permdock 0.4.0 → 0.5.0

package/dist/{version-BEogC-rB.js → version-CEbQ5UeM.js}

@@ -1,7 +1,7 @@
-import { t as packageRoot } from "./package-root-DtNnpmUd.js";
+import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-//#region src/cli/version.ts
+//#region src/cli/core/version.ts
 function cliVersion() {
 	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
 }
@@ -13,5 +13,6 @@ const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest
 const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
 const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
 const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
+const ARAZZO_REPORT_SCHEMA = "https://permdock.com/schemas/arazzo-report-v1.json";
 //#endregion
-export { USAGE_REPORT_SCHEMA as a, SUPABASE_MANIFEST_SCHEMA as i, CONFIG_REPORT_SCHEMA as n, cliVersion as o, DOCTOR_REPORT_SCHEMA as r, generatorBanner as s, CATALOG_SCHEMA as t };
+export { SUPABASE_MANIFEST_SCHEMA as a, generatorBanner as c, DOCTOR_REPORT_SCHEMA as i, CATALOG_SCHEMA as n, USAGE_REPORT_SCHEMA as o, CONFIG_REPORT_SCHEMA as r, cliVersion as s, ARAZZO_REPORT_SCHEMA as t };

package/dist/version-DXkYUISx.js

@@ -0,0 +1 @@
+export { s as cliVersion } from "./version-CEbQ5UeM.js";

package/dist/{views-CJsrBS1f.js → views-DTIIO-oQ.js}

@@ -1,4 +1,5 @@
-import { t as describe } from "./describe-Cgkp7eP0.js";
+import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
+import { t as describe } from "./describe-BybMRY7A.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];
@@ -73,7 +74,7 @@ function protectedView(local, root, permission, data, scoped) {
 	};
 	if (!state.allowed || decision.outcome !== "granted") return {
 		...state,
-		slot: "fallback"
+		slot: "denied"
 	};
 	return {
 		allowed: true,
@@ -101,8 +102,8 @@ function approvalHandle(store, decision) {
 function slotContent(slot, own, defaults) {
 	switch (slot) {
 		case "pending": return own.pending ?? defaults?.pending;
-		case "fallback": return own.fallback ?? defaults?.fallback;
-		case "approval": return own.approval ?? own.fallback ?? defaults?.approval ?? defaults?.fallback;
+		case "denied": return own.denied ?? defaults?.denied;
+		case "approval": return own.approval ?? own.denied ?? defaults?.approval ?? defaults?.denied;
 		default: return slot;
 	}
 }
@@ -113,5 +114,21 @@ function describeWith(messages) {
 		messages
 	});
 }
+/** The `GateView` of a permission state; `describeDecision` localises the reason. */
+function gateView(state, describeDecision, mode = "disable") {
+	const pending = state.status === "pending";
+	const needsApproval = state.decision.outcome === "approval-required";
+	const allowed = state.allowed && !pending;
+	return {
+		allowed,
+		pending,
+		hidden: mode === "hide" && !allowed && !pending && !needsApproval,
+		disabled: !allowed,
+		needsApproval,
+		upgrade: requiredPlans(state.decision),
+		reason: describeDecision(state.decision),
+		decision: state.decision
+	};
+}
 //#endregion
-export { permissionSet as a, scopedTenant as c, tenantView as d, livePermDock as i, slotContent as l, describeWith as n, protectedView as o, filterResult as r, rolesView as s, approvalHandle as t, subjectView as u };
+export { livePermDock as a, rolesView as c, subjectView as d, tenantView as f, gateView as i, scopedTenant as l, describeWith as n, permissionSet as o, filterResult as r, protectedView as s, approvalHandle as t, slotContent as u };

package/dist/{permission-types-Dg39z9Kv.d.ts → vocabulary-D6lPdb4Z.d.ts}

@@ -28,7 +28,7 @@ declare const RESOURCE_X: unique symbol;
 //#endregion
 //#region src/core/permission-types.d.ts
 /** `definePermissions` options. */
-type DefinePermissionsOptions<PX = never, RX = never> = {
+type PermissionsOptions<PX = never, RX = never> = {
   /**
    * Keys a permission used to have, mapped to its current key. Old keys are
    * accepted wherever a key arrives as a string (stored custom roles, OAuth
@@ -239,4 +239,67 @@ type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends Per
 type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
 type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
 //#endregion
-export { WithX as A, ResourceRelationInput as C, AppData as D, RESOURCE_X as E, AppDataSchema as O, ResourceRelation as S, ResourceXTree as T, ResourceLink as _, EdgeGroup as a, ResourceOptions as b, EdgeRelation as c, Permission as d, PermissionKind as f, ResourceLevel as g, ResourceInit as h, DefinePermissionsOptions as i, MetaValue as k, FieldRelation as l, PrincipalRelation as m, ActionMeta as n, EdgeGroups as o, PermissionTree as p, ComputedRelation as r, EdgeMatch as s, ActionList as t, InferPermissionTree as u, ResourceMeta as v, ResourceRestricted as w, ResourceParent as x, ResourceNode as y };
+//#region src/core/vocabulary.d.ts
+declare const ROLE_KIND: "role";
+declare const PLAN_KIND: "plan";
+/** `defineRoles` and `definePlans` options. */
+type VocabularyOptions<X = never> = {
+  /**
+   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
+   * definition time. On a role tree it also checks the `meta.x` of custom
+   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
+   */
+  readonly x?: AppDataSchema<X>;
+};
+/**
+ * A role's metadata. `audience` names the surface its holders use (`'staff'`,
+ * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
+ * audiences of the roles held in the active scope.
+ */
+type RoleMeta = ActionMeta & {
+  readonly audience?: string;
+};
+type Role<K extends string = string> = {
+  readonly key: K;
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable: boolean;
+  readonly meta: RoleMeta;
+  readonly kind: typeof ROLE_KIND;
+};
+type Plan<K extends string = string> = {
+  readonly key: K;
+  readonly meta: ActionMeta;
+  readonly kind: typeof PLAN_KIND;
+};
+type RoleInit = {
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable?: boolean;
+  readonly meta?: RoleMeta;
+};
+type PlanInit = {
+  readonly meta?: ActionMeta;
+};
+type RoleTree = {
+  readonly [key: string]: Role;
+};
+type PlanTree = {
+  readonly [key: string]: Plan;
+};
+type Vocabulary = {
+  readonly permissions?: unknown;
+  readonly roles?: RoleTree;
+  readonly plans?: PlanTree;
+};
+type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
+type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
+declare function isRole(value: unknown): value is Role;
+declare function isPlan(value: unknown): value is Plan;
+declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
+declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
+declare function listRoles(tree: RoleTree | undefined): readonly Role[];
+declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
+declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
+//#endregion
+export { ResourceLevel as A, RESOURCE_X as B, InferPermissionTree as C, PermissionsOptions as D, PermissionTree as E, ResourceParent as F, AppDataSchema as H, ResourceRelation as I, ResourceRelationInput as L, ResourceMeta as M, ResourceNode as N, PrincipalRelation as O, ResourceOptions as P, ResourceRestricted as R, FieldRelation as S, PermissionKind as T, MetaValue as U, AppData as V, ComputedRelation as _, RoleTree as a, EdgeMatch as b, definePlans as c, isPlan as d, isRole as f, ActionMeta as g, ActionList as h, RoleMeta as i, ResourceLink as j, ResourceInit as k, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u, EdgeGroup as v, Permission as w, EdgeRelation as x, EdgeGroups as y, ResourceXTree as z };

package/dist/vue/index.d.ts

@@ -1,11 +1,10 @@
-import { Dr as Membership, an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { r as Role } from "../vocabulary-hhEFLFoL.js";
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-C3ldA9os.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership } from "../policy-types-DzwivBgR.js";
+import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult, u as ProviderOptionsBase } from "../store-9KO4BlkB.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {
@@ -28,7 +27,7 @@ type SlotOutput = VNode | VNode[] | string | null;
 /** Render functions for the `<Protected>` slots a component leaves out; they get the slot props. */
 type PermDockDefaults = {
   readonly pending?: () => SlotOutput;
-  readonly fallback?: (props: {
+  readonly denied?: (props: {
     readonly decision: Decision;
   }) => SlotOutput;
   readonly approval?: (props: {
@@ -47,7 +46,7 @@ export declare function usePermissions(permissions: MaybeRefOrGetter<readonly Pe
 export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: MaybeRefOrGetter<readonly T[]>): ComputedRef<FilterResult<T>>;
 export declare function useTenant(): ComputedRef<TenantView>;
 export declare function useMemberships(): ComputedRef<readonly Membership[]>;
-export declare function useRoles(options?: MaybeRefOrGetter<UseRolesOptions>): ComputedRef<{
+export declare function useRoles(options?: MaybeRefOrGetter<RolesOptions>): ComputedRef<{
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): ComputedRef<readonly Role[]>;
@@ -81,4 +80,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans };

package/dist/vue/index.js

@@ -1,10 +1,10 @@
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-CbUHDoSe.js";
-import { a as permissionSet, c as scopedTenant, d as tenantView, i as livePermDock, l as slotContent, n as describeWith, o as protectedView, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "../views-CJsrBS1f.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-Ctt-81Ni.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
@@ -195,12 +195,12 @@ const Protected = defineComponent({
 			}, root, props.permission, props.data, scoped.value);
 			const own = {
 				pending: slots["pending"],
-				fallback: slots["fallback"],
+				denied: slots["denied"],
 				approval: slots["approval"]
 			};
 			switch (view.slot) {
 				case "pending": return slotContent("pending", own, defaults)?.() ?? null;
-				case "fallback": return slotContent("fallback", own, defaults)?.({ decision: view.decision }) ?? null;
+				case "denied": return slotContent("denied", own, defaults)?.({ decision: view.decision }) ?? null;
 				case "approval": return slotContent("approval", own, defaults)?.({ decision: view.decision }) ?? null;
 				case "default": return slots["default"]?.({ decision: view.decision }) ?? null;
 				default: return view;

package/dist/waiter-BGUtGYoU.js

@@ -0,0 +1,67 @@
+import { f as nowMillis } from "./time-DkWjdL98.js";
+//#region src/workflow/waiter.ts
+const DEFAULT_INTERVAL = 5e3;
+/**
+* An in-process `ApprovalWaiter` that reads `store` every `interval`
+* milliseconds. `wake` ends a wait in the same process at once. A store read
+* that throws counts as still pending until the request expires.
+*/
+function pollingApprovalWaiter(options) {
+	const interval = options.interval ?? DEFAULT_INTERVAL;
+	if (!Number.isFinite(interval) || interval <= 0) throw new RangeError("PermDock: pollingApprovalWaiter interval must be a positive number");
+	const woken = /* @__PURE__ */ new Map();
+	const decided = async (token) => {
+		try {
+			return (await options.store.get(token))?.status !== "pending";
+		} catch {
+			return false;
+		}
+	};
+	return Object.freeze({
+		wait(token, waitOptions = {}) {
+			const { signal, expiresAt } = waitOptions;
+			return new Promise((resolve, reject) => {
+				let timer;
+				const listeners = woken.get(token) ?? /* @__PURE__ */ new Set();
+				woken.set(token, listeners);
+				const finish = (error) => {
+					if (timer !== void 0) clearTimeout(timer);
+					listeners.delete(done);
+					if (listeners.size === 0) woken.delete(token);
+					signal?.removeEventListener("abort", aborted);
+					if (error === void 0) resolve();
+					else reject(error);
+				};
+				const done = () => {
+					finish();
+				};
+				const aborted = () => {
+					const reason = signal?.reason;
+					finish(reason instanceof Error ? reason : new Error("PermDock: approval wait aborted", { cause: reason }));
+				};
+				if (signal?.aborted === true) {
+					aborted();
+					return;
+				}
+				listeners.add(done);
+				signal?.addEventListener("abort", aborted, { once: true });
+				const poll = async () => {
+					if (!listeners.has(done)) return;
+					if (expiresAt !== void 0 && expiresAt.epochMilliseconds <= nowMillis() || await decided(token)) {
+						finish();
+						return;
+					}
+					if (listeners.has(done)) timer = setTimeout(() => {
+						poll();
+					}, interval);
+				};
+				poll();
+			});
+		},
+		wake(token) {
+			for (const listener of woken.get(token) ?? []) listener();
+		}
+	});
+}
+//#endregion
+export { pollingApprovalWaiter as t };

package/dist/waiter-CKy4MQSY.d.ts

@@ -0,0 +1,36 @@
+import { Rt as Instant } from "./policy-types-DzwivBgR.js";
+import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+//#region src/workflow/waiter.d.ts
+type ApprovalWaitOptions = {
+  /** When the approval request expires; the wait ends then whatever the store says. */
+  readonly expiresAt?: Instant;
+  /** Aborting rejects the wait with the signal's reason. */
+  readonly signal?: AbortSignal;
+};
+/**
+ * Suspends a run until an approval request is decided. `wait` resolves once
+ * the request is no longer pending, `wake` is called for its token, or it
+ * expires; it never says how the request was decided, so the caller always
+ * decides again with the token. A durable runner implements it with its own
+ * suspension primitive.
+ */
+type ApprovalWaiter = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  wait(token: string, options?: ApprovalWaitOptions): Promise<void>;
+  /** Called after an approver resolves the request for `token`. */
+  wake(token: string): void | Promise<void>;
+};
+type PollingApprovalWaiterOptions = {
+  readonly store: ApprovalStore;
+  /** Milliseconds between reads of the store. Defaults to 5000. */
+  readonly interval?: number;
+};
+/**
+ * An in-process `ApprovalWaiter` that reads `store` every `interval`
+ * milliseconds. `wake` ends a wait in the same process at once. A store read
+ * that throws counts as still pending until the request expires.
+ */
+declare function pollingApprovalWaiter(options: PollingApprovalWaiterOptions): ApprovalWaiter;
+//#endregion
+export { pollingApprovalWaiter as i, ApprovalWaiter as n, PollingApprovalWaiterOptions as r, ApprovalWaitOptions as t };

package/dist/watch-Cb-NcaUw.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-CszoTJMq.js";

package/dist/{watch-zeucB7eF.js → watch-CszoTJMq.js}

@@ -1,7 +1,8 @@
-import { i as describeError } from "./errors-CWfoNg9N.js";
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
 import { t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { r as runCollect } from "./collect-2SrB7lfk.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BIjREpyE.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { n as isConfigFile, r as loadConfig } from "./config-bs_kZeYq.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts
@@ -19,7 +20,7 @@ function within(dirs, file) {
 		return path !== "" && !path.startsWith("..") && !path.startsWith(sep);
 	});
 }
-async function collectOnce(cwd, options, check, fresh, configFile, now = () => /* @__PURE__ */ new Date()) {
+async function collectOnce(cwd, options, check, fresh, configFile, now = () => dateAt()) {
 	const config = await loadConfig(cwd, configFile, { fresh });
 	const collect = {
 		...config.collect,
@@ -124,5 +125,43 @@ function createCollectScheduler(cwd, options, settings) {
 		close
 	};
 }
+/**
+* `collect --watch`: one collect now, then one per change until Ctrl-C.
+* Under `--json` each collect is an NDJSON event on stdout; otherwise a
+* line on stderr.
+*/
+async function watchCollect(ctx, overrides) {
+	const emit = (status, message) => {
+		if (ctx.json) ctx.io.stdout(`${JSON.stringify({
+			event: "collect",
+			status,
+			message,
+			at: dateAt().toISOString()
+		})}\n`);
+		else ctx.log(message);
+	};
+	const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
+		...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
+		report: (message) => {
+			emit(message === void 0 ? "success" : "error", message ?? "catalog updated");
+		}
+	});
+	try {
+		const message = await scheduler.run(false);
+		emit(message === void 0 ? "success" : "error", message ?? "catalog written");
+	} catch (error) {
+		emit("error", describeError(error));
+	}
+	scheduler.watch();
+	ctx.signal.addEventListener("abort", () => {
+		scheduler.close();
+	});
+	ctx.log("watching for changes; Ctrl-C to stop");
+	return {
+		code: 0,
+		output: "",
+		streamed: true
+	};
+}
 //#endregion
-export { createCollectScheduler as n, report as r, collectOnce as t };
+export { watchCollect as i, createCollectScheduler as n, report as r, collectOnce as t };

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { an as Snapshot, ir as Decision } from "../policy-types-sp9P1iIV.js";
-import { d as Permission, p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { Nn as Decision, Vt as Snapshot } from "../policy-types-DzwivBgR.js";
+import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/webmcp/index.js

@@ -1,9 +1,9 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as isThenable, t as ignoreRejection } from "../thenable-QSmvt-vZ.js";
 import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-BsblpB-z.js";
+import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-Br4jSNVi.js";
+import { n as isThenable, t as ignoreRejection } from "../thenable-yD7SabqG.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-CQ7OEia9.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-CMLN5xhn.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");