permdock 0.1.0 → 0.3.0

package/dist/watch-BwxLTYMZ.js

@@ -0,0 +1,2 @@
+import { n as createCollectScheduler } from "./watch-DVBJ9cBq.js";
+export { createCollectScheduler };

package/dist/watch-DVBJ9cBq.js

@@ -0,0 +1,128 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { r as runCollect } from "./collect-DSTE3ml9.js";
+import { n as isConfigFile, r as loadConfig } from "./config-BJiM-xAm.js";
+import { watch } from "node:fs";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+//#region src/cli/watch.ts
+const DEBOUNCE_MS = 50;
+function report(message) {
+	if (message !== void 0) process.stderr.write(`permdock: ${message}\n`);
+}
+function watchRoot(cwd, entry) {
+	const wildcard = entry.search(/[*?[{]/u);
+	return resolve(cwd, wildcard === -1 ? entry : dirname(`${entry.slice(0, wildcard)}x`));
+}
+function within(dirs, file) {
+	return dirs.some((dir) => {
+		const path = relative(dir, file);
+		return path !== "" && !path.startsWith("..") && !path.startsWith(sep);
+	});
+}
+async function collectOnce(cwd, options, check, fresh, configFile) {
+	const config = await loadConfig(cwd, configFile, { fresh });
+	const collect = {
+		...config.collect,
+		...options?.collect
+	};
+	const result = await runCollect({
+		cwd,
+		config,
+		collect,
+		check,
+		now: /* @__PURE__ */ new Date(),
+		fresh
+	});
+	const inputs = [
+		configFile,
+		config.permissions,
+		config.policy
+	].filter((path) => path !== void 0).map((path) => resolve(cwd, path));
+	const sources = (collect.srcPath ?? defaultSrcPath()).map((entry) => watchRoot(cwd, entry));
+	const run = {
+		written: result.written ?? [],
+		inputs,
+		sources
+	};
+	if (result.code === 0) return {
+		message: void 0,
+		...run
+	};
+	if (check && options?.onDrift !== "warn" && result.code === 1) throw new Error(result.message);
+	return {
+		message: result.message,
+		...run
+	};
+}
+function createCollectScheduler(cwd, options, settings) {
+	const log = settings?.report ?? report;
+	let loaded = false;
+	let ignored = /* @__PURE__ */ new Set();
+	let inputs = [];
+	let sources = (options?.collect?.srcPath ?? defaultSrcPath()).map((entry) => watchRoot(cwd, entry));
+	let running = false;
+	let pending = false;
+	let timer;
+	const watchers = [];
+	async function run(check) {
+		const fresh = loaded;
+		loaded = true;
+		const result = await collectOnce(cwd, options, check, fresh, settings?.configFile);
+		ignored = new Set(result.written);
+		inputs = result.inputs;
+		sources = result.sources;
+		return result.message;
+	}
+	async function drain() {
+		running = true;
+		while (pending) {
+			pending = false;
+			try {
+				log(await run(false));
+			} catch (error) {
+				log(describeError(error));
+			}
+		}
+		running = false;
+	}
+	function changed(file) {
+		if (file !== void 0 && ignored.has(resolve(cwd, file))) return;
+		pending = true;
+		if (running) return;
+		clearTimeout(timer);
+		timer = setTimeout(() => {
+			drain();
+		}, DEBOUNCE_MS);
+	}
+	function watchDir(dir, recursive, accept) {
+		try {
+			watchers.push(watch(dir, { recursive }, (_event, name) => {
+				if (name === null) {
+					changed(void 0);
+					return;
+				}
+				const file = resolve(dir, name);
+				if (accept(file)) changed(file);
+			}));
+		} catch {}
+	}
+	function startWatch() {
+		if (watchers.length > 0) return;
+		for (const dir of sources) watchDir(dir, true, () => true);
+		const loose = inputs.filter((file) => !within(sources, file));
+		const dirs = /* @__PURE__ */ new Set([cwd, ...loose.map((file) => dirname(file))]);
+		for (const dir of dirs) watchDir(dir, false, (file) => loose.includes(file) || dir === cwd && isConfigFile(basename(file)));
+	}
+	function close() {
+		clearTimeout(timer);
+		for (const watcher of watchers.splice(0)) watcher.close();
+	}
+	return {
+		run,
+		changed,
+		watch: startWatch,
+		close
+	};
+}
+//#endregion
+export { createCollectScheduler as n, report as r, collectOnce as t };

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { Mn as Decision, gt as Snapshot } from "../policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "../permissions-B4apnahQ.js";
+import { Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
+import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/webmcp/index.js

@@ -1,8 +1,10 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { b as resourceOfNode, g as listPermissions, m as isRegistryTree, s as getRegistry, t as annotationsFor } from "../permissions-DC7GROPA.js";
-import { t as describe } from "../describe-Bt1YD5uS.js";
-import { i as PermDockValidationError, s as wireDenials } from "../errors-Iy71s7Oj.js";
+import { _ as listPermissions, h as isRegistryTree, s as getRegistry, t as annotationsFor, x as resourceOfNode } from "../permissions-DVoF6dMt.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { a as wireDenials } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 function isRecord(value) {
@@ -98,14 +100,6 @@ function bindTenant(input, tenantKey, tenant) {
 		}
 	};
 }
-function resourceRef(permission, data) {
-	if (permission.kind === "collection" || !isRecord(data)) return { type: permission.resource };
-	const id = data["id"];
-	return typeof id === "string" || typeof id === "number" ? {
-		type: permission.resource,
-		id: String(id)
-	} : { type: permission.resource };
-}
 function alternativesOf(decision) {
 	return decision.alternatives.map((leaf) => leaf.key);
 }
@@ -122,7 +116,7 @@ function deniedResult(decision, permission, data) {
 		structuredContent: compact({
 			outcome: "denied",
 			permission: permission.key,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
 			denials: wireDenials(decision.denials),
 			alternatives,
 			detail: described.detail
@@ -138,7 +132,7 @@ function approvalResult(decision, permission, data) {
 		structuredContent: {
 			outcome: "approval-required",
 			permission: permission.key,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
 			token: decision.token
 		}
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -13,7 +13,7 @@
     "tanstack-intent",
     "typescript"
   ],
-  "homepage": "https://permdock.dev",
+  "homepage": "https://permdock.com",
   "bugs": {
     "url": "https://github.com/ScaleDockHQ/permdock/issues"
   },
@@ -35,6 +35,12 @@
   ],
   "type": "module",
   "sideEffects": false,
+  "imports": {
+    "#next/navigation": {
+      "react-server": "next/navigation",
+      "default": "next/navigation.js"
+    }
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -197,6 +203,10 @@
       "types": "./dist/better-auth/index.d.ts",
       "default": "./dist/better-auth/index.js"
     },
+    "./better-supabase": {
+      "types": "./dist/better-supabase/index.d.ts",
+      "default": "./dist/better-supabase/index.js"
+    },
     "./clerk": {
       "types": "./dist/clerk/index.d.ts",
       "default": "./dist/clerk/index.js"
@@ -221,6 +231,10 @@
       "types": "./dist/testing/saas/permissions.d.ts",
       "default": "./dist/testing/saas/permissions.js"
     },
+    "./compile": {
+      "types": "./dist/compile/index.d.ts",
+      "default": "./dist/compile/index.js"
+    },
     "./catalog": {
       "types": "./dist/catalog/index.d.ts",
       "default": "./dist/catalog/index.js"
@@ -249,31 +263,37 @@
     "smol-toml": "1.9.0"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.287",
+    "@anthropic-ai/claude-agent-sdk": "0.3.288",
     "@arethetypeswrong/cli": "0.18.5",
-    "@modelcontextprotocol/client": "2.2.0",
-    "@modelcontextprotocol/server": "2.2.0",
+    "@babel/core": "8.0.6",
+    "@modelcontextprotocol/client": "2.3.0",
+    "@modelcontextprotocol/server": "2.3.0",
     "@nestjs/common": "12.1.2",
     "@nestjs/core": "12.1.2",
     "@nestjs/platform-express": "12.1.2",
     "@openai/agents": "0.18.0",
+    "@orpc/contract": "2.0.0-beta.41",
+    "@orpc/openapi": "2.0.0-beta.41",
     "@orpc/server": "2.0.0-beta.41",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@supabase/middleware": "1.0.0",
+    "@supabase/supabase-js": "2.117.2",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "24.19.1",
+    "@types/node": "26.6.4",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vitest/coverage-v8": "5.0.3",
     "ai": "7.0.127",
     "ajv": "8.20.0",
-    "drizzle-orm": "1.0.0-rc.4",
+    "babel-plugin-react-compiler": "1.0.0",
+    "better-supabase": "0.7.0",
+    "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.70.0",
+    "eve": "0.71.3",
     "express": "5.2.1",
     "fastify": "5.12.5",
     "happy-dom": "20.14.5",
@@ -292,6 +312,7 @@
     "rxjs": "7.8.2",
     "solid-js": "1.9.15",
     "svelte": "5.57.1",
+    "temporal-polyfill": "1.0.5",
     "tsdown": "0.23.0",
     "typescript": "7.0.2",
     "unplugin": "3.4.0",
@@ -304,15 +325,16 @@
   "peerDependencies": {
     "@anthropic-ai/claude-agent-sdk": ">=0.2",
     "@modelcontextprotocol/server": ">=2",
-    "@nestjs/common": ">=12",
-    "@nestjs/core": ">=12",
-    "@nestjs/platform-express": ">=12",
+    "@nestjs/common": ">=11",
+    "@nestjs/core": ">=11",
+    "@nestjs/platform-express": ">=11",
     "@openai/agents": ">=0.1",
     "@opentelemetry/api": ">=1",
     "@orpc/server": ">=2.0.0-0",
     "@supabase/middleware": ">=1",
     "@trpc/server": ">=11",
     "ai": ">=5",
+    "better-supabase": ">=0.6.0 <0.8.0",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",
     "eve": ">=0.40",
@@ -328,7 +350,7 @@
     "reflect-metadata": ">=0.1",
     "rxjs": ">=7",
     "solid-js": ">=1.9",
-    "svelte": ">=5",
+    "svelte": ">=5.3",
     "unplugin": ">=2",
     "vitest": ">=3",
     "vue": ">=3"
@@ -340,46 +362,43 @@
     "@modelcontextprotocol/server": {
       "optional": true
     },
-    "@openai/agents": {
-      "optional": true
-    },
-    "@orpc/server": {
+    "@nestjs/common": {
       "optional": true
     },
-    "@supabase/middleware": {
+    "@nestjs/core": {
       "optional": true
     },
-    "@trpc/server": {
+    "@nestjs/platform-express": {
       "optional": true
     },
-    "ai": {
+    "@openai/agents": {
       "optional": true
     },
-    "elysia": {
+    "@opentelemetry/api": {
       "optional": true
     },
-    "@nestjs/common": {
+    "@orpc/server": {
       "optional": true
     },
-    "@nestjs/core": {
+    "@supabase/middleware": {
       "optional": true
     },
-    "@nestjs/platform-express": {
+    "@trpc/server": {
       "optional": true
     },
-    "reflect-metadata": {
+    "ai": {
       "optional": true
     },
-    "rxjs": {
+    "better-supabase": {
       "optional": true
     },
     "drizzle-orm": {
       "optional": true
     },
-    "eve": {
+    "elysia": {
       "optional": true
     },
-    "kysely": {
+    "eve": {
       "optional": true
     },
     "express": {
@@ -394,41 +413,48 @@
     "jose": {
       "optional": true
     },
-    "next": {
+    "kysely": {
       "optional": true
     },
-    "react": {
+    "next": {
       "optional": true
     },
-    "solid-js": {
+    "pg": {
       "optional": true
     },
-    "svelte": {
+    "pgsql-parser": {
       "optional": true
     },
-    "vue": {
+    "react": {
       "optional": true
     },
-    "@opentelemetry/api": {
+    "reflect-metadata": {
       "optional": true
     },
-    "vitest": {
+    "rxjs": {
       "optional": true
     },
-    "pg": {
+    "solid-js": {
       "optional": true
     },
-    "pgsql-parser": {
+    "svelte": {
       "optional": true
     },
     "unplugin": {
       "optional": true
+    },
+    "vitest": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
     }
   },
   "engines": {
     "node": ">=24"
   },
   "scripts": {
+    "bench": "vitest bench --run --project \"node (bench)\" --reporter=verbose",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
     "lint": "oxlint --disable-nested-config --type-aware",

package/schemas/approval-request-v1.json

@@ -0,0 +1,175 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://permdock.com/schemas/approval-request-v1.json",
+  "title": "PermDock approval request",
+  "description": "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
+  "type": "object",
+  "required": [
+    "v",
+    "token",
+    "permission",
+    "scope",
+    "resource",
+    "subject",
+    "detail",
+    "createdAt",
+    "expiresAt",
+    "status"
+  ],
+  "properties": {
+    "v": {
+      "const": 1
+    },
+    "token": {
+      "type": "string",
+      "minLength": 1
+    },
+    "permission": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "string"
+    },
+    "resource": {
+      "type": "object",
+      "required": ["type"],
+      "properties": {
+        "type": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        }
+      }
+    },
+    "subject": {
+      "$ref": "#/$defs/subject"
+    },
+    "membership": {
+      "type": "object",
+      "required": ["roles"],
+      "properties": {
+        "roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "approvers": {
+      "type": "object"
+    },
+    "detail": {
+      "type": "string"
+    },
+    "adapter": {
+      "type": "string"
+    },
+    "createdAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "expiresAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "status": {
+      "enum": ["pending", "approved", "rejected", "expired"]
+    },
+    "approvals": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/signature"
+      }
+    },
+    "resolvedAt": {
+      "$ref": "#/$defs/instant"
+    },
+    "resolvedBy": {
+      "type": "string"
+    },
+    "vouched": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "consumedAt": {
+      "$ref": "#/$defs/instant"
+    }
+  },
+  "$defs": {
+    "instant": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "subject": {
+      "type": "object",
+      "required": ["principal"],
+      "properties": {
+        "principal": {
+          "anyOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": ["id", "roles"],
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "roles": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "tenant": {
+                  "type": "string"
+                }
+              }
+            }
+          ]
+        },
+        "actor": {
+          "type": "object",
+          "required": ["id", "kind"],
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "kind": {
+              "type": "string"
+            }
+          }
+        },
+        "session": {
+          "type": "string"
+        },
+        "delegation": {
+          "type": "object"
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": ["by", "at"],
+      "properties": {
+        "by": {
+          "type": "string"
+        },
+        "at": {
+          "$ref": "#/$defs/instant"
+        },
+        "stage": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "vouched": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/schemas/catalog-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://permdock.dev/schemas/catalog-v1.json",
+  "$id": "https://permdock.com/schemas/catalog-v1.json",
   "type": "object",
   "required": [
     "$schema",
@@ -47,6 +47,12 @@
           },
           "restricted": {
             "type": "string"
+          },
+          "restrictedStops": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           }
         }
       }
@@ -227,6 +233,12 @@
               "type": "string"
             }
           },
+          "levels": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
           "hostable": {
             "const": true
           },
@@ -442,6 +454,19 @@
               "type": "string"
             }
           },
+          "requires": {
+            "oneOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            ]
+          },
           "limit": {
             "type": "object",
             "required": ["count", "per"],
@@ -480,6 +505,9 @@
               },
               "id": {
                 "type": "string"
+              },
+              "client": {
+                "type": "string"
               }
             }
           },