permdock 0.8.0 → 0.10.0

package/dist/{manifest-Cgiq5oqc.js → manifest-B4ENCp2I.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).init
+				load: async () => (await import("./init-fNF_XmTa.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).presetDecode
+				load: async () => (await import("./init-fNF_XmTa.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).presetUrl
+				load: async () => (await import("./init-fNF_XmTa.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).install
+					load: async () => (await import("./skills-BUI8DMqy.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).update
+					load: async () => (await import("./skills-BUI8DMqy.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).list
+					load: async () => (await import("./skills-BUI8DMqy.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-D3wo-yuz.js")).doctor
+				load: async () => (await import("./doctor-B9FY9H0F.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-saoYiRFO.js")).completion
+				load: async () => (await import("./completion-VSWvaaPO.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-Bzv3le0A.js")).collect
+				load: async () => (await import("./collect-D9Tt0Bcx.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-DCspHDc8.js")).catalog
+				load: async () => (await import("./catalog-amPDr0JQ.js")).catalog
 			}),
 			leaf("gen", "Write typed constants, schemas, factories, hooks and messages from the policy", {
 				examples: [
@@ -124,7 +124,7 @@ const SECTIONS = [
 				docs: "gen",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./gen-B5kvbAoZ.js")).gen
+				load: async () => (await import("./gen-DwgCSC6V.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -132,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-ab0PdusX.js")).usage
+				load: async () => (await import("./usage-B1ZJOUdr.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CN8IYhC_.js")).diff
+				load: async () => (await import("./diff-BwR1JdP2.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-DBeXXmBF.js")).config
+				load: async () => (await import("./config-kL36AxkE.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).generate
+					load: async () => (await import("./rls-j0YrFPpW.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).importPolicies
+					load: async () => (await import("./rls-j0YrFPpW.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).verify
+					load: async () => (await import("./rls-j0YrFPpW.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).migrate
+					load: async () => (await import("./rls-j0YrFPpW.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).explain
+					load: async () => (await import("./rls-j0YrFPpW.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-D39cuGPt.js")).hookGenerate
+				load: async () => (await import("./supabase-BaizG0n7.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-D39cuGPt.js")).inspect
+				load: async () => (await import("./supabase-BaizG0n7.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-DXqGuq9A.js")).generate
+				load: async () => (await import("./powersync-B_8uwz7f.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-DXqGuq9A.js")).verify
+				load: async () => (await import("./powersync-B_8uwz7f.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-CBZUhA3l.js")).emit
+				load: async () => (await import("./openapi-DFj0cirS.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-CBZUhA3l.js")).importDocument
+				load: async () => (await import("./openapi-DFj0cirS.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-3RhGfkAK.js")).check
+				load: async () => (await import("./arazzo-DA9PCXew.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-DCj1KQfn.js")).scan
+				load: async () => (await import("./scan-B7xrAvRm.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-cbSbhT_k.js")).casbinImport
+				load: async () => (await import("./casbin-BkhqGh2z.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).login
+				load: async () => (await import("./login-DYazeWc9.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).logout
+				load: async () => (await import("./login-DYazeWc9.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).whoami
+				load: async () => (await import("./login-DYazeWc9.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-BFlGMaak.js")).push
+				load: async () => (await import("./cloud-3RIuS4E9.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-BFlGMaak.js")).pull
+				load: async () => (await import("./cloud-3RIuS4E9.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-DLQ9Zpo4.js")).codemod
+			load: async () => (await import("./codemod-DLcp-B6v.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-saoYiRFO.js")).complete
+	load: async () => (await import("./completion-VSWvaaPO.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{manifest-CzzWtnAb.d.ts → manifest-B5yF3CIq.d.ts}

@@ -6,6 +6,14 @@
  * is the major of this shape; a field is only ever added within it.
  * `schemas/supabase-manifest-v1.json` is its JSON Schema.
  */
+/** An `app_metadata` key, or a column of a table joined on `id`. */
+type SupabaseManifestActiveFrom = {
+  readonly appMetadata: string;
+} | {
+  readonly table: string;
+  readonly column: string;
+  readonly id: string;
+};
 type SupabaseHookManifest = {
   readonly $schema: "https://permdock.com/schemas/supabase-manifest-v1.json";
   readonly version: 1;
@@ -21,6 +29,12 @@ type SupabaseHookManifest = {
      */
     readonly schemas?: "pg-delta" | "migra" | "migrations";
     readonly before?: readonly string[];
+    /**
+     * Where the hook reads the active first-scope id
+     * (`supabase.hook.activeFrom`). Absent from a manifest written before
+     * 0.10.
+     */
+    readonly activeFrom?: SupabaseManifestActiveFrom;
   };
   readonly helpers: {
     readonly schema: string;
@@ -151,6 +165,11 @@ type SupabaseManifestThrough = {
   readonly table: string;
   readonly id: string;
   readonly column: string;
+  /**
+   * Every referencing column to the column of `table` it matches, when the
+   * reference spans several columns (a role set keyed by scope id and user).
+   */
+  readonly on?: Readonly<Record<string, string>>;
 };
 /**
  * A role column (with `through` when it references a roles table), or the fixed

package/dist/{manifest-wg8WkkpD.js → manifest-BXTbHNIV.js}

@@ -1,7 +1,7 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as supabaseManifestSchema } from "./manifest-schema-2r37XRhD.js";
+import { t as supabaseManifestSchema } from "./manifest-schema-DQkBK2Mr.js";
 //#region src/supabase/manifest.ts
 /** Whether the manifest describes a token hook. */
 function hasTokenHook(manifest) {

package/dist/{manifest-schema-2r37XRhD.js → manifest-schema-DQkBK2Mr.js}

@@ -47,6 +47,28 @@ const supabaseManifestSchema = freezeDeep({
 						type: "string",
 						pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
 					}
+				},
+				activeFrom: {
+					description: "Where the hook reads the active first-scope id (supabase.hook.activeFrom): an app_metadata key, or a column of a table joined on id. Absent from a manifest written before 0.10.",
+					oneOf: [{
+						type: "object",
+						required: ["appMetadata"],
+						additionalProperties: false,
+						properties: { appMetadata: { type: "string" } }
+					}, {
+						type: "object",
+						required: [
+							"table",
+							"column",
+							"id"
+						],
+						additionalProperties: false,
+						properties: {
+							table: { type: "string" },
+							column: { type: "string" },
+							id: { type: "string" }
+						}
+					}]
 				}
 			}
 		},
@@ -450,7 +472,12 @@ const supabaseManifestSchema = freezeDeep({
 							pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
 						},
 						id: { $ref: "#/$defs/identifier" },
-						column: { $ref: "#/$defs/identifier" }
+						column: { $ref: "#/$defs/identifier" },
+						on: {
+							description: "Every referencing column to the column of table it matches, when the reference spans several columns.",
+							type: "object",
+							additionalProperties: { $ref: "#/$defs/identifier" }
+						}
 					}
 				}
 			}

package/dist/{map-claims-BNWCJtmP.js → map-claims-C-nv08_n.js}

@@ -335,7 +335,8 @@ function mapClaimsToSubject(claims, options) {
 			delegation: options.accept === "id-token" ? void 0 : delegationOf(claims, options, act.status === "ok" ? act.chain : void 0),
 			context: {},
 			session: typeof sessionValue === "string" ? sessionValue : void 0,
-			expiresAt
+			expiresAt,
+			issuedAt: typeof claims.iat === "number" && Number.isFinite(claims.iat) ? claims.iat : void 0
 		})),
 		invalidClaims,
 		invalidChain: false

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { T as Policy, Y as JwtClaims, dt as TokenVerifier, lr as Subject, rr as Delegation, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Z as JwtClaims, hr as Subject, ht as TokenVerifier, lr as Delegation, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { t as ApprovalHint } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { t as ApprovalHint } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "../types-DHKPcqzr.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "../types-B6ExllNo.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DHldhVUv.js";
 import { t as ClientNames } from "../clients-C_NOET3z.js";
-import { U as JwtSubjectOptions } from "../types-DjuMBNF9.js";
+import { U as JwtSubjectOptions } from "../types-DsHGPtkR.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /**

package/dist/mcp/index.js

@@ -5,14 +5,14 @@ import { n as describe } from "../describe-Bb4hGK5d.js";
 import { m as annotationsFor } from "../permission-registry-B8tYxPIt.js";
 import { t as actorMayCallTool } from "../delegation-CDB6_keF.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BvjivVb9.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { t as composeWraps } from "../wrap-B2wziJI_.js";
 import { l as problemResponse, o as methodNotAllowed, r as bearerChallenge, u as protectedResourceMetadataUrl } from "../problem-BVLHFK33.js";
 import { t as clientNameOf } from "../clients-DYr3U86j.js";
-import { r as mapClaimsToSubject } from "../map-claims-BNWCJtmP.js";
-import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
-import { i as refusalText, n as createAgentKernel } from "../kernel-C-fYydV2.js";
+import { r as mapClaimsToSubject } from "../map-claims-C-nv08_n.js";
+import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
+import { i as refusalText, n as createAgentKernel } from "../kernel-qv4cr9w8.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";

package/dist/{migrate-B7oP_sQU.js → migrate-BJHxQqT5.js}

@@ -3,11 +3,11 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { a as RETIRE_MARKER } from "./markers-BeHZ4x9Q.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-BIQ_9pIs.js";
-import { r as HELPERS } from "./shared-Afctg7B0.js";
+import { r as HELPERS } from "./shared-DrGLwM3s.js";
 import { o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { i as retireSql, r as retirePlan } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{module-values-BJTBdo6y.js → module-values-B1EVTkHP.js}

@@ -1,7 +1,7 @@
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-ykV0Vm2n.js";
+import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-tsxHx71E.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { parseSync } from "oxc-parser";

package/dist/nest/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts

package/dist/nest/index.js

@@ -4,7 +4,7 @@ import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockAppro
 import { c as writeReply, r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as socketConnection, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-DH94eh6f.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";

package/dist/next/index.d.ts

@@ -1,13 +1,13 @@
-import { Bn as DenialReason, Gt as Snapshot, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { Kn as DenialReason, T as Policy, Un as Decision, X as Intent, Zt as Snapshot, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
-import { n as PermDockWrap } from "../wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "../types-DHKPcqzr.js";
-import { n as DescribeMessages } from "../describe-ByS9LgHK.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "../types-B6ExllNo.js";
+import { n as DescribeMessages } from "../describe-BbFPBSms.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { ReactElement, ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/types.d.ts
@@ -34,6 +34,13 @@ type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
 };
 type GetPermDockQuery = {
   readonly tenant?: string;
+  /**
+   * Default `'read'`: with `claimsFirst(…, { versions })` the token may be
+   * judged from the shared version cache, at most its `maxStaleMs` stale. Pass
+   * `'write'` before a mutation outside `protectAction`, which always reads the
+   * version live.
+   */
+  readonly intent?: Intent;
 };
 type GetSnapshotQuery = GetPermDockQuery & {
   readonly include?: readonly (Permission | {
@@ -58,13 +65,26 @@ type ServerPermissionState = {
   readonly status: "ready";
   readonly decision: Decision;
 };
-type NextPermDockProviderProps = {
-  readonly children: ReactNode;
-  readonly tenant?: string;
+type NextPermDockProviderProps = NextPermDockProviderDisplay & ({
+  /**
+   * The snapshot to hand to the client, usually from the app's `'use
+   * cache: private'` loader around `getSnapshot`, so a prefetch carries
+   * it. The loader decides what it includes.
+   */
+  readonly snapshot: Promise<Snapshot>;
+  readonly include?: never;
+  readonly tenants?: never;
+} | {
+  /** Without `snapshot`, the provider builds one outside any cache. */
+  readonly snapshot?: undefined;
   readonly include?: readonly (Permission | {
     readonly [key: string]: unknown;
   })[];
   readonly tenants?: "all";
+});
+type NextPermDockProviderDisplay = {
+  readonly children: ReactNode;
+  readonly tenant?: string;
   /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
   readonly endpoint?: string | false;
   /**

package/dist/next/index.js

@@ -3,12 +3,12 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { o as statusProblem, t as notFoundDetails } from "../problem-details-CLDgX1KV.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
 import { i as decisionProblem } from "../problem-BVLHFK33.js";
 import { s as resumeDecision } from "../helpers-DJicaG6f.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { _ as LOAD_FAILED, o as evaluationsHandler, v as NO_GRANT } from "../evaluations-IBceAeKT.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -63,7 +63,10 @@ function protectActionOf(deps) {
 		let permdock;
 		let data;
 		try {
-			permdock = await deps.getPermDock(compact({ tenant: options.tenant?.(input) }));
+			permdock = await deps.getPermDock(compact({
+				tenant: options.tenant?.(input),
+				intent: "write"
+			}));
 		} catch (error) {
 			deps.rethrow(error);
 			return refused(decisionProblem(NO_GRANT, permission, void 0));
@@ -181,7 +184,7 @@ function createPermDock(policy, given) {
 		return wrapInstance(options.wrap === void 0 ? traced : options.wrap(traced), options.onDenied);
 	};
 	const resolveFallbackTenant = cache(() => readTenant(options.tenant));
-	const instantiate = cache(async (tenantKey) => {
+	const instantiate = cache(async (tenantKey, intent) => {
 		const tenant = tenantKey === "" ? void 0 : tenantKey;
 		const user = await resolveSubject();
 		await io();
@@ -191,14 +194,15 @@ function createPermDock(policy, given) {
 			sources: options,
 			scope: {
 				tenant,
-				sink
+				sink,
+				intent
 			},
 			wrap: decorate
 		})).permdock;
 	});
 	const getPermDock = async (query) => {
 		const tenant = query?.tenant ?? await resolveFallbackTenant();
-		return instantiate(tenant ?? "");
+		return instantiate(tenant ?? "", query?.intent ?? "read");
 	};
 	const getPermission = async (permission, data, query) => {
 		try {
@@ -233,7 +237,10 @@ function createPermDock(policy, given) {
 		return snapshot;
 	};
 	const requirePermission = async (permission, data, requirement = {}) => {
-		const permdock = await getPermDock(requirement.tenant === void 0 ? void 0 : { tenant: requirement.tenant });
+		const permdock = await getPermDock(compact({
+			tenant: requirement.tenant,
+			intent: requirement.intent
+		}));
 		const assert = permdock.assert;
 		const handler = requirement.onDenied ?? options.onDenied;
 		return assert(permission, data, { onDenied: (decision) => {
@@ -244,7 +251,7 @@ function createPermDock(policy, given) {
 		} });
 	};
 	const PermDockProvider = (props) => {
-		const snapshotPromise = getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
+		const snapshotPromise = props.snapshot ?? getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
 			include: props.include,
 			tenants: props.tenants
 		})));

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-DC1Loeh3.js";
+import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Cx_WciLE.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Bpci3hBY.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";