agent-safe-spl 0.3.0

What's changed

The 0.3.0 functional changes are limited to sdk/js; the version bump on sdk/python and sdk/rust keeps the SDKs version-locked.

Fixed (sdk/js)

• now symbol resolution. resolveSymbol previously read ctx.vars?.now, but verify and verifyToken set ctx.now. Any policy using (before now <expires>) silently resolved the symbol's name as the literal string "now" and string-compared against the right-hand side. Now reads from ctx.now first, falls back to ctx.vars?.now for backward compatibility, and throws under ctx.strict.

Added (sdk/js)

• vars symbol binding. (get vars "key") now resolves to the same value as the bare-symbol form key, mirroring how req is exposed. Bare-symbol var lookup continues to work unchanged.

Tests

• Two regression tests cover both behaviours (one for (before now ...) driven through verify with only ctx.now set; one asserting (get vars "key") matches the bare-symbol form).