feat: add provider authorization adapters on immutable core

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,94 @@
+name: Bug report
+description: Something isn't working as expected
+title: '[Bug]: '
+labels: ['bug']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before opening a bug report, please check that the issue hasn't already been reported.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: A minimal code snippet or repository that reproduces the issue.
+      placeholder: |
+        import { createPermix } from 'permix'
+
+        const permix = createPermix<{ post: ['read'] }>()
+        permix.setup({ post: { read: true } })
+        permix.check('post.read')
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened? Include any error messages or console output.
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: permix version
+      placeholder: e.g. 4.1.2
+    validations:
+      required: true
+
+  - type: dropdown
+    id: framework
+    attributes:
+      label: Framework / adapter
+      options:
+        - Core (no adapter)
+        - React
+        - Vue
+        - Solid
+        - Svelte
+        - Next.js
+        - TanStack Start
+        - Express
+        - Hono
+        - Fastify
+        - tRPC
+        - oRPC
+        - Elysia
+        - Node
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: framework_version
+    attributes:
+      label: Framework version
+      placeholder: e.g. React 19.2, Next.js 16
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues first
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://permix.letstri.dev/docs
+    about: Usage questions are often answered in the docs.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,41 @@
+name: Feature request
+description: Propose a DX, API, or adapter improvement
+title: '[Feature]: '
+labels: ['enhancement']
+body:
+  - type: input
+    id: summary
+    attributes:
+      label: Summary
+      placeholder: Add a typed helper for checking several permissions at once
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What workflow or maintenance pain does this solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Keep this focused on implementation shape, not product marketing.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I checked existing issues and docs first
+          required: true

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '05:00'
+      timezone: UTC
+    open-pull-requests-limit: 10
+    groups:
+      workspace-dependencies:
+        patterns:
+          - '*'
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '05:30'
+      timezone: UTC
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+- [ ] closes #
+- [ ] follow-up issues opened and linked
+
+## Testing
+
+- [ ] `pnpm format:check`
+- [ ] `pnpm lint`
+- [ ] `pnpm check-types`
+- [ ] `pnpm test`
+- [ ] `pnpm verify`
+
+## Checklist
+
+- [ ] docs updated where needed (`docs/content/docs/`, `README.md`, `CONTRIBUTING.md`)
+- [ ] `permix/skills/` aligned when public API or integration patterns changed
+- [ ] added or updated tests where it materially reduces regression risk

.github/release.yml

@@ -0,0 +1,22 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking
+    - title: New Features
+      labels:
+        - enhancement
+        - feature
+    - title: Bug Fixes
+      labels:
+        - bug
+        - fix
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Other Changes
+      labels:
+        - '*'

.github/scripts/select-react-catalog.mjs

@@ -0,0 +1,17 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+
+const react = process.env.REACT
+const reactTypes = process.env.REACT_TYPES
+const reactDomTypes = process.env.REACT_DOM_TYPES
+
+if (!react || !reactTypes || !reactDomTypes) {
+  throw new Error('REACT, REACT_TYPES, and REACT_DOM_TYPES must be set')
+}
+
+const yaml = readFileSync('pnpm-workspace.yaml', 'utf-8')
+  .replace(/^( {2}react: ).+$/m, `$1${react}`)
+  .replace(/^( {2}react-dom: ).+$/m, `$1${react}`)
+  .replace(/^( {2}'@types\/react': ).+$/m, `$1${reactTypes}`)
+  .replace(/^( {2}'@types\/react-dom': ).+$/m, `$1${reactDomTypes}`)
+
+writeFileSync('pnpm-workspace.yaml', yaml)

.github/workflows/bundle-size.yml

@@ -0,0 +1,34 @@
+name: Bundle Size
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  bundle-size:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build package
+        run: pnpm --filter permix build
+
+      - name: Enforce bundle-size budgets
+        run: pnpm --filter permix size:compare

.github/workflows/lint-check.yml

@@ -16,15 +16,14 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 24
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 11.5.0
+          cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/next-integration.yml

@@ -0,0 +1,36 @@
+name: Next Integration
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - main
+
+jobs:
+  next-matrix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Playwright Chromium
+        run: pnpm --filter @permix/next-integration exec playwright install chromium --with-deps
+
+      - name: Build Permix and run Next fixtures
+        run: pnpm test:next

.github/workflows/npm-publish.yml

@@ -1,6 +1,8 @@
 name: Build and publish
 
 on:
+  release:
+    types: [published]
   workflow_dispatch:
 
 permissions:
@@ -15,7 +17,8 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: latest
+          node-version: 24
+          cache: pnpm
           registry-url: 'https://registry.npmjs.org'
       - run: pnpm i --frozen-lockfile
       - run: pnpm run lint