permdock 0.3.1 → 0.5.0

package/dist/{version-BvacVTZR.js → version-CEbQ5UeM.js}

@@ -1,7 +1,7 @@
-import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-//#region src/cli/version.ts
+//#region src/cli/core/version.ts
 function cliVersion() {
 	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
 }
@@ -13,5 +13,6 @@ const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest
 const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
 const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
 const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
+const ARAZZO_REPORT_SCHEMA = "https://permdock.com/schemas/arazzo-report-v1.json";
 //#endregion
-export { USAGE_REPORT_SCHEMA as a, SUPABASE_MANIFEST_SCHEMA as i, CONFIG_REPORT_SCHEMA as n, cliVersion as o, DOCTOR_REPORT_SCHEMA as r, generatorBanner as s, CATALOG_SCHEMA as t };
+export { SUPABASE_MANIFEST_SCHEMA as a, generatorBanner as c, DOCTOR_REPORT_SCHEMA as i, CATALOG_SCHEMA as n, USAGE_REPORT_SCHEMA as o, CONFIG_REPORT_SCHEMA as r, cliVersion as s, ARAZZO_REPORT_SCHEMA as t };

package/dist/version-DXkYUISx.js

@@ -0,0 +1 @@
+export { s as cliVersion } from "./version-CEbQ5UeM.js";

package/dist/{views-Soe7bGSC.js → views-DTIIO-oQ.js}

@@ -1,3 +1,5 @@
+import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
+import { t as describe } from "./describe-BybMRY7A.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];
@@ -64,9 +66,15 @@ function protectedView(local, root, permission, data, scoped) {
 		slot: "pending"
 	};
 	const decision = state.decision;
+	if (decision.outcome === "approval-required") return {
+		allowed: false,
+		status: state.status,
+		decision,
+		slot: "approval"
+	};
 	if (!state.allowed || decision.outcome !== "granted") return {
 		...state,
-		slot: "fallback"
+		slot: "denied"
 	};
 	return {
 		allowed: true,
@@ -91,5 +99,36 @@ function approvalHandle(store, decision) {
 		request: (note) => store.requestApproval(decision, note)
 	};
 }
+function slotContent(slot, own, defaults) {
+	switch (slot) {
+		case "pending": return own.pending ?? defaults?.pending;
+		case "denied": return own.denied ?? defaults?.denied;
+		case "approval": return own.approval ?? own.denied ?? defaults?.approval ?? defaults?.denied;
+		default: return slot;
+	}
+}
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+function describeWith(messages) {
+	return (decision, options) => describe(decision, messages === void 0 || options?.messages !== void 0 ? options : {
+		...options,
+		messages
+	});
+}
+/** The `GateView` of a permission state; `describeDecision` localises the reason. */
+function gateView(state, describeDecision, mode = "disable") {
+	const pending = state.status === "pending";
+	const needsApproval = state.decision.outcome === "approval-required";
+	const allowed = state.allowed && !pending;
+	return {
+		allowed,
+		pending,
+		hidden: mode === "hide" && !allowed && !pending && !needsApproval,
+		disabled: !allowed,
+		needsApproval,
+		upgrade: requiredPlans(state.decision),
+		reason: describeDecision(state.decision),
+		decision: state.decision
+	};
+}
 //#endregion
-export { protectedView as a, subjectView as c, permissionSet as i, tenantView as l, filterResult as n, rolesView as o, livePermDock as r, scopedTenant as s, approvalHandle as t };
+export { livePermDock as a, rolesView as c, subjectView as d, tenantView as f, gateView as i, scopedTenant as l, describeWith as n, permissionSet as o, filterResult as r, protectedView as s, approvalHandle as t, slotContent as u };

package/dist/{permissions-DttnqqxC.d.ts → vocabulary-D6lPdb4Z.d.ts}

@@ -1,8 +1,34 @@
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/core/permissions.d.ts
+//#region src/core/app-data.d.ts
+/** A JSON value in an app `x` field. */
+type MetaValue = string | number | boolean | null | readonly MetaValue[] | {
+  readonly [key: string]: MetaValue;
+};
+/** The default shape of an app `x` field: a plain JSON object. */
+type AppData = Readonly<Record<string, MetaValue>>;
+/**
+ * A Standard Schema for one kind of app data. It must validate synchronously;
+ * its output is the type PermDock gives the `x` field it checks.
+ */
+type AppDataSchema<X = AppData> = StandardSchemaV1<unknown, X>;
+/** A leaf whose `meta.x` is typed by a schema; intersected so it stays assignable to the untyped leaf. */
+type WithX<L, X> = [X] extends [never] ? L : L & {
+  readonly meta: {
+    readonly x?: Readonly<X>;
+  };
+};
+//#endregion
+//#region src/core/brands.d.ts
 declare const RESOURCE_BRAND: unique symbol;
+/**
+ * Phantom key carrying a tree's resource `x` type for `getResource`. Exported
+ * as a type only, so a consumer's declaration emit can name it; it has no value.
+ */
+declare const RESOURCE_X: unique symbol;
+//#endregion
+//#region src/core/permission-types.d.ts
 /** `definePermissions` options. */
-type DefinePermissionsOptions = {
+type PermissionsOptions<PX = never, RX = never> = {
   /**
    * Keys a permission used to have, mapped to its current key. Old keys are
    * accepted wherever a key arrives as a string (stored custom roles, OAuth
@@ -10,6 +36,27 @@ type DefinePermissionsOptions = {
    * the current leaf; code, decisions and audit only ever see the current key.
    */
   readonly renamed?: Readonly<Record<string, string>>;
+  /**
+   * Standard Schemas for app data. `permission` checks every action's
+   * `meta.x` and types it on the leaves; `resource` checks every resource's
+   * `meta.x` and types it on `getResource`. Both validate synchronously at
+   * definition time and throw on invalid data.
+   */
+  readonly x?: {
+    readonly permission?: AppDataSchema<PX>;
+    readonly resource?: AppDataSchema<RX>;
+  };
+};
+/** A resource's metadata. PermDock carries it to the catalog and never reads `x`. */
+type ResourceMeta<X = AppData> = {
+  readonly title?: string;
+  readonly description?: string;
+  /** Data the application owns. Plain JSON, typed by `definePermissions(…, { x: { resource } })`. */
+  readonly x?: X;
+};
+/** A tree whose resources carry `meta.x` of type `X`, read through `getResource`. */
+type ResourceXTree<X> = {
+  readonly [RESOURCE_X]?: X;
 };
 type ActionMeta = {
   readonly title?: string;
@@ -30,13 +77,9 @@ type ActionMeta = {
   /**
    * Data the application owns, such as a risk level or an undo window. Plain
    * JSON; PermDock carries it on the leaf, the catalog and snapshots and
-   * never reads it.
+   * never reads it. `definePermissions(…, { x: { permission } })` types it.
    */
-  readonly x?: Readonly<Record<string, MetaValue>>;
-};
-/** A JSON value in `ActionMeta.x`. */
-type MetaValue = string | number | boolean | null | readonly MetaValue[] | {
-  readonly [key: string]: MetaValue;
+  readonly x?: AppData;
 };
 type PermissionKind = "instance" | "collection";
 type Permission<K extends string = string, T = unknown, Kind extends PermissionKind = PermissionKind> = {
@@ -159,6 +202,8 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
    * it; it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
    */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** Display text and app data for the resource; carried to the catalog, never read in evaluation. */
+  readonly meta?: ResourceMeta;
 };
 /** A level's row condition: `where` shorthand or a normalised `Condition`, checked by `definePolicy`. */
 type ResourceLevel = Readonly<Record<string, unknown>>;
@@ -183,32 +228,78 @@ type ResourceNode<T = unknown> = {
   readonly collectionActions: ReadonlySet<string>;
   /** Declared level names to their raw condition; `definePolicy` normalises them. */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** The resource's `meta`, when it declares one. */
+  readonly meta?: ResourceMeta;
 };
 type PermissionTree = {
   readonly [key: string]: PermissionTree | Permission;
 };
 type ActionNames<A extends ActionList | undefined> = A extends readonly string[] ? A[number] : A extends Record<string, ActionMeta> ? keyof A & string : never;
-type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind> = [Names] extends [never] ? object : { readonly [K in Names]: Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>; };
-type InferResourceLeaves<R extends ResourceInit, Prefix extends string> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance"> & LeavesFrom<Prefix, ActionNames<C>, T, "collection"> : object;
-type InferPermissionTree<Input, Prefix extends string = ""> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`>; } : never;
-/**
- * The keys `permission` was renamed from, sorted. Empty for a leaf without
- * renames and for one that crossed a serialisation boundary.
- */
-declare function formerKeys(permission: object): readonly string[];
-declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly []>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C>): ResourceInit<T, A, C>;
-declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly []>(options: ResourceOptions<A, C>): ResourceInit<unknown, A, C>;
-declare function getResource(tree: PermissionTree, name: string): ResourceNode | undefined;
-declare function definePermissions<const Input>(input: Input, options?: DefinePermissionsOptions): InferPermissionTree<Input>;
-declare function listPermissions(tree: PermissionTree | Permission): readonly Permission[];
-declare function findPermission(tree: PermissionTree, keyOrScope: string): Permission | undefined;
+type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>, X>; };
+type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
+type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
+//#endregion
+//#region src/core/vocabulary.d.ts
+declare const ROLE_KIND: "role";
+declare const PLAN_KIND: "plan";
+/** `defineRoles` and `definePlans` options. */
+type VocabularyOptions<X = never> = {
+  /**
+   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
+   * definition time. On a role tree it also checks the `meta.x` of custom
+   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
+   */
+  readonly x?: AppDataSchema<X>;
+};
 /**
- * A permission leaf: string `key`, `scope`, `resource` and `action` plus an
- * object `meta`. `kind` is non-enumerable and does not survive
- * `JSON.stringify`, so a leaf that crossed a serialisation boundary passes
- * without it; when present it must be `instance` or `collection`.
+ * A role's metadata. `audience` names the surface its holders use (`'staff'`,
+ * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
+ * audiences of the roles held in the active scope.
  */
-declare function isPermission(value: unknown): value is Permission;
-declare function mergePermissions<const Trees extends readonly PermissionTree[]>(...trees: Trees): PermissionTree;
+type RoleMeta = ActionMeta & {
+  readonly audience?: string;
+};
+type Role<K extends string = string> = {
+  readonly key: K;
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable: boolean;
+  readonly meta: RoleMeta;
+  readonly kind: typeof ROLE_KIND;
+};
+type Plan<K extends string = string> = {
+  readonly key: K;
+  readonly meta: ActionMeta;
+  readonly kind: typeof PLAN_KIND;
+};
+type RoleInit = {
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable?: boolean;
+  readonly meta?: RoleMeta;
+};
+type PlanInit = {
+  readonly meta?: ActionMeta;
+};
+type RoleTree = {
+  readonly [key: string]: Role;
+};
+type PlanTree = {
+  readonly [key: string]: Plan;
+};
+type Vocabulary = {
+  readonly permissions?: unknown;
+  readonly roles?: RoleTree;
+  readonly plans?: PlanTree;
+};
+type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
+type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
+declare function isRole(value: unknown): value is Role;
+declare function isPlan(value: unknown): value is Plan;
+declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
+declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
+declare function listRoles(tree: RoleTree | undefined): readonly Role[];
+declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
+declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
 //#endregion
-export { listPermissions as A, ResourceRelationInput as C, formerKeys as D, findPermission as E, resource as M, getResource as O, ResourceRelation as S, definePermissions as T, ResourceLevel as _, EdgeGroup as a, ResourceOptions as b, EdgeRelation as c, MetaValue as d, Permission as f, ResourceInit as g, PrincipalRelation as h, DefinePermissionsOptions as i, mergePermissions as j, isPermission as k, FieldRelation as l, PermissionTree as m, ActionMeta as n, EdgeGroups as o, PermissionKind as p, ComputedRelation as r, EdgeMatch as s, ActionList as t, InferPermissionTree as u, ResourceLink as v, ResourceRestricted as w, ResourceParent as x, ResourceNode as y };
+export { ResourceLevel as A, RESOURCE_X as B, InferPermissionTree as C, PermissionsOptions as D, PermissionTree as E, ResourceParent as F, AppDataSchema as H, ResourceRelation as I, ResourceRelationInput as L, ResourceMeta as M, ResourceNode as N, PrincipalRelation as O, ResourceOptions as P, ResourceRestricted as R, FieldRelation as S, PermissionKind as T, MetaValue as U, AppData as V, ComputedRelation as _, RoleTree as a, EdgeMatch as b, definePlans as c, isPlan as d, isRole as f, ActionMeta as g, ActionList as h, RoleMeta as i, ResourceLink as j, ResourceInit as k, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u, EdgeGroup as v, Permission as w, EdgeRelation as x, EdgeGroups as y, ResourceXTree as z };

package/dist/vue/index.d.ts

@@ -1,36 +1,38 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership } from "../policy-types-DzwivBgR.js";
+import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
-import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin } from "vue";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
+import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
-type PermDockPluginOptions = {
+type PermDockPluginOptions = ProviderOptionsBase & {
   /**
    * A ref or getter re-hydrates the store when it changes; a promise keeps
    * the store `pending` until it settles (await the same promise in an async
    * `setup` under `<Suspense>`).
    */
   readonly snapshot: MaybeRefOrGetter<Snapshot | string> | PromiseLike<Snapshot | string>;
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
-   * `false` never calls one: such a check is denied with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
   /** A ref or getter switches the active tenant (`refresh({ tenant })`) when it changes. */
   readonly tenant?: MaybeRefOrGetter<string | undefined>;
-  readonly fetch?: typeof fetch;
   /** Read on every request: a ref or getter carries a rotated token without rebuilding the store. */
   readonly headers?: MaybeRefOrGetter<Readonly<Record<string, string>> | undefined>;
-  readonly maxAge?: number;
   /** Read on every verification; set it at install to verify signed snapshots. */
   readonly verifier?: MaybeRefOrGetter<TokenVerifier | undefined>;
+  /** What every `<Protected>` renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+};
+type SlotOutput = VNode | VNode[] | string | null;
+/** Render functions for the `<Protected>` slots a component leaves out; they get the slot props. */
+type PermDockDefaults = {
+  readonly pending?: () => SlotOutput;
+  readonly denied?: (props: {
+    readonly decision: Decision;
+  }) => SlotOutput;
+  readonly approval?: (props: {
+    readonly decision: ApprovalRequiredDecision;
+  }) => SlotOutput;
 };
 //#endregion
 //#region src/vue/composables.d.ts
@@ -44,7 +46,7 @@ export declare function usePermissions(permissions: MaybeRefOrGetter<readonly Pe
 export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: MaybeRefOrGetter<readonly T[]>): ComputedRef<FilterResult<T>>;
 export declare function useTenant(): ComputedRef<TenantView>;
 export declare function useMemberships(): ComputedRef<readonly Membership[]>;
-export declare function useRoles(options?: MaybeRefOrGetter<UseRolesOptions>): ComputedRef<{
+export declare function useRoles(options?: MaybeRefOrGetter<RolesOptions>): ComputedRef<{
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): ComputedRef<readonly Role[]>;
@@ -53,6 +55,8 @@ export declare function useAssignablePermissions(options?: MaybeRefOrGetter<{
 }>): ComputedRef<readonly Permission[]>;
 export declare function useSubject(): ComputedRef<SubjectView>;
 export declare function useApproval(decision: MaybeRefOrGetter<Decision>): ComputedRef<ApprovalHandle>;
+/** `describe` with the plugin's `messages`; a call's own `messages` win. */
+export declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
 //#endregion
 //#region src/vue/boundary.d.ts
 /**
@@ -76,4 +80,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans };

package/dist/vue/index.js

@@ -1,13 +1,14 @@
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-ByhZq1jV.js";
-import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-Cfbvo4DE.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
+const permDockUiKey = Symbol("permdock-ui");
 //#endregion
 //#region src/vue/composables.ts
 function useStore() {
@@ -87,6 +88,10 @@ function useApproval(decision) {
 		return approvalHandle(store, toValue(decision));
 	});
 }
+/** `describe` with the plugin's `messages`; a call's own `messages` win. */
+function useDescribe() {
+	return describeWith(inject(permDockUiKey, {}).messages);
+}
 //#endregion
 //#region src/vue/boundary.ts
 const boundaryKey = Symbol("permdock-boundary");
@@ -154,6 +159,10 @@ const permdockPlugin = { install(app, options) {
 		store.dispose();
 	});
 	app.provide(permDockKey, store);
+	app.provide(permDockUiKey, {
+		defaults: options.defaults,
+		messages: options.messages
+	});
 } };
 //#endregion
 //#region src/vue/protected.ts
@@ -176,6 +185,7 @@ const Protected = defineComponent({
 	setup(props, { slots }) {
 		const local = usePermission(() => props.permission, () => props.data);
 		const root = usePermDock();
+		const { defaults } = inject(permDockUiKey, {});
 		const scoped = computed(() => scopedTenant(root, props.tenant));
 		return () => {
 			const view = protectedView({
@@ -183,9 +193,15 @@ const Protected = defineComponent({
 				status: local.status.value,
 				decision: local.decision.value
 			}, root, props.permission, props.data, scoped.value);
+			const own = {
+				pending: slots["pending"],
+				denied: slots["denied"],
+				approval: slots["approval"]
+			};
 			switch (view.slot) {
-				case "pending": return slots["pending"]?.() ?? null;
-				case "fallback": return slots["fallback"]?.({ decision: view.decision }) ?? null;
+				case "pending": return slotContent("pending", own, defaults)?.() ?? null;
+				case "denied": return slotContent("denied", own, defaults)?.({ decision: view.decision }) ?? null;
+				case "approval": return slotContent("approval", own, defaults)?.({ decision: view.decision }) ?? null;
 				case "default": return slots["default"]?.({ decision: view.decision }) ?? null;
 				default: return view;
 			}
@@ -193,4 +209,4 @@ const Protected = defineComponent({
 	}
 });
 //#endregion
-export { PermissionBoundary, Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };

package/dist/waiter-BGUtGYoU.js

@@ -0,0 +1,67 @@
+import { f as nowMillis } from "./time-DkWjdL98.js";
+//#region src/workflow/waiter.ts
+const DEFAULT_INTERVAL = 5e3;
+/**
+* An in-process `ApprovalWaiter` that reads `store` every `interval`
+* milliseconds. `wake` ends a wait in the same process at once. A store read
+* that throws counts as still pending until the request expires.
+*/
+function pollingApprovalWaiter(options) {
+	const interval = options.interval ?? DEFAULT_INTERVAL;
+	if (!Number.isFinite(interval) || interval <= 0) throw new RangeError("PermDock: pollingApprovalWaiter interval must be a positive number");
+	const woken = /* @__PURE__ */ new Map();
+	const decided = async (token) => {
+		try {
+			return (await options.store.get(token))?.status !== "pending";
+		} catch {
+			return false;
+		}
+	};
+	return Object.freeze({
+		wait(token, waitOptions = {}) {
+			const { signal, expiresAt } = waitOptions;
+			return new Promise((resolve, reject) => {
+				let timer;
+				const listeners = woken.get(token) ?? /* @__PURE__ */ new Set();
+				woken.set(token, listeners);
+				const finish = (error) => {
+					if (timer !== void 0) clearTimeout(timer);
+					listeners.delete(done);
+					if (listeners.size === 0) woken.delete(token);
+					signal?.removeEventListener("abort", aborted);
+					if (error === void 0) resolve();
+					else reject(error);
+				};
+				const done = () => {
+					finish();
+				};
+				const aborted = () => {
+					const reason = signal?.reason;
+					finish(reason instanceof Error ? reason : new Error("PermDock: approval wait aborted", { cause: reason }));
+				};
+				if (signal?.aborted === true) {
+					aborted();
+					return;
+				}
+				listeners.add(done);
+				signal?.addEventListener("abort", aborted, { once: true });
+				const poll = async () => {
+					if (!listeners.has(done)) return;
+					if (expiresAt !== void 0 && expiresAt.epochMilliseconds <= nowMillis() || await decided(token)) {
+						finish();
+						return;
+					}
+					if (listeners.has(done)) timer = setTimeout(() => {
+						poll();
+					}, interval);
+				};
+				poll();
+			});
+		},
+		wake(token) {
+			for (const listener of woken.get(token) ?? []) listener();
+		}
+	});
+}
+//#endregion
+export { pollingApprovalWaiter as t };

package/dist/waiter-CKy4MQSY.d.ts

@@ -0,0 +1,36 @@
+import { Rt as Instant } from "./policy-types-DzwivBgR.js";
+import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+//#region src/workflow/waiter.d.ts
+type ApprovalWaitOptions = {
+  /** When the approval request expires; the wait ends then whatever the store says. */
+  readonly expiresAt?: Instant;
+  /** Aborting rejects the wait with the signal's reason. */
+  readonly signal?: AbortSignal;
+};
+/**
+ * Suspends a run until an approval request is decided. `wait` resolves once
+ * the request is no longer pending, `wake` is called for its token, or it
+ * expires; it never says how the request was decided, so the caller always
+ * decides again with the token. A durable runner implements it with its own
+ * suspension primitive.
+ */
+type ApprovalWaiter = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  wait(token: string, options?: ApprovalWaitOptions): Promise<void>;
+  /** Called after an approver resolves the request for `token`. */
+  wake(token: string): void | Promise<void>;
+};
+type PollingApprovalWaiterOptions = {
+  readonly store: ApprovalStore;
+  /** Milliseconds between reads of the store. Defaults to 5000. */
+  readonly interval?: number;
+};
+/**
+ * An in-process `ApprovalWaiter` that reads `store` every `interval`
+ * milliseconds. `wake` ends a wait in the same process at once. A store read
+ * that throws counts as still pending until the request expires.
+ */
+declare function pollingApprovalWaiter(options: PollingApprovalWaiterOptions): ApprovalWaiter;
+//#endregion
+export { pollingApprovalWaiter as i, ApprovalWaiter as n, PollingApprovalWaiterOptions as r, ApprovalWaitOptions as t };

package/dist/watch-Cb-NcaUw.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-CszoTJMq.js";

package/dist/{watch-DVBJ9cBq.js → watch-CszoTJMq.js}

@@ -1,7 +1,8 @@
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { r as runCollect } from "./collect-DSTE3ml9.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BJiM-xAm.js";
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
+import { t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { n as isConfigFile, r as loadConfig } from "./config-bs_kZeYq.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts
@@ -19,7 +20,7 @@ function within(dirs, file) {
 		return path !== "" && !path.startsWith("..") && !path.startsWith(sep);
 	});
 }
-async function collectOnce(cwd, options, check, fresh, configFile) {
+async function collectOnce(cwd, options, check, fresh, configFile, now = () => dateAt()) {
 	const config = await loadConfig(cwd, configFile, { fresh });
 	const collect = {
 		...config.collect,
@@ -30,7 +31,7 @@ async function collectOnce(cwd, options, check, fresh, configFile) {
 		config,
 		collect,
 		check,
-		now: /* @__PURE__ */ new Date(),
+		now: now(),
 		fresh
 	});
 	const inputs = [
@@ -67,7 +68,7 @@ function createCollectScheduler(cwd, options, settings) {
 	async function run(check) {
 		const fresh = loaded;
 		loaded = true;
-		const result = await collectOnce(cwd, options, check, fresh, settings?.configFile);
+		const result = await collectOnce(cwd, options, check, fresh, settings?.configFile, settings?.now);
 		ignored = new Set(result.written);
 		inputs = result.inputs;
 		sources = result.sources;
@@ -124,5 +125,43 @@ function createCollectScheduler(cwd, options, settings) {
 		close
 	};
 }
+/**
+* `collect --watch`: one collect now, then one per change until Ctrl-C.
+* Under `--json` each collect is an NDJSON event on stdout; otherwise a
+* line on stderr.
+*/
+async function watchCollect(ctx, overrides) {
+	const emit = (status, message) => {
+		if (ctx.json) ctx.io.stdout(`${JSON.stringify({
+			event: "collect",
+			status,
+			message,
+			at: dateAt().toISOString()
+		})}\n`);
+		else ctx.log(message);
+	};
+	const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
+		...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
+		report: (message) => {
+			emit(message === void 0 ? "success" : "error", message ?? "catalog updated");
+		}
+	});
+	try {
+		const message = await scheduler.run(false);
+		emit(message === void 0 ? "success" : "error", message ?? "catalog written");
+	} catch (error) {
+		emit("error", describeError(error));
+	}
+	scheduler.watch();
+	ctx.signal.addEventListener("abort", () => {
+		scheduler.close();
+	});
+	ctx.log("watching for changes; Ctrl-C to stop");
+	return {
+		code: 0,
+		output: "",
+		streamed: true
+	};
+}
 //#endregion
-export { createCollectScheduler as n, report as r, collectOnce as t };
+export { watchCollect as i, createCollectScheduler as n, report as r, collectOnce as t };

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { Nn as Decision, Vt as Snapshot } from "../policy-types-DzwivBgR.js";
+import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";