permdock 0.0.0 → 0.2.0

package/package.json

@@ -1,8 +1,19 @@
 {
   "name": "permdock",
-  "version": "0.0.0",
-  "description": "Placeholder that reserves the name for PermDock. The first real release is 0.1.0.",
-  "homepage": "https://permdock.dev",
+  "version": "0.2.0",
+  "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
+  "keywords": [
+    "ai-agents",
+    "authorization",
+    "authzen",
+    "mcp",
+    "permissions",
+    "rbac",
+    "rls",
+    "tanstack-intent",
+    "typescript"
+  ],
+  "homepage": "https://permdock.com",
   "bugs": {
     "url": "https://github.com/ScaleDockHQ/permdock/issues"
   },
@@ -12,8 +23,442 @@
     "url": "git+https://github.com/ScaleDockHQ/permdock.git",
     "directory": "packages/permdock"
   },
+  "bin": {
+    "permdock": "./dist/cli/bin.js"
+  },
   "files": [
-    "README.md",
+    "dist",
+    "schemas",
+    "rulesets",
+    "skills",
     "LICENSE"
-  ]
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "imports": {
+    "#next/navigation": {
+      "react-server": "next/navigation",
+      "default": "next/navigation.js"
+    }
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./approvals": {
+      "types": "./dist/approvals/index.d.ts",
+      "default": "./dist/approvals/index.js"
+    },
+    "./jwt": {
+      "types": "./dist/jwt/index.d.ts",
+      "default": "./dist/jwt/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "default": "./dist/react/index.js"
+    },
+    "./react-native": {
+      "types": "./dist/react-native/index.d.ts",
+      "default": "./dist/react-native/index.js"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "default": "./dist/next/index.js"
+    },
+    "./next/plugin": {
+      "types": "./dist/next/plugin.d.ts",
+      "default": "./dist/next/plugin.js"
+    },
+    "./next/client": {
+      "types": "./dist/next/client.d.ts",
+      "default": "./dist/next/client.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    },
+    "./hono": {
+      "types": "./dist/hono/index.d.ts",
+      "default": "./dist/hono/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "default": "./dist/express/index.js"
+    },
+    "./fastify": {
+      "types": "./dist/fastify/index.d.ts",
+      "default": "./dist/fastify/index.js"
+    },
+    "./elysia": {
+      "types": "./dist/elysia/index.d.ts",
+      "default": "./dist/elysia/index.js"
+    },
+    "./nest": {
+      "types": "./dist/nest/index.d.ts",
+      "default": "./dist/nest/index.js"
+    },
+    "./node": {
+      "types": "./dist/node/index.d.ts",
+      "default": "./dist/node/index.js"
+    },
+    "./trpc": {
+      "types": "./dist/trpc/index.d.ts",
+      "default": "./dist/trpc/index.js"
+    },
+    "./orpc": {
+      "types": "./dist/orpc/index.d.ts",
+      "default": "./dist/orpc/index.js"
+    },
+    "./vue": {
+      "types": "./dist/vue/index.d.ts",
+      "default": "./dist/vue/index.js"
+    },
+    "./svelte": {
+      "types": "./dist/svelte/index.d.ts",
+      "svelte": "./dist/svelte/source.js",
+      "default": "./dist/svelte/index.js"
+    },
+    "./solid": {
+      "types": "./dist/solid/index.d.ts",
+      "default": "./dist/solid/index.js"
+    },
+    "./ai-sdk": {
+      "types": "./dist/ai-sdk/index.d.ts",
+      "default": "./dist/ai-sdk/index.js"
+    },
+    "./claude-agent": {
+      "types": "./dist/claude-agent/index.d.ts",
+      "default": "./dist/claude-agent/index.js"
+    },
+    "./eve": {
+      "types": "./dist/eve/index.d.ts",
+      "default": "./dist/eve/index.js"
+    },
+    "./openai": {
+      "types": "./dist/openai/index.d.ts",
+      "default": "./dist/openai/index.js"
+    },
+    "./mcp": {
+      "types": "./dist/mcp/index.d.ts",
+      "default": "./dist/mcp/index.js"
+    },
+    "./authzen": {
+      "types": "./dist/authzen/index.d.ts",
+      "default": "./dist/authzen/index.js"
+    },
+    "./openapi": {
+      "types": "./dist/openapi/index.d.ts",
+      "default": "./dist/openapi/index.js"
+    },
+    "./terminal": {
+      "types": "./dist/terminal/index.d.ts",
+      "default": "./dist/terminal/index.js"
+    },
+    "./webmcp": {
+      "types": "./dist/webmcp/index.d.ts",
+      "default": "./dist/webmcp/index.js"
+    },
+    "./a2a": {
+      "types": "./dist/a2a/index.d.ts",
+      "default": "./dist/a2a/index.js"
+    },
+    "./otel": {
+      "types": "./dist/otel/index.d.ts",
+      "default": "./dist/otel/index.js"
+    },
+    "./scim": {
+      "types": "./dist/scim/index.d.ts",
+      "default": "./dist/scim/index.js"
+    },
+    "./cloud": {
+      "types": "./dist/cloud/index.d.ts",
+      "default": "./dist/cloud/index.js"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle/index.d.ts",
+      "default": "./dist/drizzle/index.js"
+    },
+    "./prisma": {
+      "types": "./dist/prisma/index.d.ts",
+      "default": "./dist/prisma/index.js"
+    },
+    "./kysely": {
+      "types": "./dist/kysely/index.d.ts",
+      "default": "./dist/kysely/index.js"
+    },
+    "./supabase": {
+      "types": "./dist/supabase/index.d.ts",
+      "default": "./dist/supabase/index.js"
+    },
+    "./supabase/middleware": {
+      "types": "./dist/supabase/middleware.d.ts",
+      "default": "./dist/supabase/middleware.js"
+    },
+    "./ssf": {
+      "types": "./dist/ssf/index.d.ts",
+      "default": "./dist/ssf/index.js"
+    },
+    "./better-auth": {
+      "types": "./dist/better-auth/index.d.ts",
+      "default": "./dist/better-auth/index.js"
+    },
+    "./better-supabase": {
+      "types": "./dist/better-supabase/index.d.ts",
+      "default": "./dist/better-supabase/index.js"
+    },
+    "./clerk": {
+      "types": "./dist/clerk/index.d.ts",
+      "default": "./dist/clerk/index.js"
+    },
+    "./convex": {
+      "types": "./dist/convex/index.d.ts",
+      "default": "./dist/convex/index.js"
+    },
+    "./pdp": {
+      "types": "./dist/pdp/index.d.ts",
+      "default": "./dist/pdp/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    },
+    "./testing/saas": {
+      "types": "./dist/testing/saas/index.d.ts",
+      "default": "./dist/testing/saas/index.js"
+    },
+    "./testing/saas/permissions": {
+      "types": "./dist/testing/saas/permissions.d.ts",
+      "default": "./dist/testing/saas/permissions.js"
+    },
+    "./compile": {
+      "types": "./dist/compile/index.d.ts",
+      "default": "./dist/compile/index.js"
+    },
+    "./catalog": {
+      "types": "./dist/catalog/index.d.ts",
+      "default": "./dist/catalog/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "default": "./dist/cli/index.js"
+    },
+    "./unplugin": {
+      "types": "./dist/unplugin/index.d.ts",
+      "default": "./dist/unplugin/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@clack/prompts": "1.8.1",
+    "@standard-schema/spec": "1.1.0",
+    "citty": "0.2.2",
+    "diff": "9.0.0",
+    "jiti": "2.7.0",
+    "oxc-parser": "0.152.0",
+    "package-manager-detector": "1.8.0",
+    "smol-toml": "1.9.0"
+  },
+  "devDependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.288",
+    "@arethetypeswrong/cli": "0.18.5",
+    "@babel/core": "8.0.6",
+    "@modelcontextprotocol/client": "2.3.0",
+    "@modelcontextprotocol/server": "2.3.0",
+    "@nestjs/common": "12.1.2",
+    "@nestjs/core": "12.1.2",
+    "@nestjs/platform-express": "12.1.2",
+    "@openai/agents": "0.18.0",
+    "@orpc/contract": "2.0.0-beta.41",
+    "@orpc/openapi": "2.0.0-beta.41",
+    "@orpc/server": "2.0.0-beta.41",
+    "@permdock/ox-config": "0.0.0",
+    "@permdock/typescript-config": "0.0.0",
+    "@supabase/middleware": "1.0.0",
+    "@supabase/supabase-js": "2.117.2",
+    "@sveltejs/vite-plugin-svelte": "7.3.1",
+    "@trpc/server": "11.19.0",
+    "@types/express": "5.0.6",
+    "@types/node": "26.6.4",
+    "@types/pg": "8.23.1",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "@vitest/coverage-v8": "5.0.3",
+    "ai": "7.0.127",
+    "ajv": "8.20.0",
+    "babel-plugin-react-compiler": "1.0.0",
+    "better-supabase": "0.6.0",
+    "drizzle-orm": "1.0.0-rc.5-5935859",
+    "elysia": "1.4.30",
+    "eve": "0.71.3",
+    "express": "5.2.1",
+    "fastify": "5.12.5",
+    "happy-dom": "20.14.5",
+    "hono": "4.13.12",
+    "jose": "6.2.12",
+    "kysely": "0.29.6",
+    "next": "16.3.8",
+    "oxlint": "1.86.0",
+    "oxlint-tsgolint": "7.0.2003",
+    "pg": "8.23.1",
+    "pgsql-parser": "18.2.8",
+    "publint": "0.3.25",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
+    "solid-js": "1.9.15",
+    "svelte": "5.57.1",
+    "temporal-polyfill": "1.0.5",
+    "tsdown": "0.23.0",
+    "typescript": "7.0.2",
+    "unplugin": "3.4.0",
+    "valibot": "1.5.0",
+    "vitest": "5.0.3",
+    "vue": "3.5.43",
+    "yaml": "2.9.1",
+    "zod": "4.6.5"
+  },
+  "peerDependencies": {
+    "@anthropic-ai/claude-agent-sdk": ">=0.2",
+    "@modelcontextprotocol/server": ">=2",
+    "@nestjs/common": ">=11",
+    "@nestjs/core": ">=11",
+    "@nestjs/platform-express": ">=11",
+    "@openai/agents": ">=0.1",
+    "@opentelemetry/api": ">=1",
+    "@orpc/server": ">=2.0.0-0",
+    "@supabase/middleware": ">=1",
+    "@trpc/server": ">=11",
+    "ai": ">=5",
+    "better-supabase": ">=0.6.0 <0.7.0",
+    "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
+    "elysia": ">=1",
+    "eve": ">=0.40",
+    "express": ">=4",
+    "fastify": ">=5",
+    "hono": ">=4",
+    "jose": "^6",
+    "kysely": ">=0.27",
+    "next": ">=16.3",
+    "pg": ">=8",
+    "pgsql-parser": ">=18",
+    "react": "^19",
+    "reflect-metadata": ">=0.1",
+    "rxjs": ">=7",
+    "solid-js": ">=1.9",
+    "svelte": ">=5.3",
+    "unplugin": ">=2",
+    "vitest": ">=3",
+    "vue": ">=3"
+  },
+  "peerDependenciesMeta": {
+    "@anthropic-ai/claude-agent-sdk": {
+      "optional": true
+    },
+    "@modelcontextprotocol/server": {
+      "optional": true
+    },
+    "@nestjs/common": {
+      "optional": true
+    },
+    "@nestjs/core": {
+      "optional": true
+    },
+    "@nestjs/platform-express": {
+      "optional": true
+    },
+    "@openai/agents": {
+      "optional": true
+    },
+    "@opentelemetry/api": {
+      "optional": true
+    },
+    "@orpc/server": {
+      "optional": true
+    },
+    "@supabase/middleware": {
+      "optional": true
+    },
+    "@trpc/server": {
+      "optional": true
+    },
+    "ai": {
+      "optional": true
+    },
+    "better-supabase": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "elysia": {
+      "optional": true
+    },
+    "eve": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    },
+    "fastify": {
+      "optional": true
+    },
+    "hono": {
+      "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "kysely": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    },
+    "pgsql-parser": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "reflect-metadata": {
+      "optional": true
+    },
+    "rxjs": {
+      "optional": true
+    },
+    "solid-js": {
+      "optional": true
+    },
+    "svelte": {
+      "optional": true
+    },
+    "unplugin": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "bench": "vitest bench --run --project \"node (bench)\" --reporter=verbose",
+    "build": "tsdown",
+    "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "lint": "oxlint --disable-nested-config --type-aware",
+    "test": "vitest run --coverage",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tests/tsconfig.json"
+  }
 }

package/rulesets/permdock.yaml

@@ -0,0 +1,29 @@
+# Spectral / Redocly / vacuum ruleset for PermDock OpenAPI output.
+# Compose: point your existing linter at this file. PermDock does not wrap those tools.
+rules:
+  permdock-permissions-need-security:
+    description: Operations with x-permdock-permissions must also declare security.
+    given: $.paths[*][*]
+    severity: error
+    then:
+      field: security
+      function: truthy
+    # Only meaningful when x-permdock-permissions is present; appliers should
+    # combine this with a filter in their own ruleset if they lint the whole spec.
+  permdock-no-unregistered-x-oai:
+    description: Only registered x-oai-* names may appear.
+    given: $..
+    severity: error
+    then:
+      function: pattern
+      functionOptions:
+        notMatch: x-oai-(?!deprecated$|deviceAuthorization$|deviceAuthorizationUrl$)
+  permdock-overlay-no-security-remove:
+    description: Overlays must not remove security metadata.
+    given: $.actions[?(@.remove == true)]
+    severity: error
+    then:
+      field: target
+      function: pattern
+      functionOptions:
+        notMatch: security

package/schemas/approval-request-v1.json

@@ -0,0 +1,175 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://permdock.com/schemas/approval-request-v1.json",
+  "title": "PermDock approval request",
+  "description": "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
+  "type": "object",
+  "required": [
+    "v",
+    "token",
+    "permission",
+    "scope",
+    "resource",
+    "subject",
+    "detail",
+    "createdAt",
+    "expiresAt",
+    "status"
+  ],
+  "properties": {
+    "v": {
+      "const": 1
+    },
+    "token": {
+      "type": "string",
+      "minLength": 1
+    },
+    "permission": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "string"
+    },
+    "resource": {
+      "type": "object",
+      "required": ["type"],
+      "properties": {
+        "type": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        }
+      }
+    },
+    "subject": {
+      "$ref": "#/$defs/subject"
+    },
+    "membership": {
+      "type": "object",
+      "required": ["roles"],
+      "properties": {
+        "roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "approvers": {
+      "type": "object"
+    },
+    "detail": {
+      "type": "string"
+    },
+    "adapter": {
+      "type": "string"
+    },
+    "createdAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "expiresAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "status": {
+      "enum": ["pending", "approved", "rejected", "expired"]
+    },
+    "approvals": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/signature"
+      }
+    },
+    "resolvedAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "resolvedBy": {
+      "type": "string"
+    },
+    "vouched": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "consumedAt": {
+      "$ref": "#/$defs/instant"
+    }
+  },
+  "$defs": {
+    "instant": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "subject": {
+      "type": "object",
+      "required": ["principal"],
+      "properties": {
+        "principal": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": ["id", "roles"],
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "roles": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "tenant": {
+                  "type": "string"
+                }
+              }
+            }
+          ]
+        },
+        "actor": {
+          "type": "object",
+          "required": ["id", "kind"],
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "kind": {
+              "type": "string"
+            }
+          }
+        },
+        "session": {
+          "type": "string"
+        },
+        "delegation": {
+          "type": "object"
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": ["by", "at"],
+      "properties": {
+        "by": {
+          "type": "string"
+        },
+        "at": {
+          "$ref": "#/$defs/instant"
+        },
+        "stage": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "vouched": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}