permdock 0.1.0 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -13,7 +13,7 @@
     "tanstack-intent",
     "typescript"
   ],
-  "homepage": "https://permdock.dev",
+  "homepage": "https://permdock.com",
   "bugs": {
     "url": "https://github.com/ScaleDockHQ/permdock/issues"
   },
@@ -35,6 +35,12 @@
   ],
   "type": "module",
   "sideEffects": false,
+  "imports": {
+    "#next/navigation": {
+      "react-server": "next/navigation",
+      "default": "next/navigation.js"
+    }
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -197,6 +203,10 @@
       "types": "./dist/better-auth/index.d.ts",
       "default": "./dist/better-auth/index.js"
     },
+    "./better-supabase": {
+      "types": "./dist/better-supabase/index.d.ts",
+      "default": "./dist/better-supabase/index.js"
+    },
     "./clerk": {
       "types": "./dist/clerk/index.d.ts",
       "default": "./dist/clerk/index.js"
@@ -221,6 +231,10 @@
       "types": "./dist/testing/saas/permissions.d.ts",
       "default": "./dist/testing/saas/permissions.js"
     },
+    "./compile": {
+      "types": "./dist/compile/index.d.ts",
+      "default": "./dist/compile/index.js"
+    },
     "./catalog": {
       "types": "./dist/catalog/index.d.ts",
       "default": "./dist/catalog/index.js"
@@ -249,31 +263,37 @@
     "smol-toml": "1.9.0"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.287",
+    "@anthropic-ai/claude-agent-sdk": "0.3.288",
     "@arethetypeswrong/cli": "0.18.5",
-    "@modelcontextprotocol/client": "2.2.0",
-    "@modelcontextprotocol/server": "2.2.0",
+    "@babel/core": "8.0.6",
+    "@modelcontextprotocol/client": "2.3.0",
+    "@modelcontextprotocol/server": "2.3.0",
     "@nestjs/common": "12.1.2",
     "@nestjs/core": "12.1.2",
     "@nestjs/platform-express": "12.1.2",
     "@openai/agents": "0.18.0",
+    "@orpc/contract": "2.0.0-beta.41",
+    "@orpc/openapi": "2.0.0-beta.41",
     "@orpc/server": "2.0.0-beta.41",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@supabase/middleware": "1.0.0",
+    "@supabase/supabase-js": "2.117.2",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "24.19.1",
+    "@types/node": "26.6.4",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vitest/coverage-v8": "5.0.3",
     "ai": "7.0.127",
     "ajv": "8.20.0",
-    "drizzle-orm": "1.0.0-rc.4",
+    "babel-plugin-react-compiler": "1.0.0",
+    "better-supabase": "0.6.0",
+    "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.70.0",
+    "eve": "0.71.3",
     "express": "5.2.1",
     "fastify": "5.12.5",
     "happy-dom": "20.14.5",
@@ -292,6 +312,7 @@
     "rxjs": "7.8.2",
     "solid-js": "1.9.15",
     "svelte": "5.57.1",
+    "temporal-polyfill": "1.0.5",
     "tsdown": "0.23.0",
     "typescript": "7.0.2",
     "unplugin": "3.4.0",
@@ -304,15 +325,16 @@
   "peerDependencies": {
     "@anthropic-ai/claude-agent-sdk": ">=0.2",
     "@modelcontextprotocol/server": ">=2",
-    "@nestjs/common": ">=12",
-    "@nestjs/core": ">=12",
-    "@nestjs/platform-express": ">=12",
+    "@nestjs/common": ">=11",
+    "@nestjs/core": ">=11",
+    "@nestjs/platform-express": ">=11",
     "@openai/agents": ">=0.1",
     "@opentelemetry/api": ">=1",
     "@orpc/server": ">=2.0.0-0",
     "@supabase/middleware": ">=1",
     "@trpc/server": ">=11",
     "ai": ">=5",
+    "better-supabase": ">=0.6.0 <0.7.0",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",
     "eve": ">=0.40",
@@ -328,7 +350,7 @@
     "reflect-metadata": ">=0.1",
     "rxjs": ">=7",
     "solid-js": ">=1.9",
-    "svelte": ">=5",
+    "svelte": ">=5.3",
     "unplugin": ">=2",
     "vitest": ">=3",
     "vue": ">=3"
@@ -340,46 +362,43 @@
     "@modelcontextprotocol/server": {
       "optional": true
     },
-    "@openai/agents": {
-      "optional": true
-    },
-    "@orpc/server": {
+    "@nestjs/common": {
       "optional": true
     },
-    "@supabase/middleware": {
+    "@nestjs/core": {
       "optional": true
     },
-    "@trpc/server": {
+    "@nestjs/platform-express": {
       "optional": true
     },
-    "ai": {
+    "@openai/agents": {
       "optional": true
     },
-    "elysia": {
+    "@opentelemetry/api": {
       "optional": true
     },
-    "@nestjs/common": {
+    "@orpc/server": {
       "optional": true
     },
-    "@nestjs/core": {
+    "@supabase/middleware": {
       "optional": true
     },
-    "@nestjs/platform-express": {
+    "@trpc/server": {
       "optional": true
     },
-    "reflect-metadata": {
+    "ai": {
       "optional": true
     },
-    "rxjs": {
+    "better-supabase": {
       "optional": true
     },
     "drizzle-orm": {
       "optional": true
     },
-    "eve": {
+    "elysia": {
       "optional": true
     },
-    "kysely": {
+    "eve": {
       "optional": true
     },
     "express": {
@@ -394,41 +413,48 @@
     "jose": {
       "optional": true
     },
-    "next": {
+    "kysely": {
       "optional": true
     },
-    "react": {
+    "next": {
       "optional": true
     },
-    "solid-js": {
+    "pg": {
       "optional": true
     },
-    "svelte": {
+    "pgsql-parser": {
       "optional": true
     },
-    "vue": {
+    "react": {
       "optional": true
     },
-    "@opentelemetry/api": {
+    "reflect-metadata": {
       "optional": true
     },
-    "vitest": {
+    "rxjs": {
       "optional": true
     },
-    "pg": {
+    "solid-js": {
       "optional": true
     },
-    "pgsql-parser": {
+    "svelte": {
       "optional": true
     },
     "unplugin": {
       "optional": true
+    },
+    "vitest": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
     }
   },
   "engines": {
     "node": ">=24"
   },
   "scripts": {
+    "bench": "vitest bench --run --project \"node (bench)\" --reporter=verbose",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
     "lint": "oxlint --disable-nested-config --type-aware",

package/schemas/approval-request-v1.json

@@ -0,0 +1,175 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://permdock.com/schemas/approval-request-v1.json",
+  "title": "PermDock approval request",
+  "description": "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
+  "type": "object",
+  "required": [
+    "v",
+    "token",
+    "permission",
+    "scope",
+    "resource",
+    "subject",
+    "detail",
+    "createdAt",
+    "expiresAt",
+    "status"
+  ],
+  "properties": {
+    "v": {
+      "const": 1
+    },
+    "token": {
+      "type": "string",
+      "minLength": 1
+    },
+    "permission": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "string"
+    },
+    "resource": {
+      "type": "object",
+      "required": ["type"],
+      "properties": {
+        "type": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        }
+      }
+    },
+    "subject": {
+      "$ref": "#/$defs/subject"
+    },
+    "membership": {
+      "type": "object",
+      "required": ["roles"],
+      "properties": {
+        "roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "approvers": {
+      "type": "object"
+    },
+    "detail": {
+      "type": "string"
+    },
+    "adapter": {
+      "type": "string"
+    },
+    "createdAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "expiresAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "status": {
+      "enum": ["pending", "approved", "rejected", "expired"]
+    },
+    "approvals": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/signature"
+      }
+    },
+    "resolvedAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "resolvedBy": {
+      "type": "string"
+    },
+    "vouched": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "consumedAt": {
+      "$ref": "#/$defs/instant"
+    }
+  },
+  "$defs": {
+    "instant": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "subject": {
+      "type": "object",
+      "required": ["principal"],
+      "properties": {
+        "principal": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": ["id", "roles"],
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "roles": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "tenant": {
+                  "type": "string"
+                }
+              }
+            }
+          ]
+        },
+        "actor": {
+          "type": "object",
+          "required": ["id", "kind"],
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "kind": {
+              "type": "string"
+            }
+          }
+        },
+        "session": {
+          "type": "string"
+        },
+        "delegation": {
+          "type": "object"
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": ["by", "at"],
+      "properties": {
+        "by": {
+          "type": "string"
+        },
+        "at": {
+          "$ref": "#/$defs/instant"
+        },
+        "stage": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "vouched": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/schemas/catalog-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://permdock.dev/schemas/catalog-v1.json",
+  "$id": "https://permdock.com/schemas/catalog-v1.json",
   "type": "object",
   "required": [
     "$schema",
@@ -47,6 +47,12 @@
           },
           "restricted": {
             "type": "string"
+          },
+          "restrictedStops": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           }
         }
       }
@@ -227,6 +233,12 @@
               "type": "string"
             }
           },
+          "levels": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
           "hostable": {
             "const": true
           },
@@ -442,6 +454,19 @@
               "type": "string"
             }
           },
+          "requires": {
+            "oneOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            ]
+          },
           "limit": {
             "type": "object",
             "required": ["count", "per"],
@@ -480,6 +505,9 @@
               },
               "id": {
                 "type": "string"
+              },
+              "client": {
+                "type": "string"
               }
             }
           },

package/schemas/supabase-claims-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://permdock.dev/schemas/supabase-claims-v1.json",
+  "$id": "https://permdock.com/schemas/supabase-claims-v1.json",
   "title": "PermDock claims in a Supabase access token",
   "description": "The claims the permdock supabase hook writes and the SQL helpers and subjectFromSupabase read, plus the OAuth claims subjectFromSupabase maps to the actor and delegation. Other claims pass through. Each hook claim may also sit under app_metadata. supabaseClaims() in permdock/supabase validates the same shape; tenant_id is the default rls.tenantClaim.",
   "type": "object",
@@ -123,6 +123,11 @@
         },
         "managedBy": { "const": "idp" },
         "entitlements": { "type": "array", "items": { "type": "string" } },
+        "keep": {
+          "description": "Set when the instance or an ancestor is suspended: the permission keys the membership still grants.",
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
         "grants": {
           "description": "Custom roles in compact form, read by the helpers in jwt mode.",
           "type": "object"