permdock 0.4.0 → 0.6.0

package/dist/operations-X0VM7F3m.d.ts

@@ -0,0 +1,59 @@
+import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
+//#region src/core/operation-risks.d.ts
+type OperationRisk = "low" | "medium" | "high" | "critical";
+/** Every `meta.risk` level, lowest first. */
+declare const OPERATION_RISKS: readonly OperationRisk[];
+declare function isOperationRisk(value: unknown): value is OperationRisk;
+//#endregion
+//#region src/core/operations.d.ts
+type OperationEffect = "read" | "write" | "delete" | "send" | "spend" | "external";
+/** Plain JSON a host reads to label, confirm or gate an operation; PermDock never decides on it. */
+type OperationMeta = {
+  readonly risk?: OperationRisk;
+  /** What running the operation does, each effect at most once. */
+  readonly effects?: readonly OperationEffect[];
+  readonly title?: string;
+};
+/**
+ * Loads the row the check runs on from the operation's input, the binding
+ * every surface shares. The row is validated against the permission's
+ * resource schema like any request-derived data (invariant 9).
+ */
+type OperationData<TInput = never> = {
+  load(input: TInput): unknown;
+}["load"];
+/** One entry of the object passed to `defineOperations`. */
+type OperationDefinition = {
+  readonly permission: Permission;
+  readonly data?: OperationData<unknown>;
+  /** The permission each result row is filtered by. */
+  readonly results?: Permission;
+  readonly meta?: OperationMeta;
+};
+/**
+ * A permission-bound action that agent tools, workflow nodes, MCP operations,
+ * HTTP routes and chat commands read by name. `TInput` is the parameter type
+ * of `data`; an operation without `data` takes `undefined`.
+ */
+type Operation<TInput = unknown, TName extends string = string, TPermission extends Permission = Permission> = {
+  readonly name: TName;
+  readonly permission: TPermission;
+  readonly data?: OperationData<TInput>;
+  readonly results?: Permission;
+  readonly meta: OperationMeta;
+};
+/** The input type of an operation: the parameter type of its `data` loader. */
+type OperationInput<TOperation> = TOperation extends Operation<infer TInput> ? TInput : never;
+type InputOf<TDefinition> = TDefinition extends {
+  readonly data: (input: infer TInput) => unknown;
+} ? TInput : undefined;
+type OperationMap<TDefinitions extends Record<string, OperationDefinition> = Record<string, OperationDefinition>> = { readonly [TName in keyof TDefinitions & string]: Operation<InputOf<TDefinitions[TName]>, TName, TDefinitions[TName]["permission"]>; };
+/**
+ * Binds each named operation to a permission of `permissions`. Throws at
+ * definition time for a permission or `results` outside the tree, a name that
+ * is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
+ * a `data` that is not a function, or meta outside the closed lists.
+ */
+declare function defineOperations<const TDefinitions extends Record<string, OperationDefinition>>(permissions: PermissionTree, definitions: TDefinitions): OperationMap<TDefinitions>;
+//#endregion
+export { OperationInput as a, defineOperations as c, isOperationRisk as d, OperationEffect as i, OPERATION_RISKS as l, OperationData as n, OperationMap as o, OperationDefinition as r, OperationMeta as s, Operation as t, OperationRisk as u };

package/dist/orpc/index.d.ts

@@ -1,9 +1,10 @@
-import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
-import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
-import { t as StreamProtectOptions } from "../stream-Dwsg6WwE.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { t as StreamProtectOptions } from "../stream-CeCMJmBB.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
@@ -25,7 +26,7 @@ type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = Server
   readonly revocations?: RevocationFeed;
 };
 type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, data?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   readonly security: (permission: Permission) => {
     readonly security: readonly Record<string, readonly string[]>[];
     readonly "x-permdock-permissions": readonly string[];
@@ -33,11 +34,13 @@ type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary =
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => OrpcMiddleware<TCtx, unknown, V>;
-  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  readonly getPermDock: (opts: OrpcMiddlewareOpts<TCtx>) => Promise<PermDock<V>>;
+  readonly middleware: () => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, data?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   /** A long-lived connection for the request behind `context`. */
   readonly connection: (opts: OrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly permdockHandler: () => (request: Request) => Promise<Response>;
   readonly openapi: OrpcOpenApiHooks<TCtx, V>;
 };
 /**

package/dist/orpc/index.js

@@ -1,10 +1,10 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { o as isPermission } from "../permission-registry-BsblpB-z.js";
+import { o as isPermission } from "../permission-registry-Br4jSNVi.js";
 import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-BE27PYkE.js";
-import { n as attached } from "../bind-kk-uyCwH.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-BMui98KK.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-nYC3cR_u.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { n as attached } from "../bind-CAvgUuKs.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-VSl5ylaQ.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {
@@ -83,10 +83,14 @@ function createPermDock(policy, options) {
 		if (typeof bound !== "object" || bound === null || !issued.has(bound) || issued.get(bound) !== scope.tenant) return;
 		return bound;
 	};
-	const permdock = () => ((mwOptions, input) => {
+	const getPermDock = async (opts) => {
+		const scope = await scopeOf(opts);
+		return boundFor(opts.context, scope) ?? issue(await kernel.getPermDock(bind(opts), scope), scope);
+	};
+	const middleware = () => ((mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
 		const request = bind(opts);
-		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.permdock(request, scope), scope))).then((instance) => {
+		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.getPermDock(request, scope), scope))).then((instance) => {
 			if (!instance.ok) return throwOrpcError(instance.response, mwOptions.errors);
 			const nextCtx = {
 				...opts.context,
@@ -97,17 +101,17 @@ function createPermDock(policy, options) {
 		});
 	});
 	/** Wraps an event iterator so revocation ends it and unreadable items drop. */
-	const guardOutput = async (result, opts, permission, loadData, protectOptions, errors) => {
+	const guardOutput = async (result, opts, permission, data, protectOptions, errors) => {
 		const output = result !== null && typeof result === "object" && "output" in result ? result.output : void 0;
 		if (!isAsyncIterable(output)) return result;
 		return {
 			...result,
-			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
+			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, data, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
 		};
 	};
-	const protect = (permission, loadData, protectOptions) => tagged(permission, (async (mwOptions, input) => {
+	const protect = (permission, data, protectOptions) => tagged(permission, (async (mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
-		const { request, scope, guard } = await runGuard(permission, loadData, opts, protectOptions);
+		const { request, scope, guard } = await runGuard(permission, data, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.context,
@@ -115,11 +119,11 @@ function createPermDock(policy, options) {
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions, mwOptions.errors);
+			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, data === void 0 ? void 0 : reloadAfter(guard.data, () => data(opts)), protectOptions, mwOptions.errors);
 		}
 		return throwOrpcError(guard.response, mwOptions.errors);
 	}));
-	const permdockHandler = (request) => {
+	const handler = (request) => {
 		return evaluate(request, {
 			context: { req: request },
 			path: ["permdock"],
@@ -128,10 +132,11 @@ function createPermDock(policy, options) {
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
-		permdockHandler,
+		permdockHandler: () => handler,
 		openapi: {
 			protect,
 			security: kernelOpenApi.security,

package/dist/otel/index.d.ts

@@ -1,5 +1,6 @@
-import { j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-CUcFZfpU.js";
+import { j as PolicyVocabulary } from "../policy-types-n0uRTsW8.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-lUlG3TVd.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/otel/index.js

@@ -1,10 +1,15 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as wrapPermDock } from "../wrap-DWsU_5Bd.js";
-import { r as appObligationNames } from "../ocsf-uYFXGVw2.js";
+import { n as wrapPermDock } from "../wrap-gX61EtpB.js";
+import { r as appObligationNames } from "../ocsf-BFp-PZZA.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";
 const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
 const GEN_AI_TOOL_CALL_ID = "gen_ai.tool.call.id";
+const GEN_AI_AGENT_ID = "gen_ai.agent.id";
+const GEN_AI_REQUEST_MODEL = "gen_ai.request.model";
+const USER_ID = "user.id";
+const USER_ROLES = "user.roles";
+const ERROR_TYPE = "error.type";
 //#endregion
 //#region src/otel/instrument.ts
 const FORBIDDEN = /* @__PURE__ */ new Set([
@@ -80,9 +85,26 @@ function omitPath(attributes, path) {
 		matched: true
 	};
 }
+/**
+* `error.type` for a decision that failed: a boundary validation failure
+* always, and the first denial reason when `errorOnDeny` marks every denial
+* an error.
+*/
+function errorType(event, options) {
+	if (event.outcome !== "denied") return;
+	if (event.denials?.some((denial) => denial.reason === "validation") === true) return "validation";
+	return options.errorOnDeny === true ? event.denials?.[0]?.reason : void 0;
+}
 function attributesOf(event, options, parent) {
 	const extra = options.attributes === void 0 ? {} : options.attributes(event);
+	const actor = event.subject.actor;
+	const scopes = event.subject.delegation?.scope?.split(" ").filter((scope) => scope !== "");
 	let redacted = compact({
+		[USER_ID]: event.subject.principal?.id,
+		[USER_ROLES]: event.subject.principal?.roles,
+		[GEN_AI_AGENT_ID]: actor?.kind === "agent" ? actor.id : void 0,
+		[GEN_AI_REQUEST_MODEL]: event.model ?? parent?.attributes?.["gen_ai.request.model"],
+		[ERROR_TYPE]: errorType(event, options),
 		"permdock.outcome": event.outcome,
 		"permdock.permission": event.permission,
 		"permdock.scope": event.scope,
@@ -91,10 +113,11 @@ function attributesOf(event, options, parent) {
 		"permdock.subject.id": event.subject.principal?.id,
 		"permdock.actor.id": event.subject.actor?.id,
 		"permdock.actor.kind": event.subject.actor?.kind,
-		"permdock.delegation.scopes": event.subject.delegation?.scopes?.join(","),
+		"permdock.support_session.id": event.subject.supportSession?.id,
+		"permdock.delegation.scopes": scopes,
 		"permdock.matched.role": event.matched?.role,
 		"permdock.matched.name": event.matched?.name,
-		"permdock.obligations": appObligationNames(event)?.join(","),
+		"permdock.obligations": appObligationNames(event),
 		"permdock.denials.count": event.denials?.length,
 		"permdock.token": event.token,
 		"permdock.validate": event.trusted ? "trusted" : "boundary",
@@ -135,9 +158,9 @@ function recordSignals(event, options, api, timing) {
 	span.setAttributes?.(attributes);
 	if (event.outcome === "denied") {
 		span.addEvent?.("permdock.denied", compact({
-			role: event.denials?.map((denial) => denial.role).join(","),
-			reason: event.denials?.map((denial) => denial.reason).join(","),
-			alternatives: event.alternatives?.join(",")
+			role: event.denials?.map((denial) => denial.role ?? ""),
+			reason: event.denials?.map((denial) => denial.reason),
+			alternatives: event.alternatives
 		}));
 		if (event.denials?.some((denial) => denial.reason === "validation") === true) span.recordException?.(/* @__PURE__ */ new Error("validation"));
 		if (options.errorOnDeny === true) span.setStatus?.({ code: SPAN_STATUS_ERROR });

package/dist/output-1im__-08.js

@@ -0,0 +1,88 @@
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+//#region src/cli/core/output.ts
+const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
+function envelope(input) {
+	return {
+		$schema: CLI_RESULT_SCHEMA,
+		status: input.status,
+		...input.data === void 0 ? {} : { data: input.data },
+		...input.error === void 0 ? {} : { error: input.error },
+		...input.next === void 0 || input.next.length === 0 ? {} : { next: input.next }
+	};
+}
+/** A command's JSON report as data; text that is not JSON becomes `{ message }`. */
+function dataOf(output) {
+	const text = output.trim();
+	if (text === "") return;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return { message: text };
+	}
+}
+const LOCATION = /^([^\s:]+\.[A-Za-z0-9]+):(\d+)\b/u;
+/**
+* A finding whose `file` and `line` default to the `path:line` a message
+* opens with, the form doctor, usage and scan already print.
+*/
+function findingOf(input) {
+	if (input.file !== void 0) return input;
+	const match = LOCATION.exec(input.message);
+	if (match?.[1] === void 0 || match[2] === void 0) return input;
+	return {
+		...input,
+		file: match[1],
+		line: Number(match[2])
+	};
+}
+function escapeData(value) {
+	return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function escapeProperty(value) {
+	return escapeData(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+}
+/** GitHub Actions workflow commands, one per finding. */
+function githubAnnotations(findings) {
+	return findings.map((finding) => {
+		return `::${finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "notice"} ${[
+			...finding.file === void 0 ? [] : [`file=${escapeProperty(finding.file)}`],
+			...finding.line === void 0 ? [] : [`line=${String(finding.line)}`],
+			`title=${escapeProperty(finding.code)}`
+		].join(",")}::${escapeData(finding.fix === void 0 ? finding.message : `${finding.message}\nFix: ${finding.fix}`)}`;
+	}).join("\n");
+}
+/** A SARIF 2.1.0 log with one run, one rule per finding code. */
+function sarifLog(command, findings) {
+	const rules = [...new Set(findings.map((finding) => finding.code))].map((code) => {
+		const sample = findings.find((finding) => finding.code === code);
+		const rule = { id: code };
+		if (sample?.docs !== void 0) rule.helpUri = sample.docs;
+		if (sample?.fix !== void 0) rule.help = { text: sample.fix };
+		return rule;
+	});
+	const results = findings.map((finding) => ({
+		ruleId: finding.code,
+		level: finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "note",
+		message: { text: finding.message },
+		...finding.file === void 0 ? {} : { locations: [{ physicalLocation: {
+			artifactLocation: { uri: finding.file },
+			...finding.line === void 0 ? {} : { region: { startLine: finding.line } }
+		} }] }
+	}));
+	return `${JSON.stringify({
+		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
+		version: "2.1.0",
+		runs: [{
+			tool: { driver: {
+				name: `permdock ${command}`,
+				version: cliVersion(),
+				informationUri: DOCS_BASE,
+				rules
+			} },
+			results
+		}]
+	}, null, 2)}\n`;
+}
+//#endregion
+export { sarifLog as a, githubAnnotations as i, envelope as n, findingOf as r, dataOf as t };

package/dist/output-files-B3IZJksC.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-DhRBBE4n.js";

package/dist/{output-files-CgIsvdSa.js → output-files-DhRBBE4n.js}

@@ -1,7 +1,8 @@
-import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { t as shortDiff } from "./text-diff-BQcUapOb.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { resolve } from "node:path";
+import { basename, dirname, resolve } from "node:path";
 /** How `path` on disk differs from `expected`; `undefined` when `same` holds. */
 function fileDrift(path, expected, same = (a, b) => a === b) {
 	if (!existsSync(path)) return { kind: "missing" };
@@ -22,25 +23,19 @@ function driftOf(cwd, files) {
 	}
 	return drift;
 }
-/** Writes every file but the stdout ones, whose text it returns for printing. */
+/** Writes every file but the stdout ones, all or nothing, and returns the stdout text for printing. */
 function writeOutputFiles(cwd, files) {
-	const wrote = [];
-	const printed = [];
-	for (const file of files) {
-		if (file.rel === "-") {
-			printed.push(file.text.trimEnd());
-			continue;
-		}
-		const path = resolve(cwd, file.rel);
-		writeFileEnsuringDir(path, file.text);
-		wrote.push(file.rel);
-	}
+	const onDisk = files.filter((file) => file.rel !== "-");
+	applyFiles(cwd, onDisk.map((file) => ({
+		path: file.rel,
+		text: file.text
+	})));
 	return {
-		wrote,
-		printed: printed.join("\n")
+		wrote: onDisk.map((file) => file.rel),
+		printed: files.filter((file) => file.rel === "-").map((file) => file.text.trimEnd()).join("\n")
 	};
 }
-const PARTS = [
+const SPLIT_PARTS = [
 	"helpers",
 	"seeds",
 	"indexes",
@@ -51,8 +46,8 @@ const PARTS = [
 function parseSplit(raw) {
 	if (raw === void 0) return;
 	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
-	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
-	return PARTS.filter((part) => names.includes(part));
+	if (names.filter((name) => !SPLIT_PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return SPLIT_PARTS.filter((part) => names.includes(part));
 }
 /** The path of one split part: `{part}` in `out` replaced by the part name. */
 function partPath(out, part) {
@@ -83,7 +78,8 @@ function isSeedsDirectory(cwd, out) {
 * A generated data migration at `out`: a file, `-` for stdout, or a
 * migrations directory that gets a new versioned file only when the newest
 * one starting with `marker` differs. With `check`, the planned file is
-* always returned, so drift names it.
+* always returned, so drift names it. `reserved` lists the files this run
+* already plans, so two data migrations never share a version.
 */
 function dataMigrationFile(input) {
 	if (!isSeedsDirectory(input.cwd, input.out)) return {
@@ -91,7 +87,7 @@ function dataMigrationFile(input) {
 		rel: input.out,
 		text: input.text
 	};
-	const planned = seedsMigration(input.cwd, input.out, input.marker, input.text, input.now, input.part);
+	const planned = seedsMigration(input.cwd, input.out, input.marker, input.text, input.now, input.part, input.reserved);
 	return !planned.current || input.check ? {
 		part: input.part,
 		rel: planned.rel,
@@ -113,7 +109,7 @@ function nextMigrationVersion(names, now) {
 		const stamp = VERSION_PREFIX.exec(name)?.[0];
 		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
 	});
-	return times.length === 0 ? migrationVersion(now) : migrationVersion(new Date(Math.max(...times) + 1e3));
+	return times.length === 0 ? migrationVersion(now) : migrationVersion(dateAt({ epochMilliseconds: Math.max(...times) + 1e3 }));
 }
 /**
 * The seeds part in a migrations directory: the newest migration there that
@@ -122,8 +118,10 @@ function nextMigrationVersion(names, now) {
 * (\`nextMigrationVersion\`), so a regeneration of the same directory names it
 * the same. \`current\` is false when a new one is due. \`label\` replaces
 * \`seeds\` in the file name for the other generated data migrations.
+* \`reserved\` holds paths, relative to \`cwd\`, that this run writes; the ones
+* in \`dir\` count as migrations already there.
 */
-function seedsMigration(cwd, dir, marker, text, now, label = "seeds") {
+function seedsMigration(cwd, dir, marker, text, now, label = "seeds", reserved = []) {
 	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
 	const path = resolve(cwd, base);
 	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
@@ -132,9 +130,9 @@ function seedsMigration(cwd, dir, marker, text, now, label = "seeds") {
 		current: true
 	};
 	return {
-		rel: `${base}/${nextMigrationVersion(existsSync(path) ? readdirSync(path) : [], now)}_permdock_${label}.sql`,
+		rel: `${base}/${nextMigrationVersion([...existsSync(path) ? readdirSync(path) : [], ...reserved.filter((rel) => resolve(cwd, dirname(rel)) === path).map((rel) => basename(rel))], now)}_permdock_${label}.sql`,
 		current: false
 	};
 }
 //#endregion
-export { parseSplit as a, seedsMigration as c, isSeedsDirectory as i, writeOutputFiles as l, driftOf as n, partPath as o, fileDrift as r, pgDeltaPath as s, dataMigrationFile as t };
+export { isSeedsDirectory as a, parseSplit as c, seedsMigration as d, writeOutputFiles as f, fileDrift as i, partPath as l, dataMigrationFile as n, migrationVersion as o, driftOf as r, nextMigrationVersion as s, SPLIT_PARTS as t, pgDeltaPath as u };