permdock 0.1.0 → 0.2.0

package/dist/views-Soe7bGSC.js

@@ -0,0 +1,95 @@
+//#region src/client/views.ts
+function permissionSet(store, permissions, data) {
+	const granted = [];
+	const byKey = {};
+	for (const permission of permissions) {
+		const state = store.permissionState(permission, data);
+		byKey[permission.key] = state;
+		if (state.allowed) granted.push(permission);
+	}
+	return new Proxy({
+		granted,
+		get(permission) {
+			return byKey[permission.key];
+		}
+	}, { get(target, prop, receiver) {
+		if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+function filterResult(permdock, permission, rows) {
+	const result = permdock.filter(permission, rows);
+	result.partial = permdock.where(permission).partial;
+	return result;
+}
+function tenantView(permdock) {
+	return {
+		tenant: permdock.subject.principal?.tenant ?? null,
+		tenants: permdock.tenants(),
+		switchTo: (id) => permdock.refresh({ tenant: id }),
+		status: permdock.status()
+	};
+}
+function rolesView(permdock, options) {
+	return { roles: (options.team === void 0 ? permdock : permdock.team(options.team)).heldRoles(options.tenant === void 0 ? void 0 : { tenant: options.tenant }) };
+}
+function subjectView(permdock) {
+	const snapshot = permdock.snapshot();
+	return {
+		principal: permdock.subject.principal,
+		actor: permdock.subject.actor,
+		delegation: permdock.subject.delegation,
+		expiresAt: permdock.subject.expiresAt,
+		simulated: typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true
+	};
+}
+/** The root's view of another tenant for a `Protected` with a `tenant` prop; `undefined` answers the active one. */
+function scopedTenant(root, tenant) {
+	return tenant === void 0 ? void 0 : root.tenant(tenant);
+}
+/** An instance whose every read answers from `current()`, so a held reference follows the store. */
+function livePermDock(current) {
+	return new Proxy({}, { get(_target, prop, _receiver) {
+		return Reflect.get(current(), prop);
+	} });
+}
+/**
+* `local` answers the active tenant; `scoped`, the root's view of another
+* tenant, is decided on the spot and shares the root's `pending` and `stale`.
+*/
+function protectedView(local, root, permission, data, scoped) {
+	const state = scoped === void 0 ? local : decideIn(root, scoped, permission, data);
+	if (state.status === "pending") return {
+		...state,
+		slot: "pending"
+	};
+	const decision = state.decision;
+	if (!state.allowed || decision.outcome !== "granted") return {
+		...state,
+		slot: "fallback"
+	};
+	return {
+		allowed: true,
+		status: state.status,
+		decision,
+		slot: "default"
+	};
+}
+function decideIn(root, scoped, permission, data) {
+	const decision = scoped.decide(permission, data);
+	const status = root.status();
+	return {
+		allowed: decision.outcome === "granted",
+		status: status === "pending" || status === "stale" ? status : "ready",
+		decision
+	};
+}
+function approvalHandle(store, decision) {
+	return {
+		state: store.approvalState(decision),
+		token: decision.outcome === "approval-required" ? decision.token : void 0,
+		request: (note) => store.requestApproval(decision, note)
+	};
+}
+//#endregion
+export { protectedView as a, subjectView as c, permissionSet as i, tenantView as l, filterResult as n, rolesView as o, livePermDock as r, scopedTenant as s, approvalHandle as t };

package/dist/{vocabulary-Dk0fs-Jk.d.ts → vocabulary-DA8a8zif.d.ts}

@@ -1,4 +1,4 @@
-import { n as ActionMeta } from "./permissions-B4apnahQ.js";
+import { n as ActionMeta } from "./permissions-DttnqqxC.js";
 //#region src/core/vocabulary.d.ts
 declare const ROLE_KIND: "role";
 declare const PLAN_KIND: "plan";

package/dist/vue/index.d.ts

@@ -1,9 +1,11 @@
-import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { r as Role } from "../vocabulary-Dk0fs-Jk.js";
-import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
-import { t as approvalHeaders } from "../headers-C8SHQccD.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { r as Role } from "../vocabulary-DA8a8zif.js";
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = {
@@ -13,13 +15,22 @@ type PermDockPluginOptions = {
    * `setup` under `<Suspense>`).
    */
   readonly snapshot: MaybeRefOrGetter<Snapshot | string> | PromiseLike<Snapshot | string>;
-  readonly endpoint?: string;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
   readonly approvals?: string;
-  readonly tenant?: string;
+  /** A ref or getter switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: MaybeRefOrGetter<string | undefined>;
   readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
+  /** Read on every request: a ref or getter carries a rotated token without rebuilding the store. */
+  readonly headers?: MaybeRefOrGetter<Readonly<Record<string, string>> | undefined>;
   readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
+  /** Read on every verification; set it at install to verify signed snapshots. */
+  readonly verifier?: MaybeRefOrGetter<TokenVerifier | undefined>;
 };
 //#endregion
 //#region src/vue/composables.d.ts
@@ -37,12 +48,23 @@ export declare function useRoles(options?: MaybeRefOrGetter<UseRolesOptions>): C
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): ComputedRef<readonly Role[]>;
-export declare function useAssignablePermissions(options?: {
+export declare function useAssignablePermissions(options?: MaybeRefOrGetter<{
   readonly tenant?: string;
-}): ComputedRef<readonly Permission[]>;
+}>): ComputedRef<readonly Permission[]>;
 export declare function useSubject(): ComputedRef<SubjectView>;
 export declare function useApproval(decision: MaybeRefOrGetter<Decision>): ComputedRef<ApprovalHandle>;
 //#endregion
+//#region src/vue/boundary.d.ts
+/**
+ * Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+ * by a descendant and renders the `denied` slot, or the `approval` slot for
+ * an approval request (default `denied`). The slots receive the refused
+ * permission and `retry()`. Any other error propagates.
+ */
+export declare const PermissionBoundary: DefineComponent;
+/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+export declare function usePermissionBoundary(): PermissionBoundaryState | null;
+//#endregion
 //#region src/vue/plugin.d.ts
 export declare const permdockPlugin: Plugin<PermDockPluginOptions>;
 //#endregion
@@ -54,4 +76,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionSet, type PermissionState, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };

package/dist/vue/index.js

@@ -1,10 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
-import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
-import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
-import { t as createClientStore } from "../store-C6hFW6ta.js";
-import { t as isPromiseLike } from "../source-DoBBYJi2.js";
-import { computed, defineComponent, effectScope, inject, isRef, onScopeDispose, shallowRef, toValue, watch } from "vue";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { i as isPromiseLike } from "../store-options-yO0V6gRn.js";
+import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-DNyC1y48.js";
+import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
 //#endregion
@@ -15,6 +16,7 @@ function useStore() {
 	return store;
 }
 function useTick(store) {
+	if (getCurrentScope() === void 0) throw new Error("PermDock: call composables in setup() or an effectScope, which removes their store subscription.");
 	const tick = shallowRef(0);
 	onScopeDispose(store.subscribe(() => {
 		tick.value += 1;
@@ -26,9 +28,7 @@ function useTick(store) {
 }
 function usePermDock() {
 	const permdock = useTick(useStore());
-	return new Proxy({}, { get(_target, prop, _receiver) {
-		return Reflect.get(permdock.value, prop);
-	} });
+	return livePermDock(() => permdock.value);
 }
 function usePermission(permission, data) {
 	const store = useStore();
@@ -48,40 +48,16 @@ function usePermissions(permissions, data) {
 	const permdock = useTick(store);
 	return computed(() => {
 		permdock.value;
-		const granted = [];
-		const byKey = {};
-		for (const permission of toValue(permissions)) {
-			const next = store.permissionState(permission, toValue(data));
-			byKey[permission.key] = next;
-			if (next.allowed) granted.push(permission);
-		}
-		return new Proxy({
-			granted,
-			get(permission) {
-				return byKey[permission.key];
-			}
-		}, { get(target, prop, receiver) {
-			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
-			return Reflect.get(target, prop, receiver);
-		} });
+		return permissionSet(store, toValue(permissions), toValue(data));
 	});
 }
 function useFilter(permission, rows) {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const result = [...permdock.value.filter(permission, toValue(rows))];
-		result.partial = permdock.value.where(permission).partial;
-		return result;
-	});
+	return computed(() => filterResult(permdock.value, permission, toValue(rows)));
 }
 function useTenant() {
 	const permdock = useTick(useStore());
-	return computed(() => ({
-		tenant: permdock.value.subject.principal?.tenant ?? null,
-		tenants: permdock.value.tenants(),
-		switchTo: (id) => permdock.value.refresh({ tenant: id }),
-		status: permdock.value.status()
-	}));
+	return computed(() => tenantView(permdock.value));
 }
 function useMemberships() {
 	const permdock = useTick(useStore());
@@ -89,10 +65,7 @@ function useMemberships() {
 }
 function useRoles(options = {}) {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const next = toValue(options);
-		return { roles: (next.team === void 0 ? permdock.value : permdock.value.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
-	});
+	return computed(() => rolesView(permdock.value, toValue(options)));
 }
 function useAssignableRoles() {
 	const permdock = useTick(useStore());
@@ -100,62 +73,86 @@ function useAssignableRoles() {
 }
 function useAssignablePermissions(options = {}) {
 	const permdock = useTick(useStore());
-	return computed(() => permdock.value.assignablePermissions(options));
+	return computed(() => permdock.value.assignablePermissions(toValue(options)));
 }
 function useSubject() {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const snapshot = permdock.value.snapshot();
-		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
-		return {
-			principal: permdock.value.subject.principal,
-			actor: permdock.value.subject.actor,
-			delegation: permdock.value.subject.delegation,
-			expiresAt: permdock.value.subject.expiresAt,
-			simulated
-		};
-	});
+	return computed(() => subjectView(permdock.value));
 }
 function useApproval(decision) {
 	const store = useStore();
 	const permdock = useTick(store);
 	return computed(() => {
 		permdock.value;
-		const next = toValue(decision);
-		return {
-			state: store.approvalState(next),
-			token: next.outcome === "approval-required" ? next.token : void 0,
-			request: (note) => store.requestApproval(next, note)
-		};
+		return approvalHandle(store, toValue(decision));
 	});
 }
 //#endregion
+//#region src/vue/boundary.ts
+const boundaryKey = Symbol("permdock-boundary");
+/**
+* Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+* by a descendant and renders the `denied` slot, or the `approval` slot for
+* an approval request (default `denied`). The slots receive the refused
+* permission and `retry()`. Any other error propagates.
+*/
+const PermissionBoundary = defineComponent({
+	name: "PermissionBoundary",
+	setup(_props, { slots }) {
+		const state = shallowRef(null);
+		provide(boundaryKey, state);
+		onErrorCaptured((error) => {
+			const digest = boundaryDigest(error);
+			if (digest === null) return;
+			state.value = {
+				...digest,
+				retry: () => {
+					state.value = null;
+				}
+			};
+			return false;
+		});
+		return () => {
+			const current = state.value;
+			if (current === null) return slots["default"]?.() ?? null;
+			return boundaryFallback(current, {
+				denied: slots["denied"],
+				approval: slots["approval"]
+			})?.(current) ?? null;
+		};
+	}
+});
+/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+function usePermissionBoundary() {
+	return inject(boundaryKey, null)?.value ?? null;
+}
+//#endregion
 //#region src/vue/plugin.ts
 const permdockPlugin = { install(app, options) {
 	const source = options.snapshot;
 	const promised = isPromiseLike(source);
-	const store = createClientStore(compact({
-		snapshot: promised ? emptySnapshot() : toValue(source),
-		endpoint: options.endpoint,
-		approvals: options.approvals,
-		tenant: options.tenant,
+	const store = providerStore({
+		...options,
+		tenant: toValue(options.tenant)
+	}, () => ({
+		headers: toValue(options.headers),
 		fetch: options.fetch,
-		headers: options.headers,
-		maxAge: options.maxAge,
-		verifier: options.verifier
-	}));
-	if (promised) store.follow(source);
-	else if (isRef(source) || typeof source === "function") {
-		const scope = effectScope(true);
-		scope.run(() => {
-			watch(() => toValue(source), (next) => {
-				store.replace(next);
-			});
+		verifier: toValue(options.verifier)
+	}), promised ? source : toValue(source));
+	const scope = effectScope(true);
+	scope.run(() => {
+		if (!promised && (isRef(source) || typeof source === "function")) watch(() => toValue(source), (next) => {
+			store.replace(next);
 		});
-		app.onUnmount(() => {
-			scope.stop();
+		const tenant = options.tenant;
+		if (isRef(tenant) || typeof tenant === "function") watch(() => toValue(tenant), (next) => {
+			switchTenant(store, next);
 		});
-	}
+	});
+	app.onUnmount(() => {
+		scope.stop();
+		store.dispose();
+	});
 	app.provide(permDockKey, store);
 } };
 //#endregion
@@ -168,7 +165,7 @@ const Protected = defineComponent({
 			required: true
 		},
 		data: {
-			type: Object,
+			type: null,
 			required: false
 		},
 		tenant: {
@@ -179,25 +176,21 @@ const Protected = defineComponent({
 	setup(props, { slots }) {
 		const local = usePermission(() => props.permission, () => props.data);
 		const root = usePermDock();
+		const scoped = computed(() => scopedTenant(root, props.tenant));
 		return () => {
-			const scoped = props.tenant === void 0 ? {
+			const view = protectedView({
 				allowed: local.allowed.value,
 				status: local.status.value,
 				decision: local.decision.value
-			} : tenantView(root.tenant(props.tenant), props.permission, props.data);
-			if (scoped.status === "pending") return slots["pending"]?.() ?? null;
-			if (!scoped.allowed || scoped.decision.outcome !== "granted") return slots["fallback"]?.({ decision: scoped.decision }) ?? null;
-			return slots["default"]?.({ decision: scoped.decision }) ?? null;
+			}, root, props.permission, props.data, scoped.value);
+			switch (view.slot) {
+				case "pending": return slots["pending"]?.() ?? null;
+				case "fallback": return slots["fallback"]?.({ decision: view.decision }) ?? null;
+				case "default": return slots["default"]?.({ decision: view.decision }) ?? null;
+				default: return view;
+			}
 		};
 	}
 });
-function tenantView(permdock, permission, data) {
-	const decision = permdock.decide(permission, data);
-	return {
-		allowed: decision.outcome === "granted",
-		status: "ready",
-		decision
-	};
-}
 //#endregion
-export { Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };

package/dist/watch-Etoa_Mvr.js

@@ -0,0 +1,2 @@
+import { n as createCollectScheduler } from "./watch-UihESpsJ.js";
+export { createCollectScheduler };

package/dist/watch-UihESpsJ.js

@@ -0,0 +1,128 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { n as isConfigFile, r as loadConfig } from "./config-BJiM-xAm.js";
+import { watch } from "node:fs";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+//#region src/cli/watch.ts
+const DEBOUNCE_MS = 50;
+function report(message) {
+	if (message !== void 0) process.stderr.write(`permdock: ${message}\n`);
+}
+function watchRoot(cwd, entry) {
+	const wildcard = entry.search(/[*?[{]/u);
+	return resolve(cwd, wildcard === -1 ? entry : dirname(`${entry.slice(0, wildcard)}x`));
+}
+function within(dirs, file) {
+	return dirs.some((dir) => {
+		const path = relative(dir, file);
+		return path !== "" && !path.startsWith("..") && !path.startsWith(sep);
+	});
+}
+async function collectOnce(cwd, options, check, fresh, configFile) {
+	const config = await loadConfig(cwd, configFile, { fresh });
+	const collect = {
+		...config.collect,
+		...options?.collect
+	};
+	const result = await runCollect({
+		cwd,
+		config,
+		collect,
+		check,
+		now: /* @__PURE__ */ new Date(),
+		fresh
+	});
+	const inputs = [
+		configFile,
+		config.permissions,
+		config.policy
+	].filter((path) => path !== void 0).map((path) => resolve(cwd, path));
+	const sources = (collect.srcPath ?? defaultSrcPath()).map((entry) => watchRoot(cwd, entry));
+	const run = {
+		written: result.written ?? [],
+		inputs,
+		sources
+	};
+	if (result.code === 0) return {
+		message: void 0,
+		...run
+	};
+	if (check && options?.onDrift !== "warn" && result.code === 1) throw new Error(result.message);
+	return {
+		message: result.message,
+		...run
+	};
+}
+function createCollectScheduler(cwd, options, settings) {
+	const log = settings?.report ?? report;
+	let loaded = false;
+	let ignored = /* @__PURE__ */ new Set();
+	let inputs = [];
+	let sources = (options?.collect?.srcPath ?? defaultSrcPath()).map((entry) => watchRoot(cwd, entry));
+	let running = false;
+	let pending = false;
+	let timer;
+	const watchers = [];
+	async function run(check) {
+		const fresh = loaded;
+		loaded = true;
+		const result = await collectOnce(cwd, options, check, fresh, settings?.configFile);
+		ignored = new Set(result.written);
+		inputs = result.inputs;
+		sources = result.sources;
+		return result.message;
+	}
+	async function drain() {
+		running = true;
+		while (pending) {
+			pending = false;
+			try {
+				log(await run(false));
+			} catch (error) {
+				log(describeError(error));
+			}
+		}
+		running = false;
+	}
+	function changed(file) {
+		if (file !== void 0 && ignored.has(resolve(cwd, file))) return;
+		pending = true;
+		if (running) return;
+		clearTimeout(timer);
+		timer = setTimeout(() => {
+			drain();
+		}, DEBOUNCE_MS);
+	}
+	function watchDir(dir, recursive, accept) {
+		try {
+			watchers.push(watch(dir, { recursive }, (_event, name) => {
+				if (name === null) {
+					changed(void 0);
+					return;
+				}
+				const file = resolve(dir, name);
+				if (accept(file)) changed(file);
+			}));
+		} catch {}
+	}
+	function startWatch() {
+		if (watchers.length > 0) return;
+		for (const dir of sources) watchDir(dir, true, () => true);
+		const loose = inputs.filter((file) => !within(sources, file));
+		const dirs = /* @__PURE__ */ new Set([cwd, ...loose.map((file) => dirname(file))]);
+		for (const dir of dirs) watchDir(dir, false, (file) => loose.includes(file) || dir === cwd && isConfigFile(basename(file)));
+	}
+	function close() {
+		clearTimeout(timer);
+		for (const watcher of watchers.splice(0)) watcher.close();
+	}
+	return {
+		run,
+		changed,
+		watch: startWatch,
+		close
+	};
+}
+//#endregion
+export { createCollectScheduler as n, report as r, collectOnce as t };

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { Mn as Decision, gt as Snapshot } from "../policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "../permissions-B4apnahQ.js";
+import { Tt as Snapshot, Yn as Decision } from "../policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/webmcp/index.js

@@ -1,8 +1,10 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { b as resourceOfNode, g as listPermissions, m as isRegistryTree, s as getRegistry, t as annotationsFor } from "../permissions-DC7GROPA.js";
-import { t as describe } from "../describe-Bt1YD5uS.js";
-import { i as PermDockValidationError, s as wireDenials } from "../errors-Iy71s7Oj.js";
+import { _ as listPermissions, h as isRegistryTree, s as getRegistry, t as annotationsFor, x as resourceOfNode } from "../permissions-DVoF6dMt.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { a as wireDenials } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 function isRecord(value) {
@@ -98,14 +100,6 @@ function bindTenant(input, tenantKey, tenant) {
 		}
 	};
 }
-function resourceRef(permission, data) {
-	if (permission.kind === "collection" || !isRecord(data)) return { type: permission.resource };
-	const id = data["id"];
-	return typeof id === "string" || typeof id === "number" ? {
-		type: permission.resource,
-		id: String(id)
-	} : { type: permission.resource };
-}
 function alternativesOf(decision) {
 	return decision.alternatives.map((leaf) => leaf.key);
 }
@@ -122,7 +116,7 @@ function deniedResult(decision, permission, data) {
 		structuredContent: compact({
 			outcome: "denied",
 			permission: permission.key,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
 			denials: wireDenials(decision.denials),
 			alternatives,
 			detail: described.detail
@@ -138,7 +132,7 @@ function approvalResult(decision, permission, data) {
 		structuredContent: {
 			outcome: "approval-required",
 			permission: permission.key,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
 			token: decision.token
 		}
 	};