permdock 0.7.0 → 0.8.0

package/dist/version-DMQ0dnN5.js

@@ -0,0 +1,48 @@
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/cli/project/package-root.ts
+let cached;
+/**
+* The `permdock` package directory. The bundler may place this module in
+* `dist/cli/` or in a shared chunk at `dist/`, so walk up instead of assuming a
+* depth.
+*/
+function packageRoot() {
+	cached ??= findPackageRoot(dirname(fileURLToPath(import.meta.url)));
+	return cached;
+}
+/**
+* The nearest directory at or above `start` whose `package.json` is named
+* `permdock`.
+*/
+function findPackageRoot(start) {
+	let dir = start;
+	for (;;) {
+		const manifest = join(dir, "package.json");
+		if (existsSync(manifest)) {
+			const { name } = readJsonFile(manifest);
+			if (name === "permdock") return dir;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) throw new Error("PermDock CLI: cannot find the permdock package root");
+		dir = parent;
+	}
+}
+//#endregion
+//#region src/cli/core/version.ts
+function cliVersion() {
+	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
+}
+function generatorBanner() {
+	return `permdock@${cliVersion()}`;
+}
+const CATALOG_SCHEMA = "https://permdock.com/schemas/catalog-v1.json";
+const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest-v1.json";
+const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
+const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
+const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
+const ARAZZO_REPORT_SCHEMA = "https://permdock.com/schemas/arazzo-report-v1.json";
+//#endregion
+export { SUPABASE_MANIFEST_SCHEMA as a, generatorBanner as c, DOCTOR_REPORT_SCHEMA as i, packageRoot as l, CATALOG_SCHEMA as n, USAGE_REPORT_SCHEMA as o, CONFIG_REPORT_SCHEMA as r, cliVersion as s, ARAZZO_REPORT_SCHEMA as t };

package/dist/version-DizhmD72.js

@@ -0,0 +1 @@
+export { s as cliVersion } from "./version-DMQ0dnN5.js";

package/dist/{views-BB8E9dTP.js → views-CD8wuL4Z.js}

@@ -1,5 +1,5 @@
-import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-DZlnEtLy.js";
+import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];
@@ -33,7 +33,11 @@ function tenantView(permdock) {
 	};
 }
 function rolesView(permdock, options) {
-	return { roles: (options.team === void 0 ? permdock : permdock.team(options.team)).heldRoles(options.tenant === void 0 ? void 0 : { tenant: options.tenant }) };
+	return { roles: permdock.heldRoles({
+		...options.tenant === void 0 ? {} : { tenant: options.tenant },
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.id === void 0 ? {} : { id: options.id }
+	}) };
 }
 function subjectView(permdock) {
 	const snapshot = permdock.snapshot();
@@ -45,11 +49,17 @@ function subjectView(permdock) {
 		simulated: typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true
 	};
 }
-/** The root's view of another tenant for a `Protected` with a `tenant` prop; `undefined` answers the active one. */
+/**
+* The root's view of another tenant for a `Protected` with a `tenant` prop;
+* `undefined` answers the active one.
+*/
 function scopedTenant(root, tenant) {
 	return tenant === void 0 ? void 0 : root.tenant(tenant);
 }
-/** An instance whose every read answers from `current()`, so a held reference follows the store. */
+/**
+* An instance whose every read answers from `current()`, so a held reference
+* follows the store.
+*/
 function livePermDock(current) {
 	return new Proxy({}, { get(_target, prop, _receiver) {
 		return Reflect.get(current(), prop);
@@ -114,7 +124,10 @@ function describeWith(messages) {
 		messages
 	});
 }
-/** The `GateView` of a permission state; `describeDecision` localises the reason. */
+/**
+* The `GateView` of a permission state; `describeDecision` localises the
+* reason.
+*/
 function gateView(state, describeDecision, mode = "disable") {
 	const pending = state.status === "pending";
 	const needsApproval = state.decision.outcome === "approval-required";

package/dist/{vocabulary-Bg3eeT2H.d.ts → vocabulary-DEJ5j4mR.d.ts}

@@ -1,4 +1,4 @@
-import { j as WithX, k as AppDataSchema, n as ActionMeta } from "./permission-types-DhNEmoRG.js";
+import { F as WithX, N as AppDataSchema, n as ActionMeta } from "./permission-types-CAY-GU7e.js";
 //#region src/core/vocabulary.d.ts
 declare const ROLE_KIND: "role";
 declare const PLAN_KIND: "plan";
@@ -6,8 +6,8 @@ declare const PLAN_KIND: "plan";
 type VocabularyOptions<X = never> = {
   /**
    * A Standard Schema for every leaf's `meta.x`, validated synchronously at
-   * definition time. On a role tree it also checks the `meta.x` of custom
-   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
+   * definition time. On a role tree it also checks the `meta.x` of custom roles
+   * a `CustomRoleSource` returns; an invalid one is dropped, not the role.
    */
   readonly x?: AppDataSchema<X>;
 };
@@ -25,7 +25,10 @@ type Role<K extends string = string> = {
   readonly on?: string;
   readonly assignable: boolean;
   readonly meta: RoleMeta;
-  /** A shared custom role: the platform defines it for every tenant, and a tenant admin cannot edit it. */
+  /**
+   * A shared custom role: the platform defines it for every tenant, and a
+   * tenant admin cannot edit it.
+   */
   readonly shared?: true;
   readonly kind: typeof ROLE_KIND;
 };

package/dist/vue/index.d.ts

@@ -1,23 +1,31 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, dt as TokenVerifier, or as Membership } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { r as Role } from "../vocabulary-Bg3eeT2H.js";
-import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-O0SwYIK8.js";
-import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-CKV71kKh.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, dt as TokenVerifier, j as PolicyVocabulary, or as Membership } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { r as Role } from "../vocabulary-DEJ5j4mR.js";
+import { d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
+import { c as requiredPlans } from "../errors-zi_4T-rx.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-ByS9LgHK.js";
+import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {
   /**
-   * A ref or getter re-hydrates the store when it changes; a promise keeps
-   * the store `pending` until it settles (await the same promise in an async
+   * A ref or getter re-hydrates the store when it changes; a promise keeps the
+   * store `pending` until it settles (await the same promise in an async
    * `setup` under `<Suspense>`).
    */
   readonly snapshot: MaybeRefOrGetter<Snapshot | string> | PromiseLike<Snapshot | string>;
-  /** A ref or getter switches the active tenant (`refresh({ tenant })`) when it changes. */
+  /**
+   * A ref or getter switches the active tenant (`refresh({ tenant })`) when it
+   * changes.
+   */
   readonly tenant?: MaybeRefOrGetter<string | undefined>;
-  /** Read on every request: a ref or getter carries a rotated token without rebuilding the store. */
+  /**
+   * Read on every request: a ref or getter carries a rotated token without
+   * rebuilding the store.
+   */
   readonly headers?: MaybeRefOrGetter<Readonly<Record<string, string>> | undefined>;
   /** Read on every verification; set it at install to verify signed snapshots. */
   readonly verifier?: MaybeRefOrGetter<TokenVerifier | undefined>;
@@ -25,7 +33,10 @@ type PermDockPluginOptions = ProviderOptionsBase & {
   readonly defaults?: PermDockDefaults;
 };
 type SlotOutput = VNode | VNode[] | string | null;
-/** Render functions for the `<Protected>` slots a component leaves out; they get the slot props. */
+/**
+ * Render functions for the `<Protected>` slots a component leaves out; they get
+ * the slot props.
+ */
 type PermDockDefaults = {
   readonly pending?: () => SlotOutput;
   readonly denied?: (props: {
@@ -35,16 +46,40 @@ type PermDockDefaults = {
     readonly decision: ApprovalRequiredDecision;
   }) => SlotOutput;
 };
+/**
+ * `useProtectedAction` in Vue: the fields of `ProtectedActionView` as computed
+ * refs.
+ */
+type ProtectedActionRefs<T> = {
+  readonly gate: ComputedRef<GateView>;
+  readonly result: ComputedRef<ActionResult<T> | undefined>;
+  readonly pending: ComputedRef<boolean>;
+  readonly approval: ComputedRef<ApprovalHandle | undefined>;
+  readonly run: (input: unknown) => Promise<ActionResult<T>>;
+  readonly retry: () => Promise<ActionResult<T> | undefined>;
+};
 //#endregion
 //#region src/vue/composables.d.ts
-export declare function usePermDock(): ClientPermDock;
-export declare function usePermission(permission: MaybeRefOrGetter<Permission>, data?: MaybeRefOrGetter<unknown>): {
+export declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+type PermissionRefs = {
   readonly allowed: ComputedRef<boolean>;
   readonly status: ComputedRef<PermissionState["status"]>;
   readonly decision: ComputedRef<Decision>;
 };
+export declare function usePermission<D>(permission: MaybeRefOrGetter<Permission>, data?: MaybeRefOrGetter<UncheckedData<D>>): PermissionRefs;
+export declare function usePermission<P extends Permission>(permission: MaybeRefOrGetter<P>, data?: MaybeRefOrGetter<RowData<P>>): PermissionRefs;
+/**
+ * What a permission-gated control renders, as `useGate` in React: `hidden`,
+ * `disabled`, `needsApproval`, `upgrade` and a localised `reason`.
+ */
+export declare function useGate<D>(permission: MaybeRefOrGetter<Permission>, data?: MaybeRefOrGetter<UncheckedData<D>>, options?: {
+  readonly mode?: GateMode;
+}): ComputedRef<GateView>;
+export declare function useGate<P extends Permission>(permission: MaybeRefOrGetter<P>, data?: MaybeRefOrGetter<RowData<P>>, options?: {
+  readonly mode?: GateMode;
+}): ComputedRef<GateView>;
 export declare function usePermissions(permissions: MaybeRefOrGetter<readonly Permission[]>, data?: MaybeRefOrGetter<unknown>): ComputedRef<PermissionSet>;
-export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: MaybeRefOrGetter<readonly T[]>): ComputedRef<FilterResult<T>>;
+export declare function useFilter<T>(permission: Permission<string, NoInfer<T>, "instance">, rows: MaybeRefOrGetter<readonly T[]>): ComputedRef<FilterResult<T>>;
 export declare function useTenant(): ComputedRef<TenantView>;
 export declare function useMemberships(): ComputedRef<readonly Membership[]>;
 export declare function useRoles(options?: MaybeRefOrGetter<RolesOptions>): ComputedRef<{
@@ -58,16 +93,30 @@ export declare function useSubject(): ComputedRef<SubjectView>;
 export declare function useApproval(decision: MaybeRefOrGetter<Decision>): ComputedRef<ApprovalHandle>;
 /** `describe` with the plugin's `messages`; a call's own `messages` win. */
 export declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
+/**
+ * A `protectAction` server action wired to a control, as `useProtectedAction`
+ * in React: refs for `gate`, `result`, `pending` and `approval`, plus `run` and
+ * `retry`.
+ */
+export declare function useProtectedAction<T, D>(action: ProtectedAction<T>, permission: MaybeRefOrGetter<Permission>, data?: MaybeRefOrGetter<UncheckedData<D>>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionRefs<T>;
+export declare function useProtectedAction<T, P extends Permission>(action: ProtectedAction<T>, permission: MaybeRefOrGetter<P>, data?: MaybeRefOrGetter<RowData<P>>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionRefs<T>;
 //#endregion
 //#region src/vue/boundary.d.ts
 /**
- * Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
- * by a descendant and renders the `denied` slot, or the `approval` slot for
- * an approval request (default `denied`). The slots receive the refused
- * permission and `retry()`. Any other error propagates.
+ * Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown by a
+ * descendant and renders the `denied` slot, or the `approval` slot for an
+ * approval request (default `denied`). The slots receive the refused permission
+ * and `retry()`. Any other error propagates.
  */
 export declare const PermissionBoundary: DefineComponent;
-/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+/**
+ * Inside a `PermissionBoundary`: what was refused and `retry()`, or `null`
+ * while the children render.
+ */
 export declare function usePermissionBoundary(): PermissionBoundaryState | null;
 //#endregion
 //#region src/vue/plugin.d.ts
@@ -81,4 +130,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };

package/dist/vue/index.js

@@ -1,10 +1,10 @@
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-DZlnEtLy.js";
-import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { i as isPromiseLike } from "../store-options-B_poyYvg.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-IgqQipCO.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-BB8E9dTP.js";
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
+import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
@@ -44,6 +44,16 @@ function usePermission(permission, data) {
 		decision: computed(() => state.value.decision)
 	};
 }
+function useGate(permission, data, options = {}) {
+	const store = useStore();
+	const permdock = useTick(store);
+	const describeDecision = useDescribe();
+	return computed(() => {
+		permdock.value;
+		const current = toValue(permission);
+		return gateView(store.permissionState(current, toValue(data)), (decision) => describeDecision(decision, { permission: current }), options.mode);
+	});
+}
 function usePermissions(permissions, data) {
 	const store = useStore();
 	const permdock = useTick(store);
@@ -92,14 +102,38 @@ function useApproval(decision) {
 function useDescribe() {
 	return describeWith(inject(permDockUiKey, {}).messages);
 }
+function useProtectedAction(action, permission, data, options = {}) {
+	const store = useStore();
+	const permdock = useTick(store);
+	const gate = useGate(permission, data, options);
+	const state = shallowRef({
+		result: void 0,
+		pending: false
+	});
+	const runner = actionRunner(() => action, (next) => {
+		state.value = next;
+	});
+	const approval = computed(() => {
+		permdock.value;
+		return actionApproval(store, state.value.result);
+	});
+	return {
+		gate,
+		result: computed(() => state.value.result),
+		pending: computed(() => state.value.pending),
+		approval,
+		run: runner.run,
+		retry: runner.retry
+	};
+}
 //#endregion
 //#region src/vue/boundary.ts
 const boundaryKey = Symbol("permdock-boundary");
 /**
-* Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
-* by a descendant and renders the `denied` slot, or the `approval` slot for
-* an approval request (default `denied`). The slots receive the refused
-* permission and `retry()`. Any other error propagates.
+* Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown by a
+* descendant and renders the `denied` slot, or the `approval` slot for an
+* approval request (default `denied`). The slots receive the refused permission
+* and `retry()`. Any other error propagates.
 */
 const PermissionBoundary = defineComponent({
 	name: "PermissionBoundary",
@@ -127,7 +161,10 @@ const PermissionBoundary = defineComponent({
 		};
 	}
 });
-/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+/**
+* Inside a `PermissionBoundary`: what was refused and `retry()`, or `null`
+* while the children render.
+*/
 function usePermissionBoundary() {
 	return inject(boundaryKey, null)?.value ?? null;
 }
@@ -209,4 +246,4 @@ const Protected = defineComponent({
 	}
 });
 //#endregion
-export { PermissionBoundary, Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/{waiter-DwEyouan.d.ts → waiter-Bu9zAlE0.d.ts}

@@ -1,25 +1,28 @@
-import { Rt as Instant } from "./policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
+import { Rt as Instant } from "./policy-types-CCiDRZBH.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
-  /** When the approval request expires; the wait ends then whatever the store says. */
+  /**
+   * When the approval request expires; the wait ends then whatever the store
+   * says.
+   */
   readonly expiresAt?: Instant;
   /** Aborting rejects the wait with the signal's reason. */
   readonly signal?: AbortSignal;
 };
 /**
- * Suspends a run until an approval request is decided. `wait` resolves once
- * the request is no longer pending, `wake` is called for its token, or it
- * expires; it never says how the request was decided, so the caller always
- * decides again with the token. A durable runner implements it with its own
- * suspension primitive.
+ * Suspends a run until an approval request is decided. `wait` resolves once the
+ * request is no longer pending, `wake` is called for its token, or it expires;
+ * it never says how the request was decided, so the caller always decides again
+ * with the token. A durable runner implements it with its own suspension
+ * primitive.
  */
 type ApprovalWaiter = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  wait(token: string, options?: ApprovalWaitOptions): Promise<void>;
+  wait: (token: string, options?: ApprovalWaitOptions) => Promise<void>;
   /** Called after an approver resolves the request for `token`. */
-  wake(token: string): void | Promise<void>;
+  wake: (token: string) => void | Promise<void>;
 };
 type PollingApprovalWaiterOptions = {
   readonly store: ApprovalStore;

package/dist/{waiter-BGUtGYoU.js → waiter-aBLM63_f.js}

@@ -1,4 +1,4 @@
-import { f as nowMillis } from "./time-DkWjdL98.js";
+import { f as nowMillis } from "./time-nR1JesoH.js";
 //#region src/workflow/waiter.ts
 const DEFAULT_INTERVAL = 5e3;
 /**

package/dist/{watch-C-4VmFlL.js → watch-Cx_WciLE.js}

@@ -1,8 +1,8 @@
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError } from "./errors-DpP_U6Bf.js";
-import { t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { r as runCollect } from "./collect-BaWeMjwV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-CoQHDrDi.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
+import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { n as isConfigFile, r as loadConfig } from "./config-BwPBfN0t.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts
@@ -126,9 +126,9 @@ function createCollectScheduler(cwd, options, settings) {
 	};
 }
 /**
-* `collect --watch`: one collect now, then one per change until Ctrl-C.
-* Under `--json` each collect is an NDJSON event on stdout; otherwise a
-* line on stderr.
+* `collect --watch`: one collect now, then one per change until Ctrl-C. Under
+* `--json` each collect is an NDJSON event on stdout; otherwise a line on
+* stderr.
 */
 async function watchCollect(ctx, overrides) {
 	const emit = (status, message) => {

package/dist/watch-DB42U1ib.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-Cx_WciLE.js";

package/dist/webmcp/index.d.ts

@@ -1,15 +1,15 @@
-import { Gt as Snapshot, Ln as Decision } from "../policy-types-B-F-qAZk.js";
-import { f as PermissionTree, u as Permission } from "../permission-types-DhNEmoRG.js";
+import { Gt as Snapshot, Ln as Decision } from "../policy-types-CCiDRZBH.js";
+import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";
 type WebMcpPermDock = {
-  can(permission: Permission, data?: unknown): boolean;
-  decide(permission: Permission, data?: unknown): Decision;
-  snapshot(): Snapshot | string | Promise<Snapshot | string>;
-  tenant?(id: string): WebMcpPermDock;
-  subscribe?(listener: () => void): () => void;
-  status?(permission?: Permission, data?: unknown): WebMcpClientStatus;
+  can: (permission: Permission, data?: unknown) => boolean;
+  decide: (permission: Permission, data?: unknown) => Decision;
+  snapshot: () => Snapshot | string | Promise<Snapshot | string>;
+  tenant?: (id: string) => WebMcpPermDock;
+  subscribe?: (listener: () => void) => () => void;
+  status?: (permission?: Permission, data?: unknown) => WebMcpClientStatus;
 };
 type WebMcpToolContent = {
   readonly type: "text";
@@ -37,12 +37,12 @@ type WebMcpRegisteredTool = {
   readonly description?: string;
   readonly inputSchema?: Readonly<Record<string, unknown>>;
   readonly annotations?: WebMcpToolAnnotations;
-  execute(input: unknown): Promise<WebMcpToolResult>;
+  execute: (input: unknown) => Promise<WebMcpToolResult>;
 };
 type ModelContext = {
-  registerTool(tool: WebMcpRegisteredTool, options?: {
+  registerTool: (tool: WebMcpRegisteredTool, options?: {
     readonly signal?: AbortSignal;
-  }): {
+  }) => {
     readonly unregister?: () => void;
   };
 };

package/dist/webmcp/index.js

@@ -1,9 +1,9 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-DpPtSKNZ.js";
-import { n as isThenable, t as ignoreRejection } from "../thenable-yD7SabqG.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-B8tYxPIt.js";
+import { n as isThenable, t as ignoreRejection } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-reAhIzdl.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");
@@ -109,7 +109,10 @@ function approvalResult(decision, permission, data) {
 		structuredContent: refusal.structured
 	};
 }
-/** A collection permission names the resource type only, never an id from the input. */
+/**
+* A collection permission names the resource type only, never an id from the
+* input.
+*/
 function refOf(permission, data) {
 	return resourceRef(permission, permission.kind === "collection" ? void 0 : data);
 }

package/dist/{where-scope-wq2coopv.js → where-scope-DlCdCM_8.js}

@@ -1,13 +1,13 @@
 import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
-import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
-import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-BHsc-wp-.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
-import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-C6P1Tvol.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { t as loadPrincipal } from "./principal-source-C6N60GtM.js";
+import { g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
+import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 //#region src/core/snapshot-sign.ts
 /**
 * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`
@@ -24,7 +24,10 @@ function snapshotClaims(snapshot) {
 		exp: secondsOf(expiresAt)
 	});
 }
-/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
+/**
+* Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims
+* `snapshotClaims` answers.
+*/
 function signSnapshot(snapshot, signer, options = {}) {
 	const { iat, exp, ...payload } = snapshotClaims(snapshot);
 	return signer.sign(payload, compact({
@@ -35,8 +38,8 @@ function signSnapshot(snapshot, signer, options = {}) {
 	}));
 }
 /**
-* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt`
-* taken from `iat` and `exp`; `undefined` when the claim is not an object.
+* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt` taken
+* from `iat` and `exp`; `undefined` when the claim is not an object.
 */
 function snapshotClaim(claims) {
 	const claim = claims["snapshot"];
@@ -79,8 +82,8 @@ function deniedFor(permission, reason) {
 const PEEK = Object.freeze({ call: "can" });
 /**
 * What `permission` on `row` decides for the principal `principalId` in the
-* caller's active tenant. Never throws, never consumes a limit, and grants
-* the caller nothing: the target is a separate instance with its own caches.
+* caller's active tenant. Never throws, never consumes a limit, and grants the
+* caller nothing: the target is a separate instance with its own caches.
 */
 async function decideForTarget(caller, principals, create, principalId, permission, row) {
 	if (caller.principal === null) return deniedFor(permission, "anonymous");
@@ -108,9 +111,9 @@ function withinDelegation(permdock, permission, ceiling) {
 	return (ceiling === void 0 || ceiling.includes(permission.key)) && !readOnlyActorRefuses(permdock.subject.actor, permission) && delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0);
 }
 /**
-* Whether the subject's delegation, its delegated ceiling and a read-only
-* actor leave `permission` within reach, whatever the grants say. A hint,
-* never a decision.
+* Whether the subject's delegation, its delegated ceiling and a read-only actor
+* leave `permission` within reach, whatever the grants say. A hint, never a
+* decision.
 */
 function delegationAllows(permdock, permission) {
 	try {
@@ -198,7 +201,10 @@ function eq(field, value) {
 		value
 	};
 }
-/** One equality per partitioning scope key on the membership's chain, outermost first. */
+/**
+* One equality per partitioning scope key on the membership's chain, outermost
+* first.
+*/
 function namedFilters(membership, scope) {
 	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
 	const filters = [];