@via-profit/ability 3.0.1 → 3.1.0

package/dist/index.js

@@ -2,7 +2,99 @@
 /******/ 	"use strict";
 /******/ 	var __webpack_modules__ = ({
 
-/***/ 19:
+/***/ 6:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+
+
+/***/ }),
+
+/***/ 829:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityInMemoryCache = void 0;
+class AbilityInMemoryCache {
+    store = new Map();
+    async get(key) {
+        const entry = this.store.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expires) {
+            this.store.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds = 60) {
+        this.store.set(key, {
+            value,
+            expires: Date.now() + ttlSeconds * 1000,
+        });
+    }
+    serialize(input) {
+        return this.fastHash(this.stableStringify(input));
+    }
+    async delete(key) {
+        this.store.delete(key);
+    }
+    async clear() {
+        this.store.clear();
+    }
+    async deleteByPrefix(prefix) {
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix)) {
+                this.store.delete(key);
+            }
+        }
+    }
+    fastHash(str) {
+        let hash = 5381;
+        for (let i = 0; i < str.length; i++) {
+            hash = (hash * 33) ^ str.charCodeAt(i);
+        }
+        return (hash >>> 0).toString(36);
+    }
+    stableStringify(obj) {
+        if (obj === null)
+            return 'null';
+        const type = typeof obj;
+        if (type === 'string')
+            return JSON.stringify(obj);
+        if (type === 'number' || type === 'boolean')
+            return String(obj);
+        if (type === 'undefined')
+            return 'undefined';
+        if (Array.isArray(obj)) {
+            let out = '[';
+            for (let i = 0; i < obj.length; i++) {
+                if (i > 0)
+                    out += ',';
+                out += this.stableStringify(obj[i]);
+            }
+            return out + ']';
+        }
+        const keys = Object.keys(obj);
+        keys.sort();
+        let out = '{';
+        for (let i = 0; i < keys.length; i++) {
+            const k = keys[i];
+            if (i > 0)
+                out += ',';
+            out += k + ':' + this.stableStringify(obj[k]);
+        }
+        return out + '}';
+    }
+}
+exports.AbilityInMemoryCache = AbilityInMemoryCache;
+
+
+/***/ }),
+
+/***/ 301:
 /***/ ((__unused_webpack_module, exports) => {
 
 
@@ -29,7 +121,7 @@ exports["default"] = AbilityCode;
 
 /***/ }),
 
-/***/ 923:
+/***/ 413:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -38,7 +130,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityCompare = void 0;
-const AbilityCode_1 = __importDefault(__webpack_require__(19));
+const AbilityCode_1 = __importDefault(__webpack_require__(301));
 class AbilityCompare extends AbilityCode_1.default {
     static and = new AbilityCompare('and');
     static or = new AbilityCompare('or');
@@ -49,7 +141,7 @@ exports["default"] = AbilityCompare;
 
 /***/ }),
 
-/***/ 261:
+/***/ 167:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -58,35 +150,48 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityCondition = void 0;
-const AbilityCode_1 = __importDefault(__webpack_require__(19));
-const AbilityError_1 = __webpack_require__(122);
+const AbilityCode_1 = __importDefault(__webpack_require__(301));
+const AbilityError_1 = __webpack_require__(216);
 class AbilityCondition extends AbilityCode_1.default {
-    static equal = new AbilityCondition('=');
-    static not_equal = new AbilityCondition('<>');
-    static more_than = new AbilityCondition('>');
+    static equals = new AbilityCondition('=');
+    static not_equals = new AbilityCondition('<>');
+    static greater_than = new AbilityCondition('>');
     static less_than = new AbilityCondition('<');
     static less_or_equal = new AbilityCondition('<=');
-    static more_or_equal = new AbilityCondition('>=');
+    static greater_or_equal = new AbilityCondition('>=');
     static in = new AbilityCondition('in');
     static not_in = new AbilityCondition('not in');
+    static contains = new AbilityCondition('contains');
+    static not_contains = new AbilityCondition('not contains');
+    static length_greater_than = new AbilityCondition('length greater than');
+    static length_less_than = new AbilityCondition('length less than');
+    static length_equals = new AbilityCondition('length equals');
     static fromLiteral(literal) {
         switch (literal) {
-            case 'equal':
-                return this.equal;
-            case 'not_equal':
-                return this.not_equal;
-            case 'more_than':
-                return this.more_than;
+            case 'equals':
+                return this.equals;
+            case 'not_equals':
+                return this.not_equals;
+            case 'greater_than':
+                return this.greater_than;
             case 'less_than':
                 return this.less_than;
             case 'less_or_equal':
                 return this.less_or_equal;
-            case 'more_or_equal':
-                return this.more_or_equal;
+            case 'greater_or_equal':
+                return this.greater_or_equal;
+            case 'contains':
+                return this.contains;
+            case 'no_contains':
+                return this.not_contains;
             case 'in':
                 return this.in;
             case 'not_in':
                 return this.not_in;
+            case 'length_greater_than':
+                return this.length_greater_than;
+            case 'length_equals':
+                return this.length_equals;
             default:
                 throw new AbilityError_1.AbilityParserError(`Literal ${literal} does not found in AbilityCondition class`);
         }
@@ -108,7 +213,7 @@ exports["default"] = AbilityCondition;
 
 /***/ }),
 
-/***/ 122:
+/***/ 216:
 /***/ ((__unused_webpack_module, exports) => {
 
 
@@ -130,7 +235,7 @@ exports.AbilityParserError = AbilityParserError;
 
 /***/ }),
 
-/***/ 363:
+/***/ 221:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -139,7 +244,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityExplainPolicy = exports.AbilityExplainRuleSet = exports.AbilityExplainRule = exports.AbilityExplain = void 0;
-const AbilityMatch_1 = __importDefault(__webpack_require__(909));
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
 class AbilityExplain {
     type;
     children;
@@ -198,7 +303,7 @@ exports.AbilityExplainPolicy = AbilityExplainPolicy;
 
 /***/ }),
 
-/***/ 909:
+/***/ 247:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -207,7 +312,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityMatch = void 0;
-const AbilityCode_1 = __importDefault(__webpack_require__(19));
+const AbilityCode_1 = __importDefault(__webpack_require__(301));
 class AbilityMatch extends AbilityCode_1.default {
     static pending = new AbilityMatch('pending');
     static match = new AbilityMatch('match');
@@ -219,7 +324,7 @@ exports["default"] = AbilityMatch;
 
 /***/ }),
 
-/***/ 189:
+/***/ 147:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -228,8 +333,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityParser = void 0;
-const AbilityError_1 = __webpack_require__(122);
-const AbilityCondition_1 = __importDefault(__webpack_require__(261));
+const AbilityError_1 = __webpack_require__(216);
+const AbilityCondition_1 = __importDefault(__webpack_require__(167));
 class AbilityParser {
     /**
      * Sets a value in a nested object structure based on a dot/bracket notation path.
@@ -280,7 +385,7 @@ class AbilityParser {
         const typeStructure = {};
         // Iterate through all policies
         policies.forEach(policy => {
-            const action = policy.action;
+            const action = policy.permission;
             // Initialize object for action if it doesn't exist
             if (!typeStructure[action]) {
                 typeStructure[action] = {};
@@ -313,9 +418,9 @@ class AbilityParser {
      */
     static determineTypeFromRule(rule) {
         // Numeric comparisons - always number
-        if (rule.condition.isEqual(AbilityCondition_1.default.more_than) ||
+        if (rule.condition.isEqual(AbilityCondition_1.default.greater_than) ||
             rule.condition.isEqual(AbilityCondition_1.default.less_than) ||
-            rule.condition.isEqual(AbilityCondition_1.default.more_or_equal) ||
+            rule.condition.isEqual(AbilityCondition_1.default.greater_or_equal) ||
             rule.condition.isEqual(AbilityCondition_1.default.less_or_equal)) {
             return 'number';
         }
@@ -325,8 +430,8 @@ class AbilityParser {
             return this.getArrayType(rule.resource);
         }
         // Equality/Inequality operations
-        if (rule.condition.isEqual(AbilityCondition_1.default.equal) ||
-            rule.condition.isEqual(AbilityCondition_1.default.not_equal)) {
+        if (rule.condition.isEqual(AbilityCondition_1.default.equals) ||
+            rule.condition.isEqual(AbilityCondition_1.default.not_equals)) {
             return this.getPrimitiveType(rule.resource);
         }
         return 'any';
@@ -417,7 +522,8 @@ class AbilityParser {
      */
     static formatTypeDefinitions(structure) {
         let output = '// Automatically generated by via-profit/ability\n';
-        output += '// Do not edit manually\n\n';
+        output += '// Do not edit manually\n';
+        output += '\n/* eslint-disable */\n\n';
         output += 'export type Resources = {\n';
         // Sort actions for stable output
         const sortedActions = Object.keys(structure).sort();
@@ -462,7 +568,7 @@ exports["default"] = AbilityParser;
 
 /***/ }),
 
-/***/ 844:
+/***/ 278:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -471,12 +577,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityPolicy = void 0;
-const AbilityRuleSet_1 = __importDefault(__webpack_require__(402));
-const AbilityMatch_1 = __importDefault(__webpack_require__(909));
-const AbilityCompare_1 = __importDefault(__webpack_require__(923));
-const AbilityPolicyEffect_1 = __importDefault(__webpack_require__(277));
-const AbilityExplain_1 = __webpack_require__(363);
-const AbilityError_1 = __webpack_require__(122);
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
+const AbilityCompare_1 = __importDefault(__webpack_require__(413));
+const AbilityExplain_1 = __webpack_require__(221);
+const AbilityError_1 = __webpack_require__(216);
+const AbilityJSONParser_1 = __webpack_require__(909);
+const AbilityDSLParser_1 = __webpack_require__(577);
 class AbilityPolicy {
     matchState = AbilityMatch_1.default.pending;
     /**
@@ -504,14 +610,14 @@ class AbilityPolicy {
     id;
     /**
      * Running the `enforce` or `resolve` method
-     * will select only those from all passed policies that fall under the specified action.
+     * will select only those from all passed policies that fall under the specified permission key.
      */
-    action;
+    permission;
     constructor(params) {
-        const { name, id, action, effect, compareMethod = AbilityCompare_1.default.and } = params;
+        const { name, id, permission, effect, compareMethod = AbilityCompare_1.default.and } = params;
         this.name = name;
         this.id = id;
-        this.action = action;
+        this.permission = permission;
         this.effect = effect;
         this.compareMethod = compareMethod;
     }
@@ -523,25 +629,45 @@ class AbilityPolicy {
         this.ruleSet.push(ruleSet);
         return this;
     }
+    /**
+     * Add rule set to the policy
+     * @param ruleSets - The array of rule set to add
+     */
+    addRuleSets(ruleSets) {
+        for (const ruleSet of ruleSets) {
+            this.ruleSet.push(ruleSet);
+        }
+        return this;
+    }
     /**
      * Check if the policy is matched
-     * @param resources - The resource to check
+     * @param resource - The resource to check
+     * @param environment - The user environment object
      */
-    check(resources) {
+    async check(resource, environment) {
         this.matchState = AbilityMatch_1.default.mismatch;
         if (!this.ruleSet.length) {
             return this.matchState;
         }
-        const rulesetCheckStates = this.ruleSet.reduce((collect, ruleSet) => {
-            return collect.concat(ruleSet.check(resources));
-        }, []);
+        const rulesetCheckStates = [];
+        for (const ruleSet of this.ruleSet) {
+            const state = await ruleSet.check(resource, environment);
+            rulesetCheckStates.push(state);
+            if (AbilityCompare_1.default.and.isEqual(this.compareMethod) && AbilityMatch_1.default.mismatch.isEqual(state)) {
+                return this.matchState; // mismatch
+            }
+            if (AbilityCompare_1.default.or.isEqual(this.compareMethod) && AbilityMatch_1.default.match.isEqual(state)) {
+                this.matchState = AbilityMatch_1.default.match;
+                return this.matchState;
+            }
+        }
         if (AbilityCompare_1.default.and.isEqual(this.compareMethod)) {
-            if (rulesetCheckStates.every(ruleState => AbilityMatch_1.default.match.isEqual(ruleState))) {
+            if (rulesetCheckStates.every(s => AbilityMatch_1.default.match.isEqual(s))) {
                 this.matchState = AbilityMatch_1.default.match;
             }
         }
         if (AbilityCompare_1.default.or.isEqual(this.compareMethod)) {
-            if (rulesetCheckStates.some(ruleState => AbilityMatch_1.default.match.isEqual(ruleState))) {
+            if (rulesetCheckStates.some(s => AbilityMatch_1.default.match.isEqual(s))) {
                 this.matchState = AbilityMatch_1.default.match;
             }
         }
@@ -558,36 +684,23 @@ class AbilityPolicy {
      * @param configs - Array of policy configurations
      * @returns Array of AbilityPolicy instances
      */
-    static parseAll(configs) {
-        return configs.map(config => this.parse(config));
+    static fromJSONAll(configs) {
+        return AbilityJSONParser_1.AbilityJSONParser.parse(configs);
     }
     /**
      * Parse the config JSON format to Policy class instance
      */
-    static parse(config) {
-        const { id, name, ruleSet, compareMethod, action, effect } = config;
-        // Create the empty policy
-        const policy = new AbilityPolicy({
-            name,
-            id,
-            action,
-            effect: new AbilityPolicyEffect_1.default(effect),
-        });
-        policy.compareMethod = new AbilityCompare_1.default(compareMethod);
-        ruleSet.forEach(ruleSetConfig => {
-            policy.addRuleSet(AbilityRuleSet_1.default.parse(ruleSetConfig));
-        });
-        return policy;
+    static fromJSON(config) {
+        return AbilityJSONParser_1.AbilityJSONParser.parsePolicy(config);
     }
-    export() {
-        return {
-            id: this.id.toString(),
-            name: this.name.toString(),
-            compareMethod: this.compareMethod.code.toString(),
-            ruleSet: this.ruleSet.map(rule => rule.export()),
-            action: this.action,
-            effect: this.effect.code,
-        };
+    static fromDSL(dsl) {
+        return new AbilityDSLParser_1.AbilityDSLParser(dsl).parse()[0];
+    }
+    toJSON() {
+        return AbilityJSONParser_1.AbilityJSONParser.toJSON([this])[0];
+    }
+    toString() {
+        return JSON.stringify(this.toJSON());
     }
 }
 exports.AbilityPolicy = AbilityPolicy;
@@ -596,7 +709,7 @@ exports["default"] = AbilityPolicy;
 
 /***/ }),
 
-/***/ 277:
+/***/ 179:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -605,7 +718,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityPolicyEffect = void 0;
-const AbilityCode_1 = __importDefault(__webpack_require__(19));
+const AbilityCode_1 = __importDefault(__webpack_require__(301));
 class AbilityPolicyEffect extends AbilityCode_1.default {
     static deny = new AbilityPolicyEffect('deny');
     static permit = new AbilityPolicyEffect('permit');
@@ -616,7 +729,7 @@ exports["default"] = AbilityPolicyEffect;
 
 /***/ }),
 
-/***/ 668:
+/***/ 634:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -625,96 +738,159 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityResolver = void 0;
-const AbilityPolicyEffect_1 = __importDefault(__webpack_require__(277));
-const AbilityMatch_1 = __importDefault(__webpack_require__(909));
-const AbilityError_1 = __webpack_require__(122);
-const AbilityExplain_1 = __webpack_require__(363);
+const AbilityError_1 = __webpack_require__(216);
+const AbilityResult_1 = __webpack_require__(941);
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
 class AbilityResolver {
     policies;
-    constructor(policyOrListOfPolicies) {
+    cache;
+    constructor(
+    /**
+     * `Important!` The incorrect Resources type was intentionally passed to AbilityPolicy so that TypeScript could suggest the name of the permission and the structure of its resource in the parse method.
+     */
+    policyOrListOfPolicies, options) {
+        const { cache } = options || {};
+        this.cache = cache;
         this.policies = Array.isArray(policyOrListOfPolicies)
             ? policyOrListOfPolicies
             : [policyOrListOfPolicies];
     }
     /**
-     * Resolve policy for the resource and action
+     * Resolve policy for the resource and permission key
      *
-     @param action - Action
+     * @param permission - Permission key
      * @param resource - Resource
+     * @param environment
      */
-    resolve(action, resource) {
-        const filteredPolicies = this.policies.filter(policy => {
-            return AbilityResolver.isInActionContain(policy.action, String(action));
-        });
-        filteredPolicies.map(policy => policy.check(resource));
-        this.policies = filteredPolicies;
-        return this;
+    async resolve(permission, resource, environment) {
+        const filteredPolicies = this.policies.filter(policy => AbilityResolver.isInPermissionContain(policy.permission, String(permission).replace(/^permission\./, '')));
+        for (const policy of filteredPolicies) {
+            const cacheKey = this.cache ? this.makeCacheKey(policy.id, resource, environment) : '';
+            // cache
+            if (this.cache) {
+                const cached = await this.cache.get(cacheKey);
+                if (cached !== undefined) {
+                    policy.matchState = cached;
+                    continue;
+                }
+            }
+            const policyMatchState = await policy.check(resource, environment);
+            if (policyMatchState === AbilityMatch_1.default.pending) {
+                throw new AbilityError_1.AbilityError(`The policy "${policy.name}" is still in a pending state. Make sure to call "check" to evaluate the policy before resolving permissions.`);
+            }
+            if (this.cache) {
+                await this.cache.set(cacheKey, policyMatchState);
+            }
+        }
+        return new AbilityResult_1.AbilityResult(filteredPolicies);
     }
-    resolveWithExplain(action, resource) {
-        return this.resolve(action, resource).policies.map(policy => {
-            return new AbilityExplain_1.AbilityExplainPolicy(policy);
+    async enforce(permission, resource, environment) {
+        const result = await this.resolve(permission, resource, environment);
+        if (result.isDenied()) {
+            const policyName = result.getLastMatchedPolicy()?.name?.toString() || 'unknown';
+            throw new AbilityError_1.AbilityError(`Permission denied by policy "${policyName}"`);
+        }
+    }
+    /**
+     * Check if the permission key is contained in another permission key
+     * @param permissionA - The first permission to check
+     * @param permissionB - The second permission to check
+     */
+    static isInPermissionContain(permissionA, permissionB) {
+        const A = permissionA.split('.');
+        const B = permissionB.split('.');
+        const [longer, shorter] = A.length >= B.length ? [A, B] : [B, A];
+        return shorter.every((chunk, i) => {
+            return chunk === '*' || longer[i] === '*' || chunk === longer[i];
         });
     }
-    enforce(action, resource) {
-        const resolver = this.resolve(action, resource);
-        if (resolver.isDeny()) {
-            throw new AbilityError_1.AbilityError(resolver.getMatchedPolicy()?.name?.toString() || 'Unknown permission error');
+    makeCacheKey(policyId, resource, environment) {
+        if (!this.cache) {
+            return '';
         }
+        return `policy:${policyId}:res:${this.cache.serialize(resource)}:env:${this.cache.serialize(environment)}`;
+    }
+    async invalidatePolicy(policyId) {
+        await this.cache?.deleteByPrefix(policyId);
     }
+    async invalidateCache() {
+        await this.cache?.clear();
+    }
+}
+exports.AbilityResolver = AbilityResolver;
+exports["default"] = AbilityResolver;
+
+
+/***/ }),
+
+/***/ 941:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityResult = void 0;
+const AbilityExplain_1 = __webpack_require__(221);
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
+const AbilityPolicyEffect_1 = __importDefault(__webpack_require__(179));
+class AbilityResult {
     /**
-     * Get the last effect of the policy
+     * Already checked policies (after call the policy.check())
+     */
+    policies;
+    constructor(policies) {
+        this.policies = policies;
+    }
+    /**
+     * Returns a list of explanations for each policy involved in the ability evaluation.
+     * Each item describes how a specific policy contributed to the final permission result.
      *
-     * @returns {AbilityPolicyEffect | null}
+     * Useful for debugging, logging, or building UI tools that visualize permission logic.
      */
-    getEffect() {
-        const effects = this.policies.reduce((collect, policy, _index) => {
-            if (policy.matchState.isEqual(AbilityMatch_1.default.match)) {
-                return collect.concat(policy.effect);
+    explain() {
+        return this.policies.map(policy => {
+            return new AbilityExplain_1.AbilityExplainPolicy(policy);
+        });
+    }
+    getLastMatchedPolicy() {
+        for (let i = this.policies.length - 1; i >= 0; i--) {
+            if (this.policies[i].matchState.isEqual(AbilityMatch_1.default.match)) {
+                return this.policies[i];
             }
-            return collect;
-        }, []);
-        if (effects.length) {
-            return effects[effects.length - 1];
         }
         return null;
     }
-    isPermit() {
-        const effect = this.getEffect();
-        return effect !== null && effect.isEqual(AbilityPolicyEffect_1.default.permit);
+    isAllowed() {
+        const effect = this.getLastEffectOfMatchedPolicy();
+        return effect?.isEqual(AbilityPolicyEffect_1.default.permit) ?? false;
     }
-    isDeny() {
-        const effect = this.getEffect();
-        return effect !== null && effect.isEqual(AbilityPolicyEffect_1.default.deny);
-    }
-    getMatchedPolicy() {
-        const matchedPolicies = this.policies.filter(policy => policy.matchState.isEqual(AbilityMatch_1.default.match));
-        const lastPolicy = matchedPolicies.length ? matchedPolicies[matchedPolicies.length - 1] : null;
-        return lastPolicy || null;
+    isDenied() {
+        const effect = this.getLastEffectOfMatchedPolicy();
+        return effect?.isEqual(AbilityPolicyEffect_1.default.deny) ?? true;
     }
     /**
-     * Check if the action is contained in another action
-     * @param actionA - The first action to check
-     * @param actionB - The second action to check
+     * Get the last effect of the policy
+     *
+     * @returns {AbilityPolicyEffect | null}
      */
-    static isInActionContain(actionA, actionB) {
-        const actionAArray = String(actionA).split('.');
-        const actionBArray = String(actionB).split('.');
-        const a = actionAArray.length >= actionBArray.length ? actionAArray : actionBArray;
-        const b = actionBArray.length <= actionAArray.length ? actionBArray : actionAArray;
-        const c = a.reduce((acc, chunk, index) => {
-            const iterationRes = chunk === b[index] || b[index] === '*' || chunk === '*';
-            return acc.concat(iterationRes);
-        }, []);
-        return c.every(Boolean);
+    getLastEffectOfMatchedPolicy() {
+        for (let i = this.policies.length - 1; i >= 0; i--) {
+            const p = this.policies[i];
+            if (p.matchState.isEqual(AbilityMatch_1.default.match)) {
+                return p.effect;
+            }
+        }
+        return null;
     }
 }
-exports.AbilityResolver = AbilityResolver;
-exports["default"] = AbilityResolver;
+exports.AbilityResult = AbilityResult;
 
 
 /***/ }),
 
-/***/ 476:
+/***/ 306:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -723,8 +899,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityRule = void 0;
-const AbilityMatch_1 = __importDefault(__webpack_require__(909));
-const AbilityCondition_1 = __importDefault(__webpack_require__(261));
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
+const AbilityCondition_1 = __importDefault(__webpack_require__(167));
+const AbilityJSONParser_1 = __webpack_require__(909);
 /**
  * Represents a rule that defines a condition to be checked against a subject and resource.
  */
@@ -743,11 +920,11 @@ class AbilityRule {
     state = AbilityMatch_1.default.pending;
     /**
      * Creates an instance of AbilityRule.
-     * @param {string} options.id - The unique identifier of the rule.
-     * @param {string} options.name - The name of the rule.
-     * @param {AbilityCondition} options.condition - The condition to evaluate.
-     * @param {string} options.subject - The subject of the rule.
-     * @param {string} options.resource - The resource to compare against.
+     * @param {string} params.id - The unique identifier of the rule.
+     * @param {string} params.name - The name of the rule.
+     * @param {AbilityCondition} params.condition - The condition to evaluate.
+     * @param {string} params.subject - The subject of the rule.
+     * @param {string} params.resource - The resource to compare against.
      * @param params
      */
     constructor(params) {
@@ -761,54 +938,139 @@ class AbilityRule {
     /**
      * Check if the rule is matched
      * @param resource - The resource to check
+     * @param environment
      */
-    check(resource) {
+    async check(resource, environment) {
         let is = false;
-        const [valueS, valueO] = this.extractValues(resource);
+        const [subjectValue, resourceValue] = this.extractValues(resource, environment);
+        const isValue = (v) => typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' || v === null;
+        // equals
+        if (AbilityCondition_1.default.equals.isEqual(this.condition)) {
+            is = subjectValue === resourceValue;
+        }
+        // not equals
+        if (AbilityCondition_1.default.not_equals.isEqual(this.condition)) {
+            is = subjectValue !== resourceValue;
+        }
+        // less than
         if (AbilityCondition_1.default.less_than.isEqual(this.condition)) {
-            is = Number(valueS) < Number(valueO);
+            if (typeof subjectValue === 'number' && typeof resourceValue === 'number') {
+                is = subjectValue < resourceValue;
+            }
         }
+        // less or equal
         if (AbilityCondition_1.default.less_or_equal.isEqual(this.condition)) {
-            is = Number(valueS) <= Number(valueO);
+            if (typeof subjectValue === 'number' && typeof resourceValue === 'number') {
+                is = subjectValue <= resourceValue;
+            }
         }
-        if (AbilityCondition_1.default.more_than.isEqual(this.condition)) {
-            is = Number(valueS) > Number(valueO);
+        // more than
+        if (AbilityCondition_1.default.greater_than.isEqual(this.condition)) {
+            if (typeof subjectValue === 'number' && typeof resourceValue === 'number') {
+                is = subjectValue > resourceValue;
+            }
         }
-        if (AbilityCondition_1.default.more_or_equal.isEqual(this.condition)) {
-            is = Number(valueS) >= Number(valueO);
+        // more or equal
+        if (AbilityCondition_1.default.greater_or_equal.isEqual(this.condition)) {
+            if (typeof subjectValue === 'number' && typeof resourceValue === 'number') {
+                is = subjectValue >= resourceValue;
+            }
         }
-        if (AbilityCondition_1.default.equal.isEqual(this.condition)) {
-            is = valueS === valueO;
+        // in
+        if (AbilityCondition_1.default.in.isEqual(this.condition)) {
+            // value in array
+            if (isValue(subjectValue) && Array.isArray(resourceValue)) {
+                is = resourceValue.includes(subjectValue);
+            }
+            // array intersects array
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = subjectValue.some(v => resourceValue.includes(v));
+            }
         }
-        if (AbilityCondition_1.default.not_equal.isEqual(this.condition)) {
-            is = valueS !== valueO;
+        // not in
+        if (AbilityCondition_1.default.not_in.isEqual(this.condition)) {
+            if (isValue(subjectValue) && Array.isArray(resourceValue)) {
+                is = !resourceValue.includes(subjectValue);
+            }
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = !subjectValue.some(v => resourceValue.includes(v));
+            }
         }
-        if (AbilityCondition_1.default.in.isEqual(this.condition)) {
-            // [<some>] and [<some>]
-            if (Array.isArray(valueS) && Array.isArray(valueO)) {
-                is = valueS.some(v => valueO.find(v1 => v1 === v));
+        // contains
+        if (AbilityCondition_1.default.contains.isEqual(this.condition)) {
+            // array contains value
+            if (Array.isArray(subjectValue) && isValue(resourceValue)) {
+                is = subjectValue.includes(resourceValue);
             }
-            // <some> and [<some>]
-            if ((typeof valueS === 'string' || typeof valueS === 'number') && Array.isArray(valueO)) {
-                is = valueO.includes(valueS);
+            // array intersects array
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = subjectValue.some(v => resourceValue.includes(v));
             }
-            // [<some>] and <some>
-            if ((typeof valueO === 'string' || typeof valueO === 'number') && Array.isArray(valueS)) {
-                is = valueS.includes(valueO);
+        }
+        // not contains
+        if (AbilityCondition_1.default.not_contains.isEqual(this.condition)) {
+            if (Array.isArray(subjectValue) && isValue(resourceValue)) {
+                is = !subjectValue.includes(resourceValue);
+            }
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = !subjectValue.some(v => resourceValue.includes(v));
             }
         }
-        if (AbilityCondition_1.default.not_in.isEqual(this.condition)) {
-            // [<some>] and [<some>]
-            if (Array.isArray(valueS) && Array.isArray(valueO)) {
-                is = !valueS.some(v => valueO.find(v1 => v1 === v));
+        // length equals
+        if (AbilityCondition_1.default.length_equals.isEqual(this.condition)) {
+            // foo.bar == n
+            if (isValue(subjectValue) && typeof resourceValue === 'number') {
+                is = String(subjectValue).length === resourceValue;
+            }
+            // ['foo', 'bar'] = n
+            else if (Array.isArray(subjectValue) && typeof resourceValue === 'number') {
+                is = subjectValue.length === resourceValue;
+            }
+            // ['foo', 'bar'] = ['baz', 'taz']
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = subjectValue.length === resourceValue.length;
+            }
+            // 'foo' = 'bar'
+            else if (typeof subjectValue === 'string' && typeof resourceValue === 'string') {
+                is = subjectValue.length === resourceValue.length;
+            }
+        }
+        // length greater than
+        if (AbilityCondition_1.default.length_greater_than.isEqual(this.condition)) {
+            // foo.bar > n
+            if (isValue(subjectValue) && typeof resourceValue === 'number') {
+                is = String(subjectValue).length > resourceValue;
             }
-            // <some> and [<some>]
-            if ((typeof valueS === 'string' || typeof valueS === 'number') && Array.isArray(valueO)) {
-                is = !valueO.includes(valueS);
+            // ['foo', 'bar'] > n
+            else if (Array.isArray(subjectValue) && typeof resourceValue === 'number') {
+                is = subjectValue.length > resourceValue;
             }
-            // [<some>] and <some>
-            if ((typeof valueO === 'string' || typeof valueO === 'number') && Array.isArray(valueS)) {
-                is = !valueS.includes(valueO);
+            // ['foo', 'bar'] > ['baz', 'taz']
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = subjectValue.length > resourceValue.length;
+            }
+            // 'foo' > 'bar'
+            else if (typeof subjectValue === 'string' && typeof resourceValue === 'string') {
+                is = subjectValue.length > resourceValue.length;
+            }
+        }
+        // length greater than
+        if (AbilityCondition_1.default.length_less_than.isEqual(this.condition)) {
+            // foo.bar < n
+            if (isValue(subjectValue) && typeof resourceValue === 'number') {
+                is = String(subjectValue).length < resourceValue;
+            }
+            // ['foo', 'bar'] < n
+            else if (Array.isArray(subjectValue) && typeof resourceValue === 'number') {
+                is = subjectValue.length < resourceValue;
+            }
+            // ['foo', 'bar'] < ['baz', 'taz']
+            else if (Array.isArray(subjectValue) && Array.isArray(resourceValue)) {
+                is = subjectValue.length < resourceValue.length;
+            }
+            // 'foo' < 'bar'
+            else if (typeof subjectValue === 'string' && typeof resourceValue === 'string') {
+                is = subjectValue.length < resourceValue.length;
             }
         }
         this.state = is ? AbilityMatch_1.default.match : AbilityMatch_1.default.mismatch;
@@ -817,29 +1079,44 @@ class AbilityRule {
     /**
      * Extract values from the resourceData
      * @param resourceData - The resourceData to extract values from
+     * @param environment - Environment data
      */
-    extractValues(resourceData) {
-        let leftSideValue;
-        let rightSideValue;
-        if (resourceData === null || typeof resourceData === 'undefined') {
+    extractValues(resourceData, environment) {
+        let subjectValue;
+        let resourceValue;
+        if ((resourceData === null || typeof resourceData === 'undefined') &&
+            (environment === null || typeof environment === 'undefined')) {
             return [NaN, NaN];
         }
-        const isPath = (str) => {
-            return typeof str === 'string' && str.match(/\./g) !== null;
-        };
-        if (isPath(this.subject)) {
-            leftSideValue = this.getDotNotationValue(resourceData, this.subject);
+        // left side resolve
+        if (this.subject.includes('.')) {
+            // if is environment
+            if (this.subject.startsWith('env.') && typeof environment !== 'undefined') {
+                subjectValue = this.getDotNotationValue(environment, this.subject.replace(/^env\./, ''));
+                // if is resource
+            }
+            else {
+                subjectValue = this.getDotNotationValue(resourceData, this.subject);
+            }
         }
         else {
-            leftSideValue = this.subject;
+            subjectValue = this.subject;
         }
-        if (isPath(this.resource)) {
-            rightSideValue = this.getDotNotationValue(resourceData, this.resource);
+        // right side resolve
+        if (typeof this.resource === 'string' && this.resource.includes('.')) {
+            // if is environment
+            if (this.resource.startsWith('env.') && typeof environment !== 'undefined') {
+                resourceValue = this.getDotNotationValue(environment, this.resource.replace(/^env\./, ''));
+            }
+            else {
+                // if is resource
+                resourceValue = this.getDotNotationValue(resourceData, this.resource);
+            }
         }
         else {
-            rightSideValue = this.resource;
+            resourceValue = this.resource;
         }
-        return [leftSideValue, rightSideValue];
+        return [subjectValue, resourceValue];
     }
     /**
      * Get the value of the object by dot notation
@@ -850,7 +1127,7 @@ class AbilityRule {
         const arr = desc.split('.');
         while (arr.length && resource) {
             const comp = arr.shift() || '';
-            const match = new RegExp('(.+)\\[([0-9]*)\\]').exec(comp);
+            const match = new RegExp('(.+)\\[([0-9]*)]').exec(comp);
             if (match !== null && match.length == 3) {
                 const arrayData = {
                     arrName: match[1],
@@ -869,31 +1146,36 @@ class AbilityRule {
         }
         return resource;
     }
-    static parse(config) {
-        const { id, name, subject, resource, condition } = config;
+    toString() {
+        return `AbilityRule: ${this.name} condition: ${this.condition.code} subject: "${this.subject?.toString()}" resource: "${this.resource?.toString()}"`;
+    }
+    static fromJSON(config) {
+        return AbilityJSONParser_1.AbilityJSONParser.parseRule(config);
+    }
+    static equals(subject, resource) {
         return new AbilityRule({
-            id,
-            name,
+            condition: AbilityCondition_1.default.equals,
             subject,
             resource,
-            condition: new AbilityCondition_1.default(condition),
         });
     }
-    /**
-     * Export the rule to config object
-     */
-    export() {
-        return {
-            id: this.id,
-            name: this.name,
-            subject: this.subject,
-            resource: this.resource,
-            condition: this.condition.code,
-        };
+    static notEquals(subject, resource) {
+        return new AbilityRule({
+            condition: AbilityCondition_1.default.not_equals,
+            subject,
+            resource,
+        });
     }
-    static equal(subject, resource) {
+    static contains(subject, resource) {
         return new AbilityRule({
-            condition: AbilityCondition_1.default.equal,
+            condition: AbilityCondition_1.default.contains,
+            subject,
+            resource,
+        });
+    }
+    static notContains(subject, resource) {
+        return new AbilityRule({
+            condition: AbilityCondition_1.default.not_contains,
             subject,
             resource,
         });
@@ -914,7 +1196,7 @@ class AbilityRule {
     }
     static notEqual(subject, resource) {
         return new AbilityRule({
-            condition: AbilityCondition_1.default.not_equal,
+            condition: AbilityCondition_1.default.not_equals,
             subject,
             resource,
         });
@@ -935,14 +1217,14 @@ class AbilityRule {
     }
     static moreThan(subject, resource) {
         return new AbilityRule({
-            condition: AbilityCondition_1.default.more_than,
+            condition: AbilityCondition_1.default.greater_than,
             subject,
             resource,
         });
     }
     static moreOrEqual(subject, resource) {
         return new AbilityRule({
-            condition: AbilityCondition_1.default.more_or_equal,
+            condition: AbilityCondition_1.default.greater_or_equal,
             subject,
             resource,
         });
@@ -954,7 +1236,7 @@ exports["default"] = AbilityRule;
 
 /***/ }),
 
-/***/ 402:
+/***/ 56:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
@@ -963,9 +1245,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AbilityRuleSet = void 0;
-const AbilityRule_1 = __importDefault(__webpack_require__(476));
-const AbilityCompare_1 = __importDefault(__webpack_require__(923));
-const AbilityMatch_1 = __importDefault(__webpack_require__(909));
+const AbilityCompare_1 = __importDefault(__webpack_require__(413));
+const AbilityMatch_1 = __importDefault(__webpack_require__(247));
+const AbilityJSONParser_1 = __webpack_require__(909);
 class AbilityRuleSet {
     state = AbilityMatch_1.default.pending;
     /**
@@ -989,7 +1271,7 @@ class AbilityRuleSet {
     id;
     constructor(params) {
         const { name, id, compareMethod } = params;
-        this.name = name || 'No name';
+        this.name = name || '';
         this.id = id || this.name;
         this.compareMethod = compareMethod;
     }
@@ -1001,50 +1283,43 @@ class AbilityRuleSet {
         rules.forEach(rule => this.addRule(rule));
         return this;
     }
-    check(resources) {
+    async check(resources, environment) {
         this.state = AbilityMatch_1.default.mismatch;
         if (!this.rules.length) {
             return this.state;
         }
-        const ruleCheckStates = this.rules.reduce((collect, rule) => {
-            return collect.concat(rule.check(resources));
-        }, []);
+        const ruleCheckStates = [];
+        for (const rule of this.rules) {
+            const state = await rule.check(resources, environment);
+            ruleCheckStates.push(state);
+            if (AbilityCompare_1.default.and.isEqual(this.compareMethod) && AbilityMatch_1.default.mismatch.isEqual(state)) {
+                return this.state; // mismatch
+            }
+            if (AbilityCompare_1.default.or.isEqual(this.compareMethod) && AbilityMatch_1.default.match.isEqual(state)) {
+                this.state = AbilityMatch_1.default.match;
+                return this.state;
+            }
+        }
         if (AbilityCompare_1.default.and.isEqual(this.compareMethod)) {
-            if (ruleCheckStates.every(ruleState => AbilityMatch_1.default.match.isEqual(ruleState))) {
+            if (ruleCheckStates.every(s => AbilityMatch_1.default.match.isEqual(s))) {
                 this.state = AbilityMatch_1.default.match;
             }
         }
         if (AbilityCompare_1.default.or.isEqual(this.compareMethod)) {
-            if (ruleCheckStates.some(ruleState => AbilityMatch_1.default.match.isEqual(ruleState))) {
+            if (ruleCheckStates.some(s => AbilityMatch_1.default.match.isEqual(s))) {
                 this.state = AbilityMatch_1.default.match;
             }
         }
         return this.state;
     }
+    toString() {
+        return `AbilityRuleSet: ${this.name} compareMethod: ${this.compareMethod.code}, rules: ${this.rules.map(rule => rule.toString()).join('\n')}`;
+    }
     /**
      * Parse the config JSON format to Group class instance
      */
-    static parse(config) {
-        const { id, name, rules, compareMethod } = config;
-        const ruleSet = new AbilityRuleSet({
-            compareMethod: new AbilityCompare_1.default(compareMethod),
-            name,
-            id,
-        });
-        // Adding rules if exists
-        if (rules && rules.length > 0) {
-            const abilityRules = rules.map(ruleConfig => AbilityRule_1.default.parse(ruleConfig));
-            ruleSet.addRules(abilityRules);
-        }
-        return ruleSet;
-    }
-    export() {
-        return {
-            id: this.id.toString(),
-            name: this.name.toString(),
-            compareMethod: this.compareMethod.code.toString(),
-            rules: this.rules.map(rule => rule.export()),
-        };
+    static fromJSON(config) {
+        return AbilityJSONParser_1.AbilityJSONParser.parseRuleSet(config);
     }
     static and(rules) {
         return new AbilityRuleSet({
@@ -1082,18 +1357,1207 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-__exportStar(__webpack_require__(19), exports);
-__exportStar(__webpack_require__(923), exports);
-__exportStar(__webpack_require__(261), exports);
-__exportStar(__webpack_require__(122), exports);
+__exportStar(__webpack_require__(301), exports);
+__exportStar(__webpack_require__(413), exports);
+__exportStar(__webpack_require__(167), exports);
+__exportStar(__webpack_require__(216), exports);
+__exportStar(__webpack_require__(247), exports);
+__exportStar(__webpack_require__(147), exports);
+__exportStar(__webpack_require__(278), exports);
+__exportStar(__webpack_require__(179), exports);
+__exportStar(__webpack_require__(634), exports);
+__exportStar(__webpack_require__(306), exports);
+__exportStar(__webpack_require__(56), exports);
+__exportStar(__webpack_require__(221), exports);
+__exportStar(__webpack_require__(941), exports);
+__exportStar(__webpack_require__(6), exports);
+__exportStar(__webpack_require__(829), exports);
 __exportStar(__webpack_require__(909), exports);
-__exportStar(__webpack_require__(189), exports);
-__exportStar(__webpack_require__(844), exports);
-__exportStar(__webpack_require__(277), exports);
-__exportStar(__webpack_require__(668), exports);
-__exportStar(__webpack_require__(476), exports);
-__exportStar(__webpack_require__(402), exports);
-__exportStar(__webpack_require__(363), exports);
+__exportStar(__webpack_require__(577), exports);
+__exportStar(__webpack_require__(10), exports);
+__exportStar(__webpack_require__(325), exports);
+
+
+/***/ }),
+
+/***/ 10:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityDSLLexer = void 0;
+const AbilityDSLToken_1 = __webpack_require__(325);
+class AbilityDSLLexer {
+    input;
+    pos = 0;
+    tokens = [];
+    line = 1;
+    column = 1;
+    // Список ключевых слов
+    keywords = new Set([
+        'if',
+        'all',
+        'any',
+        'of',
+        'permit',
+        'allow',
+        'deny',
+        'forbidden',
+        'true',
+        'false',
+        'null',
+        'contains',
+        'includes',
+        'length',
+        'has',
+        'in',
+        'gt',
+        'lt',
+        'gte',
+        'lte',
+        'equals',
+        'greater',
+        'less',
+        'not',
+        'is',
+        'or',
+        'than',
+    ]);
+    constructor(input) {
+        this.input = input;
+    }
+    tokenize() {
+        while (!this.isAtEnd()) {
+            this.skipWhitespace();
+            if (this.isAtEnd())
+                break;
+            const char = this.peek();
+            if (char === '#') {
+                this.tokens.push(this.readComment());
+                continue;
+            }
+            if (char === '"' || char === "'") {
+                this.tokens.push(this.readString());
+                continue;
+            }
+            if (this.isDigit(char)) {
+                this.tokens.push(this.readNumber());
+                continue;
+            }
+            if (this.isSymbol(char)) {
+                this.tokens.push(this.readSymbol());
+                continue;
+            }
+            if (this.isAlpha(char)) {
+                this.tokens.push(this.readWord());
+                continue;
+            }
+            throw new Error(`Unexpected character '${char}' at ${this.line}:${this.column}`);
+        }
+        this.tokens.push(new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.EOF, '', this.line, this.column));
+        return this.tokens;
+    }
+    readComment() {
+        const startLine = this.line;
+        const startColumn = this.column;
+        this.advance(); // skip '#'
+        let value = '';
+        while (!this.isAtEnd() && !this.isNewline()) {
+            value += this.advance();
+        }
+        return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.COMMENT, value.trim(), startLine, startColumn);
+    }
+    readString() {
+        const startLine = this.line;
+        const startColumn = this.column;
+        const quote = this.advance();
+        let value = '';
+        let escaped = false;
+        while (!this.isAtEnd()) {
+            const char = this.advance();
+            if (escaped) {
+                value += char;
+                escaped = false;
+                continue;
+            }
+            if (char === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (char === quote) {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.STRING, value, startLine, startColumn);
+            }
+            value += char;
+        }
+        throw new Error(`Unterminated string at ${startLine}:${startColumn}`);
+    }
+    readNumber() {
+        const startLine = this.line;
+        const startColumn = this.column;
+        const start = this.pos;
+        while (!this.isAtEnd() && this.isDigit(this.peek())) {
+            this.advance();
+        }
+        const value = this.input.slice(start, this.pos);
+        return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.NUMBER, value, startLine, startColumn);
+    }
+    readSymbol() {
+        const startLine = this.line;
+        const startColumn = this.column;
+        const char = this.advance();
+        switch (char) {
+            case '.':
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.DOT, char, startLine, startColumn);
+            case ':':
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.COLON, char, startLine, startColumn);
+            case ',':
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.COMMA, char, startLine, startColumn);
+            case '[':
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.LBRACKET, char, startLine, startColumn);
+            case ']':
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.RBRACKET, char, startLine, startColumn);
+            case '>':
+                if (this.peek() === '=') {
+                    this.advance();
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '>=', startLine, startColumn);
+                }
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '>', startLine, startColumn);
+            case '<':
+                if (this.peek() === '=') {
+                    this.advance();
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '<=', startLine, startColumn);
+                }
+                if (this.peek() === '>') {
+                    this.advance();
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '<>', startLine, startColumn);
+                }
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '<', startLine, startColumn);
+            case '=':
+                if (this.peek() === '=') {
+                    this.advance();
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '==', startLine, startColumn);
+                }
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '=', startLine, startColumn);
+            case '!':
+                if (this.peek() === '=') {
+                    this.advance();
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.SYMBOL, '!=', startLine, startColumn);
+                }
+                throw new Error(`Unexpected symbol '!' at ${this.line}:${this.column}`);
+            default:
+                throw new Error(`Unknown symbol '${char}' at ${this.line}:${this.column}`);
+        }
+    }
+    readWord() {
+        const startLine = this.line;
+        const startColumn = this.column;
+        const start = this.pos;
+        // Первый сегмент
+        while (!this.isAtEnd() && /[a-zA-Z0-9_*]/.test(this.peek())) {
+            this.advance();
+        }
+        // Сегменты через точку
+        while (!this.isAtEnd() && this.peek() === '.') {
+            this.advance(); // dot
+            if (!/[a-zA-Z_*]/.test(this.peek())) {
+                break;
+            }
+            while (!this.isAtEnd() && /[a-zA-Z0-9_*]/.test(this.peek())) {
+                this.advance();
+            }
+        }
+        const word = this.input.slice(start, this.pos);
+        // Если есть точка — это путь (identifier или permission)
+        if (word.includes('.')) {
+            const last = this.tokens[this.tokens.length - 1];
+            if (last?.code === AbilityDSLToken_1.AbilityDSLToken.EFFECT) {
+                if (word.startsWith('permission.')) {
+                    return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.PERMISSION, word, startLine, startColumn);
+                }
+            }
+            return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER, word, startLine, startColumn);
+        }
+        // Ключевые слова
+        if (this.keywords.has(word)) {
+            // Эффекты
+            if (word === 'permit' || word === 'allow') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.EFFECT, 'permit', startLine, startColumn);
+            }
+            if (word === 'deny' || word === 'forbidden') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.EFFECT, 'deny', startLine, startColumn);
+            }
+            // Групповые ключевые слова
+            if (word === 'all') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.ALL, word, startLine, startColumn);
+            }
+            if (word === 'any') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.ANY, word, startLine, startColumn);
+            }
+            if (word === 'of') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.OF, word, startLine, startColumn);
+            }
+            if (word === 'if') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.IF, word, startLine, startColumn);
+            }
+            // Булевы и null
+            if (word === 'true' || word === 'false') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.BOOLEAN, word, startLine, startColumn);
+            }
+            if (word === 'null') {
+                return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.NULL, word, startLine, startColumn);
+            }
+            // Остальные ключевые слова (contains, in, equals, greater, less, not, is, or, than, equal)
+            return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.KEYWORD, word, startLine, startColumn);
+        }
+        // Если после EFFECT и нет точки — действие (например, "create")
+        const lastToken = this.tokens[this.tokens.length - 1];
+        if (lastToken?.code === AbilityDSLToken_1.AbilityDSLToken.EFFECT) {
+            return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.PERMISSION, word, startLine, startColumn);
+        }
+        // Обычный идентификатор
+        return new AbilityDSLToken_1.AbilityDSLToken(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER, word, startLine, startColumn);
+    }
+    skipWhitespace() {
+        while (!this.isAtEnd() && /\s/.test(this.peek())) {
+            this.advance();
+        }
+    }
+    isDigit(char) {
+        return char >= '0' && char <= '9';
+    }
+    isAlpha(char) {
+        return /[a-zA-Z_]/.test(char);
+    }
+    isSymbol(char) {
+        return ['.', ':', ',', '[', ']', '>', '<', '=', '!'].includes(char);
+    }
+    isNewline() {
+        return this.peek() === '\n';
+    }
+    peek() {
+        return this.input[this.pos];
+    }
+    advance() {
+        const ch = this.input[this.pos++];
+        if (ch === '\n') {
+            this.line++;
+            this.column = 1;
+        }
+        else {
+            this.column++;
+        }
+        return ch;
+    }
+    isAtEnd() {
+        return this.pos >= this.input.length;
+    }
+}
+exports.AbilityDSLLexer = AbilityDSLLexer;
+
+
+/***/ }),
+
+/***/ 577:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityDSLParser = void 0;
+const AbilityCompare_1 = __importDefault(__webpack_require__(413));
+const AbilityCondition_1 = __importDefault(__webpack_require__(167));
+const AbilityPolicy_1 = __importDefault(__webpack_require__(278));
+const AbilityPolicyEffect_1 = __importDefault(__webpack_require__(179));
+const AbilityRule_1 = __importDefault(__webpack_require__(306));
+const AbilityRuleSet_1 = __importDefault(__webpack_require__(56));
+const AbilityDSLLexer_1 = __webpack_require__(10);
+const AbilityDSLToken_1 = __webpack_require__(325);
+const AbilityDSLSyntaxError_1 = __webpack_require__(883);
+/**
+ * Parser for the Ability DSL.
+ *
+ * Converts a DSL string into one or more AbilityPolicy instances.
+ * The grammar follows the structure:
+ *
+ *   <effect> <permission> if <group> [ <group> ... ]
+ *
+ * where <group> is either "all of:" or "any of:", followed by a colon,
+ * and then a list of rules (one per line).
+ *
+ * Each rule is: <identifier> <operator> <value>
+ *
+ * Operators can be simple (equals, contains, in) or
+ * composed (is null, is not null, greater than, less than or equal, etc.).
+ */
+class AbilityDSLParser {
+    dsl;
+    tokens = [];
+    pos = 0;
+    annotationBuffer = {
+        name: null,
+        description: null,
+    };
+    constructor(dsl) {
+        this.dsl = dsl;
+    }
+    /**
+     * Main entry point: tokenize the input and parse all policies.
+     * @returns Array of AbilityPolicy instances.
+     */
+    parse() {
+        // Tokenize the entire DSL string.
+        this.tokens = new AbilityDSLLexer_1.AbilityDSLLexer(this.dsl).tokenize();
+        this.pos = 0;
+        const policies = [];
+        // Keep parsing until we've consumed all tokens.
+        while (!this.isAtEnd()) {
+            this.consumeLeadingComments();
+            // Every policy must start with an EFFECT token.
+            if (!this.isStartOfPolicy()) {
+                const token = this.peek();
+                this.syntaxError(`Expected policy, got ${token.code}.`, token, ['EFFECT']);
+            }
+            policies.push(this.parsePolicy());
+        }
+        return policies;
+    }
+    // -------------------------------------------------------------------------
+    // #region Policy parsing
+    // -------------------------------------------------------------------------
+    /**
+     * Parses a single policy from the current token position.
+     *
+     * Grammar:
+     *   policy = EFFECT PERMISSION IF (ALL | ANY) COLON ruleSets
+     */
+    parsePolicy() {
+        this.consumeLeadingComments();
+        const meta = this.takeAnnotations();
+        // Effect: "permit" or "deny"
+        const effectToken = this.consume(AbilityDSLToken_1.AbilityDSLToken.EFFECT, 'Expected effect');
+        const effect = effectToken.value;
+        // Permission: e.g. "order.update"
+        const permissionToken = this.consume(AbilityDSLToken_1.AbilityDSLToken.PERMISSION, 'Expected permission');
+        const permission = permissionToken.value;
+        if (!permission.startsWith('permission.')) {
+            return this.syntaxError(`Unexpected token. The permission key, must be starts with prefix \`permission.\`, but got \`${permission}\`.\nDid you mean \`permission.${permission}\`?`, permissionToken);
+        }
+        // "if" keyword
+        this.consume(AbilityDSLToken_1.AbilityDSLToken.IF, 'Expected "if"');
+        // Group selector: "all" or "any" – determines how the top‑level rule sets are combined.
+        const compareToken = this.consumeOneOf([AbilityDSLToken_1.AbilityDSLToken.ALL, AbilityDSLToken_1.AbilityDSLToken.ANY], 'Expected "all" or "any"');
+        const compareMethod = compareToken.code === AbilityDSLToken_1.AbilityDSLToken.ALL ? AbilityCompare_1.default.and : AbilityCompare_1.default.or;
+        // Colon after the group keyword
+        this.consume(AbilityDSLToken_1.AbilityDSLToken.COLON, 'Expected ":"');
+        // Parse the list of rule sets (each "all of:" or "any of:" block)
+        const ruleSets = this.parseRuleSets(compareMethod);
+        // Construct the policy instance.
+        return new AbilityPolicy_1.default({
+            id: `${effect}:${permission}:${Math.random()}`,
+            name: meta.name ?? `${effect} ${permission}`,
+            permission: permission.replace(/^permission\./, ''),
+            effect: effect === 'permit' ? AbilityPolicyEffect_1.default.permit : AbilityPolicyEffect_1.default.deny,
+            compareMethod,
+        }).addRuleSets(ruleSets);
+    }
+    // -------------------------------------------------------------------------
+    // #region Rule set parsing (groups of rules)
+    // -------------------------------------------------------------------------
+    /**
+     * Parses a sequence of rule sets (groups) until a new policy starts or EOF.
+     */
+    parseRuleSets(policyCompareMethod) {
+        const sets = [];
+        while (!this.isAtEnd() && !this.isStartOfPolicy()) {
+            this.consumeLeadingComments();
+            // Если начинается новая группа — парсим её
+            if (this.isStartOfGroup()) {
+                sets.push(this.parseGroup());
+                continue;
+            }
+            // Иначе — implicit group (all-of по умолчанию)
+            const meta = this.takeAnnotations();
+            const group = new AbilityRuleSet_1.default({
+                compareMethod: policyCompareMethod,
+                name: meta.name,
+            });
+            // Читаем правила implicit-группы
+            while (!this.isAtEnd()) {
+                this.consumeLeadingComments();
+                if (this.isStartOfGroup() || this.isStartOfPolicy()) {
+                    break;
+                }
+                if (this.check(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER)) {
+                    group.addRule(this.parseRule());
+                }
+                else {
+                    this.syntaxError(`Unexpected token in implicit group: ${this.peek().code}`, this.peek());
+                }
+            }
+            sets.push(group);
+        }
+        return sets;
+    }
+    /**
+     * Parses a single group, e.g. "all of:" or "any of:", and returns a RuleSet.
+     */
+    parseGroup() {
+        this.consumeLeadingComments();
+        const meta = this.takeAnnotations();
+        const compareToken = this.consumeOneOf([AbilityDSLToken_1.AbilityDSLToken.ALL, AbilityDSLToken_1.AbilityDSLToken.ANY], 'Expected "all" or "any"');
+        const compareMethod = compareToken.code === AbilityDSLToken_1.AbilityDSLToken.ALL ? AbilityCompare_1.default.and : AbilityCompare_1.default.or;
+        if (this.check(AbilityDSLToken_1.AbilityDSLToken.OF)) {
+            this.advance();
+        }
+        this.consume(AbilityDSLToken_1.AbilityDSLToken.COLON, 'Expected ":"');
+        const group = new AbilityRuleSet_1.default({ compareMethod, name: meta.name });
+        while (!this.isAtEnd()) {
+            this.consumeLeadingComments();
+            if (this.isStartOfGroup() || this.isStartOfPolicy()) {
+                break;
+            }
+            if (this.check(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER)) {
+                group.addRule(this.parseRule());
+            }
+            else {
+                this.syntaxError(`Unexpected token in group: ${this.peek().code}`, this.peek());
+            }
+        }
+        return group;
+    }
+    // -------------------------------------------------------------------------
+    // #region Rule parsing
+    // -------------------------------------------------------------------------
+    /**
+     * Parses a single rule: subject operator value
+     */
+    parseRule() {
+        this.consumeLeadingComments();
+        const meta = this.takeAnnotations();
+        if (!this.check(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER)) {
+            this.syntaxError(`Expected identifier, got ${this.peek().code}`, this.peek());
+        }
+        // Subject (e.g., "user.roles")
+        const subject = this.consume(AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER, 'Expected field').value;
+        // Operator (e.g., "contains", "equals", "is not null")
+        const { condition, operator } = this.parseConditionOperator();
+        let resource;
+        let beforePos = this.pos;
+        // Special operators that don't consume a value token.
+        if (operator === AbilityDSLToken_1.AbilityDSLToken.EQ_NULL ||
+            operator === AbilityDSLToken_1.AbilityDSLToken.NOT_EQ_NULL ||
+            operator === AbilityDSLToken_1.AbilityDSLToken.NULL) {
+            resource = null;
+        }
+        else {
+            beforePos = this.pos;
+            resource = this.parseValue();
+        }
+        // Checking that there are no extra tokens after the value
+        // (skip comments)
+        this.consumeLeadingComments();
+        const resourceToken = this.tokens[beforePos];
+        if (typeof resource === 'string' &&
+            resourceToken.code === AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER &&
+            !resourceToken.value.includes('.')) {
+            this.syntaxError(`Expected comparison operator or value, got \`${resource}\``, this.tokens[beforePos], [AbilityDSLToken_1.AbilityDSLToken.KEYWORD]);
+        }
+        return new AbilityRule_1.default({
+            subject,
+            resource,
+            condition,
+            name: meta.name,
+        });
+    }
+    // -------------------------------------------------------------------------
+    // #region Operator parsing
+    // -------------------------------------------------------------------------
+    /**
+     * Parses the comparison operator part of a rule.
+     * Returns both the resulting AbilityCondition and the token type that was consumed.
+     */
+    parseConditionOperator() {
+        const savedPos = this.pos;
+        // "length equals"
+        if (this.matchWord('length') && this.matchWord('equals')) {
+            return { condition: AbilityCondition_1.default.length_equals, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_EQ };
+        }
+        this.pos = savedPos;
+        // "length ="
+        if (this.matchWord('length') && this.matchSymbol('=')) {
+            return { condition: AbilityCondition_1.default.length_equals, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_EQ };
+        }
+        this.pos = savedPos;
+        // "length greater than"
+        if (this.matchWord('length') && this.matchWord('greater') && this.matchWord('than')) {
+            return { condition: AbilityCondition_1.default.length_greater_than, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_GT };
+        }
+        this.pos = savedPos;
+        // "length >"
+        if (this.matchWord('length') && this.matchSymbol('>')) {
+            return { condition: AbilityCondition_1.default.length_greater_than, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_GT };
+        }
+        this.pos = savedPos;
+        // "length less than"
+        if (this.matchWord('length') && this.matchWord('less') && this.matchWord('than')) {
+            return { condition: AbilityCondition_1.default.length_less_than, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_LT };
+        }
+        this.pos = savedPos;
+        // "length <"
+        if (this.matchWord('length') && this.matchSymbol('<')) {
+            return { condition: AbilityCondition_1.default.length_less_than, operator: AbilityDSLToken_1.AbilityDSLToken.LEN_LT };
+        }
+        this.pos = savedPos;
+        // "greater than or equal"
+        if (this.matchWord('greater') &&
+            this.matchWord('than') &&
+            this.matchWord('or') &&
+            this.matchWord('equal')) {
+            return { condition: AbilityCondition_1.default.greater_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.GTE };
+        }
+        this.pos = savedPos;
+        // greater than
+        if (this.matchWord('greater') && this.matchWord('than')) {
+            return { condition: AbilityCondition_1.default.greater_than, operator: AbilityDSLToken_1.AbilityDSLToken.GT };
+        }
+        this.pos = savedPos;
+        // less than or equal
+        if (this.matchWord('less') &&
+            this.matchWord('than') &&
+            this.matchWord('or') &&
+            this.matchWord('equal')) {
+            return { condition: AbilityCondition_1.default.less_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.LTE };
+        }
+        this.pos = savedPos;
+        // less than
+        if (this.matchWord('less') && this.matchWord('than')) {
+            return { condition: AbilityCondition_1.default.less_than, operator: AbilityDSLToken_1.AbilityDSLToken.LT };
+        }
+        this.pos = savedPos;
+        // "not contains"
+        if (this.matchWord('not') && this.matchWord('contains')) {
+            return {
+                condition: AbilityCondition_1.default.not_contains,
+                operator: AbilityDSLToken_1.AbilityDSLToken.NOT_CONTAINS,
+            };
+        }
+        this.pos = savedPos;
+        // "not includes"
+        if (this.matchWord('not') && this.matchWord('includes')) {
+            return {
+                condition: AbilityCondition_1.default.not_contains,
+                operator: AbilityDSLToken_1.AbilityDSLToken.NOT_CONTAINS,
+            };
+        }
+        this.pos = savedPos;
+        // "not includes"
+        if (this.matchWord('not') && this.matchWord('has')) {
+            return {
+                condition: AbilityCondition_1.default.not_contains,
+                operator: AbilityDSLToken_1.AbilityDSLToken.NOT_CONTAINS,
+            };
+        }
+        this.pos = savedPos;
+        // "is equals"
+        if (this.matchWord('is') && this.matchWord('equals')) {
+            return { condition: AbilityCondition_1.default.equals, operator: AbilityDSLToken_1.AbilityDSLToken.EQ };
+        }
+        this.pos = savedPos;
+        // not equal
+        if (this.matchWord('not') && this.matchWord('equals')) {
+            return { condition: AbilityCondition_1.default.not_equals, operator: AbilityDSLToken_1.AbilityDSLToken.NOT_EQ };
+        }
+        this.pos = savedPos;
+        // is not equals
+        if (this.matchWord('is') && this.matchWord('not') && this.matchWord('equals')) {
+            return { condition: AbilityCondition_1.default.not_equals, operator: AbilityDSLToken_1.AbilityDSLToken.NOT_EQ };
+        }
+        this.pos = savedPos;
+        // is in
+        if (this.matchWord('is') && this.matchWord('in')) {
+            return { condition: AbilityCondition_1.default.in, operator: AbilityDSLToken_1.AbilityDSLToken.IN };
+        }
+        this.pos = savedPos;
+        // not in
+        if (this.matchWord('not') && this.matchWord('in')) {
+            return { condition: AbilityCondition_1.default.not_in, operator: AbilityDSLToken_1.AbilityDSLToken.NOT_IN };
+        }
+        this.pos = savedPos;
+        // is not null
+        if (this.matchWord('is') && this.matchWord('not')) {
+            if (this.check(AbilityDSLToken_1.AbilityDSLToken.NULL)) {
+                this.advance();
+                return {
+                    condition: AbilityCondition_1.default.not_equals,
+                    operator: AbilityDSLToken_1.AbilityDSLToken.NOT_EQ_NULL,
+                };
+            }
+        }
+        this.pos = savedPos;
+        // is null
+        if (this.matchWord('is') && this.matchWord('null')) {
+            if (this.check(AbilityDSLToken_1.AbilityDSLToken.NULL)) {
+                this.advance();
+                return {
+                    condition: AbilityCondition_1.default.equals,
+                    operator: AbilityDSLToken_1.AbilityDSLToken.EQ_NULL,
+                };
+            }
+        }
+        this.pos = savedPos;
+        // Single token (symbol or keyword)
+        const token = this.peek();
+        if (token.code !== AbilityDSLToken_1.AbilityDSLToken.SYMBOL &&
+            token.code !== AbilityDSLToken_1.AbilityDSLToken.KEYWORD &&
+            token.code !== AbilityDSLToken_1.AbilityDSLToken.NULL) {
+            this.syntaxError(`Expected comparison operator, got \`${token.value}\``, token, [
+                AbilityDSLToken_1.AbilityDSLToken.SYMBOL,
+                AbilityDSLToken_1.AbilityDSLToken.KEYWORD,
+                AbilityDSLToken_1.AbilityDSLToken.NULL,
+            ]);
+        }
+        this.advance();
+        switch (token.code) {
+            case AbilityDSLToken_1.AbilityDSLToken.SYMBOL:
+                if (token.value === '=' || token.value === '==')
+                    return { condition: AbilityCondition_1.default.equals, operator: AbilityDSLToken_1.AbilityDSLToken.EQ };
+                if (token.value === '!=' || token.value === '<>')
+                    return { condition: AbilityCondition_1.default.not_equals, operator: AbilityDSLToken_1.AbilityDSLToken.NOT_EQ };
+                if (token.value === '>')
+                    return { condition: AbilityCondition_1.default.greater_than, operator: AbilityDSLToken_1.AbilityDSLToken.GT };
+                if (token.value === '<')
+                    return { condition: AbilityCondition_1.default.less_than, operator: AbilityDSLToken_1.AbilityDSLToken.LT };
+                if (token.value === '>=')
+                    return { condition: AbilityCondition_1.default.greater_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.GTE };
+                if (token.value === '<=')
+                    return { condition: AbilityCondition_1.default.less_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.LTE };
+                break;
+            case AbilityDSLToken_1.AbilityDSLToken.KEYWORD:
+                if (token.value === 'contains' || token.value === 'includes' || token.value === 'has')
+                    return { condition: AbilityCondition_1.default.contains, operator: AbilityDSLToken_1.AbilityDSLToken.CONTAINS };
+                if (token.value === 'in')
+                    return { condition: AbilityCondition_1.default.in, operator: AbilityDSLToken_1.AbilityDSLToken.IN };
+                if (token.value === 'equals')
+                    return { condition: AbilityCondition_1.default.equals, operator: AbilityDSLToken_1.AbilityDSLToken.EQ };
+                if (token.value === 'gte') {
+                    return { condition: AbilityCondition_1.default.greater_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.GTE };
+                }
+                if (token.value === 'greater' || token.value === 'gt') {
+                    // If we come here, it means "greater" without "than" – treat as '>'
+                    return { condition: AbilityCondition_1.default.greater_than, operator: AbilityDSLToken_1.AbilityDSLToken.GT };
+                }
+                if (token.value === 'less' || token.value === 'lt') {
+                    return { condition: AbilityCondition_1.default.less_than, operator: AbilityDSLToken_1.AbilityDSLToken.LT };
+                }
+                if (token.value === 'lte') {
+                    return { condition: AbilityCondition_1.default.less_or_equal, operator: AbilityDSLToken_1.AbilityDSLToken.LTE };
+                }
+                if (token.value === 'is') {
+                    // "is" alone -> equals
+                    return { condition: AbilityCondition_1.default.equals, operator: AbilityDSLToken_1.AbilityDSLToken.EQ };
+                }
+                break;
+            default:
+                break;
+        }
+        return this.syntaxError(`Unexpected operator token \`${token.value}\``, token, [
+            AbilityDSLToken_1.AbilityDSLToken.SYMBOL,
+            AbilityDSLToken_1.AbilityDSLToken.KEYWORD,
+        ]);
+    }
+    /**
+     * Helper to match and consume a specific word token (KEYWORD or IDENTIFIER).
+     * @param word The exact string to look for.
+     * @returns True if the next token has that value.
+     */
+    matchWord(word) {
+        if (this.isAtEnd()) {
+            return false;
+        }
+        const token = this.peek();
+        if ((token.code === AbilityDSLToken_1.AbilityDSLToken.KEYWORD || token.code === AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER) &&
+            token.value === word) {
+            this.advance();
+            return true;
+        }
+        return false;
+    }
+    matchSymbol(symbol) {
+        if (this.isAtEnd())
+            return false;
+        const token = this.peek();
+        if (token.code === AbilityDSLToken_1.AbilityDSLToken.SYMBOL && token.value === symbol) {
+            this.advance();
+            return true;
+        }
+        return false;
+    }
+    // -------------------------------------------------------------------------
+    // #region Value parsing (literals, arrays, identifiers)
+    // -------------------------------------------------------------------------
+    /**
+     * Parses a resource value. Can be a string literal, number, boolean,
+     * null, a path (identifier), or an array.
+     */
+    parseValue() {
+        // Arrays start with a left bracket
+        if (this.check(AbilityDSLToken_1.AbilityDSLToken.LBRACKET)) {
+            this.advance();
+            return this.parseArray();
+        }
+        // Ensure we are not about to read a structural token as a value.
+        const token = this.peek();
+        if (token.code === AbilityDSLToken_1.AbilityDSLToken.ALL ||
+            token.code === AbilityDSLToken_1.AbilityDSLToken.ANY ||
+            token.code === AbilityDSLToken_1.AbilityDSLToken.EFFECT) {
+            this.syntaxError(`Unexpected ${token.code} in value position`, token);
+        }
+        this.advance();
+        // CHECK THIS SWITCH COMPARE
+        switch (token.code) {
+            case AbilityDSLToken_1.AbilityDSLToken.STRING:
+                return token.value;
+            case AbilityDSLToken_1.AbilityDSLToken.NUMBER:
+                return Number(token.value);
+            case AbilityDSLToken_1.AbilityDSLToken.BOOLEAN:
+                return token.value === 'true';
+            case AbilityDSLToken_1.AbilityDSLToken.NULL:
+                return null;
+            case AbilityDSLToken_1.AbilityDSLToken.IDENTIFIER:
+                return token.value;
+            default: {
+                this.syntaxError(`Unexpected value token "${token.value}"`, token ?? this.tokens[this.tokens.length - 1], [AbilityDSLToken_1.AbilityDSLToken.KEYWORD]);
+            }
+        }
+    }
+    /**
+     * Parses an array literal: [ <value>, <value>, ... ]
+     * The opening bracket has already been consumed.
+     */
+    parseArray() {
+        const arr = [];
+        // Handle empty array
+        if (this.check(AbilityDSLToken_1.AbilityDSLToken.RBRACKET)) {
+            this.advance();
+            return arr;
+        }
+        while (!this.isAtEnd() && !this.check(AbilityDSLToken_1.AbilityDSLToken.RBRACKET)) {
+            const value = this.parseValue();
+            // Flatten nested arrays if they appear (though grammar doesn't currently allow nesting).
+            if (Array.isArray(value)) {
+                arr.push(...value);
+            }
+            else if (typeof value === 'string' ||
+                typeof value === 'number' ||
+                typeof value === 'boolean') {
+                arr.push(value);
+            }
+            else if (value === null) {
+                // Null is allowed in arrays? Currently, we throw.
+                this.syntaxError('Unexpected null in array', this.peek());
+            }
+            // Optional comma between elements
+            if (this.check(AbilityDSLToken_1.AbilityDSLToken.COMMA)) {
+                this.advance();
+            }
+        }
+        this.consume(AbilityDSLToken_1.AbilityDSLToken.RBRACKET, 'Expected "]"');
+        return arr;
+    }
+    // -------------------------------------------------------------------------
+    // #region Annotations and comments
+    // -------------------------------------------------------------------------
+    consumeLeadingComments() {
+        while (this.check(AbilityDSLToken_1.AbilityDSLToken.COMMENT)) {
+            const token = this.advance();
+            this.processCommentToken(token);
+        }
+    }
+    processCommentToken(token) {
+        const text = token.value.trim();
+        if (text.startsWith('@name ')) {
+            this.annotationBuffer.name = text.slice(6).trim();
+        }
+        if (text.startsWith('@description ')) {
+            this.annotationBuffer.description = text.slice(13).trim();
+        }
+    }
+    takeAnnotations() {
+        const meta = { ...this.annotationBuffer };
+        this.annotationBuffer = {
+            name: null,
+            description: null,
+        };
+        return meta;
+    }
+    // -------------------------------------------------------------------------
+    // #region Errors
+    // -------------------------------------------------------------------------
+    syntaxError(details, token, expected) {
+        const lines = this.dsl.split(/\r?\n/);
+        const lineIdx = token.line - 1;
+        const lineBefore = lineIdx > 0 ? lines[lineIdx - 1] : '';
+        const current = lines[lineIdx];
+        const linesAfter = lineIdx + 1 < lines.length ? lines[lineIdx + 1] : '';
+        const wave = ' '.repeat(Math.max(0, token.column - 1)) + '~'.repeat(token.value.length);
+        const lineNumWidth = String(token.line + 1).length;
+        const num = (n) => String(n).padStart(lineNumWidth, ' ');
+        let context = '';
+        if (lineBefore.trim() !== '') {
+            context += `${num(token.line - 1)} | ${lineBefore}\n`;
+        }
+        context += `${num(token.line)} | ${current}\n`;
+        context += `${' '.repeat(lineNumWidth)} | ${wave}\n`;
+        if (linesAfter.trim() !== '') {
+            context += `${num(token.line + 1)} | ${linesAfter}`;
+        }
+        let finalDetails = details;
+        if (expected && expected?.length > 0) {
+            const actual = token.value;
+            const suggestion = this.suggest(actual, expected);
+            const detailsMsg = `${details}\nDetails: Unexpected value token \`${actual}\``;
+            finalDetails = suggestion ? `${detailsMsg} Did you mean \`${suggestion}\`?` : detailsMsg;
+        }
+        throw new AbilityDSLSyntaxError_1.AbilityDSLSyntaxError(token.line, token.column, context + '\n', finalDetails);
+    }
+    getLine(lineNumber) {
+        return this.dsl.split(/\r?\n/)[lineNumber - 1] ?? '';
+    }
+    suggest(actual, expectedTypes) {
+        const candidates = [];
+        for (const type of expectedTypes) {
+            candidates.push(type);
+        }
+        const uniqueCandidates = [...new Set(candidates)];
+        let best = null;
+        let bestDist = 3;
+        for (const candidate of uniqueCandidates) {
+            const d = this.levenshteinDistance(actual.toLowerCase(), candidate.toLowerCase());
+            if (d < bestDist) {
+                bestDist = d;
+                best = candidate;
+            }
+        }
+        return best;
+    }
+    levenshteinDistance(a, b) {
+        const matrix = Array(b.length + 1)
+            .fill(null)
+            .map(() => Array(a.length + 1).fill(null));
+        for (let i = 0; i <= a.length; i++)
+            matrix[0][i] = i;
+        for (let j = 0; j <= b.length; j++)
+            matrix[j][0] = j;
+        for (let j = 1; j <= b.length; j++) {
+            for (let i = 1; i <= a.length; i++) {
+                const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+                matrix[j][i] = Math.min(matrix[j][i - 1] + 1, matrix[j - 1][i] + 1, matrix[j - 1][i - 1] + cost);
+            }
+        }
+        return matrix[b.length][a.length];
+    }
+    // -------------------------------------------------------------------------
+    // #region Helper / lookahead methods
+    // -------------------------------------------------------------------------
+    consumeOneOf(types, message) {
+        const token = this.peek();
+        for (const t of types) {
+            if (token && token.code === t) {
+                return this.advance();
+            }
+        }
+        const expected = types.map(t => t).join(', ');
+        const actual = token ? token.value : AbilityDSLToken_1.AbilityDSLToken.EOF;
+        const suggestion = this.suggest(actual, types);
+        const details = `${message}\nDetails: Unexpected token \`${actual}\`, expected one of: ${expected}.`;
+        const finalMsg = suggestion ? `${details} Did you mean \`${suggestion}\`?` : details;
+        this.syntaxError(finalMsg, token ?? this.tokens[this.tokens.length - 1]);
+    }
+    consume(type, message) {
+        const token = this.peek();
+        if (token && token.code === type) {
+            return this.advance();
+        }
+        const expected = type;
+        const actual = token ? token.value : AbilityDSLToken_1.AbilityDSLToken.EOF;
+        const suggestion = this.suggest(actual, [type]);
+        const details = `${message}\nDetails: Unexpected token \`${actual}\`, expected "${expected}".`;
+        const finalMsg = suggestion ? `${details} Did you mean \`${suggestion}\`?` : details;
+        this.syntaxError(finalMsg, token ?? this.tokens[this.tokens.length - 1]);
+    }
+    check(type) {
+        if (this.isAtEnd())
+            return false;
+        return this.peek().code === type;
+    }
+    isStartOfPolicy() {
+        return this.check(AbilityDSLToken_1.AbilityDSLToken.EFFECT);
+    }
+    isStartOfGroup() {
+        return this.check(AbilityDSLToken_1.AbilityDSLToken.ALL) || this.check(AbilityDSLToken_1.AbilityDSLToken.ANY);
+    }
+    advance() {
+        return this.tokens[this.pos++];
+    }
+    peek() {
+        return this.tokens[this.pos];
+    }
+    isAtEnd() {
+        return this.peek().code === AbilityDSLToken_1.AbilityDSLToken.EOF;
+    }
+}
+exports.AbilityDSLParser = AbilityDSLParser;
+
+
+/***/ }),
+
+/***/ 883:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityDSLSyntaxError = void 0;
+class AbilityDSLSyntaxError extends Error {
+    line;
+    column;
+    context;
+    details;
+    _formattedMessage;
+    _originalStack;
+    constructor(line, column, context, // строка DSL + ^ + соседние строки
+    details) {
+        super(details.split('\n')[0]); // message = только первая строка
+        this.line = line;
+        this.column = column;
+        this.context = context;
+        this.details = details;
+        this.name = 'AbilityDSLSyntaxError';
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, AbilityDSLSyntaxError);
+        }
+        this._originalStack = this.stack;
+        this._formattedMessage = this.formatMessage();
+        Object.defineProperty(this, 'stack', {
+            get: () => this._formattedMessage,
+            configurable: true,
+        });
+    }
+    static supportsColor() {
+        return typeof process !== 'undefined' && process.stdout?.isTTY;
+    }
+    formatMessage() {
+        const useColor = AbilityDSLSyntaxError.supportsColor();
+        const BOLD = useColor ? '\x1b[1m' : '';
+        const RED = useColor ? '\x1b[31m' : '';
+        const ORANGE = useColor ? '\x1b[33;1m' : '';
+        const GRAY = useColor ? '\x1b[90m' : '';
+        const RESET = useColor ? '\x1b[0m' : '';
+        const lines = this.context.split('\n');
+        // Find line with ^
+        const pointerIndex = lines.findIndex(l => l.includes('^') || l.includes('~'));
+        const commentIndex = lines.findIndex(l => l.trim().includes('#'));
+        const formattedLines = lines.map((line, idx) => {
+            if (idx === pointerIndex - 1) {
+                // Error line
+                return `${BOLD}${ORANGE}${line}${RESET}`;
+            }
+            if (idx === pointerIndex) {
+                // Error with ~~~~~
+                return `${RED}${line}${RESET}`;
+            }
+            // Comments # ...
+            if (idx === commentIndex) {
+                return `${GRAY}${line}${RESET}`;
+            }
+            return line;
+        });
+        const contextBlock = formattedLines.join('\n');
+        return `${BOLD}${RED}${this.name}: ${this.details}${RESET}\n\n` + contextBlock;
+    }
+    toString() {
+        return this._formattedMessage;
+    }
+}
+exports.AbilityDSLSyntaxError = AbilityDSLSyntaxError;
+
+
+/***/ }),
+
+/***/ 325:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityDSLToken = void 0;
+const AbilityCode_1 = __importDefault(__webpack_require__(301));
+/**
+ * Represents a single token produced by the Ability DSL lexer.
+ * Each token carries a type (e.g., EFFECT, IDENTIFIER, STRING) and its raw string value.
+ */
+class AbilityDSLToken extends AbilityCode_1.default {
+    /** The literal text of the token as it appeared in the input (e.g., "permit", "user.roles", "admin"). */
+    value = '';
+    /** The line number in DSL */
+    line = 1;
+    /** The column in dsl */
+    column = 1;
+    constructor(type, value, line, column) {
+        super(type);
+        this.value = value;
+        this.line = line;
+        this.column = column;
+    }
+    /**
+     * Returns a human-readable representation of the token, useful for debugging.
+     * Example output: "AbilityDSLToken([EFFECT] permit"
+     */
+    toString() {
+        return `AbilityDSLToken([${this.code}] "${this.value}" at ${this.line}:${this.column})`;
+    }
+    static EFFECT = 'EFFECT';
+    static IF = 'IF';
+    static PERMISSION = 'PERMISSION';
+    static IDENTIFIER = 'IDENTIFIER';
+    static COLON = 'COLON';
+    static COMMA = 'COMMA';
+    static DOT = 'DOT';
+    static LBRACKET = 'LBRACKET';
+    static RBRACKET = 'RBRACKET';
+    static ALL = 'ALL';
+    static ANY = 'ANY';
+    static OF = 'OF';
+    static EOF = 'EOF';
+    static COMMENT = 'COMMENT';
+    static EQ = 'EQ';
+    static CONTAINS = 'CONTAINS';
+    static IN = 'IN';
+    static NOT_IN = 'NOT_IN';
+    static NOT_CONTAINS = 'NOT_CONTAINS';
+    static GT = 'GT';
+    static GTE = 'GTE';
+    static LT = 'LT';
+    static LTE = 'LTE';
+    static NULL = 'NULL';
+    static EQ_NULL = 'EQ_NULL';
+    static NOT_EQ_NULL = 'NOT_EQ_NULL';
+    static LEN_GT = 'LEN_GT';
+    static LEN_LT = 'LEN_LT';
+    static LEN_EQ = 'LEN_EQ';
+    static NOT_EQ = 'NOT_EQ';
+    static STRING = 'STRING';
+    static NUMBER = 'NUMBER';
+    static BOOLEAN = 'BOOLEAN';
+    static SYMBOL = 'SYMBOL';
+    static KEYWORD = 'KEYWORD';
+}
+exports.AbilityDSLToken = AbilityDSLToken;
+
+
+/***/ }),
+
+/***/ 909:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AbilityJSONParser = void 0;
+const AbilityCondition_1 = __importDefault(__webpack_require__(167));
+const AbilityRule_1 = __webpack_require__(306);
+const AbilityRuleSet_1 = __webpack_require__(56);
+const AbilityCompare_1 = __importDefault(__webpack_require__(413));
+const AbilityPolicyEffect_1 = __importDefault(__webpack_require__(179));
+const AbilityPolicy_1 = __webpack_require__(278);
+class AbilityJSONParser {
+    /**
+     * Parses an array of policy configurations into an array of AbilityPolicy instances.
+     * @param configs - Array of policy configurations
+     * @returns Array of AbilityPolicy instances
+     */
+    static parse(configs) {
+        return configs.map(config => AbilityJSONParser.parsePolicy(config));
+    }
+    static parsePolicy(config) {
+        const { id, name, ruleSet, compareMethod, permission, effect } = config;
+        // Create the empty policy
+        const policy = new AbilityPolicy_1.AbilityPolicy({
+            name,
+            id,
+            permission: permission,
+            effect: new AbilityPolicyEffect_1.default(effect),
+        });
+        policy.compareMethod = new AbilityCompare_1.default(compareMethod);
+        ruleSet.forEach(ruleSetConfig => {
+            policy.addRuleSet(AbilityRuleSet_1.AbilityRuleSet.fromJSON(ruleSetConfig));
+        });
+        return policy;
+    }
+    static parseRule(config) {
+        const { id, name, subject, resource, condition } = config;
+        return new AbilityRule_1.AbilityRule({
+            id,
+            name,
+            subject,
+            resource,
+            condition: new AbilityCondition_1.default(condition),
+        });
+    }
+    /**
+     * Parse the config JSON format to Group class instance
+     */
+    static parseRuleSet(config) {
+        const { id, name, rules, compareMethod } = config;
+        const ruleSet = new AbilityRuleSet_1.AbilityRuleSet({
+            compareMethod: new AbilityCompare_1.default(compareMethod),
+            name,
+            id,
+        });
+        // Adding rules if exists
+        if (rules && rules.length > 0) {
+            const abilityRules = rules.map(ruleConfig => AbilityRule_1.AbilityRule.fromJSON(ruleConfig));
+            ruleSet.addRules(abilityRules);
+        }
+        return ruleSet;
+    }
+    static ruleToJSON(rule) {
+        return {
+            id: rule.id,
+            name: rule.name,
+            subject: rule.subject,
+            resource: rule.resource,
+            condition: rule.condition.code,
+        };
+    }
+    static ruleSetToJSON(ruleSet) {
+        return {
+            id: ruleSet.id.toString(),
+            name: ruleSet.name.toString(),
+            compareMethod: ruleSet.compareMethod.code.toString(),
+            rules: ruleSet.rules.map(rule => AbilityJSONParser.ruleToJSON(rule)),
+        };
+    }
+    static policyToJSON(policy) {
+        return {
+            id: policy.id.toString(),
+            name: policy.name.toString(),
+            compareMethod: policy.compareMethod.code.toString(),
+            ruleSet: policy.ruleSet.map(ruleSet => AbilityJSONParser.ruleSetToJSON(ruleSet)),
+            permission: policy.permission,
+            effect: policy.effect.code,
+        };
+    }
+    static toJSON(policies) {
+        return policies.map(policy => AbilityJSONParser.policyToJSON(policy));
+    }
+}
+exports.AbilityJSONParser = AbilityJSONParser;
 
 
 /***/ })