permdock 0.5.0 → 0.7.0

package/dist/{views-DTIIO-oQ.js → views-BB8E9dTP.js}

@@ -1,5 +1,5 @@
 import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-BybMRY7A.js";
+import { t as describe } from "./describe-DZlnEtLy.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];

package/dist/vocabulary-Bg3eeT2H.d.ts

@@ -0,0 +1,67 @@
+import { j as WithX, k as AppDataSchema, n as ActionMeta } from "./permission-types-DhNEmoRG.js";
+//#region src/core/vocabulary.d.ts
+declare const ROLE_KIND: "role";
+declare const PLAN_KIND: "plan";
+/** `defineRoles` and `definePlans` options. */
+type VocabularyOptions<X = never> = {
+  /**
+   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
+   * definition time. On a role tree it also checks the `meta.x` of custom
+   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
+   */
+  readonly x?: AppDataSchema<X>;
+};
+/**
+ * A role's metadata. `audience` names the surface its holders use (`'staff'`,
+ * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
+ * audiences of the roles held in the active scope.
+ */
+type RoleMeta = ActionMeta & {
+  readonly audience?: string;
+};
+type Role<K extends string = string> = {
+  readonly key: K;
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable: boolean;
+  readonly meta: RoleMeta;
+  /** A shared custom role: the platform defines it for every tenant, and a tenant admin cannot edit it. */
+  readonly shared?: true;
+  readonly kind: typeof ROLE_KIND;
+};
+type Plan<K extends string = string> = {
+  readonly key: K;
+  readonly meta: ActionMeta;
+  readonly kind: typeof PLAN_KIND;
+};
+type RoleInit = {
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable?: boolean;
+  readonly meta?: RoleMeta;
+};
+type PlanInit = {
+  readonly meta?: ActionMeta;
+};
+type RoleTree = {
+  readonly [key: string]: Role;
+};
+type PlanTree = {
+  readonly [key: string]: Plan;
+};
+type Vocabulary = {
+  readonly permissions?: unknown;
+  readonly roles?: RoleTree;
+  readonly plans?: PlanTree;
+};
+type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
+type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
+declare function isRole(value: unknown): value is Role;
+declare function isPlan(value: unknown): value is Plan;
+declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
+declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
+declare function listRoles(tree: RoleTree | undefined): readonly Role[];
+declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
+declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
+//#endregion
+export { RoleTree as a, definePlans as c, isPlan as d, isRole as f, RoleMeta as i, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u };

package/dist/vue/index.d.ts

@@ -1,10 +1,11 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership } from "../policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, dt as TokenVerifier, or as Membership } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { r as Role } from "../vocabulary-Bg3eeT2H.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-O0SwYIK8.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-CKV71kKh.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {

package/dist/vue/index.js

@@ -1,10 +1,10 @@
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
+import { i as isPromiseLike } from "../store-options-B_poyYvg.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-IgqQipCO.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-BB8E9dTP.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");

package/dist/{waiter-CKy4MQSY.d.ts → waiter-DwEyouan.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { Rt as Instant } from "./policy-types-B-F-qAZk.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /** When the approval request expires; the wait ends then whatever the store says. */

package/dist/watch-Bd9mx3rd.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-C-4VmFlL.js";

package/dist/{watch-CszoTJMq.js → watch-C-4VmFlL.js}

@@ -1,8 +1,8 @@
 import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
+import { a as describeError } from "./errors-DpP_U6Bf.js";
 import { t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
-import { n as isConfigFile, r as loadConfig } from "./config-bs_kZeYq.js";
+import { r as runCollect } from "./collect-BaWeMjwV.js";
+import { n as isConfigFile, r as loadConfig } from "./config-CoQHDrDi.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { Nn as Decision, Vt as Snapshot } from "../policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { Gt as Snapshot, Ln as Decision } from "../policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "../permission-types-DhNEmoRG.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/webmcp/index.js

@@ -1,9 +1,9 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-Br4jSNVi.js";
+import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-DpPtSKNZ.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-yD7SabqG.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-CMLN5xhn.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-reAhIzdl.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");

package/dist/{where-scope-Dv-WTP-w.js → where-scope-wq2coopv.js}

@@ -2,28 +2,36 @@ import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
 import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
-import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-BHsc-wp-.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
 import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
 //#region src/core/snapshot-sign.ts
 /**
-* Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
-* `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
-* registered claims are the only times a verifier reads.
+* The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`
+* become `iat` and `exp` and leave the `snapshot` claim, so the registered
+* claims are the only times a verifier reads.
 */
-function signSnapshot(snapshot, signer, options = {}) {
+function snapshotClaims(snapshot) {
 	const { issuedAt, expiresAt, ...claim } = snapshot;
-	const payload = { snapshot: claim };
-	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
 	const iat = secondsOf(issuedAt);
+	return compact({
+		snapshot: claim,
+		sub: snapshot.subject.principal?.id,
+		iat: iat === void 0 || iat <= 0 ? void 0 : iat,
+		exp: secondsOf(expiresAt)
+	});
+}
+/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
+function signSnapshot(snapshot, signer, options = {}) {
+	const { iat, exp, ...payload } = snapshotClaims(snapshot);
 	return signer.sign(payload, compact({
 		typ: "vnd.permdock.snapshot+jwt",
 		audience: options.audience,
-		issuedAt: iat === void 0 || iat <= 0 ? void 0 : iat,
-		expiresAt: secondsOf(expiresAt)
+		issuedAt: iat,
+		expiresAt: exp
 	}));
 }
 /**
@@ -96,6 +104,22 @@ function delegationMayCover(permission, delegation, hasActor) {
 function blocksEveryRow(grant) {
 	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
 }
+function withinDelegation(permdock, permission, ceiling) {
+	return (ceiling === void 0 || ceiling.includes(permission.key)) && !readOnlyActorRefuses(permdock.subject.actor, permission) && delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0);
+}
+/**
+* Whether the subject's delegation, its delegated ceiling and a read-only
+* actor leave `permission` within reach, whatever the grants say. A hint,
+* never a decision.
+*/
+function delegationAllows(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		return "grants" in snapshot && withinDelegation(permdock, permission, snapshot.delegated);
+	} catch {
+		return false;
+	}
+}
 /**
 * Whether `permission` could be granted to this instance's subject for some
 * row: the grants its snapshot carries for the active tenant, minus an
@@ -105,10 +129,7 @@ function blocksEveryRow(grant) {
 function mayUse(permdock, permission) {
 	try {
 		const snapshot = permdock.snapshot();
-		if (!("grants" in snapshot)) return false;
-		const ceiling = snapshot.delegated;
-		if (ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission)) return false;
-		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		if (!("grants" in snapshot) || !withinDelegation(permdock, permission, snapshot.delegated)) return false;
 		const tenant = permdock.subject.principal?.tenant;
 		const scopes = scopeList(snapshot.scopes);
 		const grants = snapshot.grants.filter((grant) => {
@@ -143,8 +164,7 @@ function permittedIds(permdock, permission, scope, options = {}) {
 		if (!("grants" in snapshot)) return [];
 		const scopes = scopeList(snapshot.scopes);
 		const name = resolveScope(scopes, scope);
-		const ceiling = snapshot.delegated;
-		if (name === void 0 || ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission) || !delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return [];
+		if (name === void 0 || !withinDelegation(permdock, permission, snapshot.delegated)) return [];
 		const conditioned = options.conditioned === true;
 		const now = nowSeconds();
 		const allowed = /* @__PURE__ */ new Set();
@@ -183,7 +203,7 @@ function namedFilters(membership, scope) {
 	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
 	const filters = [];
 	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
-		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
+		const key = scope.fieldOf(name);
 		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
 	}
 	return filters;
@@ -303,4 +323,4 @@ function whereFromGrants(grants, scope) {
 	return freezeDeep(result);
 }
 //#endregion
-export { deniedFor as a, snapshotFromClaims as c, decideForTarget as i, mayUse as n, signSnapshot as o, permittedIds as r, snapshotClaim as s, whereFromGrants as t };
+export { decideForTarget as a, snapshotClaim as c, permittedIds as i, snapshotClaims as l, delegationAllows as n, deniedFor as o, mayUse as r, signSnapshot as s, whereFromGrants as t, snapshotFromClaims as u };

package/dist/{who-can-D0QoYbEb.js → who-can-BwNsI_Js.js}

@@ -2,15 +2,15 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { r as ownGet } from "./paths-DXSHAMIa.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { a as getResource } from "./permission-registry-DpPtSKNZ.js";
 import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { s as instantAt } from "./time-DkWjdL98.js";
-import { a as normalizeMemberships, c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { r as relationCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { r as relationCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-CmeBQ6Nv.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { C as emptyListeners, t as evaluate } from "./evaluate-_R8QkWaf.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-B_oqFbWC.js";
 import { n as relationId, t as pendingRelations } from "./relations-BnCWnJGI.js";
 import { t as relationWalk } from "./relation-walk-3OyDBF0S.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-BMZPIVUM.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CKy4MQSY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-DOtAFWdy.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-DwEyouan.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-QHuuPw3q.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -1,12 +1,12 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as findPermission } from "../permission-registry-Br4jSNVi.js";
+import { n as findPermission } from "../permission-registry-DpPtSKNZ.js";
 import { n as isThenable } from "../thenable-yD7SabqG.js";
-import { n as memoryAutomationSource, r as parseAutomation } from "../automation-DVjOckjV.js";
-import { c as withApp, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { n as memoryAutomationSource, r as parseAutomation } from "../automation-ySsxp_Yp.js";
+import { l as withApp, t as getPermDock } from "../permdock-BfWEeMqk.js";
 import { o as automationEvent } from "../sink-BEZSlMS_.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-DTcZOzhF.js";
-import { n as signRunTicket, r as subjectFromRunTicket } from "../run-ticket-sxFI6LAk.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DY3vXuGs.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-B5d_63Ma.js";
 import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {

package/dist/workflow-sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { Nn as Decision } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+import { Ln as Decision } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { n as ApprovalWaiter } from "../waiter-DwEyouan.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-QHuuPw3q.js";
 //#region src/workflow-sdk/index.d.ts
 /** The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the run. */
 export type WorkflowSdkHook = {

package/dist/{wrap-Bd1Tejur.d.ts → wrap-B6R0cMRL.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { j as PolicyVocabulary } from "./policy-types-B-F-qAZk.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;

package/dist/{wrap-gX61EtpB.js → wrap-CiSc_KCq.js}

@@ -1,4 +1,5 @@
 import { n as internalsOf, t as attachInternals } from "./internals-Dk8A8fX3.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-BC_0mPIq.js";
 //#region src/core/wrap.ts
 /**
 * A frozen copy of `permdock` with the members `overrides` returns replaced.
@@ -7,9 +8,14 @@ import { n as internalsOf, t as attachInternals } from "./internals-Dk8A8fX3.js"
 */
 function wrapPermDock(permdock, overrides) {
 	const wrap = (next) => wrapPermDock(next, overrides);
-	const wrapped = {
+	const replaced = {
 		...permdock,
-		...overrides(permdock),
+		...overrides(permdock)
+	};
+	const wrapped = {
+		...replaced,
+		canAll: (checks, options) => canAllWith(replaced.can, checks, options),
+		decideAll: (checks, options) => decideAllWith(replaced.decide, checks, options),
 		tenant: (id) => wrap(permdock.tenant(id)),
 		team: (id) => wrap(permdock.team(id)),
 		derive: async (options) => wrap(await permdock.derive(options))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -271,6 +271,14 @@
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
     },
+    "./testing/core": {
+      "types": "./dist/testing/core.d.ts",
+      "default": "./dist/testing/core.js"
+    },
+    "./testing/fixtures": {
+      "types": "./dist/testing/fixtures/index.d.ts",
+      "default": "./dist/testing/fixtures/index.js"
+    },
     "./testing/saas": {
       "types": "./dist/testing/saas/index.d.ts",
       "default": "./dist/testing/saas/index.js"
@@ -299,26 +307,23 @@
       "types": "./dist/unplugin/index.d.ts",
       "default": "./dist/unplugin/index.js"
     },
-    "./schemas/*": "./schemas/*"
+    "./schemas/*": "./schemas/*",
+    "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "dependencies": {
-    "@clack/prompts": "1.8.1",
     "@standard-schema/spec": "1.1.0",
-    "diff": "9.0.0",
-    "fastest-levenshtein": "1.0.16",
     "jiti": "2.7.0",
-    "oxc-parser": "0.154.0",
-    "package-manager-detector": "1.9.0",
-    "smol-toml": "1.9.1"
+    "oxc-parser": "0.154.0"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.301",
     "@arethetypeswrong/cli": "0.18.5",
     "@babel/core": "8.0.7",
+    "@clack/prompts": "1.8.1",
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/server": "2.3.1",
     "@nestjs/common": "12.1.3",
@@ -348,13 +353,15 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.9.0",
-    "better-supabase-floor": "npm:better-supabase@0.9.0",
+    "better-supabase": "0.12.0",
+    "better-supabase-floor": "npm:better-supabase@0.11.0",
     "chat": "4.42.0",
+    "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
     "eve": "0.79.2",
     "express": "5.3.0",
+    "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
     "h3": "2.0.2",
     "happy-dom": "20.14.5",
@@ -364,6 +371,7 @@
     "next": "16.4.1",
     "oxlint": "1.88.0",
     "oxlint-tsgolint": "7.0.2004",
+    "package-manager-detector": "1.9.0",
     "pg": "8.23.1",
     "pgsql-parser": "18.2.12",
     "publint": "0.3.25",
@@ -372,6 +380,7 @@
     "reflect-metadata": "0.2.2",
     "resend": "6.33.0",
     "rxjs": "7.8.2",
+    "smol-toml": "1.9.1",
     "solid-js": "1.9.17",
     "svelte": "5.57.2",
     "temporal-polyfill": "1.0.6",
@@ -402,7 +411,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.9.0 <0.10.0",
+    "better-supabase": ">=0.11.0 <0.13.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",
@@ -556,6 +565,8 @@
     "bench": "vitest bench --run --project \"node (bench)\" --reporter=verbose",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "gen": "node ../../scripts/testing-fixtures.ts",
+    "gen:check": "node ../../scripts/testing-fixtures.ts --check",
     "lint": "oxlint --disable-nested-config --type-aware",
     "test": "vitest run --coverage",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tests/tsconfig.json"

package/schemas/cli-result-v1.json

@@ -77,6 +77,7 @@
             "dirty_worktree",
             "write_failed",
             "check_failed",
+            "catalog_invalid",
             "input_required",
             "consent_required",
             "cancelled",