@ahmed109/gatekeeper-core 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ahmed Tamer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @ahmed109/gatekeeper-core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Pure, framework-independent authorization and feature-flag evaluator for TypeScript.
+
+Part of the **Gatekeeper** toolkit. Zero runtime dependencies, deterministic evaluation, and full TypeScript type safety for role-based (RBAC) and attribute-based (ABAC) access control.
+
+## Installation
+
+`ash
+npm install @ahmed109/gatekeeper-core
+
+# or
+
+pnpm add @ahmed109/gatekeeper-core
+
+# or
+
+yarn add @ahmed109/gatekeeper-core
+`
+
+## Features
+
+- **Zero runtime dependencies**: Pure functional logic running identically in Node.js, browsers, Edge runtimes, and Cloudflare Workers.
+- **Layered Privilege Model**: Evaluates base role permissions (dmin, manager, member, or custom) combined with explicit user-level direct grants.
+- **Feature Flag Engine**: Side-by-side authorization and feature-flag evaluation.
+- **Compound Checks**: Built-in support for can(), canAll(), and canAny().
+
+## Quickstart
+
+` ypescript
+import { can, canAll, isFeatureEnabled, type GatekeeperUser } from '@ahmed109/gatekeeper-core';
+
+const user: GatekeeperUser = {
+id: 'usr_123',
+name: 'Alice Admin',
+email: 'alice@example.com',
+role: 'admin',
+permissions: ['custom.override'],
+};
+
+// Check single permission
+if (can(user, 'users.delete')) {
+console.log('User can delete users');
+}
+
+// Check multiple permissions
+if (canAll(user, ['users.read', 'settings.manage'])) {
+console.log('User possesses all required permissions');
+}
+
+// Evaluate feature flags
+const flags = { 'new-dashboard': true, 'beta-analytics': false };
+if (isFeatureEnabled('new-dashboard', flags)) {
+console.log('Feature is enabled');
+}
+`
+
+## License
+
+MIT © [Ahmed Tamer](https://github.com/Ahmed1092002)

package/dist/index.cjs

@@ -0,0 +1,378 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_ROLE_PERMISSIONS: () => DEFAULT_ROLE_PERMISSIONS,
+  can: () => can,
+  canAll: () => canAll,
+  canAny: () => canAny,
+  createSubject: () => createSubject,
+  defineRolePermissions: () => defineRolePermissions,
+  evaluatePermission: () => evaluatePermission,
+  fromJwtClaims: () => fromJwtClaims,
+  fromPermissions: () => fromPermissions,
+  fromRoles: () => fromRoles,
+  getUserEffectivePermissions: () => getUserEffectivePermissions,
+  isFeatureEnabled: () => isFeatureEnabled,
+  normalizeFeatureFlags: () => normalizeFeatureFlags,
+  parseEvaluateOptions: () => parseEvaluateOptions
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/roles.ts
+var DEFAULT_ROLE_PERMISSIONS = {
+  admin: ["users.read", "users.create", "users.delete", "reports.view", "settings.manage"],
+  manager: ["users.read", "reports.view"],
+  member: ["reports.view"]
+};
+function defineRolePermissions(customMap, baseMap = DEFAULT_ROLE_PERMISSIONS) {
+  if (!customMap) {
+    return { ...baseMap };
+  }
+  const merged = { ...baseMap };
+  for (const [role, perms] of Object.entries(customMap)) {
+    if (perms) {
+      merged[role] = [...perms];
+    }
+  }
+  return merged;
+}
+
+// src/evaluator.ts
+function parseEvaluateOptions(options) {
+  if (!options || typeof options !== "object") {
+    return {};
+  }
+  if ("roleMap" in options || "context" in options || "policy" in options) {
+    return options;
+  }
+  const values = Object.values(options);
+  if (values.length === 0 || values.every((v) => Array.isArray(v))) {
+    return { roleMap: options };
+  }
+  return options;
+}
+function getUserEffectivePermissions(subject, roleMapOrOptions) {
+  const permissions = /* @__PURE__ */ new Set();
+  if (!subject) {
+    return permissions;
+  }
+  const opts = parseEvaluateOptions(roleMapOrOptions);
+  const roleMap = opts.roleMap ?? DEFAULT_ROLE_PERMISSIONS;
+  const rolesToEvaluate = /* @__PURE__ */ new Set();
+  if (Array.isArray(subject.roles)) {
+    for (const r of subject.roles) {
+      if (r) rolesToEvaluate.add(r);
+    }
+  }
+  if (subject.role) {
+    rolesToEvaluate.add(subject.role);
+  }
+  for (const role of rolesToEvaluate) {
+    const rolePerms = roleMap[role];
+    if (rolePerms && Array.isArray(rolePerms)) {
+      for (const perm of rolePerms) {
+        permissions.add(perm);
+      }
+    }
+  }
+  if (Array.isArray(subject.permissions)) {
+    for (const perm of subject.permissions) {
+      if (perm) permissions.add(perm);
+    }
+  }
+  return permissions;
+}
+function can(subject, permission, options) {
+  if (!subject || !permission) {
+    return false;
+  }
+  const opts = parseEvaluateOptions(options);
+  if (opts.policy) {
+    const decision = opts.policy(subject, permission, opts.context);
+    if (typeof decision === "boolean") {
+      return decision;
+    }
+  }
+  const effective = getUserEffectivePermissions(subject, options !== void 0 ? opts : void 0);
+  return effective.has(permission);
+}
+function canAll(subject, permissions, options) {
+  if (!subject || !permissions.length) {
+    return false;
+  }
+  return permissions.every((p) => can(subject, p, options));
+}
+function canAny(subject, permissions, options) {
+  if (!subject || !permissions.length) {
+    return false;
+  }
+  return permissions.some((p) => can(subject, p, options));
+}
+function evaluatePermission(subject, permission, options) {
+  if (!subject) {
+    return {
+      allowed: false,
+      reason: "No authenticated user provided.",
+      missingPermissions: [permission]
+    };
+  }
+  const opts = parseEvaluateOptions(options);
+  if (opts.policy) {
+    const decision = opts.policy(subject, permission, opts.context);
+    if (typeof decision === "boolean") {
+      return {
+        allowed: decision,
+        reason: decision ? "Permission granted by policy." : "Permission denied by policy.",
+        missingPermissions: decision ? void 0 : [permission]
+      };
+    }
+  }
+  const effective = getUserEffectivePermissions(subject, options !== void 0 ? opts : void 0);
+  const allowed = effective.has(permission);
+  if (allowed) {
+    return {
+      allowed: true,
+      reason: "Permission granted."
+    };
+  }
+  const roleDesc = subject.role ?? (subject.roles?.length ? subject.roles.join(", ") : "none");
+  return {
+    allowed: false,
+    reason: `User with role '${roleDesc}' lacks required permission '${permission}'.`,
+    missingPermissions: [permission]
+  };
+}
+function normalizeFeatureFlags(flags) {
+  if (!flags) {
+    return {};
+  }
+  if (Array.isArray(flags)) {
+    const result = {};
+    for (const flag of flags) {
+      result[flag.key] = flag.enabled;
+    }
+    return result;
+  }
+  return { ...flags };
+}
+function isFeatureEnabled(flags, flagKey) {
+  if (!flags || !flagKey) {
+    return false;
+  }
+  if (Array.isArray(flags)) {
+    const found = flags.find((f) => f.key === flagKey);
+    return Boolean(found?.enabled);
+  }
+  return Boolean(flags[flagKey]);
+}
+
+// src/adapters.ts
+function fromRoles(idOrInput, roles, attributes) {
+  if (typeof idOrInput === "object" && idOrInput !== null) {
+    const rolesList2 = [];
+    if (Array.isArray(idOrInput.roles)) {
+      rolesList2.push(...idOrInput.roles);
+    } else if (idOrInput.roles) {
+      rolesList2.push(idOrInput.roles);
+    }
+    if (idOrInput.role && !rolesList2.includes(idOrInput.role)) {
+      rolesList2.push(idOrInput.role);
+    }
+    return {
+      id: String(idOrInput.id),
+      roles: rolesList2,
+      role: idOrInput.role ?? rolesList2[0],
+      ...idOrInput.permissions ? { permissions: idOrInput.permissions } : {},
+      ...idOrInput.attributes ? { attributes: idOrInput.attributes } : {},
+      ...idOrInput.name ? { name: idOrInput.name } : {},
+      ...idOrInput.email ? { email: idOrInput.email } : {}
+    };
+  }
+  const rolesList = [];
+  if (Array.isArray(roles)) {
+    rolesList.push(...roles);
+  } else if (roles) {
+    rolesList.push(roles);
+  }
+  return {
+    id: String(idOrInput),
+    roles: rolesList,
+    role: rolesList[0],
+    ...attributes ? { attributes } : {}
+  };
+}
+function fromPermissions(idOrInput, permissions, attributes) {
+  if (typeof idOrInput === "object" && idOrInput !== null) {
+    return {
+      id: String(idOrInput.id),
+      roles: [],
+      permissions: Array.isArray(idOrInput.permissions) ? [...idOrInput.permissions] : [],
+      ...idOrInput.attributes ? { attributes: idOrInput.attributes } : {},
+      ...idOrInput.name ? { name: idOrInput.name } : {},
+      ...idOrInput.email ? { email: idOrInput.email } : {}
+    };
+  }
+  return {
+    id: String(idOrInput),
+    roles: [],
+    permissions: Array.isArray(permissions) ? [...permissions] : [],
+    ...attributes ? { attributes } : {}
+  };
+}
+function getByPath(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current && typeof current === "object" && part in current) {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+function fromJwtClaims(claims, options = {}) {
+  if (!claims || typeof claims !== "object") {
+    return { id: "", roles: [], permissions: [] };
+  }
+  const idFields = options.idField ? Array.isArray(options.idField) ? options.idField : [options.idField] : ["sub", "id"];
+  let resolvedId = "";
+  for (const field of idFields) {
+    const val = getByPath(claims, field);
+    if (val !== void 0 && val !== null && String(val).trim()) {
+      resolvedId = String(val);
+      break;
+    }
+  }
+  const rolesFields = options.rolesField ? Array.isArray(options.rolesField) ? options.rolesField : [options.rolesField] : ["roles", "role", "realm_access.roles"];
+  const resolvedRoles = [];
+  for (const field of rolesFields) {
+    const val = getByPath(claims, field);
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item === "string") {
+          resolvedRoles.push(item);
+        }
+      }
+      if (resolvedRoles.length > 0) break;
+    } else if (typeof val === "string" && val.trim()) {
+      resolvedRoles.push(val);
+      break;
+    }
+  }
+  const permFields = options.permissionsField ? Array.isArray(options.permissionsField) ? options.permissionsField : [options.permissionsField] : ["permissions", "perms"];
+  const resolvedPerms = [];
+  for (const field of permFields) {
+    const val = getByPath(claims, field);
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item === "string") {
+          resolvedPerms.push(item);
+        }
+      }
+      if (resolvedPerms.length > 0) break;
+    } else if (typeof val === "string" && val.trim()) {
+      resolvedPerms.push(val);
+      break;
+    }
+  }
+  const attributes = {};
+  if (options.attributesFields && Array.isArray(options.attributesFields)) {
+    for (const attrField of options.attributesFields) {
+      const val = getByPath(claims, attrField);
+      if (val !== void 0) {
+        attributes[attrField] = val;
+      }
+    }
+  } else {
+    const excludedKeys = /* @__PURE__ */ new Set([
+      "sub",
+      "id",
+      "roles",
+      "role",
+      "realm_access",
+      "permissions",
+      "perms"
+    ]);
+    for (const [k, v] of Object.entries(claims)) {
+      if (!excludedKeys.has(k) && v !== void 0) {
+        attributes[k] = v;
+      }
+    }
+  }
+  const email = typeof claims.email === "string" ? claims.email : void 0;
+  const name = typeof claims.name === "string" ? claims.name : typeof claims.preferred_username === "string" ? claims.preferred_username : void 0;
+  return {
+    id: resolvedId,
+    roles: resolvedRoles,
+    role: resolvedRoles[0],
+    permissions: resolvedPerms,
+    attributes,
+    ...name ? { name } : {},
+    ...email ? { email } : {}
+  };
+}
+function createSubject(source, mapping) {
+  if (typeof mapping === "function") {
+    return mapping(source);
+  }
+  const rawRoles = mapping.getRoles ? mapping.getRoles(source) : void 0;
+  const rolesList = [];
+  if (Array.isArray(rawRoles)) {
+    for (const r of rawRoles) {
+      if (r) rolesList.push(r);
+    }
+  } else if (rawRoles) {
+    rolesList.push(rawRoles);
+  }
+  const rawPerms = mapping.getPermissions ? mapping.getPermissions(source) : void 0;
+  const permsList = Array.isArray(rawPerms) ? [...rawPerms] : [];
+  const attributes = mapping.getAttributes ? mapping.getAttributes(source) : void 0;
+  const name = mapping.getName ? mapping.getName(source) : void 0;
+  const email = mapping.getEmail ? mapping.getEmail(source) : void 0;
+  return {
+    id: mapping.getId(source),
+    roles: rolesList,
+    role: rolesList[0],
+    permissions: permsList,
+    ...attributes ? { attributes } : {},
+    ...name ? { name } : {},
+    ...email ? { email } : {}
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_ROLE_PERMISSIONS,
+  can,
+  canAll,
+  canAny,
+  createSubject,
+  defineRolePermissions,
+  evaluatePermission,
+  fromJwtClaims,
+  fromPermissions,
+  fromRoles,
+  getUserEffectivePermissions,
+  isFeatureEnabled,
+  normalizeFeatureFlags,
+  parseEvaluateOptions
+});

package/dist/index.d.cts

@@ -0,0 +1,242 @@
+/**
+ * Standard permissions supported out-of-the-box.
+ * Users can also supply arbitrary string permissions.
+ */
+type StandardPermission = 'users.read' | 'users.create' | 'users.delete' | 'reports.view' | 'settings.manage';
+type Permission = StandardPermission | (string & {});
+/**
+ * Built-in standard roles.
+ */
+type StandardRole = 'admin' | 'manager' | 'member';
+type Role = StandardRole | (string & {});
+/**
+ * Flexible authorization subject supporting single role, multiple roles,
+ * direct permissions, and contextual attributes.
+ */
+interface AuthorizationSubject {
+    id: string;
+    /** Legacy single-role support */
+    role?: Role;
+    /** Preferred multiple-role support */
+    roles?: Role[];
+    name?: string;
+    email?: string;
+    /**
+     * Optional direct permissions assigned directly to this subject,
+     * extending or complementing role permissions.
+     */
+    permissions?: Permission[];
+    /**
+     * Optional metadata attributes such as tenantId, plan, teamId, etc.
+     */
+    attributes?: Record<string, unknown>;
+}
+/**
+ * Backward-compatible alias for AuthorizationSubject.
+ */
+type GatekeeperUser = AuthorizationSubject;
+/**
+ * Optional policy callback for scoped or attribute-based authorization.
+ * Returning true/false decides immediately. Returning undefined falls back to RBAC.
+ */
+type AuthorizationPolicy = (subject: AuthorizationSubject, permission: Permission, context?: Record<string, unknown>) => boolean | undefined;
+/**
+ * Options passed to authorization checks.
+ */
+interface EvaluateOptions {
+    roleMap?: RolePermissionsMap;
+    context?: Record<string, unknown>;
+    policy?: AuthorizationPolicy;
+}
+type RoleMapOrOptions = RolePermissionsMap | EvaluateOptions;
+/**
+ * Represents a feature flag with its key and active status.
+ */
+interface FeatureFlag {
+    key: string;
+    enabled: boolean;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Detailed outcome of an authorization decision.
+ */
+interface AuthorizationResult {
+    allowed: boolean;
+    reason?: string;
+    missingPermissions?: Permission[];
+}
+/**
+ * Mapping from roles to their granted permissions.
+ */
+type RolePermissionsMap = Record<Role, readonly Permission[] | Permission[]>;
+
+/**
+ * Default role-to-permissions map for Gatekeeper.
+ *
+ * - Admin: Full access across user management, reports, and settings.
+ * - Manager: Can read users and view reports.
+ * - Member: Can view reports.
+ */
+declare const DEFAULT_ROLE_PERMISSIONS: RolePermissionsMap;
+/**
+ * Creates a merged role-to-permissions map by extending or overriding the defaults.
+ */
+declare function defineRolePermissions(customMap?: Partial<RolePermissionsMap>, baseMap?: RolePermissionsMap): RolePermissionsMap;
+
+/**
+ * Normalizes either a legacy RolePermissionsMap or a modern EvaluateOptions object.
+ * An empty plain object `{}` is treated as an explicit empty RolePermissionsMap (`{ roleMap: {} }`).
+ * When options is omitted/undefined, an empty options object is returned (roleMap remains undefined).
+ */
+declare function parseEvaluateOptions(options?: RoleMapOrOptions): EvaluateOptions;
+/**
+ * Returns all effective permissions granted to a subject, combining
+ * permissions from every role in `roles`, the legacy `role` field,
+ * and direct permissions assigned in `permissions`.
+ * Deduplicates permissions and denies safely if no roles or permissions exist.
+ */
+declare function getUserEffectivePermissions(subject: AuthorizationSubject | null | undefined, roleMapOrOptions?: RoleMapOrOptions): Set<Permission>;
+/**
+ * Evaluates whether a subject has a specific permission.
+ * Supports scoped policy checks and legacy roleMap options.
+ *
+ * @param subject - The subject to check.
+ * @param permission - The required permission string.
+ * @param options - Optional roleMap or EvaluateOptions ({ roleMap, context, policy }).
+ * @returns boolean indicating if access is granted.
+ */
+declare function can(subject: AuthorizationSubject | null | undefined, permission: Permission, options?: RoleMapOrOptions): boolean;
+/**
+ * Checks if a subject has ALL of the requested permissions.
+ */
+declare function canAll(subject: AuthorizationSubject | null | undefined, permissions: Permission[], options?: RoleMapOrOptions): boolean;
+/**
+ * Checks if a subject has AT LEAST ONE of the requested permissions.
+ */
+declare function canAny(subject: AuthorizationSubject | null | undefined, permissions: Permission[], options?: RoleMapOrOptions): boolean;
+/**
+ * Evaluates access with detailed diagnostic reasons.
+ */
+declare function evaluatePermission(subject: AuthorizationSubject | null | undefined, permission: Permission, options?: RoleMapOrOptions): AuthorizationResult;
+/**
+ * Normalizes feature flag inputs (either an array of FeatureFlag or a record of boolean flags)
+ * into a standard Record<string, boolean>.
+ */
+declare function normalizeFeatureFlags(flags?: Record<string, boolean> | FeatureFlag[]): Record<string, boolean>;
+/**
+ * Checks whether a feature flag is enabled.
+ */
+declare function isFeatureEnabled(flags: Record<string, boolean> | FeatureFlag[] | undefined, flagKey: string): boolean;
+
+interface FromRolesInput {
+    id: string;
+    role?: Role;
+    roles?: Role[] | Role;
+    permissions?: Permission[];
+    attributes?: Record<string, unknown>;
+    name?: string;
+    email?: string;
+}
+/**
+ * Normalizes an identity with one or multiple roles into a standard AuthorizationSubject.
+ *
+ * @example
+ * // Single role
+ * fromRoles('u1', 'admin');
+ *
+ * // Multiple roles with metadata attributes
+ * fromRoles('u1', ['billing-manager', 'support-agent'], { tenantId: 't-123' });
+ *
+ * // Object input
+ * fromRoles({ id: 'u1', roles: ['editor', 'viewer'] });
+ */
+declare function fromRoles(idOrInput: string | FromRolesInput, roles?: Role[] | Role, attributes?: Record<string, unknown>): AuthorizationSubject;
+interface FromPermissionsInput {
+    id: string;
+    permissions: Permission[];
+    attributes?: Record<string, unknown>;
+    name?: string;
+    email?: string;
+}
+/**
+ * Normalizes an identity with direct permissions into an AuthorizationSubject.
+ *
+ * @example
+ * fromPermissions('u1', ['users.read', 'reports.view']);
+ * fromPermissions({ id: 'u1', permissions: ['users.read'] });
+ */
+declare function fromPermissions(idOrInput: string | FromPermissionsInput, permissions?: Permission[], attributes?: Record<string, unknown>): AuthorizationSubject;
+interface JwtClaimsOptions {
+    /** Field name(s) to check for subject ID. Defaults to ['sub', 'id'] */
+    idField?: string | string[];
+    /** Field name(s) or dot-paths to check for roles. Defaults to ['roles', 'role', 'realm_access.roles'] */
+    rolesField?: string | string[];
+    /** Field name(s) to check for permissions. Defaults to ['permissions', 'perms'] */
+    permissionsField?: string | string[];
+    /** Optional specific claim keys to copy into subject attributes */
+    attributesFields?: string[];
+}
+/**
+ * Normalizes JWT / OIDC claims payload into an AuthorizationSubject.
+ * Supports standard claims as well as Keycloak realm_access and custom claims.
+ *
+ * Note: This is a generic normalization helper and does not validate token signatures.
+ * Signature verification must be performed by your upstream authentication layer.
+ *
+ * @example
+ * // Keycloak JWT with realm_access.roles:
+ * const token = {
+ *   sub: 'user_kc_123',
+ *   realm_access: { roles: ['admin', 'billing'] },
+ *   email: 'alex@example.com'
+ * };
+ * const subject = fromJwtClaims(token);
+ */
+declare function fromJwtClaims(claims: Record<string, unknown>, options?: JwtClaimsOptions): AuthorizationSubject;
+interface SubjectMappingConfig<TSource> {
+    getId: (source: TSource) => string;
+    getRoles?: (source: TSource) => Role[] | Role | undefined | null;
+    getPermissions?: (source: TSource) => Permission[] | undefined | null;
+    getAttributes?: (source: TSource) => Record<string, unknown> | undefined | null;
+    getName?: (source: TSource) => string | undefined | null;
+    getEmail?: (source: TSource) => string | undefined | null;
+}
+/**
+ * Creates an AuthorizationSubject by mapping any arbitrary domain or database model.
+ *
+ * @example
+ * // 1. Simple database record
+ * interface DbUser {
+ *   user_id: string;
+ *   primary_role: string;
+ *   is_active: boolean;
+ * }
+ * const subject = createSubject(dbUser, {
+ *   getId: (u) => u.user_id,
+ *   getRoles: (u) => [u.primary_role],
+ *   getAttributes: (u) => ({ isActive: u.is_active }),
+ * });
+ *
+ * // 2. Custom membership model with nested roles
+ * interface OrgMembership {
+ *   memberId: string;
+ *   organization: { orgId: string };
+ *   access: { roles: string[]; customGrants?: string[] };
+ * }
+ * const memberSubject = createSubject(membership, {
+ *   getId: (m) => m.memberId,
+ *   getRoles: (m) => m.access.roles,
+ *   getPermissions: (m) => m.access.customGrants,
+ *   getAttributes: (m) => ({ orgId: m.organization.orgId }),
+ * });
+ *
+ * // 3. Functional transformer
+ * const customSubject = createSubject(rawInput, (input) => ({
+ *   id: input.id,
+ *   roles: input.assignedRoles,
+ * }));
+ */
+declare function createSubject<TSource>(source: TSource, mapping: SubjectMappingConfig<TSource> | ((source: TSource) => AuthorizationSubject)): AuthorizationSubject;
+
+export { type AuthorizationPolicy, type AuthorizationResult, type AuthorizationSubject, DEFAULT_ROLE_PERMISSIONS, type EvaluateOptions, type FeatureFlag, type FromPermissionsInput, type FromRolesInput, type GatekeeperUser, type JwtClaimsOptions, type Permission, type Role, type RoleMapOrOptions, type RolePermissionsMap, type StandardPermission, type StandardRole, type SubjectMappingConfig, can, canAll, canAny, createSubject, defineRolePermissions, evaluatePermission, fromJwtClaims, fromPermissions, fromRoles, getUserEffectivePermissions, isFeatureEnabled, normalizeFeatureFlags, parseEvaluateOptions };

package/dist/index.d.ts

@@ -0,0 +1,242 @@
+/**
+ * Standard permissions supported out-of-the-box.
+ * Users can also supply arbitrary string permissions.
+ */
+type StandardPermission = 'users.read' | 'users.create' | 'users.delete' | 'reports.view' | 'settings.manage';
+type Permission = StandardPermission | (string & {});
+/**
+ * Built-in standard roles.
+ */
+type StandardRole = 'admin' | 'manager' | 'member';
+type Role = StandardRole | (string & {});
+/**
+ * Flexible authorization subject supporting single role, multiple roles,
+ * direct permissions, and contextual attributes.
+ */
+interface AuthorizationSubject {
+    id: string;
+    /** Legacy single-role support */
+    role?: Role;
+    /** Preferred multiple-role support */
+    roles?: Role[];
+    name?: string;
+    email?: string;
+    /**
+     * Optional direct permissions assigned directly to this subject,
+     * extending or complementing role permissions.
+     */
+    permissions?: Permission[];
+    /**
+     * Optional metadata attributes such as tenantId, plan, teamId, etc.
+     */
+    attributes?: Record<string, unknown>;
+}
+/**
+ * Backward-compatible alias for AuthorizationSubject.
+ */
+type GatekeeperUser = AuthorizationSubject;
+/**
+ * Optional policy callback for scoped or attribute-based authorization.
+ * Returning true/false decides immediately. Returning undefined falls back to RBAC.
+ */
+type AuthorizationPolicy = (subject: AuthorizationSubject, permission: Permission, context?: Record<string, unknown>) => boolean | undefined;
+/**
+ * Options passed to authorization checks.
+ */
+interface EvaluateOptions {
+    roleMap?: RolePermissionsMap;
+    context?: Record<string, unknown>;
+    policy?: AuthorizationPolicy;
+}
+type RoleMapOrOptions = RolePermissionsMap | EvaluateOptions;
+/**
+ * Represents a feature flag with its key and active status.
+ */
+interface FeatureFlag {
+    key: string;
+    enabled: boolean;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Detailed outcome of an authorization decision.
+ */
+interface AuthorizationResult {
+    allowed: boolean;
+    reason?: string;
+    missingPermissions?: Permission[];
+}
+/**
+ * Mapping from roles to their granted permissions.
+ */
+type RolePermissionsMap = Record<Role, readonly Permission[] | Permission[]>;
+
+/**
+ * Default role-to-permissions map for Gatekeeper.
+ *
+ * - Admin: Full access across user management, reports, and settings.
+ * - Manager: Can read users and view reports.
+ * - Member: Can view reports.
+ */
+declare const DEFAULT_ROLE_PERMISSIONS: RolePermissionsMap;
+/**
+ * Creates a merged role-to-permissions map by extending or overriding the defaults.
+ */
+declare function defineRolePermissions(customMap?: Partial<RolePermissionsMap>, baseMap?: RolePermissionsMap): RolePermissionsMap;
+
+/**
+ * Normalizes either a legacy RolePermissionsMap or a modern EvaluateOptions object.
+ * An empty plain object `{}` is treated as an explicit empty RolePermissionsMap (`{ roleMap: {} }`).
+ * When options is omitted/undefined, an empty options object is returned (roleMap remains undefined).
+ */
+declare function parseEvaluateOptions(options?: RoleMapOrOptions): EvaluateOptions;
+/**
+ * Returns all effective permissions granted to a subject, combining
+ * permissions from every role in `roles`, the legacy `role` field,
+ * and direct permissions assigned in `permissions`.
+ * Deduplicates permissions and denies safely if no roles or permissions exist.
+ */
+declare function getUserEffectivePermissions(subject: AuthorizationSubject | null | undefined, roleMapOrOptions?: RoleMapOrOptions): Set<Permission>;
+/**
+ * Evaluates whether a subject has a specific permission.
+ * Supports scoped policy checks and legacy roleMap options.
+ *
+ * @param subject - The subject to check.
+ * @param permission - The required permission string.
+ * @param options - Optional roleMap or EvaluateOptions ({ roleMap, context, policy }).
+ * @returns boolean indicating if access is granted.
+ */
+declare function can(subject: AuthorizationSubject | null | undefined, permission: Permission, options?: RoleMapOrOptions): boolean;
+/**
+ * Checks if a subject has ALL of the requested permissions.
+ */
+declare function canAll(subject: AuthorizationSubject | null | undefined, permissions: Permission[], options?: RoleMapOrOptions): boolean;
+/**
+ * Checks if a subject has AT LEAST ONE of the requested permissions.
+ */
+declare function canAny(subject: AuthorizationSubject | null | undefined, permissions: Permission[], options?: RoleMapOrOptions): boolean;
+/**
+ * Evaluates access with detailed diagnostic reasons.
+ */
+declare function evaluatePermission(subject: AuthorizationSubject | null | undefined, permission: Permission, options?: RoleMapOrOptions): AuthorizationResult;
+/**
+ * Normalizes feature flag inputs (either an array of FeatureFlag or a record of boolean flags)
+ * into a standard Record<string, boolean>.
+ */
+declare function normalizeFeatureFlags(flags?: Record<string, boolean> | FeatureFlag[]): Record<string, boolean>;
+/**
+ * Checks whether a feature flag is enabled.
+ */
+declare function isFeatureEnabled(flags: Record<string, boolean> | FeatureFlag[] | undefined, flagKey: string): boolean;
+
+interface FromRolesInput {
+    id: string;
+    role?: Role;
+    roles?: Role[] | Role;
+    permissions?: Permission[];
+    attributes?: Record<string, unknown>;
+    name?: string;
+    email?: string;
+}
+/**
+ * Normalizes an identity with one or multiple roles into a standard AuthorizationSubject.
+ *
+ * @example
+ * // Single role
+ * fromRoles('u1', 'admin');
+ *
+ * // Multiple roles with metadata attributes
+ * fromRoles('u1', ['billing-manager', 'support-agent'], { tenantId: 't-123' });
+ *
+ * // Object input
+ * fromRoles({ id: 'u1', roles: ['editor', 'viewer'] });
+ */
+declare function fromRoles(idOrInput: string | FromRolesInput, roles?: Role[] | Role, attributes?: Record<string, unknown>): AuthorizationSubject;
+interface FromPermissionsInput {
+    id: string;
+    permissions: Permission[];
+    attributes?: Record<string, unknown>;
+    name?: string;
+    email?: string;
+}
+/**
+ * Normalizes an identity with direct permissions into an AuthorizationSubject.
+ *
+ * @example
+ * fromPermissions('u1', ['users.read', 'reports.view']);
+ * fromPermissions({ id: 'u1', permissions: ['users.read'] });
+ */
+declare function fromPermissions(idOrInput: string | FromPermissionsInput, permissions?: Permission[], attributes?: Record<string, unknown>): AuthorizationSubject;
+interface JwtClaimsOptions {
+    /** Field name(s) to check for subject ID. Defaults to ['sub', 'id'] */
+    idField?: string | string[];
+    /** Field name(s) or dot-paths to check for roles. Defaults to ['roles', 'role', 'realm_access.roles'] */
+    rolesField?: string | string[];
+    /** Field name(s) to check for permissions. Defaults to ['permissions', 'perms'] */
+    permissionsField?: string | string[];
+    /** Optional specific claim keys to copy into subject attributes */
+    attributesFields?: string[];
+}
+/**
+ * Normalizes JWT / OIDC claims payload into an AuthorizationSubject.
+ * Supports standard claims as well as Keycloak realm_access and custom claims.
+ *
+ * Note: This is a generic normalization helper and does not validate token signatures.
+ * Signature verification must be performed by your upstream authentication layer.
+ *
+ * @example
+ * // Keycloak JWT with realm_access.roles:
+ * const token = {
+ *   sub: 'user_kc_123',
+ *   realm_access: { roles: ['admin', 'billing'] },
+ *   email: 'alex@example.com'
+ * };
+ * const subject = fromJwtClaims(token);
+ */
+declare function fromJwtClaims(claims: Record<string, unknown>, options?: JwtClaimsOptions): AuthorizationSubject;
+interface SubjectMappingConfig<TSource> {
+    getId: (source: TSource) => string;
+    getRoles?: (source: TSource) => Role[] | Role | undefined | null;
+    getPermissions?: (source: TSource) => Permission[] | undefined | null;
+    getAttributes?: (source: TSource) => Record<string, unknown> | undefined | null;
+    getName?: (source: TSource) => string | undefined | null;
+    getEmail?: (source: TSource) => string | undefined | null;
+}
+/**
+ * Creates an AuthorizationSubject by mapping any arbitrary domain or database model.
+ *
+ * @example
+ * // 1. Simple database record
+ * interface DbUser {
+ *   user_id: string;
+ *   primary_role: string;
+ *   is_active: boolean;
+ * }
+ * const subject = createSubject(dbUser, {
+ *   getId: (u) => u.user_id,
+ *   getRoles: (u) => [u.primary_role],
+ *   getAttributes: (u) => ({ isActive: u.is_active }),
+ * });
+ *
+ * // 2. Custom membership model with nested roles
+ * interface OrgMembership {
+ *   memberId: string;
+ *   organization: { orgId: string };
+ *   access: { roles: string[]; customGrants?: string[] };
+ * }
+ * const memberSubject = createSubject(membership, {
+ *   getId: (m) => m.memberId,
+ *   getRoles: (m) => m.access.roles,
+ *   getPermissions: (m) => m.access.customGrants,
+ *   getAttributes: (m) => ({ orgId: m.organization.orgId }),
+ * });
+ *
+ * // 3. Functional transformer
+ * const customSubject = createSubject(rawInput, (input) => ({
+ *   id: input.id,
+ *   roles: input.assignedRoles,
+ * }));
+ */
+declare function createSubject<TSource>(source: TSource, mapping: SubjectMappingConfig<TSource> | ((source: TSource) => AuthorizationSubject)): AuthorizationSubject;
+
+export { type AuthorizationPolicy, type AuthorizationResult, type AuthorizationSubject, DEFAULT_ROLE_PERMISSIONS, type EvaluateOptions, type FeatureFlag, type FromPermissionsInput, type FromRolesInput, type GatekeeperUser, type JwtClaimsOptions, type Permission, type Role, type RoleMapOrOptions, type RolePermissionsMap, type StandardPermission, type StandardRole, type SubjectMappingConfig, can, canAll, canAny, createSubject, defineRolePermissions, evaluatePermission, fromJwtClaims, fromPermissions, fromRoles, getUserEffectivePermissions, isFeatureEnabled, normalizeFeatureFlags, parseEvaluateOptions };

package/dist/index.js

@@ -0,0 +1,338 @@
+// src/roles.ts
+var DEFAULT_ROLE_PERMISSIONS = {
+  admin: ["users.read", "users.create", "users.delete", "reports.view", "settings.manage"],
+  manager: ["users.read", "reports.view"],
+  member: ["reports.view"]
+};
+function defineRolePermissions(customMap, baseMap = DEFAULT_ROLE_PERMISSIONS) {
+  if (!customMap) {
+    return { ...baseMap };
+  }
+  const merged = { ...baseMap };
+  for (const [role, perms] of Object.entries(customMap)) {
+    if (perms) {
+      merged[role] = [...perms];
+    }
+  }
+  return merged;
+}
+
+// src/evaluator.ts
+function parseEvaluateOptions(options) {
+  if (!options || typeof options !== "object") {
+    return {};
+  }
+  if ("roleMap" in options || "context" in options || "policy" in options) {
+    return options;
+  }
+  const values = Object.values(options);
+  if (values.length === 0 || values.every((v) => Array.isArray(v))) {
+    return { roleMap: options };
+  }
+  return options;
+}
+function getUserEffectivePermissions(subject, roleMapOrOptions) {
+  const permissions = /* @__PURE__ */ new Set();
+  if (!subject) {
+    return permissions;
+  }
+  const opts = parseEvaluateOptions(roleMapOrOptions);
+  const roleMap = opts.roleMap ?? DEFAULT_ROLE_PERMISSIONS;
+  const rolesToEvaluate = /* @__PURE__ */ new Set();
+  if (Array.isArray(subject.roles)) {
+    for (const r of subject.roles) {
+      if (r) rolesToEvaluate.add(r);
+    }
+  }
+  if (subject.role) {
+    rolesToEvaluate.add(subject.role);
+  }
+  for (const role of rolesToEvaluate) {
+    const rolePerms = roleMap[role];
+    if (rolePerms && Array.isArray(rolePerms)) {
+      for (const perm of rolePerms) {
+        permissions.add(perm);
+      }
+    }
+  }
+  if (Array.isArray(subject.permissions)) {
+    for (const perm of subject.permissions) {
+      if (perm) permissions.add(perm);
+    }
+  }
+  return permissions;
+}
+function can(subject, permission, options) {
+  if (!subject || !permission) {
+    return false;
+  }
+  const opts = parseEvaluateOptions(options);
+  if (opts.policy) {
+    const decision = opts.policy(subject, permission, opts.context);
+    if (typeof decision === "boolean") {
+      return decision;
+    }
+  }
+  const effective = getUserEffectivePermissions(subject, options !== void 0 ? opts : void 0);
+  return effective.has(permission);
+}
+function canAll(subject, permissions, options) {
+  if (!subject || !permissions.length) {
+    return false;
+  }
+  return permissions.every((p) => can(subject, p, options));
+}
+function canAny(subject, permissions, options) {
+  if (!subject || !permissions.length) {
+    return false;
+  }
+  return permissions.some((p) => can(subject, p, options));
+}
+function evaluatePermission(subject, permission, options) {
+  if (!subject) {
+    return {
+      allowed: false,
+      reason: "No authenticated user provided.",
+      missingPermissions: [permission]
+    };
+  }
+  const opts = parseEvaluateOptions(options);
+  if (opts.policy) {
+    const decision = opts.policy(subject, permission, opts.context);
+    if (typeof decision === "boolean") {
+      return {
+        allowed: decision,
+        reason: decision ? "Permission granted by policy." : "Permission denied by policy.",
+        missingPermissions: decision ? void 0 : [permission]
+      };
+    }
+  }
+  const effective = getUserEffectivePermissions(subject, options !== void 0 ? opts : void 0);
+  const allowed = effective.has(permission);
+  if (allowed) {
+    return {
+      allowed: true,
+      reason: "Permission granted."
+    };
+  }
+  const roleDesc = subject.role ?? (subject.roles?.length ? subject.roles.join(", ") : "none");
+  return {
+    allowed: false,
+    reason: `User with role '${roleDesc}' lacks required permission '${permission}'.`,
+    missingPermissions: [permission]
+  };
+}
+function normalizeFeatureFlags(flags) {
+  if (!flags) {
+    return {};
+  }
+  if (Array.isArray(flags)) {
+    const result = {};
+    for (const flag of flags) {
+      result[flag.key] = flag.enabled;
+    }
+    return result;
+  }
+  return { ...flags };
+}
+function isFeatureEnabled(flags, flagKey) {
+  if (!flags || !flagKey) {
+    return false;
+  }
+  if (Array.isArray(flags)) {
+    const found = flags.find((f) => f.key === flagKey);
+    return Boolean(found?.enabled);
+  }
+  return Boolean(flags[flagKey]);
+}
+
+// src/adapters.ts
+function fromRoles(idOrInput, roles, attributes) {
+  if (typeof idOrInput === "object" && idOrInput !== null) {
+    const rolesList2 = [];
+    if (Array.isArray(idOrInput.roles)) {
+      rolesList2.push(...idOrInput.roles);
+    } else if (idOrInput.roles) {
+      rolesList2.push(idOrInput.roles);
+    }
+    if (idOrInput.role && !rolesList2.includes(idOrInput.role)) {
+      rolesList2.push(idOrInput.role);
+    }
+    return {
+      id: String(idOrInput.id),
+      roles: rolesList2,
+      role: idOrInput.role ?? rolesList2[0],
+      ...idOrInput.permissions ? { permissions: idOrInput.permissions } : {},
+      ...idOrInput.attributes ? { attributes: idOrInput.attributes } : {},
+      ...idOrInput.name ? { name: idOrInput.name } : {},
+      ...idOrInput.email ? { email: idOrInput.email } : {}
+    };
+  }
+  const rolesList = [];
+  if (Array.isArray(roles)) {
+    rolesList.push(...roles);
+  } else if (roles) {
+    rolesList.push(roles);
+  }
+  return {
+    id: String(idOrInput),
+    roles: rolesList,
+    role: rolesList[0],
+    ...attributes ? { attributes } : {}
+  };
+}
+function fromPermissions(idOrInput, permissions, attributes) {
+  if (typeof idOrInput === "object" && idOrInput !== null) {
+    return {
+      id: String(idOrInput.id),
+      roles: [],
+      permissions: Array.isArray(idOrInput.permissions) ? [...idOrInput.permissions] : [],
+      ...idOrInput.attributes ? { attributes: idOrInput.attributes } : {},
+      ...idOrInput.name ? { name: idOrInput.name } : {},
+      ...idOrInput.email ? { email: idOrInput.email } : {}
+    };
+  }
+  return {
+    id: String(idOrInput),
+    roles: [],
+    permissions: Array.isArray(permissions) ? [...permissions] : [],
+    ...attributes ? { attributes } : {}
+  };
+}
+function getByPath(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current && typeof current === "object" && part in current) {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+function fromJwtClaims(claims, options = {}) {
+  if (!claims || typeof claims !== "object") {
+    return { id: "", roles: [], permissions: [] };
+  }
+  const idFields = options.idField ? Array.isArray(options.idField) ? options.idField : [options.idField] : ["sub", "id"];
+  let resolvedId = "";
+  for (const field of idFields) {
+    const val = getByPath(claims, field);
+    if (val !== void 0 && val !== null && String(val).trim()) {
+      resolvedId = String(val);
+      break;
+    }
+  }
+  const rolesFields = options.rolesField ? Array.isArray(options.rolesField) ? options.rolesField : [options.rolesField] : ["roles", "role", "realm_access.roles"];
+  const resolvedRoles = [];
+  for (const field of rolesFields) {
+    const val = getByPath(claims, field);
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item === "string") {
+          resolvedRoles.push(item);
+        }
+      }
+      if (resolvedRoles.length > 0) break;
+    } else if (typeof val === "string" && val.trim()) {
+      resolvedRoles.push(val);
+      break;
+    }
+  }
+  const permFields = options.permissionsField ? Array.isArray(options.permissionsField) ? options.permissionsField : [options.permissionsField] : ["permissions", "perms"];
+  const resolvedPerms = [];
+  for (const field of permFields) {
+    const val = getByPath(claims, field);
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item === "string") {
+          resolvedPerms.push(item);
+        }
+      }
+      if (resolvedPerms.length > 0) break;
+    } else if (typeof val === "string" && val.trim()) {
+      resolvedPerms.push(val);
+      break;
+    }
+  }
+  const attributes = {};
+  if (options.attributesFields && Array.isArray(options.attributesFields)) {
+    for (const attrField of options.attributesFields) {
+      const val = getByPath(claims, attrField);
+      if (val !== void 0) {
+        attributes[attrField] = val;
+      }
+    }
+  } else {
+    const excludedKeys = /* @__PURE__ */ new Set([
+      "sub",
+      "id",
+      "roles",
+      "role",
+      "realm_access",
+      "permissions",
+      "perms"
+    ]);
+    for (const [k, v] of Object.entries(claims)) {
+      if (!excludedKeys.has(k) && v !== void 0) {
+        attributes[k] = v;
+      }
+    }
+  }
+  const email = typeof claims.email === "string" ? claims.email : void 0;
+  const name = typeof claims.name === "string" ? claims.name : typeof claims.preferred_username === "string" ? claims.preferred_username : void 0;
+  return {
+    id: resolvedId,
+    roles: resolvedRoles,
+    role: resolvedRoles[0],
+    permissions: resolvedPerms,
+    attributes,
+    ...name ? { name } : {},
+    ...email ? { email } : {}
+  };
+}
+function createSubject(source, mapping) {
+  if (typeof mapping === "function") {
+    return mapping(source);
+  }
+  const rawRoles = mapping.getRoles ? mapping.getRoles(source) : void 0;
+  const rolesList = [];
+  if (Array.isArray(rawRoles)) {
+    for (const r of rawRoles) {
+      if (r) rolesList.push(r);
+    }
+  } else if (rawRoles) {
+    rolesList.push(rawRoles);
+  }
+  const rawPerms = mapping.getPermissions ? mapping.getPermissions(source) : void 0;
+  const permsList = Array.isArray(rawPerms) ? [...rawPerms] : [];
+  const attributes = mapping.getAttributes ? mapping.getAttributes(source) : void 0;
+  const name = mapping.getName ? mapping.getName(source) : void 0;
+  const email = mapping.getEmail ? mapping.getEmail(source) : void 0;
+  return {
+    id: mapping.getId(source),
+    roles: rolesList,
+    role: rolesList[0],
+    permissions: permsList,
+    ...attributes ? { attributes } : {},
+    ...name ? { name } : {},
+    ...email ? { email } : {}
+  };
+}
+export {
+  DEFAULT_ROLE_PERMISSIONS,
+  can,
+  canAll,
+  canAny,
+  createSubject,
+  defineRolePermissions,
+  evaluatePermission,
+  fromJwtClaims,
+  fromPermissions,
+  fromRoles,
+  getUserEffectivePermissions,
+  isFeatureEnabled,
+  normalizeFeatureFlags,
+  parseEvaluateOptions
+};

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@ahmed109/gatekeeper-core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Pure framework-independent authorization and feature-flag evaluator for TypeScript",
+  "keywords": [
+    "authorization",
+    "rbac",
+    "abac",
+    "permissions",
+    "feature-flags",
+    "typescript"
+  ],
+  "author": "Ahmed Tamer",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ahmed1092002/npm-packages.git",
+    "directory": "gatekeeper/packages/core"
+  },
+  "bugs": {
+    "url": "https://github.com/Ahmed1092002/npm-packages/issues"
+  },
+  "homepage": "https://github.com/Ahmed1092002/npm-packages/tree/main/gatekeeper#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "tsup": "^8.3.6",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.5"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "dev": "tsup src/index.ts --format esm,cjs --dts --watch",
+    "test": "vitest run",
+    "lint": "eslint src"
+  }
 }