@mahiframework/permissions 0.1.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bradie Tilley
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# @mahiframework/permissions
+
+Permissions — roles, permissions, and cached authorization checks for Mahi.
+
+Part of the [Mahi](https://github.com/mahiframework/mahi) framework.
+
+See the [documentation](https://github.com/mahiframework/mahi/tree/main/docs/permissions).

package/dist/assignee.d.ts

@@ -0,0 +1,57 @@
+import { BaseModel } from "@mahiframework/database";
+/**
+ * Anything that can hold a role or a permission.
+ *
+ * Either a model instance (the ordinary case: a `User` from
+ * `Auth.user()`), or an explicit `{ type, id }` descriptor. The explicit
+ * form is not a convenience — it is what lets a queue job or a CLI
+ * command assign a role without hydrating a model, and what lets a
+ * caller name a subject whose class isn't loaded.
+ *
+ * Deliberately NOT a plain `Record` with an `id`: a bare attributes
+ * object carries no `morphAlias()`, so the discriminant would have to be
+ * guessed. A row that came back from `Auth.user()` IS a hydrated model
+ * instance in this framework, so the common path still takes the first
+ * form.
+ */
+export type Assignee = BaseModel | AssigneeRef;
+/** A subject named without a model instance: `{ type: "User", id: 123n }`. */
+export interface AssigneeRef {
+    /** The morph alias, i.e. whatever `Model.morphAlias()` returns for the class. */
+    type: string;
+    id: bigint;
+}
+/** A resolved subject, the shape every pivot read and write actually uses. */
+export interface ResolvedAssignee {
+    morphType: string;
+    key: bigint;
+}
+/**
+ * Narrow an `Assignee` to the `(model_type, model_id)` pair the pivots
+ * store.
+ *
+ * The key MUST be a `bigint`. `model_has_roles.model_id` is a
+ * `bigInteger` column (see the migration for why it can't be text), so a
+ * uuid- or string-keyed model cannot hold a role. Caught here rather
+ * than at the database because the two engines disagree about how badly:
+ * Postgres raises `operator does not exist: bigint = character varying`,
+ * a 500 that names no model, while SQLite happily stores the string and
+ * then never matches it — a permission check that silently returns false
+ * forever. A `number` is rejected for the same reason the snowflake
+ * package returns `bigint`: a 64-bit id does not survive the round trip.
+ *
+ * `morphAlias()` resolves through a `Relation.morphMap()` entry, then
+ * `static morphName`, then the TABLE NAME. That last fallback is why the
+ * docs recommend `Relation.enforceMorphMap()`: without a map, renaming a
+ * table silently orphans every assignment row that named it.
+ */
+export declare function resolveAssignee(assignee: Assignee): ResolvedAssignee;
+/**
+ * A stable string for one subject, used only as a per-request memo key.
+ *
+ * Never stored. The separator is `:` and both halves are already
+ * constrained (a morph alias is an identifier, a key is digits), so no
+ * escaping is needed to keep two different subjects from colliding.
+ */
+export declare function assigneeCacheKey(assignee: ResolvedAssignee): string;
+//# sourceMappingURL=assignee.d.ts.map

package/dist/assignee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee.d.ts","sourceRoot":"","sources":["../src/assignee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,gBAAgB,CASpE;AAUD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAEnE"}

package/dist/assignee.js

@@ -0,0 +1,46 @@
+import { BaseModel } from "@mahiframework/database";
+import { UnsupportedAssigneeKeyError } from "./errors.js";
+/**
+ * Narrow an `Assignee` to the `(model_type, model_id)` pair the pivots
+ * store.
+ *
+ * The key MUST be a `bigint`. `model_has_roles.model_id` is a
+ * `bigInteger` column (see the migration for why it can't be text), so a
+ * uuid- or string-keyed model cannot hold a role. Caught here rather
+ * than at the database because the two engines disagree about how badly:
+ * Postgres raises `operator does not exist: bigint = character varying`,
+ * a 500 that names no model, while SQLite happily stores the string and
+ * then never matches it — a permission check that silently returns false
+ * forever. A `number` is rejected for the same reason the snowflake
+ * package returns `bigint`: a 64-bit id does not survive the round trip.
+ *
+ * `morphAlias()` resolves through a `Relation.morphMap()` entry, then
+ * `static morphName`, then the TABLE NAME. That last fallback is why the
+ * docs recommend `Relation.enforceMorphMap()`: without a map, renaming a
+ * table silently orphans every assignment row that named it.
+ */
+export function resolveAssignee(assignee) {
+    if (assignee instanceof BaseModel) {
+        const modelClass = assignee.constructor;
+        const key = assignee.getRawAttribute(modelClass.primaryKeyColumn);
+        return { morphType: modelClass.morphAlias(), key: requireBigint(modelClass.morphAlias(), key) };
+    }
+    return { morphType: assignee.type, key: requireBigint(assignee.type, assignee.id) };
+}
+function requireBigint(morphType, key) {
+    if (typeof key !== "bigint") {
+        throw new UnsupportedAssigneeKeyError(morphType, key);
+    }
+    return key;
+}
+/**
+ * A stable string for one subject, used only as a per-request memo key.
+ *
+ * Never stored. The separator is `:` and both halves are already
+ * constrained (a morph alias is an identifier, a key is digits), so no
+ * escaping is needed to keep two different subjects from colliding.
+ */
+export function assigneeCacheKey(assignee) {
+    return `${assignee.morphType}:${assignee.key}`;
+}
+//# sourceMappingURL=assignee.js.map

package/dist/assignee.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee.js","sourceRoot":"","sources":["../src/assignee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAgC1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,IAAI,QAAQ,YAAY,SAAS,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAA+B,CAAC;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAY,CAAC;QAE7E,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,GAAY;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,2BAA2B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0B;IACzD,OAAO,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjD,CAAC"}

package/dist/commands/permissions-cache-reset.d.ts

@@ -0,0 +1,20 @@
+import { Command } from "@mahiframework/cli";
+/**
+ * Forget the cached role/permission map.
+ *
+ * The registrar already does this on every write it performs, and the
+ * model-event listeners cover writes that bypass it, so reaching for this
+ * command means something escaped both: a raw `DB.table("roles")` insert,
+ * a migration, a restored database dump.
+ *
+ * It forgets exactly ONE key and touches nothing else.
+ * `@mahiframework/cache` has no tags, so there is no flush-by-pattern,
+ * and `cache:clear` would take out the app's entire cache to fix a
+ * problem with five tables.
+ */
+export declare class PermissionsCacheResetCommand extends Command {
+    signature: string;
+    description: string;
+    handle(): Promise<void>;
+}
+//# sourceMappingURL=permissions-cache-reset.d.ts.map

package/dist/commands/permissions-cache-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-cache-reset.d.ts","sourceRoot":"","sources":["../../src/commands/permissions-cache-reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C;;;;;;;;;;;;GAYG;AACH,qBAAa,4BAA6B,SAAQ,OAAO;IACvD,SAAS,SAA6B;IACtC,WAAW,SAAgD;IAErD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAK9B"}

package/dist/commands/permissions-cache-reset.js

@@ -0,0 +1,24 @@
+import { Command } from "@mahiframework/cli";
+import { Permissions } from "../permissions-facade.js";
+/**
+ * Forget the cached role/permission map.
+ *
+ * The registrar already does this on every write it performs, and the
+ * model-event listeners cover writes that bypass it, so reaching for this
+ * command means something escaped both: a raw `DB.table("roles")` insert,
+ * a migration, a restored database dump.
+ *
+ * It forgets exactly ONE key and touches nothing else.
+ * `@mahiframework/cache` has no tags, so there is no flush-by-pattern,
+ * and `cache:clear` would take out the app's entire cache to fix a
+ * problem with five tables.
+ */
+export class PermissionsCacheResetCommand extends Command {
+    signature = "permissions:cache-reset";
+    description = "Forget the cached role and permission map.";
+    async handle() {
+        await Permissions.forgetCache();
+        this.app.logger.info("permissions:cache-reset forgot the cached role/permission map.");
+    }
+}
+//# sourceMappingURL=permissions-cache-reset.js.map

package/dist/commands/permissions-cache-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-cache-reset.js","sourceRoot":"","sources":["../../src/commands/permissions-cache-reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,4BAA6B,SAAQ,OAAO;IACvD,SAAS,GAAG,yBAAyB,CAAC;IACtC,WAAW,GAAG,4CAA4C,CAAC;IAE3D,KAAK,CAAC,MAAM;QACV,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAEhC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;CACF"}

package/dist/commands/permissions-check.d.ts

@@ -0,0 +1,37 @@
+import { Command } from "@mahiframework/cli";
+/**
+ * Validate stored assignment rows against the models and guards that
+ * exist.
+ *
+ * Two things can rot without anything noticing:
+ *
+ * 1. A `model_type` that names no model. Assignment rows store a morph
+ *    alias, and `morphAlias()` falls back to the TABLE NAME when no
+ *    `Relation.morphMap()` entry exists — so renaming a table orphans
+ *    every row that named the old one. The rows stay, the checks stop
+ *    matching, and nothing errors. This is the whole argument for
+ *    `Relation.enforceMorphMap()`, and this command is how an app
+ *    without one finds out.
+ *
+ * 2. A `guard_name` naming no configured guard. `guard_name` is NOT NULL
+ *    with no wildcard, so a role created under a guard that was later
+ *    renamed in `config/auth.ts` can never again satisfy a check.
+ *
+ * A CHECK, not a boot failure. A model can legitimately be registered by
+ * a provider this command never loads, so an unmatched alias is reported
+ * rather than fatal at runtime. Exits non-zero so CI can gate on it.
+ */
+export declare class PermissionsCheckCommand extends Command {
+    signature: string;
+    description: string;
+    handle(): Promise<void>;
+    /** Every distinct `model_type` across both assignment tables, with a row count. */
+    private assignedAliases;
+    /**
+     * The app's configured guard names, or null if auth isn't configured at
+     * all — in which case there is nothing to validate against and the
+     * guard check is skipped rather than reporting every guard as unknown.
+     */
+    private configuredGuards;
+}
+//# sourceMappingURL=permissions-check.d.ts.map

package/dist/commands/permissions-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-check.d.ts","sourceRoot":"","sources":["../../src/commands/permissions-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,uBAAwB,SAAQ,OAAO;IAClD,SAAS,SAAuB;IAChC,WAAW,SAA4E;IAEjF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IA4D7B,mFAAmF;YACrE,eAAe;IAc7B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;CAKzB"}

package/dist/commands/permissions-check.js

@@ -0,0 +1,92 @@
+import { Command } from "@mahiframework/cli";
+import { DB, Relation } from "@mahiframework/database";
+import { PERMISSIONS_TOKEN } from "../tokens.js";
+/**
+ * Validate stored assignment rows against the models and guards that
+ * exist.
+ *
+ * Two things can rot without anything noticing:
+ *
+ * 1. A `model_type` that names no model. Assignment rows store a morph
+ *    alias, and `morphAlias()` falls back to the TABLE NAME when no
+ *    `Relation.morphMap()` entry exists — so renaming a table orphans
+ *    every row that named the old one. The rows stay, the checks stop
+ *    matching, and nothing errors. This is the whole argument for
+ *    `Relation.enforceMorphMap()`, and this command is how an app
+ *    without one finds out.
+ *
+ * 2. A `guard_name` naming no configured guard. `guard_name` is NOT NULL
+ *    with no wildcard, so a role created under a guard that was later
+ *    renamed in `config/auth.ts` can never again satisfy a check.
+ *
+ * A CHECK, not a boot failure. A model can legitimately be registered by
+ * a provider this command never loads, so an unmatched alias is reported
+ * rather than fatal at runtime. Exits non-zero so CI can gate on it.
+ */
+export class PermissionsCheckCommand extends Command {
+    signature = "permissions:check";
+    description = "Validate stored role/permission assignments against models and guards.";
+    async handle() {
+        const registrar = this.app.make(PERMISSIONS_TOKEN);
+        const map = await registrar.map();
+        const errors = [];
+        for (const alias of await this.assignedAliases()) {
+            if (Relation.getMorphedModel(alias.model_type) !== undefined) {
+                continue;
+            }
+            errors.push(`"${alias.model_type}" names no registered model, but ${alias.total} assignment row(s) ` +
+                `use it. Morph aliases come from a Relation.morphMap() entry, a static morphName, or ` +
+                `the table name — a renamed table orphans rows that named the old one. Register the ` +
+                `alias with Relation.morphMap(), or delete the rows.`);
+        }
+        // Read straight off the map rather than the tables: it is already
+        // loaded, and a guard present in the cache but not in config is the
+        // same defect as one present in the table.
+        const guards = new Set();
+        for (const role of map.roles) {
+            guards.add(role.guardName);
+        }
+        for (const permission of map.permissions) {
+            guards.add(permission.guardName);
+        }
+        const configured = this.configuredGuards();
+        if (configured !== null) {
+            for (const guard of guards) {
+                if (!configured.has(guard)) {
+                    errors.push(`guard "${guard}" is used by a role or permission but is not configured in ` +
+                        `config/auth.ts. Nothing can ever check against it.`);
+                }
+            }
+        }
+        for (const error of errors) {
+            this.app.logger.error(`permissions:check: ${error}`);
+        }
+        if (errors.length > 0) {
+            process.exitCode = 1;
+            return;
+        }
+        this.app.logger.info(`permissions:check: ${map.roles.length} role(s), ${map.permissions.length} permission(s), ` +
+            `${guards.size} guard(s), no errors.`);
+    }
+    /** Every distinct `model_type` across both assignment tables, with a row count. */
+    async assignedAliases() {
+        const tally = new Map();
+        for (const table of ["model_has_roles", "model_has_permissions"]) {
+            const rows = await DB.table(table).select("model_type").get();
+            for (const row of rows) {
+                tally.set(row.model_type, (tally.get(row.model_type) ?? 0) + 1);
+            }
+        }
+        return [...tally].map(([model_type, total]) => ({ model_type, total }));
+    }
+    /**
+     * The app's configured guard names, or null if auth isn't configured at
+     * all — in which case there is nothing to validate against and the
+     * guard check is skipped rather than reporting every guard as unknown.
+     */
+    configuredGuards() {
+        const guards = this.app.config.get("auth.guards");
+        return guards === undefined ? null : new Set(Object.keys(guards));
+    }
+}
+//# sourceMappingURL=permissions-check.js.map

package/dist/commands/permissions-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-check.js","sourceRoot":"","sources":["../../src/commands/permissions-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,OAAO;IAClD,SAAS,GAAG,mBAAmB,CAAC;IAChC,WAAW,GAAG,wEAAwE,CAAC;IAEvF,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAsB,iBAAiB,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACjD,IAAI,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CAAC,UAAU,oCAAoC,KAAK,CAAC,KAAK,qBAAqB;gBACtF,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,oEAAoE;QACpE,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CACT,UAAU,KAAK,6DAA6D;wBAC1E,oDAAoD,CACvD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAErB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAClB,sBAAsB,GAAG,CAAC,KAAK,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,CAAC,MAAM,kBAAkB;YACzF,GAAG,MAAM,CAAC,IAAI,uBAAuB,CACxC,CAAC;IACJ,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,eAAe;QAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QAExC,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAyB,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC;YAEtF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACK,gBAAgB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAA0B,aAAa,CAAC,CAAC;QAE3E,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/commands/permissions-show.d.ts

@@ -0,0 +1,20 @@
+import type { Command as CommanderCommand } from "commander";
+import { Command } from "@mahiframework/cli";
+/**
+ * Print every role and what it grants.
+ *
+ * The answer to "why can this user do that", which is otherwise five
+ * tables and a join. Reads the same cached map the checks read, so it
+ * shows what the application currently BELIEVES rather than what the
+ * tables say — which is the more useful answer when the suspicion is a
+ * stale cache. Follow with `permissions:cache-reset` to compare.
+ */
+export declare class PermissionsShowCommand extends Command {
+    signature: string;
+    description: string;
+    configure(program: CommanderCommand): void;
+    handle(options?: {
+        guard?: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=permissions-show.d.ts.map

package/dist/commands/permissions-show.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-show.d.ts","sourceRoot":"","sources":["../../src/commands/permissions-show.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI7C;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,OAAO;IACjD,SAAS,SAAsB;IAC/B,WAAW,SAAiE;IAE5E,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAIpC,MAAM,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CA6C9D"}

package/dist/commands/permissions-show.js

@@ -0,0 +1,49 @@
+import { Command } from "@mahiframework/cli";
+import { PERMISSIONS_TOKEN } from "../tokens.js";
+/**
+ * Print every role and what it grants.
+ *
+ * The answer to "why can this user do that", which is otherwise five
+ * tables and a join. Reads the same cached map the checks read, so it
+ * shows what the application currently BELIEVES rather than what the
+ * tables say — which is the more useful answer when the suspicion is a
+ * stale cache. Follow with `permissions:cache-reset` to compare.
+ */
+export class PermissionsShowCommand extends Command {
+    signature = "permissions:show";
+    description = "Print every role, its guard, and the permissions it grants.";
+    configure(program) {
+        program.option("--guard <guard>", "Only show roles and permissions for this guard");
+    }
+    async handle(options = {}) {
+        const map = await this.app.make(PERMISSIONS_TOKEN).map();
+        const guard = options.guard;
+        const roles = guard === undefined ? map.roles : map.roles.filter((r) => r.guardName === guard);
+        const permissions = guard === undefined ? map.permissions : map.permissions.filter((p) => p.guardName === guard);
+        if (roles.length === 0 && permissions.length === 0) {
+            this.line(guard === undefined
+                ? "No roles or permissions are defined."
+                : `No roles or permissions are defined for guard "${guard}".`);
+            return;
+        }
+        this.table(["Role", "Guard", "Permissions"], roles.map((role) => [
+            role.name,
+            role.guardName,
+            role.permissionIds
+                .map((id) => map.permissionById.get(id)?.name ?? `<missing ${id}>`)
+                .sort()
+                .join(", ") || "—",
+        ]));
+        // Listed separately because a permission attached to no role is
+        // invisible above, and an unattached permission is usually either a
+        // direct grant or a typo — both worth seeing.
+        const attached = new Set(roles.flatMap((role) => role.permissionIds.map(String)));
+        const orphans = permissions.filter((p) => !attached.has(String(p.id)));
+        if (orphans.length > 0) {
+            this.line("");
+            this.line("Permissions not granted by any role (direct grants only):");
+            this.table(["Permission", "Guard"], orphans.map((permission) => [permission.name, permission.guardName]));
+        }
+    }
+}
+//# sourceMappingURL=permissions-show.js.map

package/dist/commands/permissions-show.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-show.js","sourceRoot":"","sources":["../../src/commands/permissions-show.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAuB,SAAQ,OAAO;IACjD,SAAS,GAAG,kBAAkB,CAAC;IAC/B,WAAW,GAAG,6DAA6D,CAAC;IAE5E,SAAS,CAAC,OAAyB;QACjC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAA8B,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAsB,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;QAC/F,MAAM,WAAW,GACf,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;QAE/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CACP,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,kDAAkD,KAAK,IAAI,CAChE,CAAC;YAEF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CACR,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,EAChC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,aAAa;iBACf,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,YAAY,EAAE,GAAG,CAAC;iBAClE,IAAI,EAAE;iBACN,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;SACrB,CAAC,CACH,CAAC;QAEF,gEAAgE;QAChE,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CACR,CAAC,YAAY,EAAE,OAAO,CAAC,EACvB,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Base class for every error this package throws, so an app can catch
+ * the whole family in one `catch` when it would rather render a generic
+ * failure than discriminate.
+ */
+export declare class PermissionsError extends Error {
+    constructor(message: string);
+}
+/**
+ * A role was looked up by name and does not exist.
+ *
+ * Thrown rather than returning null because every caller is a write
+ * (`assignRole("admni")`) or an explicit `findRole`. A silent no-op on a
+ * typo'd role name is the failure mode an authorization system can least
+ * afford: it reads as "assigned" and grants nothing.
+ */
+export declare class RoleNotFoundError extends PermissionsError {
+    readonly roleName: string;
+    readonly guard: string;
+    constructor(roleName: string, guard: string);
+}
+/** A permission was looked up by name and does not exist. See `RoleNotFoundError`. */
+export declare class PermissionNotFoundError extends PermissionsError {
+    readonly permissionName: string;
+    readonly guard: string;
+    constructor(permissionName: string, guard: string);
+}
+/**
+ * A role or permission with this name already exists for this guard.
+ *
+ * `(name, guard_name)` is unique in the database, so this is also a
+ * `UniqueConstraintViolationException` waiting to happen; raising it by
+ * name first means the message says which name, rather than which index.
+ */
+export declare class DuplicateNameError extends PermissionsError {
+    readonly kind: "role" | "permission";
+    readonly name: string;
+    readonly guard: string;
+    constructor(kind: "role" | "permission", name: string, guard: string);
+}
+/**
+ * The assignee's primary key is not a `bigint`.
+ *
+ * `model_has_roles.model_id` is a `bigInteger` column, so only
+ * snowflake-keyed models can hold roles. Thrown here rather than letting
+ * the value reach SQL: Postgres rejects a non-numeric string against a
+ * `bigint` with `operator does not exist`, which is a 500 that says
+ * nothing about why, and SQLite would accept it and simply never match.
+ */
+export declare class UnsupportedAssigneeKeyError extends PermissionsError {
+    readonly morphType: string;
+    readonly key: unknown;
+    constructor(morphType: string, key: unknown);
+}
+/**
+ * No guard name could be resolved.
+ *
+ * Every role and permission is scoped to a guard, and the column is NOT
+ * NULL with no wildcard, so there is nothing sensible to fall back to.
+ * Failing here beats stamping `""` and silently creating a guard nobody
+ * will ever check against.
+ */
+export declare class UnresolvedGuardError extends PermissionsError {
+    constructor();
+}
+/**
+ * An assignee's `model_type` names no registered model.
+ *
+ * Only raised by `permissions:check`, never during a check: a stale
+ * discriminant is data, and the framework's own morph resolution treats
+ * an unknown one as a dangling foreign key rather than crashing a read.
+ */
+export declare class UnknownMorphAliasError extends PermissionsError {
+    readonly alias: string;
+    constructor(alias: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,gBAAgB;IAEnD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM;CAIzB;AAED,sFAAsF;AACtF,qBAAa,uBAAwB,SAAQ,gBAAgB;IAEzD,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADb,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM;CAIzB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IAEpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAFb,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM;CAIzB;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAE7D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO;gBADZ,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,OAAO;CAQxB;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;;CAOzD;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;CAMnC"}

package/dist/errors.js

@@ -0,0 +1,106 @@
+/**
+ * Base class for every error this package throws, so an app can catch
+ * the whole family in one `catch` when it would rather render a generic
+ * failure than discriminate.
+ */
+export class PermissionsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/**
+ * A role was looked up by name and does not exist.
+ *
+ * Thrown rather than returning null because every caller is a write
+ * (`assignRole("admni")`) or an explicit `findRole`. A silent no-op on a
+ * typo'd role name is the failure mode an authorization system can least
+ * afford: it reads as "assigned" and grants nothing.
+ */
+export class RoleNotFoundError extends PermissionsError {
+    roleName;
+    guard;
+    constructor(roleName, guard) {
+        super(`There is no role named "${roleName}" for guard "${guard}".`);
+        this.roleName = roleName;
+        this.guard = guard;
+    }
+}
+/** A permission was looked up by name and does not exist. See `RoleNotFoundError`. */
+export class PermissionNotFoundError extends PermissionsError {
+    permissionName;
+    guard;
+    constructor(permissionName, guard) {
+        super(`There is no permission named "${permissionName}" for guard "${guard}".`);
+        this.permissionName = permissionName;
+        this.guard = guard;
+    }
+}
+/**
+ * A role or permission with this name already exists for this guard.
+ *
+ * `(name, guard_name)` is unique in the database, so this is also a
+ * `UniqueConstraintViolationException` waiting to happen; raising it by
+ * name first means the message says which name, rather than which index.
+ */
+export class DuplicateNameError extends PermissionsError {
+    kind;
+    name;
+    guard;
+    constructor(kind, name, guard) {
+        super(`A ${kind} named "${name}" already exists for guard "${guard}".`);
+        this.kind = kind;
+        this.name = name;
+        this.guard = guard;
+    }
+}
+/**
+ * The assignee's primary key is not a `bigint`.
+ *
+ * `model_has_roles.model_id` is a `bigInteger` column, so only
+ * snowflake-keyed models can hold roles. Thrown here rather than letting
+ * the value reach SQL: Postgres rejects a non-numeric string against a
+ * `bigint` with `operator does not exist`, which is a 500 that says
+ * nothing about why, and SQLite would accept it and simply never match.
+ */
+export class UnsupportedAssigneeKeyError extends PermissionsError {
+    morphType;
+    key;
+    constructor(morphType, key) {
+        super(`"${morphType}" keys on ${typeof key}, but model_has_roles.model_id is a bigInteger, ` +
+            `so only snowflake-keyed models can hold roles or permissions. ` +
+            `Give the model \`keyType: snowflake()\`, or assign to a model that has one.`);
+        this.morphType = morphType;
+        this.key = key;
+    }
+}
+/**
+ * No guard name could be resolved.
+ *
+ * Every role and permission is scoped to a guard, and the column is NOT
+ * NULL with no wildcard, so there is nothing sensible to fall back to.
+ * Failing here beats stamping `""` and silently creating a guard nobody
+ * will ever check against.
+ */
+export class UnresolvedGuardError extends PermissionsError {
+    constructor() {
+        super(`No guard name could be resolved. Pass one explicitly ({ guard: "web" }), set ` +
+            `\`guard\` in config/permissions.ts, or configure \`auth.default\`.`);
+    }
+}
+/**
+ * An assignee's `model_type` names no registered model.
+ *
+ * Only raised by `permissions:check`, never during a check: a stale
+ * discriminant is data, and the framework's own morph resolution treats
+ * an unknown one as a dangling foreign key rather than crashing a read.
+ */
+export class UnknownMorphAliasError extends PermissionsError {
+    alias;
+    constructor(alias) {
+        super(`"${alias}" matches no registered model. Morph aliases come from a Relation.morphMap() ` +
+            `entry, a model's \`static morphName\`, or its table name.`);
+        this.alias = alias;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IAE1C;IACA;IAFX,YACW,QAAgB,EAChB,KAAa;QAEtB,KAAK,CAAC,2BAA2B,QAAQ,gBAAgB,KAAK,IAAI,CAAC,CAAC;QAH3D,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAQ;IAGxB,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAEhD;IACA;IAFX,YACW,cAAsB,EACtB,KAAa;QAEtB,KAAK,CAAC,iCAAiC,cAAc,gBAAgB,KAAK,IAAI,CAAC,CAAC;QAHvE,mBAAc,GAAd,cAAc,CAAQ;QACtB,UAAK,GAAL,KAAK,CAAQ;IAGxB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAE3C;IACA;IACA;IAHX,YACW,IAA2B,EAC3B,IAAY,EACZ,KAAa;QAEtB,KAAK,CAAC,KAAK,IAAI,WAAW,IAAI,+BAA+B,KAAK,IAAI,CAAC,CAAC;QAJ/D,SAAI,GAAJ,IAAI,CAAuB;QAC3B,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAAQ;IAGxB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAEpD;IACA;IAFX,YACW,SAAiB,EACjB,GAAY;QAErB,KAAK,CACH,IAAI,SAAS,aAAa,OAAO,GAAG,kDAAkD;YACpF,gEAAgE;YAChE,6EAA6E,CAChF,CAAC;QAPO,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAS;IAOvB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,gBAAgB;IACxD;QACE,KAAK,CACH,+EAA+E;YAC7E,oEAAoE,CACvE,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IACrC;IAArB,YAAqB,KAAa;QAChC,KAAK,CACH,IAAI,KAAK,+EAA+E;YACtF,2DAA2D,CAC9D,CAAC;QAJiB,UAAK,GAAL,KAAK,CAAQ;IAKlC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+export { PermissionsServiceProvider, PERMISSIONS_TOKEN } from "./permissions-service-provider.js";
+export { Permissions } from "./permissions-facade.js";
+export { PermissionRegistrar } from "./permission-registrar.js";
+export type { GuardOption, RoleRef, PermissionRef } from "./permission-registrar.js";
+export { Role } from "./models/role.model.js";
+export type { RoleAttributes } from "./models/role.model.js";
+export { Permission } from "./models/permission.model.js";
+export type { PermissionAttributes } from "./models/permission.model.js";
+export { rolesRelation, permissionsRelation } from "./relations.js";
+export { resolveAssignee, assigneeCacheKey } from "./assignee.js";
+export type { Assignee, AssigneeRef, ResolvedAssignee } from "./assignee.js";
+export { resolveConfig } from "./permissions-config.js";
+export type { PermissionsConfig, PermissionsCacheConfig, ResolvedPermissionsConfig, } from "./permissions-config.js";
+export { role } from "./middleware/role.js";
+export { permission } from "./middleware/permission.js";
+export { roleOrPermission } from "./middleware/role-or-permission.js";
+export type { RoleOrPermissionOptions } from "./middleware/role-or-permission.js";
+export { withPermissionCache } from "./request-cache.js";
+export { InvalidatePermissionCacheListener } from "./listeners/invalidate-permission-cache.listener.js";
+export { PermissionsCacheResetCommand } from "./commands/permissions-cache-reset.js";
+export { PermissionsCheckCommand } from "./commands/permissions-check.js";
+export { PermissionsShowCommand } from "./commands/permissions-show.js";
+export type { PermissionMap, MappedRole, MappedPermission, SerializedPermissionMap, } from "./permission-map.js";
+export { PermissionsError, RoleNotFoundError, PermissionNotFoundError, DuplicateNameError, UnsupportedAssigneeKeyError, UnresolvedGuardError, UnknownMorphAliasError, } from "./errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAErF,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAExG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKxE,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC"}