@ultimat3/core 25.0.0 → 25.1.0

package/README.md

@@ -11,6 +11,7 @@ Zero dependencies, zero `@ultimat3/*` imports.
 | the one lazy `AsyncLocalStorage`, every ambient scope in the framework | `async-context.ts` |
 | request context on that seam | `context.ts` |
 | `Actor` (`user \| service \| agent \| anonymous`) | `actor.ts` |
+| whether a permission grant reaches a name — `grantCovers`, `*` and `<prefix>:*` | `actor.ts` |
 | acting as another actor, with an origin and a reason | `impersonate.ts` |
 | is an error worth retrying? one classification per code | `error-retry.ts` |
 | how long to wait before the next attempt — one curve, one jitter table | `backoff.ts` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/core",
-  "version": "25.0.0",
+  "version": "25.1.0",
   "description": "Ultimate's foundation: errors, context, env, config, clock, ids, logging, telemetry, lifecycle",
   "license": "MIT",
   "type": "module",
@@ -37,6 +37,6 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/schema": "25.0.0"
+    "@ultimat3/schema": "25.1.0"
   }
 }

package/src/actor.ts

@@ -202,6 +202,18 @@ export function hasScope(actor: Actor, scope: string): boolean {
   return actor.scopes.includes(scope);
 }
 
+/**
+ * Whether one permission grant reaches `wanted`: `*` reaches everything, `<prefix>:*` every name
+ * beginning `<prefix>:` (any depth), anything else only itself. The PREFIX, never the first
+ * segment: `billing:invoice:*` read as "all of `billing`" granted refunds to an invoice clerk.
+ * Here, at tier 0, because `@ultimat3/policy` (`can()`) and `@ultimat3/auth` (an API key's cut
+ * to its owner) are one tier and may not share a copy — two copies were how it drifted.
+ */
+export function grantCovers(grant: string, wanted: string): boolean {
+  if (grant === '*' || grant === wanted) return true;
+  return grant.endsWith(':*') && wanted.startsWith(grant.slice(0, -1));
+}
+
 /**
  * Attach resolved facts to an actor, once, at the request boundary — the one place that already
  * awaited the database. Returns a new frozen actor, so the actor a predicate reads later cannot

package/src/index.ts

@@ -36,6 +36,7 @@ export {
   actorOrigin,
   agentActor,
   anonymousActor,
+  grantCovers,
   hasRole,
   hasScope,
   isActorKind,

package/src/pg-executor.ts

@@ -6,8 +6,8 @@
  * One method, positional parameters. **`Bun.sql` does not satisfy it** — `Bun.sql.query` is
  * `undefined`; it is a tagged template whose positional form is `unsafe`, so `{ executor: Bun.sql }`
  * would `TypeError` on the first statement. What satisfies it is a client that already speaks
- * `(text, values)`, wrapped in one line — `@ultimat3/cli`'s `pgExecutorFor(client)` over
- * `@ultimat3/db`'s `DbClient.query({ text, values })` is the framework's own — or a transaction
+ * `(text, values)` — `@ultimat3/db`'s `dbExecutor()` over `DbClient.query({ text, values })` is
+ * the framework's own, and its one builder — or a transaction
  * handle, which is a client on its own connection. It answers rows, never a command tag.
  */
 export interface PgExecutor {