permdock 0.6.0 → 0.8.0

package/dist/{where-scope-C9vfEphl.js → where-scope-DlCdCM_8.js}

@@ -1,34 +1,45 @@
 import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
-import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
-import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
-import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { t as loadPrincipal } from "./principal-source-C6N60GtM.js";
+import { g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
+import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 //#region src/core/snapshot-sign.ts
 /**
-* Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
-* `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
-* registered claims are the only times a verifier reads.
+* The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`
+* become `iat` and `exp` and leave the `snapshot` claim, so the registered
+* claims are the only times a verifier reads.
 */
-function signSnapshot(snapshot, signer, options = {}) {
+function snapshotClaims(snapshot) {
 	const { issuedAt, expiresAt, ...claim } = snapshot;
-	const payload = { snapshot: claim };
-	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
 	const iat = secondsOf(issuedAt);
+	return compact({
+		snapshot: claim,
+		sub: snapshot.subject.principal?.id,
+		iat: iat === void 0 || iat <= 0 ? void 0 : iat,
+		exp: secondsOf(expiresAt)
+	});
+}
+/**
+* Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims
+* `snapshotClaims` answers.
+*/
+function signSnapshot(snapshot, signer, options = {}) {
+	const { iat, exp, ...payload } = snapshotClaims(snapshot);
 	return signer.sign(payload, compact({
 		typ: "vnd.permdock.snapshot+jwt",
 		audience: options.audience,
-		issuedAt: iat === void 0 || iat <= 0 ? void 0 : iat,
-		expiresAt: secondsOf(expiresAt)
+		issuedAt: iat,
+		expiresAt: exp
 	}));
 }
 /**
-* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt`
-* taken from `iat` and `exp`; `undefined` when the claim is not an object.
+* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt` taken
+* from `iat` and `exp`; `undefined` when the claim is not an object.
 */
 function snapshotClaim(claims) {
 	const claim = claims["snapshot"];
@@ -71,8 +82,8 @@ function deniedFor(permission, reason) {
 const PEEK = Object.freeze({ call: "can" });
 /**
 * What `permission` on `row` decides for the principal `principalId` in the
-* caller's active tenant. Never throws, never consumes a limit, and grants
-* the caller nothing: the target is a separate instance with its own caches.
+* caller's active tenant. Never throws, never consumes a limit, and grants the
+* caller nothing: the target is a separate instance with its own caches.
 */
 async function decideForTarget(caller, principals, create, principalId, permission, row) {
 	if (caller.principal === null) return deniedFor(permission, "anonymous");
@@ -96,6 +107,22 @@ function delegationMayCover(permission, delegation, hasActor) {
 function blocksEveryRow(grant) {
 	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
 }
+function withinDelegation(permdock, permission, ceiling) {
+	return (ceiling === void 0 || ceiling.includes(permission.key)) && !readOnlyActorRefuses(permdock.subject.actor, permission) && delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0);
+}
+/**
+* Whether the subject's delegation, its delegated ceiling and a read-only actor
+* leave `permission` within reach, whatever the grants say. A hint, never a
+* decision.
+*/
+function delegationAllows(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		return "grants" in snapshot && withinDelegation(permdock, permission, snapshot.delegated);
+	} catch {
+		return false;
+	}
+}
 /**
 * Whether `permission` could be granted to this instance's subject for some
 * row: the grants its snapshot carries for the active tenant, minus an
@@ -105,10 +132,7 @@ function blocksEveryRow(grant) {
 function mayUse(permdock, permission) {
 	try {
 		const snapshot = permdock.snapshot();
-		if (!("grants" in snapshot)) return false;
-		const ceiling = snapshot.delegated;
-		if (ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission)) return false;
-		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		if (!("grants" in snapshot) || !withinDelegation(permdock, permission, snapshot.delegated)) return false;
 		const tenant = permdock.subject.principal?.tenant;
 		const scopes = scopeList(snapshot.scopes);
 		const grants = snapshot.grants.filter((grant) => {
@@ -143,8 +167,7 @@ function permittedIds(permdock, permission, scope, options = {}) {
 		if (!("grants" in snapshot)) return [];
 		const scopes = scopeList(snapshot.scopes);
 		const name = resolveScope(scopes, scope);
-		const ceiling = snapshot.delegated;
-		if (name === void 0 || ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission) || !delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return [];
+		if (name === void 0 || !withinDelegation(permdock, permission, snapshot.delegated)) return [];
 		const conditioned = options.conditioned === true;
 		const now = nowSeconds();
 		const allowed = /* @__PURE__ */ new Set();
@@ -178,12 +201,15 @@ function eq(field, value) {
 		value
 	};
 }
-/** One equality per partitioning scope key on the membership's chain, outermost first. */
+/**
+* One equality per partitioning scope key on the membership's chain, outermost
+* first.
+*/
 function namedFilters(membership, scope) {
 	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
 	const filters = [];
 	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
-		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
+		const key = scope.fieldOf(name);
 		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
 	}
 	return filters;
@@ -303,4 +329,4 @@ function whereFromGrants(grants, scope) {
 	return freezeDeep(result);
 }
 //#endregion
-export { deniedFor as a, snapshotFromClaims as c, decideForTarget as i, mayUse as n, signSnapshot as o, permittedIds as r, snapshotClaim as s, whereFromGrants as t };
+export { decideForTarget as a, snapshotClaim as c, permittedIds as i, snapshotClaims as l, delegationAllows as n, deniedFor as o, mayUse as r, signSnapshot as s, whereFromGrants as t, snapshotFromClaims as u };

package/dist/{who-can-DWBAcaCQ.js → who-can-rI7dCR9Q.js}

@@ -1,18 +1,18 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { a as getResource } from "./permission-registry-Br4jSNVi.js";
-import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { s as instantAt } from "./time-DkWjdL98.js";
-import { a as normalizeMemberships, c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { r as relationCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { T as emptyListeners, t as evaluate } from "./evaluate-CNClBvcj.js";
-import { n as relationId, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { t as relationWalk } from "./relation-walk-3OyDBF0S.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { a as getResource } from "./permission-registry-B8tYxPIt.js";
+import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { s as instantAt } from "./time-nR1JesoH.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-Dd8Ta0Ie.js";
+import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
+import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts
 const MAX_ROUNDS = 48;
 async function settle(cache) {
@@ -22,7 +22,10 @@ async function settle(cache) {
 		await Promise.all(pending);
 	}
 }
-/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+/**
+* The holders on each instance a graph relation reads, or `undefined` when the
+* graph cannot say.
+*/
 async function walkHolders(condition, row, reader, cache) {
 	let walk = relationWalk(condition, row, reader);
 	if (walk === "relation-unavailable") {
@@ -246,11 +249,11 @@ function memberLister(source, scopes) {
 	};
 }
 /**
-* Who holds `permission` on `resource` for the instance's policy and how
-* (role, relation or share), from `MembershipSource.list` and
-* `RelationSource.related`. It lists and never grants; `complete: false`
-* means some holders could not be listed. An instance built from a
-* snapshot answers an empty, incomplete list.
+* Who holds `permission` on `resource` for the instance's policy and how (role,
+* relation or share), from `MembershipSource.list` and
+* `RelationSource.related`. It lists and never grants; `complete: false` means
+* some holders could not be listed. An instance built from a snapshot answers
+* an empty, incomplete list.
 */
 function whoCan(permdock, permission, resource) {
 	const internals = internalsOf(permdock);

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-BNM3TtDo.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-B986w1oK.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-D_NmPOdH.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-DqEoWHBc.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-Bu9zAlE0.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CM1FciYG.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -1,13 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as findPermission } from "../permission-registry-Br4jSNVi.js";
-import { n as isThenable } from "../thenable-yD7SabqG.js";
-import { n as memoryAutomationSource, r as parseAutomation } from "../automation-DVjOckjV.js";
-import { c as withApp, t as getPermDock } from "../permdock-BrAscV28.js";
-import { o as automationEvent } from "../sink-BEZSlMS_.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-CBYVMjwh.js";
-import { n as signRunTicket, r as subjectFromRunTicket } from "../run-ticket-sxFI6LAk.js";
-import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "../thenable-BNSM1U2R.js";
+import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
+import { l as withApp, t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { o as automationEvent } from "../sink-D9_vh372.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-Dv7aF7Dk.js";
+import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
 	try {
@@ -47,10 +47,10 @@ function targetOf(permission, data, resource) {
 	});
 }
 /**
-* Creates the PermDock for durable runs of published automations. A run
-* acts as the automation's principal with that principal's rights at each
-* step, narrowed to the automation's operations; the trigger is recorded
-* and never grants.
+* Creates the PermDock for durable runs of published automations. A run acts as
+* the automation's principal with that principal's rights at each step,
+* narrowed to the automation's operations; the trigger is recorded and never
+* grants.
 */
 function createPermDock(policy, given) {
 	const { signer, verifier, principals, automations, store: approvals, waiter, audience, issuer, expiresIn = DEFAULT_TTL, onAuth, ...permdockOptions } = withApp(policy, given);

package/dist/workflow-sdk/index.d.ts

@@ -1,13 +1,16 @@
-import { Nn as Decision } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-D_NmPOdH.js";
+import { Ln as Decision } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CM1FciYG.js";
 //#region src/workflow-sdk/index.d.ts
-/** The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the run. */
+/**
+ * The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the
+ * run.
+ */
 export type WorkflowSdkHook = {
   readonly then: PromiseLike<unknown>["then"];
-  dispose(): void;
+  dispose: () => void;
 };
 /** `createHook` from `workflow`; valid only inside a `"use workflow"` function. */
 export type WorkflowSdkCreateHook = (options: {
@@ -22,16 +25,19 @@ export type WorkflowSdkStart<TArgs extends unknown[], TRun> = (workflow: (ticket
 export type WorkflowSdkWaiterOptions = {
   readonly createHook: WorkflowSdkCreateHook;
   readonly resumeHook: WorkflowSdkResumeHook;
-  /** With `sleep`, a wait ends at the request's `expiresAt`; without it, only a wake ends it. */
+  /**
+   * With `sleep`, a wait ends at the request's `expiresAt`; without it, only a
+   * wake ends it.
+   */
   readonly sleep?: WorkflowSdkSleep;
 };
 /** The Workflow SDK hook token a run parks on while approval `token` is pending. */
 export declare function approvalHookToken(token: string): string;
 /**
  * An `ApprovalWaiter` over Workflow SDK hooks. `wait` parks the run on a hook
- * and must run inside the workflow function; `wake` resumes it from an
- * approval handler. The hook carries no verdict: the run decides again from
- * the approval store after it wakes.
+ * and must run inside the workflow function; `wake` resumes it from an approval
+ * handler. The hook carries no verdict: the run decides again from the approval
+ * store after it wakes.
  */
 export declare function workflowSdkWaiter(options: WorkflowSdkWaiterOptions): ApprovalWaiter;
 export type StartAutomationRunResult<TRun> = (Extract<StartAutomationResult, {
@@ -49,8 +55,8 @@ export type StartAutomationRunResult<TRun> = (Extract<StartAutomationResult, {
 export declare function startAutomation<TArgs extends unknown[], TRun>(workflow: Pick<WorkflowPermDock, "start">, start: WorkflowSdkStart<TArgs, TRun>, run: (ticket: string, ...args: TArgs) => Promise<unknown>, id: string, args: TArgs, options?: AutomationOptions): Promise<StartAutomationRunResult<TRun>>;
 /**
  * Resumes hook `token` with `payload` only when `caller` is granted
- * `permission` on `row`. A token alone never resumes a run. A hook that is
- * gone or a resume that throws denies with `validation`.
+ * `permission` on `row`. A token alone never resumes a run. A hook that is gone
+ * or a resume that throws denies with `validation`.
  */
 export declare function authorizeHook(resumeHook: WorkflowSdkResumeHook, caller: PermDock, permission: Permission, row: unknown, token: string, payload: unknown): Promise<Decision>;
 //#endregion

package/dist/workflow-sdk/index.js

@@ -1,4 +1,4 @@
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 //#region src/workflow-sdk/index.ts
 const HOOK_PREFIX = "permdock:approval:";
 /** The Workflow SDK hook token a run parks on while approval `token` is pending. */
@@ -7,9 +7,9 @@ function approvalHookToken(token) {
 }
 /**
 * An `ApprovalWaiter` over Workflow SDK hooks. `wait` parks the run on a hook
-* and must run inside the workflow function; `wake` resumes it from an
-* approval handler. The hook carries no verdict: the run decides again from
-* the approval store after it wakes.
+* and must run inside the workflow function; `wake` resumes it from an approval
+* handler. The hook carries no verdict: the run decides again from the approval
+* store after it wakes.
 */
 function workflowSdkWaiter(options) {
 	const { createHook, resumeHook, sleep } = options;
@@ -61,8 +61,8 @@ function hookDenied() {
 }
 /**
 * Resumes hook `token` with `payload` only when `caller` is granted
-* `permission` on `row`. A token alone never resumes a run. A hook that is
-* gone or a resume that throws denies with `validation`.
+* `permission` on `row`. A token alone never resumes a run. A hook that is gone
+* or a resume that throws denies with `validation`.
 */
 async function authorizeHook(resumeHook, caller, permission, row, token, payload) {
 	const decision = caller.decide(permission, row);

package/dist/{wrap-gX61EtpB.js → wrap-B2wziJI_.js}

@@ -1,15 +1,21 @@
-import { n as internalsOf, t as attachInternals } from "./internals-Dk8A8fX3.js";
+import { n as internalsOf, t as attachInternals } from "./internals-B3IgHrvo.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
 //#region src/core/wrap.ts
 /**
 * A frozen copy of `permdock` with the members `overrides` returns replaced.
-* `overrides` runs again for every instance `tenant()`, `team()` and
-* `derive()` return, so a wrapper never falls off a derived instance.
+* `overrides` runs again for every instance `tenant()`, `team()` and `derive()`
+* return, so a wrapper never falls off a derived instance.
 */
 function wrapPermDock(permdock, overrides) {
 	const wrap = (next) => wrapPermDock(next, overrides);
-	const wrapped = {
+	const replaced = {
 		...permdock,
-		...overrides(permdock),
+		...overrides(permdock)
+	};
+	const wrapped = {
+		...replaced,
+		canAll: (checks, options) => canAllWith(replaced.can, checks, options),
+		decideAll: (checks, options) => decideAllWith(replaced.decide, checks, options),
 		tenant: (id) => wrap(permdock.tenant(id)),
 		team: (id) => wrap(permdock.team(id)),
 		derive: async (options) => wrap(await permdock.derive(options))

package/dist/{wrap-C5jC6sKI.d.ts → wrap-DlJE3gS_.d.ts}

@@ -1,14 +1,17 @@
-import { j as PolicyVocabulary } from "./policy-types-n0uRTsW8.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
+import { j as PolicyVocabulary } from "./policy-types-CCiDRZBH.js";
+import { a as PermDock } from "./permdock-B6Sf4T_S.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;
-/** The members `wrapPermDock` replaces; it re-wraps the derived instances itself. */
+/**
+ * The members `wrapPermDock` replaces; it re-wraps the derived instances
+ * itself.
+ */
 type PermDockOverrides<V extends PolicyVocabulary = PolicyVocabulary> = Partial<Omit<PermDock<V>, "tenant" | "team" | "derive">>;
 /**
  * A frozen copy of `permdock` with the members `overrides` returns replaced.
- * `overrides` runs again for every instance `tenant()`, `team()` and
- * `derive()` return, so a wrapper never falls off a derived instance.
+ * `overrides` runs again for every instance `tenant()`, `team()` and `derive()`
+ * return, so a wrapper never falls off a derived instance.
  */
 declare function wrapPermDock<V extends PolicyVocabulary = PolicyVocabulary>(permdock: PermDock<V>, overrides: (permdock: PermDock<V>) => PermDockOverrides<V>): PermDock<V>;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -271,6 +271,14 @@
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
     },
+    "./testing/core": {
+      "types": "./dist/testing/core.d.ts",
+      "default": "./dist/testing/core.js"
+    },
+    "./testing/fixtures": {
+      "types": "./dist/testing/fixtures/index.d.ts",
+      "default": "./dist/testing/fixtures/index.js"
+    },
     "./testing/saas": {
       "types": "./dist/testing/saas/index.d.ts",
       "default": "./dist/testing/saas/index.js"
@@ -299,26 +307,23 @@
       "types": "./dist/unplugin/index.d.ts",
       "default": "./dist/unplugin/index.js"
     },
-    "./schemas/*": "./schemas/*"
+    "./schemas/*": "./schemas/*",
+    "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "dependencies": {
-    "@clack/prompts": "1.8.1",
     "@standard-schema/spec": "1.1.0",
-    "diff": "9.0.0",
-    "fastest-levenshtein": "1.0.16",
     "jiti": "2.7.0",
-    "oxc-parser": "0.154.0",
-    "package-manager-detector": "1.9.0",
-    "smol-toml": "1.9.1"
+    "oxc-parser": "0.154.0"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.301",
     "@arethetypeswrong/cli": "0.18.5",
     "@babel/core": "8.0.7",
+    "@clack/prompts": "1.8.1",
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/server": "2.3.1",
     "@nestjs/common": "12.1.3",
@@ -348,13 +353,15 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.9.0",
-    "better-supabase-floor": "npm:better-supabase@0.9.0",
+    "better-supabase": "0.13.0",
+    "better-supabase-floor": "npm:better-supabase@0.13.0",
     "chat": "4.42.0",
+    "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
     "eve": "0.79.2",
     "express": "5.3.0",
+    "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
     "h3": "2.0.2",
     "happy-dom": "20.14.5",
@@ -362,8 +369,9 @@
     "jose": "6.2.12",
     "kysely": "0.29.6",
     "next": "16.4.1",
-    "oxlint": "1.88.0",
+    "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
+    "package-manager-detector": "1.9.0",
     "pg": "8.23.1",
     "pgsql-parser": "18.2.12",
     "publint": "0.3.25",
@@ -372,6 +380,7 @@
     "reflect-metadata": "0.2.2",
     "resend": "6.33.0",
     "rxjs": "7.8.2",
+    "smol-toml": "1.9.1",
     "solid-js": "1.9.17",
     "svelte": "5.57.2",
     "temporal-polyfill": "1.0.6",
@@ -402,7 +411,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.9.0",
+    "better-supabase": ">=0.13.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",
@@ -411,12 +420,12 @@
     "fastify": ">=5",
     "h3": ">=2",
     "hono": ">=4",
-    "jose": "^6",
+    "jose": ">=6",
     "kysely": ">=0.27",
     "next": ">=16.3",
     "pg": ">=8",
     "pgsql-parser": ">=18",
-    "react": "^19",
+    "react": ">=19",
     "reflect-metadata": ">=0.1",
     "resend": ">=6",
     "rxjs": ">=7",
@@ -556,6 +565,8 @@
     "bench": "vitest bench --run --project \"node (bench)\" --reporter=verbose",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "gen": "node ../../scripts/testing-fixtures.ts",
+    "gen:check": "node ../../scripts/testing-fixtures.ts --check",
     "lint": "oxlint --disable-nested-config --type-aware",
     "test": "vitest run --coverage",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tests/tsconfig.json"

package/schemas/catalog-v1.json

@@ -274,6 +274,9 @@
               "type": "string"
             }
           },
+          "orderedLevels": {
+            "const": true
+          },
           "hostable": {
             "const": true
           },

package/schemas/cli-result-v1.json

@@ -77,6 +77,7 @@
             "dirty_worktree",
             "write_failed",
             "check_failed",
+            "catalog_invalid",
             "input_required",
             "consent_required",
             "cancelled",