permdock 0.3.1 → 0.5.0

package/dist/workflow-sdk/index.d.ts

@@ -0,0 +1,56 @@
+import { Nn as Decision } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+//#region src/workflow-sdk/index.d.ts
+/** The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the run. */
+export type WorkflowSdkHook = {
+  readonly then: PromiseLike<unknown>["then"];
+  dispose(): void;
+};
+/** `createHook` from `workflow`; valid only inside a `"use workflow"` function. */
+export type WorkflowSdkCreateHook = (options: {
+  readonly token: string;
+}) => WorkflowSdkHook;
+/** `resumeHook` from `workflow/api`. */
+export type WorkflowSdkResumeHook = (token: string, payload: unknown) => Promise<unknown>;
+/** `sleep` from `workflow`; valid only inside a `"use workflow"` function. */
+export type WorkflowSdkSleep = (until: Date) => PromiseLike<unknown>;
+/** `start` from `workflow/api`, with the workflow function and its arguments. */
+export type WorkflowSdkStart<TArgs extends unknown[], TRun> = (workflow: (ticket: string, ...args: TArgs) => Promise<unknown>, args: [string, ...TArgs]) => Promise<TRun>;
+export type WorkflowSdkWaiterOptions = {
+  readonly createHook: WorkflowSdkCreateHook;
+  readonly resumeHook: WorkflowSdkResumeHook;
+  /** With `sleep`, a wait ends at the request's `expiresAt`; without it, only a wake ends it. */
+  readonly sleep?: WorkflowSdkSleep;
+};
+/** The Workflow SDK hook token a run parks on while approval `token` is pending. */
+export declare function approvalHookToken(token: string): string;
+/**
+ * An `ApprovalWaiter` over Workflow SDK hooks. `wait` parks the run on a hook
+ * and must run inside the workflow function; `wake` resumes it from an
+ * approval handler. The hook carries no verdict: the run decides again from
+ * the approval store after it wakes.
+ */
+export declare function workflowSdkWaiter(options: WorkflowSdkWaiterOptions): ApprovalWaiter;
+export type StartAutomationRunResult<TRun> = (Extract<StartAutomationResult, {
+  readonly outcome: "started";
+}> & {
+  readonly workflowRun: TRun;
+}) | Extract<StartAutomationResult, {
+  readonly outcome: "denied";
+}>;
+/**
+ * Starts automation `id` and, when PermDock grants it, the Workflow SDK run
+ * that executes it, with the run ticket as the workflow's first argument. A
+ * denied start starts nothing.
+ */
+export declare function startAutomation<TArgs extends unknown[], TRun>(workflow: Pick<WorkflowPermDock, "start">, start: WorkflowSdkStart<TArgs, TRun>, run: (ticket: string, ...args: TArgs) => Promise<unknown>, id: string, args: TArgs, options?: AutomationOptions): Promise<StartAutomationRunResult<TRun>>;
+/**
+ * Resumes hook `token` with `payload` only when `caller` is granted
+ * `permission` on `row`. A token alone never resumes a run. A hook that is
+ * gone or a resume that throws denies with `validation`.
+ */
+export declare function authorizeHook(resumeHook: WorkflowSdkResumeHook, caller: PermDock, permission: Permission, row: unknown, token: string, payload: unknown): Promise<Decision>;
+//#endregion

package/dist/workflow-sdk/index.js

@@ -0,0 +1,78 @@
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+//#region src/workflow-sdk/index.ts
+const HOOK_PREFIX = "permdock:approval:";
+/** The Workflow SDK hook token a run parks on while approval `token` is pending. */
+function approvalHookToken(token) {
+	return `${HOOK_PREFIX}${token}`;
+}
+/**
+* An `ApprovalWaiter` over Workflow SDK hooks. `wait` parks the run on a hook
+* and must run inside the workflow function; `wake` resumes it from an
+* approval handler. The hook carries no verdict: the run decides again from
+* the approval store after it wakes.
+*/
+function workflowSdkWaiter(options) {
+	const { createHook, resumeHook, sleep } = options;
+	return Object.freeze({
+		async wait(token, waitOptions = {}) {
+			const hook = createHook({ token: approvalHookToken(token) });
+			try {
+				const expiresAt = waitOptions.expiresAt?.epochMilliseconds;
+				if (sleep === void 0 || expiresAt === void 0) {
+					await hook;
+					return;
+				}
+				await Promise.race([hook, sleep(new Date(expiresAt))]);
+			} finally {
+				hook.dispose();
+			}
+		},
+		async wake(token) {
+			try {
+				await resumeHook(approvalHookToken(token), { token });
+			} catch {}
+		}
+	});
+}
+/**
+* Starts automation `id` and, when PermDock grants it, the Workflow SDK run
+* that executes it, with the run ticket as the workflow's first argument. A
+* denied start starts nothing.
+*/
+async function startAutomation(workflow, start, run, id, args, options) {
+	const started = await workflow.start(id, options);
+	if (started.outcome !== "started") return started;
+	const workflowRun = await start(run, [started.ticket, ...args]);
+	return Object.freeze({
+		...started,
+		workflowRun
+	});
+}
+function hookDenied() {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "validation",
+			detail: { cause: "hook-unavailable" }
+		}],
+		alternatives: []
+	});
+}
+/**
+* Resumes hook `token` with `payload` only when `caller` is granted
+* `permission` on `row`. A token alone never resumes a run. A hook that is
+* gone or a resume that throws denies with `validation`.
+*/
+async function authorizeHook(resumeHook, caller, permission, row, token, payload) {
+	const decision = caller.decide(permission, row);
+	if (decision.outcome !== "granted") return decision;
+	try {
+		await resumeHook(token, payload);
+	} catch {
+		return hookDenied();
+	}
+	return decision;
+}
+//#endregion
+export { approvalHookToken, authorizeHook, startAutomation, workflowSdkWaiter };

package/dist/wrap-Bd1Tejur.d.ts

@@ -0,0 +1,15 @@
+import { j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
+import { r as PermDock } from "./permdock-D7eeLJER.js";
+//#region src/core/wrap.d.ts
+/** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
+type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;
+/** The members `wrapPermDock` replaces; it re-wraps the derived instances itself. */
+type PermDockOverrides<V extends PolicyVocabulary = PolicyVocabulary> = Partial<Omit<PermDock<V>, "tenant" | "team" | "derive">>;
+/**
+ * A frozen copy of `permdock` with the members `overrides` returns replaced.
+ * `overrides` runs again for every instance `tenant()`, `team()` and
+ * `derive()` return, so a wrapper never falls off a derived instance.
+ */
+declare function wrapPermDock<V extends PolicyVocabulary = PolicyVocabulary>(permdock: PermDock<V>, overrides: (permdock: PermDock<V>) => PermDockOverrides<V>): PermDock<V>;
+//#endregion
+export { PermDockWrap as n, wrapPermDock as r, PermDockOverrides as t };

package/dist/wrap-gX61EtpB.js

@@ -0,0 +1,27 @@
+import { n as internalsOf, t as attachInternals } from "./internals-Dk8A8fX3.js";
+//#region src/core/wrap.ts
+/**
+* A frozen copy of `permdock` with the members `overrides` returns replaced.
+* `overrides` runs again for every instance `tenant()`, `team()` and
+* `derive()` return, so a wrapper never falls off a derived instance.
+*/
+function wrapPermDock(permdock, overrides) {
+	const wrap = (next) => wrapPermDock(next, overrides);
+	const wrapped = {
+		...permdock,
+		...overrides(permdock),
+		tenant: (id) => wrap(permdock.tenant(id)),
+		team: (id) => wrap(permdock.team(id)),
+		derive: async (options) => wrap(await permdock.derive(options))
+	};
+	const internals = internalsOf(permdock);
+	if (internals !== void 0) attachInternals(wrapped, internals);
+	return Object.freeze(wrapped);
+}
+/** `otel`, then `wrap`. */
+function composeWraps(otel, wrap) {
+	if (otel === void 0 || wrap === void 0) return otel ?? wrap;
+	return (permdock) => wrap(otel(permdock));
+}
+//#endregion
+export { wrapPermDock as n, composeWraps as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -102,6 +102,26 @@
       "types": "./dist/node/index.d.ts",
       "default": "./dist/node/index.js"
     },
+    "./h3": {
+      "types": "./dist/h3/index.d.ts",
+      "default": "./dist/h3/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit/index.d.ts",
+      "default": "./dist/sveltekit/index.js"
+    },
+    "./astro": {
+      "types": "./dist/astro/index.d.ts",
+      "default": "./dist/astro/index.js"
+    },
+    "./solid-start": {
+      "types": "./dist/solid-start/index.d.ts",
+      "default": "./dist/solid-start/index.js"
+    },
+    "./tanstack-start": {
+      "types": "./dist/tanstack-start/index.d.ts",
+      "default": "./dist/tanstack-start/index.js"
+    },
     "./trpc": {
       "types": "./dist/trpc/index.d.ts",
       "default": "./dist/trpc/index.js"
@@ -123,6 +143,10 @@
       "types": "./dist/solid/index.d.ts",
       "default": "./dist/solid/index.js"
     },
+    "./agent": {
+      "types": "./dist/agent/index.d.ts",
+      "default": "./dist/agent/index.js"
+    },
     "./ai-sdk": {
       "types": "./dist/ai-sdk/index.d.ts",
       "default": "./dist/ai-sdk/index.js"
@@ -159,6 +183,30 @@
       "types": "./dist/webmcp/index.d.ts",
       "default": "./dist/webmcp/index.js"
     },
+    "./workflow": {
+      "types": "./dist/workflow/index.d.ts",
+      "default": "./dist/workflow/index.js"
+    },
+    "./workflow-sdk": {
+      "types": "./dist/workflow-sdk/index.d.ts",
+      "default": "./dist/workflow-sdk/index.js"
+    },
+    "./delivery": {
+      "types": "./dist/delivery/index.d.ts",
+      "default": "./dist/delivery/index.js"
+    },
+    "./resend": {
+      "types": "./dist/resend/index.d.ts",
+      "default": "./dist/resend/index.js"
+    },
+    "./chat": {
+      "types": "./dist/chat/index.d.ts",
+      "default": "./dist/chat/index.js"
+    },
+    "./chat-sdk": {
+      "types": "./dist/chat-sdk/index.d.ts",
+      "default": "./dist/chat-sdk/index.js"
+    },
     "./a2a": {
       "types": "./dist/a2a/index.d.ts",
       "default": "./dist/a2a/index.js"
@@ -239,6 +287,10 @@
       "types": "./dist/catalog/index.d.ts",
       "default": "./dist/catalog/index.js"
     },
+    "./preset": {
+      "types": "./dist/preset/index.d.ts",
+      "default": "./dist/preset/index.js"
+    },
     "./cli": {
       "types": "./dist/cli/index.d.ts",
       "default": "./dist/cli/index.js"
@@ -246,7 +298,8 @@
     "./unplugin": {
       "types": "./dist/unplugin/index.d.ts",
       "default": "./dist/unplugin/index.js"
-    }
+    },
+    "./schemas/*": "./schemas/*"
   },
   "publishConfig": {
     "access": "public",
@@ -255,91 +308,108 @@
   "dependencies": {
     "@clack/prompts": "1.8.1",
     "@standard-schema/spec": "1.1.0",
-    "citty": "0.2.2",
     "diff": "9.0.0",
+    "fastest-levenshtein": "1.0.16",
     "jiti": "2.7.0",
-    "oxc-parser": "0.152.0",
-    "package-manager-detector": "1.8.0",
-    "smol-toml": "1.9.0"
+    "oxc-parser": "0.154.0",
+    "package-manager-detector": "1.9.0",
+    "smol-toml": "1.9.1"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.288",
+    "@anthropic-ai/claude-agent-sdk": "0.3.301",
     "@arethetypeswrong/cli": "0.18.5",
-    "@babel/core": "8.0.6",
-    "@modelcontextprotocol/client": "2.3.0",
-    "@modelcontextprotocol/server": "2.3.0",
-    "@nestjs/common": "12.1.2",
-    "@nestjs/core": "12.1.2",
-    "@nestjs/platform-express": "12.1.2",
-    "@openai/agents": "0.18.0",
-    "@orpc/contract": "2.0.0-beta.41",
-    "@orpc/openapi": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
+    "@babel/core": "8.0.7",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
+    "@nestjs/common": "12.1.3",
+    "@nestjs/core": "12.1.3",
+    "@nestjs/platform-express": "12.1.3",
+    "@openai/agents": "0.20.0",
+    "@orpc/contract": "2.0.0-beta.42",
+    "@orpc/openapi": "2.0.0-beta.42",
+    "@orpc/server": "2.0.0-beta.42",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
+    "@solidjs/start": "2.0.6",
     "@supabase/middleware": "1.0.0",
-    "@supabase/supabase-js": "2.117.2",
+    "@supabase/supabase-js": "2.118.0",
+    "@sveltejs/kit": "3.1.0",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
+    "@tanstack/react-start": "1.169.2",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "26.6.4",
+    "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.3",
-    "ai": "7.0.127",
+    "@vercel/detect-agent": "1.2.5",
+    "@vitest/coverage-v8": "5.0.5",
+    "ai": "7.0.141",
     "ajv": "8.20.0",
+    "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.7.0",
+    "better-supabase": "0.9.0",
+    "better-supabase-floor": "npm:better-supabase@0.9.0",
+    "chat": "4.42.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.71.3",
-    "express": "5.2.1",
-    "fastify": "5.12.5",
+    "eve": "0.79.2",
+    "express": "5.3.0",
+    "fastify": "5.12.7",
+    "h3": "2.0.2",
     "happy-dom": "20.14.5",
-    "hono": "4.13.12",
+    "hono": "4.13.13",
     "jose": "6.2.12",
     "kysely": "0.29.6",
-    "next": "16.3.8",
-    "oxlint": "1.86.0",
-    "oxlint-tsgolint": "7.0.2003",
+    "next": "16.4.1",
+    "oxlint": "1.88.0",
+    "oxlint-tsgolint": "7.0.2004",
     "pg": "8.23.1",
-    "pgsql-parser": "18.2.8",
+    "pgsql-parser": "18.2.12",
     "publint": "0.3.25",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "reflect-metadata": "0.2.2",
+    "resend": "6.33.0",
     "rxjs": "7.8.2",
-    "solid-js": "1.9.15",
-    "svelte": "5.57.1",
-    "temporal-polyfill": "1.0.5",
-    "tsdown": "0.23.0",
+    "solid-js": "1.9.17",
+    "svelte": "5.57.2",
+    "temporal-polyfill": "1.0.6",
+    "tsdown": "0.23.1",
     "typescript": "7.0.2",
     "unplugin": "3.4.0",
     "valibot": "1.5.0",
-    "vitest": "5.0.3",
-    "vue": "3.5.43",
+    "vitest": "5.0.5",
+    "vue": "3.5.44",
+    "workflow": "5.2.2",
     "yaml": "2.9.1",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "peerDependencies": {
     "@anthropic-ai/claude-agent-sdk": ">=0.2",
     "@modelcontextprotocol/server": ">=2",
+    "@napi-rs/keyring": ">=1",
     "@nestjs/common": ">=11",
     "@nestjs/core": ">=11",
     "@nestjs/platform-express": ">=11",
     "@openai/agents": ">=0.1",
     "@opentelemetry/api": ">=1",
     "@orpc/server": ">=2.0.0-0",
+    "@solidjs/start": ">=2",
     "@supabase/middleware": ">=1",
+    "@sveltejs/kit": ">=2",
+    "@tanstack/react-start": ">=1.168",
     "@trpc/server": ">=11",
     "ai": ">=5",
-    "better-supabase": ">=0.6.0 <0.8.0",
+    "astro": ">=5",
+    "better-supabase": ">=0.9.0 <0.10.0",
+    "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",
     "eve": ">=0.40",
     "express": ">=4",
     "fastify": ">=5",
+    "h3": ">=2",
     "hono": ">=4",
     "jose": "^6",
     "kysely": ">=0.27",
@@ -348,12 +418,14 @@
     "pgsql-parser": ">=18",
     "react": "^19",
     "reflect-metadata": ">=0.1",
+    "resend": ">=6",
     "rxjs": ">=7",
     "solid-js": ">=1.9",
     "svelte": ">=5.3",
     "unplugin": ">=2",
     "vitest": ">=3",
-    "vue": ">=3"
+    "vue": ">=3",
+    "workflow": ">=5"
   },
   "peerDependenciesMeta": {
     "@anthropic-ai/claude-agent-sdk": {
@@ -362,6 +434,9 @@
     "@modelcontextprotocol/server": {
       "optional": true
     },
+    "@napi-rs/keyring": {
+      "optional": true
+    },
     "@nestjs/common": {
       "optional": true
     },
@@ -380,18 +455,33 @@
     "@orpc/server": {
       "optional": true
     },
+    "@solidjs/start": {
+      "optional": true
+    },
     "@supabase/middleware": {
       "optional": true
     },
+    "@sveltejs/kit": {
+      "optional": true
+    },
+    "@tanstack/react-start": {
+      "optional": true
+    },
     "@trpc/server": {
       "optional": true
     },
     "ai": {
       "optional": true
     },
+    "astro": {
+      "optional": true
+    },
     "better-supabase": {
       "optional": true
     },
+    "chat": {
+      "optional": true
+    },
     "drizzle-orm": {
       "optional": true
     },
@@ -407,6 +497,9 @@
     "fastify": {
       "optional": true
     },
+    "h3": {
+      "optional": true
+    },
     "hono": {
       "optional": true
     },
@@ -431,6 +524,9 @@
     "reflect-metadata": {
       "optional": true
     },
+    "resend": {
+      "optional": true
+    },
     "rxjs": {
       "optional": true
     },
@@ -448,6 +544,9 @@
     },
     "vue": {
       "optional": true
+    },
+    "workflow": {
+      "optional": true
     }
   },
   "engines": {

package/schemas/access-event-v1.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://permdock.com/schemas/access-event-v1.json",
+  "title": "PermDock support access event",
+  "description": "An AccessEvent, wire format v1: the data of com.permdock.support-session.* CloudEvents.",
+  "type": "object",
+  "required": [
+    "type",
+    "at",
+    "source",
+    "operation",
+    "tenant",
+    "principal",
+    "via",
+    "roles"
+  ],
+  "properties": {
+    "x": {
+      "type": "object",
+      "description": "The application's own data, set where the event is built: plain JSON, never read by a decision."
+    },
+    "type": {
+      "const": "access"
+    },
+    "at": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "source": {
+      "type": "string"
+    },
+    "operation": {
+      "enum": ["started", "ended", "revoked"]
+    },
+    "tenant": {
+      "type": "string",
+      "minLength": 1
+    },
+    "principal": {
+      "type": "object",
+      "required": ["id"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": false
+    },
+    "via": {
+      "type": "string"
+    },
+    "roles": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "member": {
+      "type": "object",
+      "required": ["group"],
+      "properties": {
+        "group": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$"
+    },
+    "grantedBy": {
+      "type": "string"
+    },
+    "reason": {
+      "type": "string"
+    },
+    "actor": {
+      "type": "object",
+      "required": ["id", "kind"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "kind": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "session": {
+      "type": "object",
+      "required": ["id", "principal"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "principal": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": false
+    },
+    "permissions": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "additionalProperties": false
+}