent
+				intent,
+				version: known === void 0 ? void 0 : { known }
 			},
 			wrap: decorate
 		})).permdock;
 	});
 	const getPermDock = async (query) => {
 		const tenant = query?.tenant ?? await resolveFallbackTenant();
-		return instantiate(tenant ?? "", query?.intent ?? "read");
+		const intent = query?.intent ?? "read";
+		const known = intent === "read" ? knownVersion(query?.version) ?? await resolveVersion() : void 0;
+		return instantiate(tenant ?? "", intent, known);
 	};
 	const getPermission = async (permission, data, query) => {
 		try {
@@ -221,14 +240,34 @@ function createPermDock(policy, given) {
 			};
 		}
 	};
+	const getPermissions = async (checks, query) => {
+		let permdock;
+		try {
+			permdock = await getPermDock(query);
+		} catch (error) {
+			unstable_rethrow(error);
+		}
+		if (permdock === void 0) return permissionStates(() => NO_GRANT, checks);
+		const decide = permdock.decide;
+		return permissionStates(decide, checks);
+	};
+	let warnedShortLife = false;
 	const getSnapshot = async (query = {}) => {
-		const permdock = await getPermDock(compact({ tenant: query.tenant }));
+		const permdock = await getPermDock(compact({
+			tenant: query.tenant,
+			version: query.version
+		}));
 		const snapshot = permdock.snapshot(compact({
 			include: query.include,
 			tenants: query.tenants
 		}));
+		const life = cacheLifeFor(snapshot, query.cacheLife);
+		if (life.stale < 300 && !warnedShortLife && isDevelopment()) {
+			warnedShortLife = true;
+			console.warn(`PermDock: getSnapshot() caches for ${String(life.stale)} s; Next.js drops a private entry under 300 s from the App Shell prefetch.`);
+		}
 		try {
-			cacheLife(cacheLifeFor(snapshot));
+			cacheLife(life);
 			cacheTag(snapshotTag(permdock.subject.principal?.id), ...query.tags ?? []);
 		} catch (error) {
 			unstable_rethrow(error);
@@ -239,7 +278,8 @@ function createPermDock(policy, given) {
 	const requirePermission = async (permission, data, requirement = {}) => {
 		const permdock = await getPermDock(compact({
 			tenant: requirement.tenant,
-			intent: requirement.intent
+			intent: requirement.intent,
+			version: requirement.version
 		}));
 		const assert = permdock.assert;
 		const handler = requirement.onDenied ?? options.onDenied;
@@ -255,15 +295,12 @@ function createPermDock(policy, given) {
 			include: props.include,
 			tenants: props.tenants
 		})));
-		return renderClientProvider(compact({
+		const { snapshot: _snapshot, include: _include, tenants: _tenants, ...rest } = props;
+		return renderClientProvider({
+			...rest,
 			snapshotPromise,
-			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock",
-			tenant: props.tenant,
-			suspend: props.suspend,
-			defaults: props.defaults,
-			messages: props.messages,
-			children: props.children
-		}));
+			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock"
+		});
 	};
 	const permdockHandler = () => evaluationsHandler(compact({
 		policy,
@@ -273,6 +310,7 @@ function createPermDock(policy, given) {
 	return {
 		getPermDock,
 		getPermission,
+		getPermissions,
 		getSnapshot,
 		requirePermission,
 		PermDockProvider,
@@ -286,4 +324,4 @@ function createPermDock(policy, given) {
 	};
 }
 //#endregion
-export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotTag };
+export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotKey, snapshotTag };

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
+import { s as PermDockPluginOptions } from "../types-3Y8UpFkF.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
-import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DAkjm75Y.js";
+import { a as describeError } from "../errors-BhRkoNS7.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-CBHADqBH.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { r as bindKernel } from "../bind-B4pMH9bm.js";
 import { n as sendResponse, r as toRequest, t as isServerResponse } from "../http-DH94eh6f.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;

package/dist/openai/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { u as ApprovalRequest } from "../types-CqcsNCaN.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BzwjZuRS.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */
 type OpenAiContext = {

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as approvalTokenOf } from "../kernel-BD8QuMnv.js";
-import { t as agentRuntime } from "../create-Coq5fIrq.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
+import { t as approvalTokenOf } from "../kernel-30Z2zM_d.js";
+import { t as agentRuntime } from "../create-C-tm3KIF.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, br as Condition, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal, wr as Condition } from "../policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { a as ProblemDetails } from "../errors-TpzkEKgJ.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/{openapi-BwWkHxvW.js → openapi-C4gFqeRz.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { c as missingInput } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/openapi.ts
 const docFlag = { doc: {
 	type: "string",
@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-DSzQN7Zu.js")).runOpenapi({
+		return (await import("./openapi-zMEB9qxn.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-Dfe2unKO.js")).runOpenapiImport({
+		return (await import("./import-DObwEota.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-DSzQN7Zu.js → openapi-zMEB9qxn.js}

@@ -1,13 +1,13 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
-import { r as definePolicy } from "./policy-CLQ8__GF.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as definePolicy } from "./policy-cV_wwPb8.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
-import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
-import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-DvXvxPhQ.js";
+import { i as fileDrift } from "./output-files-CM0BnH05.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-B_9tXrbG.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{operation-findings-CXtFzlKJ.js → operation-findings-CVwJHEu_.js}

@@ -1,4 +1,4 @@
-import { n as OPERATION_RISKS } from "./permissions-CVXmRILq.js";
+import { t as OPERATION_RISKS } from "./operation-risks-BKOcTv8J.js";
 //#region src/catalog/operation-findings.ts
 function rank(risk) {
 	return OPERATION_RISKS.indexOf(risk ?? "low");

package/dist/operation-risks-BKOcTv8J.js

@@ -0,0 +1,13 @@
+//#region src/core/operation-risks.ts
+/** Every `meta.risk` level, lowest first. */
+const OPERATION_RISKS = Object.freeze([
+	"low",
+	"medium",
+	"high",
+	"critical"
+]);
+function isOperationRisk(value) {
+	return OPERATION_RISKS.some((risk) => risk === value);
+}
+//#endregion
+export { isOperationRisk as n, OPERATION_RISKS as t };

package/dist/operations-Bm9HFecz.js

@@ -0,0 +1,89 @@
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isOperationRisk, t as OPERATION_RISKS } from "./operation-risks-BKOcTv8J.js";
+//#region src/core/operations.ts
+const OPERATION_EFFECTS = Object.freeze([
+	"read",
+	"write",
+	"delete",
+	"send",
+	"spend",
+	"external"
+]);
+/**
+* MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works
+* as a tool name unchanged.
+*/
+const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
+const META_KEYS = /* @__PURE__ */ new Set([
+	"risk",
+	"effects",
+	"title"
+]);
+function isOperationEffect(value) {
+	return OPERATION_EFFECTS.some((effect) => effect === value);
+}
+function readMeta(name, value) {
+	if (value === void 0) return Object.freeze({});
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`Operation "${name}": meta must be an object.`);
+	for (const key of Object.keys(value)) if (!META_KEYS.has(key)) throw new TypeError(`Operation "${name}": meta.${key} is not one of risk, effects, title.`);
+	const meta = {};
+	const risk = Reflect.get(value, "risk");
+	if (risk !== void 0) {
+		if (!isOperationRisk(risk)) throw new TypeError(`Operation "${name}": meta.risk must be one of ${OPERATION_RISKS.join(", ")}.`);
+		meta.risk = risk;
+	}
+	const effects = Reflect.get(value, "effects");
+	if (effects !== void 0) {
+		if (!Array.isArray(effects) || !effects.every(isOperationEffect) || new Set(effects).size !== effects.length) throw new TypeError(`Operation "${name}": meta.effects must list distinct values of ${OPERATION_EFFECTS.join(", ")}.`);
+		meta.effects = Object.freeze([...effects]);
+	}
+	const title = Reflect.get(value, "title");
+	if (title !== void 0) {
+		if (typeof title !== "string" || title.trim() === "") throw new TypeError(`Operation "${name}": meta.title must be a non-empty string.`);
+		meta.title = title;
+	}
+	return Object.freeze(meta);
+}
+function treeLeaf(keys, name, field, value) {
+	if (!isPermission(value)) throw new TypeError(`Operation "${name}": ${field} must be a permission from the tree.`);
+	if (!keys.has(value.key)) throw new TypeError(`Operation "${name}": ${field} ${value.key} is not a permission of the tree passed to defineOperations.`);
+	return value;
+}
+/**
+* Binds each named operation to a permission of `permissions`. Throws at
+* definition time for a permission or `results` outside the tree, a name that
+* is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
+* a `data` that is not a function, or meta outside the closed lists.
+*/
+function defineOperations(permissions, definitions) {
+	const keys = new Map(listPermissions(permissions).map((leaf) => [leaf.key, leaf]));
+	const seen = /* @__PURE__ */ new Map();
+	const out = {};
+	for (const name of Object.keys(definitions)) {
+		if (!NAME.test(name) || isForbiddenKey(name)) throw new TypeError(`Operation name "${name}" must be 1 to 128 of A-Z a-z 0-9 _ . -.`);
+		const folded = name.toLowerCase();
+		const previous = seen.get(folded);
+		if (previous !== void 0) throw new TypeError(`Operation name "${name}" is a duplicate of "${previous}".`);
+		seen.set(folded, name);
+		const definition = definitions[name];
+		if (definition === null || typeof definition !== "object" || Array.isArray(definition)) throw new TypeError(`Operation "${name}" must be an object.`);
+		const permission = treeLeaf(keys, name, "permission", Reflect.get(definition, "permission"));
+		const value = Reflect.get(definition, "data");
+		if (value !== void 0 && typeof value !== "function") throw new TypeError(`Operation "${name}": data must be a function.`);
+		const data = value;
+		const resultsValue = Reflect.get(definition, "results");
+		const results = resultsValue === void 0 ? void 0 : treeLeaf(keys, name, "results", resultsValue);
+		const meta = readMeta(name, Reflect.get(definition, "meta"));
+		out[name] = Object.freeze({
+			name,
+			permission,
+			...data === void 0 ? {} : { data },
+			...results === void 0 ? {} : { results },
+			meta
+		});
+	}
+	return Object.freeze(out);
+}
+//#endregion
+export { isOperationEffect as n, defineOperations as t };

package/dist/orpc/index.d.ts

@@ -1,11 +1,11 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
-import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
+import { t as StreamProtectOptions } from "../stream-W2RuUYly.js";
 import { AnySchema, MetaPlugin, Middleware, Procedure, Schema } from "@orpc/server";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/orpc/operations.d.ts

package/dist/orpc/index.js

@@ -1,10 +1,10 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { o as isPermission } from "../permission-registry-B8tYxPIt.js";
 import { o as problemMessage } from "../http-DKLXrFGk.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { n as attached } from "../bind-B4pMH9bm.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-KwX_Jcxz.js";
 import { ORPCError, os } from "@orpc/server";
 //#region src/orpc/operations.ts
 const root = os;

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-B6ExllNo.js";
+import { M as PolicyVocabulary } from "../policy-types-D-GwfQTc.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-DGf_cpKF.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/otel/index.js

@@ -1,5 +1,5 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { n as wrapPermDock } from "../wrap-C5PWzgkq.js";
 import { r as appObligationNames } from "../ocsf-TcjRBgIs.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";

package/dist/{output-DlICTjBh.js → output-BFWLER4r.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/output-files-BYscrQl-.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-CM0BnH05.js";

package/dist/{output-files-BIQ_9pIs.js → output-files-CM0BnH05.js}

@@ -1,6 +1,6 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 /** How `path` on disk differs from `expected`; `undefined` when `same` holds. */

package/dist/{ownership-qqBuGJXr.js → ownership-D-mIt-w0.js}

@@ -2,16 +2,16 @@ import { a as sole, n as isReadonlyArray, r as isRecord } from "./compact-CAf557
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
 import { u as isoAt } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { t as isoInstant } from "./instant-DK3Iz83e.js";
 import { m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-B_oJqmIg.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-DimBcVWY.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-BfOk0ymL.js";
 //#region src/cli/sql/conditions.ts
 const MAX_CLAIM_DEPTH = 8;
 /**

package/dist/{parse-1_ZheTW5.js → parse-UTC-sDrt.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as catalogSchema } from "./schema-BOJjqlWL.js";
+import { t as catalogSchema } from "./schema-CuX70xgH.js";
 //#region src/catalog/references.ts
 function duplicates(issues, list, name, field) {
 	const seen = /* @__PURE__ */ new Set();