permdock 0.8.0 → 0.9.0

package/dist/{kernel-C-fYydV2.js → kernel-qv4cr9w8.js}

@@ -4,14 +4,14 @@ import { n as describe } from "./describe-Bb4hGK5d.js";
 import { a as deniedMessage } from "./errors-B6R_lg2a.js";
 import { t as actorMayCallTool } from "./delegation-CDB6_keF.js";
 import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { k as activate } from "./evaluate-Dd8Ta0Ie.js";
+import { k as activate } from "./evaluate-BAmf_AQd.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as delegationAllows } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { l as withApp } from "./permdock-BvjivVb9.js";
 import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DJicaG6f.js";
-import { n as resolveOrNull } from "./build-instance-CNWaYJyr.js";
+import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-C25ilqiJ.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
 //#region src/agent/denied-text.ts
 /**
 * The hook's text, or `event.text` when there is no hook or it throws or

package/dist/kysely/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
-import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { f as WhereResult } from "../permdock-CprAPN3w.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {

package/dist/{login-D-8tMqzo.js → login-CfImTJGb.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-DplQ0s84.js");
+		const { runLogin } = await import("./login-CgfCTO3F.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-DplQ0s84.js");
+		const { runLogout } = await import("./login-CgfCTO3F.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-DplQ0s84.js");
+		const { runWhoami } = await import("./login-CgfCTO3F.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{login-DplQ0s84.js → login-CgfCTO3F.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{manifest-Cgiq5oqc.js → manifest-B2QPh19C.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).init
+				load: async () => (await import("./init-txYTuW9u.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).presetDecode
+				load: async () => (await import("./init-txYTuW9u.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-Dz_PsHdv.js")).presetUrl
+				load: async () => (await import("./init-txYTuW9u.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).install
+					load: async () => (await import("./skills-C9uKfSF5.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).update
+					load: async () => (await import("./skills-C9uKfSF5.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-OuoMR49L.js")).list
+					load: async () => (await import("./skills-C9uKfSF5.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-D3wo-yuz.js")).doctor
+				load: async () => (await import("./doctor-LPMYjSqO.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-saoYiRFO.js")).completion
+				load: async () => (await import("./completion-_bc0OUQ-.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-Bzv3le0A.js")).collect
+				load: async () => (await import("./collect-B80GYEot.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-DCspHDc8.js")).catalog
+				load: async () => (await import("./catalog-amPDr0JQ.js")).catalog
 			}),
 			leaf("gen", "Write typed constants, schemas, factories, hooks and messages from the policy", {
 				examples: [
@@ -124,7 +124,7 @@ const SECTIONS = [
 				docs: "gen",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./gen-B5kvbAoZ.js")).gen
+				load: async () => (await import("./gen-BFfzZSLH.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -132,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-ab0PdusX.js")).usage
+				load: async () => (await import("./usage-CBzgwfIs.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CN8IYhC_.js")).diff
+				load: async () => (await import("./diff-BwR1JdP2.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-DBeXXmBF.js")).config
+				load: async () => (await import("./config-D5XrLWpk.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).generate
+					load: async () => (await import("./rls-Ba9wN0SP.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).importPolicies
+					load: async () => (await import("./rls-Ba9wN0SP.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).verify
+					load: async () => (await import("./rls-Ba9wN0SP.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).migrate
+					load: async () => (await import("./rls-Ba9wN0SP.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ca8Jz9b5.js")).explain
+					load: async () => (await import("./rls-Ba9wN0SP.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-D39cuGPt.js")).hookGenerate
+				load: async () => (await import("./supabase-SBs3MYUE.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-D39cuGPt.js")).inspect
+				load: async () => (await import("./supabase-SBs3MYUE.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-DXqGuq9A.js")).generate
+				load: async () => (await import("./powersync-Bg8u-JcR.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-DXqGuq9A.js")).verify
+				load: async () => (await import("./powersync-Bg8u-JcR.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-CBZUhA3l.js")).emit
+				load: async () => (await import("./openapi-BIpw3Mb7.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-CBZUhA3l.js")).importDocument
+				load: async () => (await import("./openapi-BIpw3Mb7.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-3RhGfkAK.js")).check
+				load: async () => (await import("./arazzo-BpS7LnV0.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-DCj1KQfn.js")).scan
+				load: async () => (await import("./scan-CRTj6fke.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-cbSbhT_k.js")).casbinImport
+				load: async () => (await import("./casbin-B7_yS-oo.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).login
+				load: async () => (await import("./login-CfImTJGb.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).logout
+				load: async () => (await import("./login-CfImTJGb.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-D-8tMqzo.js")).whoami
+				load: async () => (await import("./login-CfImTJGb.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-BFlGMaak.js")).push
+				load: async () => (await import("./cloud-3kWfjnYy.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-BFlGMaak.js")).pull
+				load: async () => (await import("./cloud-3kWfjnYy.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-DLQ9Zpo4.js")).codemod
+			load: async () => (await import("./codemod-D9Aiii1r.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-saoYiRFO.js")).complete
+	load: async () => (await import("./completion-_bc0OUQ-.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{map-claims-BNWCJtmP.js → map-claims-C-nv08_n.js}

@@ -335,7 +335,8 @@ function mapClaimsToSubject(claims, options) {
 			delegation: options.accept === "id-token" ? void 0 : delegationOf(claims, options, act.status === "ok" ? act.chain : void 0),
 			context: {},
 			session: typeof sessionValue === "string" ? sessionValue : void 0,
-			expiresAt
+			expiresAt,
+			issuedAt: typeof claims.iat === "number" && Number.isFinite(claims.iat) ? claims.iat : void 0
 		})),
 		invalidClaims,
 		invalidChain: false

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { T as Policy, Y as JwtClaims, dt as TokenVerifier, lr as Subject, rr as Delegation, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Z as JwtClaims, hr as Subject, ht as TokenVerifier, lr as Delegation, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { t as ApprovalHint } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { t as ApprovalHint } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "../types-DHKPcqzr.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "../types-B6ExllNo.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DHldhVUv.js";
 import { t as ClientNames } from "../clients-C_NOET3z.js";
-import { U as JwtSubjectOptions } from "../types-DjuMBNF9.js";
+import { U as JwtSubjectOptions } from "../types-DsHGPtkR.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /**

package/dist/mcp/index.js

@@ -5,14 +5,14 @@ import { n as describe } from "../describe-Bb4hGK5d.js";
 import { m as annotationsFor } from "../permission-registry-B8tYxPIt.js";
 import { t as actorMayCallTool } from "../delegation-CDB6_keF.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BvjivVb9.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { t as composeWraps } from "../wrap-B2wziJI_.js";
 import { l as problemResponse, o as methodNotAllowed, r as bearerChallenge, u as protectedResourceMetadataUrl } from "../problem-BVLHFK33.js";
 import { t as clientNameOf } from "../clients-DYr3U86j.js";
-import { r as mapClaimsToSubject } from "../map-claims-BNWCJtmP.js";
-import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
-import { i as refusalText, n as createAgentKernel } from "../kernel-C-fYydV2.js";
+import { r as mapClaimsToSubject } from "../map-claims-C-nv08_n.js";
+import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
+import { i as refusalText, n as createAgentKernel } from "../kernel-qv4cr9w8.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";

package/dist/nest/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts

package/dist/nest/index.js

@@ -4,7 +4,7 @@ import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockAppro
 import { c as writeReply, r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as socketConnection, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-DH94eh6f.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";

package/dist/next/index.d.ts

@@ -1,13 +1,13 @@
-import { Bn as DenialReason, Gt as Snapshot, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { Kn as DenialReason, T as Policy, Un as Decision, X as Intent, Zt as Snapshot, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
-import { n as PermDockWrap } from "../wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "../types-DHKPcqzr.js";
-import { n as DescribeMessages } from "../describe-ByS9LgHK.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { n as PermDockWrap } from "../wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "../types-B6ExllNo.js";
+import { n as DescribeMessages } from "../describe-BbFPBSms.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { ReactElement, ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/types.d.ts
@@ -34,6 +34,13 @@ type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
 };
 type GetPermDockQuery = {
   readonly tenant?: string;
+  /**
+   * Default `'read'`: with `claimsFirst(…, { versions })` the token may be
+   * judged from the shared version cache, at most its `maxStaleMs` stale. Pass
+   * `'write'` before a mutation outside `protectAction`, which always reads the
+   * version live.
+   */
+  readonly intent?: Intent;
 };
 type GetSnapshotQuery = GetPermDockQuery & {
   readonly include?: readonly (Permission | {

package/dist/next/index.js

@@ -3,12 +3,12 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { o as statusProblem, t as notFoundDetails } from "../problem-details-CLDgX1KV.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
 import { i as decisionProblem } from "../problem-BVLHFK33.js";
 import { s as resumeDecision } from "../helpers-DJicaG6f.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { _ as LOAD_FAILED, o as evaluationsHandler, v as NO_GRANT } from "../evaluations-IBceAeKT.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -63,7 +63,10 @@ function protectActionOf(deps) {
 		let permdock;
 		let data;
 		try {
-			permdock = await deps.getPermDock(compact({ tenant: options.tenant?.(input) }));
+			permdock = await deps.getPermDock(compact({
+				tenant: options.tenant?.(input),
+				intent: "write"
+			}));
 		} catch (error) {
 			deps.rethrow(error);
 			return refused(decisionProblem(NO_GRANT, permission, void 0));
@@ -181,7 +184,7 @@ function createPermDock(policy, given) {
 		return wrapInstance(options.wrap === void 0 ? traced : options.wrap(traced), options.onDenied);
 	};
 	const resolveFallbackTenant = cache(() => readTenant(options.tenant));
-	const instantiate = cache(async (tenantKey) => {
+	const instantiate = cache(async (tenantKey, intent) => {
 		const tenant = tenantKey === "" ? void 0 : tenantKey;
 		const user = await resolveSubject();
 		await io();
@@ -191,14 +194,15 @@ function createPermDock(policy, given) {
 			sources: options,
 			scope: {
 				tenant,
-				sink
+				sink,
+				intent
 			},
 			wrap: decorate
 		})).permdock;
 	});
 	const getPermDock = async (query) => {
 		const tenant = query?.tenant ?? await resolveFallbackTenant();
-		return instantiate(tenant ?? "");
+		return instantiate(tenant ?? "", query?.intent ?? "read");
 	};
 	const getPermission = async (permission, data, query) => {
 		try {
@@ -233,7 +237,10 @@ function createPermDock(policy, given) {
 		return snapshot;
 	};
 	const requirePermission = async (permission, data, requirement = {}) => {
-		const permdock = await getPermDock(requirement.tenant === void 0 ? void 0 : { tenant: requirement.tenant });
+		const permdock = await getPermDock(compact({
+			tenant: requirement.tenant,
+			intent: requirement.intent
+		}));
 		const assert = permdock.assert;
 		const handler = requirement.onDenied ?? options.onDenied;
 		return assert(permission, data, { onDenied: (decision) => {

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-DC1Loeh3.js";
+import { s as PermDockPluginOptions } from "../types-CzOeVvcC.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Cx_WciLE.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-BFDKqmUa.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,5 +1,5 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { r as bindKernel } from "../bind-BNQA9JK9.js";
 import { n as sendResponse, r as toRequest, t as isServerResponse } from "../http-DH94eh6f.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;

package/dist/openai/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { u as ApprovalRequest } from "../types-B_tiYvk8.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */
 type OpenAiContext = {

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
-import { t as approvalTokenOf } from "../kernel-C-fYydV2.js";
-import { t as agentRuntime } from "../create-Cq4Uox0f.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { t as approvalTokenOf } from "../kernel-qv4cr9w8.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, mr as Condition, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, br as Condition, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/{openapi-VeHHU2l9.js → openapi-BGeuunWC.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-Dst9I9Gs.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-BTsE1WRT.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts