@vendure-platform/create 0.5.0 → 1.0.0-major.202609091053.0.0

package/dist/assets/storefront/src/lib/use-recent-searches.ts

@@ -1,6 +1,6 @@
 'use client';
 
-import { useState, useCallback } from 'react';
+import { useCallback, useState } from 'react';
 
 const STORAGE_KEY = 'vendure-recent-searches';
 const MAX_RECENT = 5;
@@ -11,7 +11,9 @@ function readFromStorage(): string[] {
         const raw = localStorage.getItem(STORAGE_KEY);
         if (!raw) return [];
         const parsed = JSON.parse(raw);
-        return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === 'string').slice(0, MAX_RECENT) : [];
+        return Array.isArray(parsed)
+            ? parsed.filter((s): s is string => typeof s === 'string').slice(0, MAX_RECENT)
+            : [];
     } catch {
         return [];
     }
@@ -31,16 +33,16 @@ export function useRecentSearches() {
     const addSearch = useCallback((term: string) => {
         const trimmed = term.trim();
         if (!trimmed) return;
-        setSearches(prev => {
-            const next = [trimmed, ...prev.filter(s => s !== trimmed)].slice(0, MAX_RECENT);
+        setSearches((prev) => {
+            const next = [trimmed, ...prev.filter((s) => s !== trimmed)].slice(0, MAX_RECENT);
             writeToStorage(next);
             return next;
         });
     }, []);
 
     const removeSearch = useCallback((term: string) => {
-        setSearches(prev => {
-            const next = prev.filter(s => s !== term);
+        setSearches((prev) => {
+            const next = prev.filter((s) => s !== term);
             writeToStorage(next);
             return next;
         });

package/dist/assets/storefront/src/lib/utils.ts

@@ -1,6 +1,6 @@
-import { clsx, type ClassValue } from "clsx"
-import { twMerge } from "tailwind-merge"
+import { clsx, type ClassValue } from 'clsx';
+import { twMerge } from 'tailwind-merge';
 
 export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs))
+    return twMerge(clsx(inputs));
 }

package/dist/assets/storefront/src/lib/vendure/actions.ts

@@ -1,8 +1,4 @@
-import {client} from './api';
-import {GetActiveCustomerQuery, GetCompanyAccountQuery, GetMyCompaniesQuery, type CompanyUserCompany} from './queries';
-import {getActiveChannelCached} from './cached';
-import {cache} from "react";
-import {readFragment, ResultOf} from "@/graphql";
+import { readFragment, ResultOf } from '@/graphql';
 import {
     ActiveCustomerFragment,
     CompanyBusinessUnitFragment,
@@ -10,7 +6,16 @@ import {
     CompanyPermissionFragment,
     CompanyRoleFragment,
     CompanyUserFragment,
-} from "@/lib/vendure/fragments";
+} from '@/lib/vendure/fragments';
+import { cache } from 'react';
+import { client } from './api';
+import { getActiveChannelCached } from './cached';
+import {
+    GetActiveCustomerQuery,
+    GetCompanyAccountQuery,
+    GetMyCompaniesQuery,
+    type CompanyUserCompany,
+} from './queries';
 
 type CompanyRoleData = Omit<ResultOf<typeof CompanyRoleFragment>, 'permissions'> & {
     permissions: ResultOf<typeof CompanyPermissionFragment>[];
@@ -34,7 +39,7 @@ export const getActiveCustomer = cache(async () => {
         return null;
     }
     return readFragment(ActiveCustomerFragment, result.data.activeCustomer);
-})
+});
 
 export const getCompanyAccount = cache(async (): Promise<CompanyAccount | null> => {
     const [result, error] = await client.query(GetCompanyAccountQuery);
@@ -52,14 +57,14 @@ export const getCompanyAccount = cache(async (): Promise<CompanyAccount | null>
 
     const companyUser: CompanyUserData = {
         ...rawUser,
-        companyRoles: rawUser.companyRoles.map(r => {
+        companyRoles: rawUser.companyRoles.map((r) => {
             const role = readFragment(CompanyRoleFragment, r);
             return {
                 ...role,
-                permissions: role.permissions.map(p => readFragment(CompanyPermissionFragment, p)),
+                permissions: role.permissions.map((p) => readFragment(CompanyPermissionFragment, p)),
             };
         }),
-        businessUnits: rawUser.businessUnits.map(bu => readFragment(CompanyBusinessUnitFragment, bu)),
+        businessUnits: rawUser.businessUnits.map((bu) => readFragment(CompanyBusinessUnitFragment, bu)),
     };
 
     return {
@@ -76,8 +81,8 @@ export const getMyCompanies = cache(async (): Promise<CompanyUserCompany[]> => {
     const customer = result.data.activeCustomer;
     if (!customer) return [];
     return customer.companyUsers
-        .filter(cu => cu.state === 'Active')
-        .map(cu => ({ id: cu.company.id, name: cu.company.name, state: cu.company.state }));
+        .filter((cu) => cu.state === 'Active')
+        .map((cu) => ({ id: cu.company.id, name: cu.company.name, state: cu.company.state }));
 });
 
 /**
@@ -86,10 +91,7 @@ export const getMyCompanies = cache(async (): Promise<CompanyUserCompany[]> => {
  * to getMyCompanies (which includes pending companies via CompanyUser state).
  */
 export const getHasCompany = cache(async (): Promise<boolean> => {
-    const [companyAccount, companies] = await Promise.all([
-        getCompanyAccount(),
-        getMyCompanies(),
-    ]);
+    const [companyAccount, companies] = await Promise.all([getCompanyAccount(), getMyCompanies()]);
     return !!companyAccount || companies.length > 0;
 });
 

package/dist/assets/storefront/src/lib/vendure/api.ts

@@ -1,5 +1,5 @@
-import {createClient} from '@vendure-platform/storefront-client';
-import type {RequestMiddleware} from '@vendure-platform/storefront-client';
+import type { RequestMiddleware } from '@vendure-platform/storefront-client';
+import { createClient } from '@vendure-platform/storefront-client';
 
 const DRAFT_MODE_SECRET = process.env.DRAFT_MODE_SECRET;
 
@@ -11,7 +11,7 @@ const DRAFT_MODE_SECRET = process.env.DRAFT_MODE_SECRET;
 const draftModeMiddleware: RequestMiddleware = async (req, next) => {
     if (DRAFT_MODE_SECRET) {
         try {
-            const {draftMode} = await import('next/headers');
+            const { draftMode } = await import('next/headers');
             const draft = await draftMode();
             if (draft.isEnabled) {
                 const url = new URL(req.url);
@@ -26,35 +26,44 @@ const draftModeMiddleware: RequestMiddleware = async (req, next) => {
 };
 
 const VENDURE_API_URL = process.env.VENDURE_SHOP_API_URL || process.env.NEXT_PUBLIC_VENDURE_SHOP_API_URL;
-const VENDURE_CHANNEL_TOKEN = process.env.VENDURE_CHANNEL_TOKEN || process.env.NEXT_PUBLIC_VENDURE_CHANNEL_TOKEN;
+const VENDURE_CHANNEL_TOKEN =
+    process.env.VENDURE_CHANNEL_TOKEN || process.env.NEXT_PUBLIC_VENDURE_CHANNEL_TOKEN;
 const VENDURE_AUTH_TOKEN_HEADER = process.env.VENDURE_AUTH_TOKEN_HEADER || 'vendure-auth-token';
 const VENDURE_CHANNEL_TOKEN_HEADER = process.env.VENDURE_CHANNEL_TOKEN_HEADER || 'vendure-token';
 
 if (!VENDURE_API_URL) {
-    throw new Error('VENDURE_SHOP_API_URL or NEXT_PUBLIC_VENDURE_SHOP_API_URL environment variable is not set');
+    throw new Error(
+        'VENDURE_SHOP_API_URL or NEXT_PUBLIC_VENDURE_SHOP_API_URL environment variable is not set',
+    );
 }
 
 // Dynamic imports to avoid Next.js static analysis marking this module as dynamic.
 // cookies() is only available in request context — providers gracefully return undefined otherwise.
 async function safeGetAuthToken(): Promise<string | undefined> {
     try {
-        const {getAuthToken} = await import('@/lib/auth');
+        const { getAuthToken } = await import('@/lib/auth');
         return await getAuthToken();
-    } catch { return undefined; }
+    } catch {
+        return undefined;
+    }
 }
 
 async function safeGetCompanyId(): Promise<string | undefined> {
     try {
-        const {getCompanyId} = await import('@/lib/company-context');
+        const { getCompanyId } = await import('@/lib/company-context');
         return await getCompanyId();
-    } catch { return undefined; }
+    } catch {
+        return undefined;
+    }
 }
 
 async function safeGetBusinessUnitId(): Promise<string | undefined> {
     try {
-        const {getBusinessUnitId} = await import('@/lib/company-context');
+        const { getBusinessUnitId } = await import('@/lib/company-context');
         return await getBusinessUnitId();
-    } catch { return undefined; }
+    } catch {
+        return undefined;
+    }
 }
 
 /**
@@ -65,16 +74,20 @@ async function safeGetBusinessUnitId(): Promise<string | undefined> {
  */
 async function safeGetChannelToken(): Promise<string | undefined> {
     try {
-        const {getActiveChannelToken} = await import('@/lib/channel-server');
+        const { getActiveChannelToken } = await import('@/lib/channel-server');
         return await getActiveChannelToken();
-    } catch { return undefined; }
+    } catch {
+        return undefined;
+    }
 }
 
 async function safeGetLanguageCode(): Promise<string | undefined> {
     try {
-        const {getLocale} = await import('next-intl/server');
+        const { getLocale } = await import('next-intl/server');
         return await getLocale();
-    } catch { return undefined; }
+    } catch {
+        return undefined;
+    }
 }
 
 const sharedConfig = {
@@ -95,7 +108,7 @@ const sharedConfig = {
  */
 const currencyMiddleware: RequestMiddleware = async (req, next) => {
     try {
-        const {getActiveCurrencyCode} = await import('@/lib/currency-server');
+        const { getActiveCurrencyCode } = await import('@/lib/currency-server');
         const currency = await getActiveCurrencyCode();
         const url = new URL(req.url);
         url.searchParams.set('currencyCode', currency);
@@ -130,7 +143,7 @@ export const client = createClient({
  * access cookies, headers, or draftMode. Pass languageCode and currencyCode explicitly
  * as query options from the calling function.
  */
-export const publicClient = createClient({...sharedConfig});
+export const publicClient = createClient({ ...sharedConfig });
 
 /**
  * Pre-resolved context for use at cache boundaries where cookies() is not available.
@@ -149,20 +162,20 @@ export interface VendureContext {
  * Use this at cache boundaries ('use cache') where providers can't access cookies().
  */
 export async function getVendureContext(): Promise<VendureContext> {
-    const {getAuthToken} = await import('@/lib/auth');
+    const { getAuthToken } = await import('@/lib/auth');
     const authToken = await getAuthToken();
     let companyId: string | undefined;
     let businessUnitId: string | undefined;
     try {
-        const {getCompanyId, getBusinessUnitId} = await import('@/lib/company-context');
+        const { getCompanyId, getBusinessUnitId } = await import('@/lib/company-context');
         companyId = await getCompanyId();
         businessUnitId = await getBusinessUnitId();
     } catch {}
-    const {getActiveChannelToken} = await import('@/lib/channel-server');
+    const { getActiveChannelToken } = await import('@/lib/channel-server');
     const channelToken = await getActiveChannelToken();
-    const {getRouteLocale} = await import('@/i18n/server');
+    const { getRouteLocale } = await import('@/i18n/server');
     const locale = await getRouteLocale();
-    const {getActiveCurrencyCode} = await import('@/lib/currency-server');
+    const { getActiveCurrencyCode } = await import('@/lib/currency-server');
     const currencyCode = await getActiveCurrencyCode();
-    return {authToken, channelToken, companyId, businessUnitId, locale, currencyCode};
+    return { authToken, channelToken, companyId, businessUnitId, locale, currencyCode };
 }

package/dist/assets/storefront/src/lib/vendure/approval-utils.ts

@@ -1,21 +1,22 @@
-import {client} from '@/lib/vendure/api';
-import type {VendureContext} from '@/lib/vendure/api';
-import {GetApprovalHistoryForEntityQuery} from '@/lib/vendure/queries';
+import type { VendureContext } from '@/lib/vendure/api';
+import { client } from '@/lib/vendure/api';
+import { GetApprovalHistoryForEntityQuery } from '@/lib/vendure/queries';
 
 export async function getLatestApprovalForOrder(orderId: string, ctx?: VendureContext) {
     const queryArgs = { entityType: 'Order', entityId: orderId } as const;
     const [result] = ctx
         ? await client.query(GetApprovalHistoryForEntityQuery, queryArgs, ctx)
         : await client.query(GetApprovalHistoryForEntityQuery, queryArgs);
-    const history = [...(result?.data?.approvalHistoryForEntity ?? [])]
-        .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const history = [...(result?.data?.approvalHistoryForEntity ?? [])].sort(
+        (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),
+    );
     const latestApproval = history[0] ?? null;
     const changesRequested = latestApproval?.status === 'CHANGES_REQUESTED';
     const changesComment = changesRequested
         ? latestApproval.decisions
-            ?.filter((d: any) => d.decision === 'CHANGES_REQUESTED' && d.comment)
-            .map((d: any) => d.comment)
-            .at(-1) ?? null
+              ?.filter((d: any) => d.decision === 'CHANGES_REQUESTED' && d.comment)
+              .map((d: any) => d.comment)
+              .at(-1) ?? null
         : null;
     return { latestApproval, changesRequested, changesComment };
 }

package/dist/assets/storefront/src/lib/vendure/cached.ts

@@ -1,6 +1,6 @@
-import {cacheLife, cacheTag} from 'next/cache';
-import {publicClient} from './api';
-import {GetActiveChannelQuery, GetAvailableCountriesQuery, GetTopCollectionsQuery} from './queries';
+import { cacheLife, cacheTag } from 'next/cache';
+import { publicClient } from './api';
+import { GetActiveChannelQuery, GetAvailableCountriesQuery, GetTopCollectionsQuery } from './queries';
 
 /**
  * Get the active channel with caching enabled.
@@ -19,11 +19,18 @@ export async function getActiveChannelCached(channelToken?: string) {
     const [result, error] = await publicClient.query(
         GetActiveChannelQuery,
         undefined,
-        channelToken ? {channelToken} : undefined,
+        channelToken ? { channelToken } : undefined,
     );
     if (error) {
         // Vendure API unavailable during build
-        return { id: '', code: '', defaultLanguageCode: 'en' as const, availableLanguageCodes: [], defaultCurrencyCode: 'USD' as const, availableCurrencyCodes: [] };
+        return {
+            id: '',
+            code: '',
+            defaultLanguageCode: 'en' as const,
+            availableLanguageCodes: [],
+            defaultCurrencyCode: 'USD' as const,
+            availableCurrencyCodes: [],
+        };
     }
     return result.data.activeChannel;
 }
@@ -38,11 +45,10 @@ export async function getAvailableCountriesCached(locale: string, channelToken?:
     cacheLife('max');
     cacheTag(`countries-${locale}${channelToken ? `-${channelToken}` : ''}`);
 
-    const [result, error] = await publicClient.query(
-        GetAvailableCountriesQuery,
-        undefined,
-        {languageCode: locale, ...(channelToken ? {channelToken} : {})},
-    );
+    const [result, error] = await publicClient.query(GetAvailableCountriesQuery, undefined, {
+        languageCode: locale,
+        ...(channelToken ? { channelToken } : {}),
+    });
     if (error) {
         return [];
     }
@@ -59,11 +65,10 @@ export async function getTopCollections(locale: string, channelToken?: string) {
     cacheLife('days');
     cacheTag(`collections-${locale}${channelToken ? `-${channelToken}` : ''}`);
 
-    const [result, error] = await publicClient.query(
-        GetTopCollectionsQuery,
-        undefined,
-        {languageCode: locale, ...(channelToken ? {channelToken} : {})},
-    );
+    const [result, error] = await publicClient.query(GetTopCollectionsQuery, undefined, {
+        languageCode: locale,
+        ...(channelToken ? { channelToken } : {}),
+    });
     if (error) {
         return [];
     }

package/dist/assets/storefront/src/lib/vendure/capability-documents.ts

@@ -0,0 +1,246 @@
+import { hasCapability } from '@/config/capabilities';
+import type {
+    DefinitionNode,
+    DocumentNode,
+    FieldNode,
+    FragmentDefinitionNode,
+    SelectionNode,
+    SelectionSetNode,
+} from 'graphql';
+import { visit } from 'graphql';
+
+/**
+ * A selection to drop, written as the path of field names from the operation
+ * root, e.g. `['product', 'customFields', 'configuratorSystemCode']`.
+ */
+export type FieldPath = readonly string[];
+
+export interface CapabilityDocumentRule {
+    capability: string;
+    paths: readonly FieldPath[];
+}
+
+export interface CapabilityDocumentRegistration<T extends DocumentNode = DocumentNode> {
+    name: string;
+    fullDocument: T;
+    rules: readonly CapabilityDocumentRule[];
+}
+
+/** Capability-owned storefront documents, used by the schema composition tests. */
+export const STOREFRONT_CAPABILITY_DOCUMENTS: CapabilityDocumentRegistration[] = [];
+
+function isField(selection: SelectionNode): selection is FieldNode {
+    return selection.kind === 'Field';
+}
+
+function fieldName(field: FieldNode): string {
+    return field.name.value;
+}
+
+function addOperationFallback<T extends DocumentNode>(document: T): T {
+    return {
+        ...document,
+        definitions: document.definitions.map((definition) => {
+            if (definition.kind !== 'OperationDefinition') return definition;
+            if (
+                definition.selectionSet.selections.some(
+                    (selection) => isField(selection) && fieldName(selection) === '__typename',
+                )
+            ) {
+                return definition;
+            }
+            return {
+                ...definition,
+                selectionSet: {
+                    ...definition.selectionSet,
+                    selections: [
+                        ...definition.selectionSet.selections,
+                        { kind: 'Field', name: { kind: 'Name', value: '__typename' } },
+                    ],
+                },
+            };
+        }),
+    } as T;
+}
+
+function fragmentSpreads(selectionSet: SelectionSetNode): string[] {
+    const names: string[] = [];
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === 'FragmentSpread') {
+            names.push(selection.name.value);
+        } else if (selection.kind === 'Field' && selection.selectionSet) {
+            names.push(...fragmentSpreads(selection.selectionSet));
+        } else if (selection.kind === 'InlineFragment') {
+            names.push(...fragmentSpreads(selection.selectionSet));
+        }
+    }
+    return names;
+}
+
+function removeUnusedFragments(definitions: readonly DefinitionNode[]): readonly DefinitionNode[] {
+    const fragments = new Map<string, FragmentDefinitionNode>();
+    for (const definition of definitions) {
+        if (definition.kind === 'FragmentDefinition') {
+            fragments.set(definition.name.value, definition);
+        }
+    }
+
+    const used = new Set<string>();
+    const pending = definitions
+        .filter((definition) => definition.kind === 'OperationDefinition')
+        .flatMap((definition) => fragmentSpreads(definition.selectionSet));
+    while (pending.length > 0) {
+        const name = pending.pop()!;
+        if (used.has(name)) continue;
+        used.add(name);
+        const fragment = fragments.get(name);
+        if (fragment) pending.push(...fragmentSpreads(fragment.selectionSet));
+    }
+
+    return definitions.filter(
+        (definition) => definition.kind !== 'FragmentDefinition' || used.has(definition.name.value),
+    );
+}
+
+function removeUnusedVariables(definitions: readonly DefinitionNode[]): readonly DefinitionNode[] {
+    const used = new Set<string>();
+    visit({ kind: 'Document', definitions } as DocumentNode, {
+        VariableDefinition() {
+            return false;
+        },
+        Variable(node) {
+            used.add(node.name.value);
+        },
+    });
+
+    return definitions.map((definition) => {
+        if (definition.kind !== 'OperationDefinition' || !definition.variableDefinitions) {
+            return definition;
+        }
+        return {
+            ...definition,
+            variableDefinitions: definition.variableDefinitions.filter((variable) =>
+                used.has(variable.variable.name.value),
+            ),
+        };
+    });
+}
+
+/**
+ * Returns `selectionSet` with `path` removed, or `null` when removing it would
+ * leave an empty selection set — GraphQL has no syntax for one, so the caller
+ * drops the parent field instead.
+ */
+function stripPath(selectionSet: SelectionSetNode, path: FieldPath): SelectionSetNode | null {
+    const [head, ...rest] = path;
+    const selections: SelectionNode[] = [];
+
+    for (const selection of selectionSet.selections) {
+        if (!isField(selection) || fieldName(selection) !== head) {
+            selections.push(selection);
+            continue;
+        }
+        if (rest.length === 0) {
+            // Leaf reached: drop it by not re-adding it.
+            continue;
+        }
+        if (!selection.selectionSet) {
+            selections.push(selection);
+            continue;
+        }
+        const nested = stripPath(selection.selectionSet, rest);
+        if (nested) {
+            selections.push({ ...selection, selectionSet: nested });
+        }
+    }
+
+    return selections.length > 0 ? { ...selectionSet, selections } : null;
+}
+
+/**
+ * Removes capability-gated selections from a GraphQL document.
+ *
+ * The server composes its schema from the capability modules the deployment is
+ * entitled to, so selecting a field owned by an absent module fails validation
+ * on every request. Rather than maintaining a hand-written copy of each
+ * document per composition, the full document stays the single typed source of
+ * truth and the selections a composition cannot serve are pruned from it here.
+ *
+ * The returned document keeps the input's TypeScript type: a pruned field is
+ * `undefined` at runtime, so consumers must treat capability-gated data as
+ * optional. That is the same contract they already need for a field the server
+ * may legitimately return as null.
+ */
+export function stripCapabilityFields<T extends DocumentNode>(document: T, paths: FieldPath[]): T {
+    if (paths.length === 0) {
+        return document;
+    }
+    let definitions = document.definitions;
+    for (const path of paths) {
+        definitions = definitions.map((definition) => {
+            if (definition.kind !== 'OperationDefinition' && definition.kind !== 'FragmentDefinition') {
+                return definition;
+            }
+            const stripped = stripPath(definition.selectionSet, path);
+            if (!stripped) {
+                // Every selection collapsed, which GraphQL cannot express. A
+                // prune list that empties a whole operation is a mistake in the
+                // capability mapping, not something to paper over by keeping
+                // the field that was supposed to be removed.
+                throw new Error(
+                    `Pruning "${path.join('.')}" would leave an empty selection set. ` +
+                        'Split the document instead of pruning its only selection.',
+                );
+            }
+            return { ...definition, selectionSet: stripped };
+        });
+    }
+    const usedDefinitions = removeUnusedFragments(definitions);
+    return { ...document, definitions: removeUnusedVariables(usedDefinitions) } as T;
+}
+
+/**
+ * Convenience wrapper: prunes `paths` only when `granted` is false.
+ */
+export function whenGranted<T extends DocumentNode>(granted: boolean, document: T, paths: FieldPath[]): T {
+    return granted ? document : stripCapabilityFields(addOperationFallback(document), paths);
+}
+
+/**
+ * Registers and composes one typed storefront document from capability rules.
+ * The full typed document remains the source of truth. Missing grants prune
+ * only the selections that their modules own.
+ */
+export function composeCapabilityDocument<T extends DocumentNode>(
+    document: T,
+    rules: readonly CapabilityDocumentRule[],
+): T {
+    const operation = document.definitions.find((definition) => definition.kind === 'OperationDefinition');
+    const name = operation?.name?.value;
+    if (!name) {
+        throw new Error('Capability-composed storefront documents must use a named operation.');
+    }
+    STOREFRONT_CAPABILITY_DOCUMENTS.push({ name, fullDocument: document, rules });
+    return composeCapabilityDocumentFor(document, rules, (capability) => hasCapability(capability));
+}
+
+/** Compose a registered document for an explicit grant set in tests. */
+export function composeCapabilityDocumentFor<T extends DocumentNode>(
+    document: T,
+    rules: readonly CapabilityDocumentRule[],
+    granted: (capability: string) => boolean,
+): T {
+    return rules.reduce(
+        (composed, rule) => whenGranted(granted(rule.capability), composed, [...rule.paths]),
+        document,
+    );
+}
+
+/** Registers a document owned by one capability. */
+export function forCapability<T extends DocumentNode>(
+    capability: string,
+    document: T,
+    paths: readonly FieldPath[],
+): T {
+    return composeCapabilityDocument(document, [{ capability, paths }]);
+}