@pleach/rbac-contract changelog

This page collects the site-content changelog entries that materially touched the @pleach/rbac-contract SKU. It is not the runtime changelog — the canonical record of @pleach/rbac-contract runtime behavior lives in the upstream package CHANGELOG.md and on npmjs.org/package/@pleach/rbac-contract.

See the combined site changelog at /docs/changelog/combined for the chronological unified view across every SKU.

Unreleased

Added

• First dedicated docs page for @pleach/rbac-contract at /docs/rbac-contract — the RbacRuntime interface, CheckPermissionInput / PermissionDecision shapes, and the @pleach/core/rbac adapter (createRbacApprovalFlow) that wires it into the existing ApprovalFlowContribution plugin hook. Added to Packages, Subpath exports, and Cycle-break contract packages (as the second SKU to use the pattern, alongside @pleach/compliance-contract). Package landed upstream 2026-08-15.

Status

@pleach/rbac-contract is a zero-dep cycle-break contract package breaking the type-graph cycle between @pleach/core and whatever concrete authorization service a host implements. Unlike @pleach/compliance-contract (extracted from an already-shipped implementation), this contract was authored fresh with no shipped implementer yet — pleach.stability is beta, not ga, until a real consumer has exercised the full surface.

The @pleach/core/rbac adapter it ships alongside is advisory pre-wiring: the checkApprovalNeeded plugin hook it targets has no shipped consumer in the reference host today. See the caveat on the SKU page before relying on it for enforcement.