@vielzeug/ward 1.0.2

package/dist/ward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ward.js","names":[],"sources":["../src/constants.ts","../src/builder.ts","../src/errors.ts","../src/_compile.ts","../src/_dev.ts","../src/resource.ts","../src/_match.ts","../src/_conflict.ts","../src/factory.ts","../src/middleware.ts"],"sourcesContent":["export const WILDCARD = '*' as const;\nexport const ANONYMOUS = 'anonymous' as const;\n","import type { WardPredicate, WardRule } from './types';\n\nimport { WILDCARD } from './constants';\n\n// ---------------------------------------------------------------------------\n// RuleOptions — shared options for allow/deny/ruleFor\n// ---------------------------------------------------------------------------\n\ntype RuleOptions<TData> = {\n  priority?: number;\n  when?: WardPredicate<TData>;\n};\n\n// ---------------------------------------------------------------------------\n// ruleFor — multi-action rule factory (low-level, effect as first arg)\n// ---------------------------------------------------------------------------\n\n/**\n * Creates one `WardRule` per action for a given effect, role(s), and resource.\n *\n * Prefer `allow()` or `deny()` for ergonomic rule authoring.\n *\n * @example\n * ```ts\n * ruleFor('allow', 'viewer', 'posts', ['read'])\n * ruleFor('deny', 'blocked', 'posts', ['read', 'update'])\n * ```\n */\nexport function ruleFor<TAction extends string = string, TData = unknown>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: string | typeof WILDCARD,\n  actions: readonly (TAction | typeof WILDCARD)[],\n  options?: RuleOptions<TData>,\n): WardRule<TAction, TData>[] {\n  return actions.map((action) => ({\n    action,\n    effect,\n    ...(options?.priority !== undefined ? { priority: options.priority } : {}),\n    resource,\n    role,\n    ...(options?.when !== undefined ? { when: options.when } : {}),\n  }));\n}\n\n// ---------------------------------------------------------------------------\n// allow / deny — ergonomic factories (R12)\n// ---------------------------------------------------------------------------\n\n/**\n * Creates one `WardRule` per action with `effect: 'allow'`.\n *\n * Reads naturally: \"allow editor to read/update posts\".\n *\n * @example\n * ```ts\n * allow('editor', 'posts', ['read', 'update'])\n * allow(['editor', 'admin'], 'posts:*', ['read', 'update'], { when: predicate.owns('authorId') })\n * ```\n */\nexport function allow<TAction extends string = string, TData = unknown>(\n  role: string | readonly string[],\n  resource: string | typeof WILDCARD,\n  actions: readonly (TAction | typeof WILDCARD)[],\n  options?: RuleOptions<TData>,\n): WardRule<TAction, TData>[] {\n  return ruleFor('allow', role, resource, actions, options);\n}\n\n/**\n * Creates one `WardRule` per action with `effect: 'deny'`.\n *\n * Reads naturally: \"deny blocked from reading posts\".\n *\n * @example\n * ```ts\n * deny('blocked', 'posts', ['read', 'update'])\n * deny('guest', WILDCARD, [WILDCARD], { priority: 10 })\n * ```\n */\nexport function deny<TAction extends string = string, TData = unknown>(\n  role: string | readonly string[],\n  resource: string | typeof WILDCARD,\n  actions: readonly (TAction | typeof WILDCARD)[],\n  options?: RuleOptions<TData>,\n): WardRule<TAction, TData>[] {\n  return ruleFor('deny', role, resource, actions, options);\n}\n\n// ---------------------------------------------------------------------------\n// predicate — grouped predicate helpers (R10)\n// ---------------------------------------------------------------------------\n\n/**\n * Grouped predicate factories. Import as a namespace to avoid name collisions:\n * ```ts\n * import { predicate } from '@vielzeug/ward';\n * allow('editor', 'posts:*', ['update'], { when: predicate.owns('authorId') })\n * allow('user', 'posts:*', ['read'], { when: predicate.and(predicate.owns('authorId'), myPred) })\n * ```\n */\nexport const predicate = {\n  /**\n   * Returns a `WardPredicate` that combines all given predicates with AND semantics —\n   * all must return `true` for the rule to match.\n   */\n  and<TData = unknown>(...preds: WardPredicate<TData>[]): WardPredicate<TData> {\n    return (ctx) => preds.every((p) => p(ctx));\n  },\n\n  /**\n   * Returns a `WardPredicate` that inverts the given predicate.\n   */\n  not<TData = unknown>(pred: WardPredicate<TData>): WardPredicate<TData> {\n    return (ctx) => !pred(ctx);\n  },\n\n  /**\n   * Returns a `WardPredicate` that combines all given predicates with OR semantics —\n   * at least one must return `true` for the rule to match.\n   */\n  or<TData = unknown>(...preds: WardPredicate<TData>[]): WardPredicate<TData> {\n    return (ctx) => preds.some((p) => p(ctx));\n  },\n\n  /**\n   * Returns a `WardPredicate` that checks whether the data object's `attributeKey` field\n   * matches the principal's `id`. Use to express ownership constraints.\n   *\n   * Must be used with a rule that requires authentication (non-`ANONYMOUS` role).\n   * Predicates only execute for authenticated principals — pairing `owns` with an\n   * `ANONYMOUS`-role rule produces a rule that can never match because the predicate\n   * is skipped for unauthenticated requests.\n   *\n   * @example\n   * ```ts\n   * allow('editor', 'posts:*', ['update'], { when: predicate.owns('authorId') })\n   * ```\n   */\n  owns<TData = unknown>(attributeKey: keyof TData & string): WardPredicate<TData> {\n    return ({ data, principal }) => {\n      if (!data || typeof data !== 'object') return false;\n\n      const record = data as Record<string, unknown>;\n\n      if (!Object.hasOwn(record, attributeKey)) return false;\n\n      return record[attributeKey] === principal.id;\n    };\n  },\n} as const;\n\n// ---------------------------------------------------------------------------\n// owns — top-level re-export for backward-compatible usage\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a `WardPredicate` that checks whether the data object's `attributeKey` field\n * matches the principal's `id`.\n *\n * Also available as `predicate.owns()` when using the grouped namespace.\n */\nexport function owns<TData = unknown>(attributeKey: keyof TData & string): WardPredicate<TData> {\n  return predicate.owns(attributeKey);\n}\n","/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n\n  static is(err: unknown): err is WardError {\n    return err instanceof WardError;\n  }\n}\n\n/** Thrown when a rule definition or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/**\n * Thrown when a `when` predicate in a ward rule throws an exception.\n *\n * Catch this to distinguish predicate failures from other errors:\n * ```ts\n * try {\n *   ward.explain(principal, resource, action, data);\n * } catch (e) {\n *   if (e instanceof WardPredicateError) {\n *     console.error(`Predicate in Rule[${e.ruleIndex}] threw`, e.cause);\n *   }\n * }\n * ```\n */\nexport class WardPredicateError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    const msg = cause instanceof Error ? cause.message : String(cause);\n\n    super(`Rule[${ruleIndex}] threw: ${msg}`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n","import type { WardRule } from './types';\n\nimport { WILDCARD } from './constants';\nimport { WardConfigError } from './errors';\n\n// ---------------------------------------------------------------------------\n// Internal types (shared across modules)\n// ---------------------------------------------------------------------------\n\n/** Normalized compiled rule — role always readonly string[], priority always number. */\nexport type CompiledRule<TAction extends string, TData> = Readonly<{\n  action: TAction | typeof WILDCARD;\n  effect: 'allow' | 'deny';\n  priority: number;\n  resource: string | typeof WILDCARD;\n  role: readonly string[];\n  when?: WardRule<TAction, TData>['when'];\n}>;\n\n/** A compiled entry stores the normalized rule plus pre-computed lookup values. */\nexport type CompiledEntry<TAction extends string, TData> = {\n  /** Deny bonus (1 for deny, 0 for allow): tiebreaker when priority and score match. */\n  denyBonus: 0 | 1;\n  /** Original rule index, used in predicate error messages. */\n  index: number;\n  /** Resolved priority (defaults to 0 when not authored). */\n  priority: number;\n  /** Normalized roles array (always an array). */\n  roles: readonly string[];\n  /** The normalized, frozen compiled rule. */\n  rule: CompiledRule<TAction, TData>;\n  /** Specificity score (0–5): roleScore(0|1) + resourceScore(0|1|2) + actionScore(0|1|2). */\n  score: number;\n};\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nexport function validateRuleInput<TAction extends string, TData>(rule: WardRule<TAction, TData>, index: number): void {\n  const at = `Rule[${index}]`;\n  const roles = Array.isArray(rule.role) ? rule.role : [rule.role];\n\n  if (roles.length === 0 || roles.some((r) => typeof r !== 'string' || !r.trim())) {\n    throw new WardConfigError(`${at}.role must be a non-empty string or non-empty array of strings`);\n  }\n\n  if (typeof rule.resource !== 'string' || !rule.resource.trim()) {\n    throw new WardConfigError(`${at}.resource must be a non-empty string`);\n  }\n\n  if ((rule.resource as string).endsWith(':')) {\n    throw new WardConfigError(\n      `${at}.resource '${String(rule.resource)}' ends with ':' — did you mean '${String(rule.resource)}*'?`,\n    );\n  }\n\n  if (typeof rule.action !== 'string' || !(rule.action as string).trim()) {\n    throw new WardConfigError(`${at}.action must be a non-empty string`);\n  }\n\n  if ((rule.action as string).endsWith(':')) {\n    throw new WardConfigError(\n      `${at}.action '${String(rule.action)}' ends with ':' — did you mean '${String(rule.action)}*'?`,\n    );\n  }\n\n  if (rule.effect !== 'allow' && rule.effect !== 'deny') {\n    throw new WardConfigError(`${at}.effect must be \"allow\" or \"deny\"`);\n  }\n\n  if (rule.priority !== undefined && (typeof rule.priority !== 'number' || !Number.isFinite(rule.priority))) {\n    throw new WardConfigError(`${at}.priority must be a finite number`);\n  }\n\n  if (rule.when !== undefined && typeof rule.when !== 'function') {\n    throw new WardConfigError(`${at}.when must be a function`);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Specificity\n// ---------------------------------------------------------------------------\n\n/**\n * Returns the specificity score for a single pattern field:\n * - 0: global wildcard (`*`)\n * - 1: namespace wildcard (e.g. `posts:*` or `read:*`)\n * - 2: exact string\n */\nexport function patternScore(pattern: string): number {\n  if (pattern === WILDCARD) return 0;\n\n  if (pattern.endsWith(':*')) return 1;\n\n  return 2;\n}\n\n/**\n * Specificity: role(0|1) + resource(0|1|2) + action(0|1|2) = max 5.\n * Higher score = more specific = wins ties in priority.\n */\nfunction specificity<TAction extends string, TData>(rule: CompiledRule<TAction, TData>): number {\n  const roleScore = rule.role.includes(WILDCARD) ? 0 : 1;\n\n  return roleScore + patternScore(rule.resource as string) + patternScore(rule.action as string);\n}\n\n// ---------------------------------------------------------------------------\n// Compilation\n// ---------------------------------------------------------------------------\n\nexport function compileEntry<TAction extends string, TData>(\n  input: WardRule<TAction, TData>,\n  index: number,\n): CompiledEntry<TAction, TData> {\n  validateRuleInput(input, index);\n\n  const rawRoles = Array.isArray(input.role) ? [...input.role] : [input.role];\n  const roles: readonly string[] = Object.freeze([...new Set(rawRoles)]);\n\n  const rule = Object.freeze({\n    action: input.action,\n    effect: input.effect,\n    priority: input.priority ?? 0,\n    resource: input.resource,\n    role: roles,\n    ...(input.when !== undefined ? { when: input.when } : {}),\n  }) as CompiledRule<TAction, TData>;\n\n  const score = specificity(rule);\n  const priority = rule.priority;\n  const denyBonus: 0 | 1 = rule.effect === 'deny' ? 1 : 0;\n\n  return { denyBonus, index, priority, roles, rule, score };\n}\n","const isDev = !(globalThis as { __WARD_PROD__?: boolean }).__WARD_PROD__;\n\n/** @internal */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/ward] ${msg}`);\n}\n\n/** @internal */\nexport function error(msg: string, ...args: unknown[]): void {\n  if (isDev) console.error(`[@vielzeug/ward] ${msg}`, ...args);\n}\n\n/** @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n","import type { CompiledEntry } from './_compile';\nimport type { Principal, UserPrincipal, WardDecision, WardRule } from './types';\n\nimport { error } from './_dev';\nimport { ANONYMOUS, WILDCARD } from './constants';\nimport { WardConfigError, WardPredicateError } from './errors';\nimport { matchesPattern } from './resource';\n\n// ---------------------------------------------------------------------------\n// Principal validation\n// ---------------------------------------------------------------------------\n\n/** Asserts that `input` is a valid `UserPrincipal`. Throws with a clear message otherwise. */\nexport function assertUserPrincipal(input: unknown): asserts input is UserPrincipal {\n  if (typeof input !== 'object' || !input) {\n    throw new WardConfigError('Invalid principal: expected { id: string, roles: string[] }');\n  }\n\n  const p = input as Record<string, unknown>;\n\n  if (typeof p.id !== 'string' || !p.id.trim()) {\n    throw new WardConfigError('Invalid principal: id must be a non-empty string');\n  }\n\n  if (!Array.isArray(p.roles) || p.roles.some((r) => typeof r !== 'string' || !(r as string).trim())) {\n    throw new WardConfigError('Invalid principal: roles must be an array of non-empty strings');\n  }\n}\n\nexport function validatePrincipal(principal: Principal): void {\n  if (principal !== null) {\n    assertUserPrincipal(principal);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Role matching\n// ---------------------------------------------------------------------------\n\n/** Returns true if the principal's role set intersects with the rule's roles. */\nexport function principalMatchesRoles(roles: readonly string[], principal: Principal): boolean {\n  if (principal === null) {\n    return roles.includes(ANONYMOUS);\n  }\n\n  if (roles.every((r) => r === ANONYMOUS)) return false;\n\n  if (roles.includes(WILDCARD)) return true;\n\n  return roles.some((role) => principal.roles.includes(role));\n}\n\n// ---------------------------------------------------------------------------\n// Rule matching\n// ---------------------------------------------------------------------------\n\n/**\n * Check whether a rule applies to a given request.\n *\n * @param action        - Pass `undefined` to skip the action check (used by `rulesInScope`).\n * @param data          - Data payload; passed to `when` predicates.\n * @param skipPredicate - When true, omit the `when` evaluation even when data is present.\n */\nexport function matchesRule<TAction extends string, TData>(\n  entry: CompiledEntry<TAction, TData>,\n  principal: Principal,\n  resource: string,\n  action: TAction | undefined,\n  data: TData | undefined,\n  skipPredicate = false,\n): boolean {\n  if (!principalMatchesRoles(entry.roles, principal)) return false;\n\n  if (!matchesPattern(entry.rule.resource as string, resource)) return false;\n\n  if (action !== undefined && !matchesPattern(entry.rule.action as string, action)) return false;\n\n  if (skipPredicate || !entry.rule.when) return true;\n\n  if (principal === null) return false;\n\n  try {\n    const result: unknown = entry.rule.when({ data, principal });\n\n    if (result instanceof Promise) {\n      error(\n        `Rule[${entry.index}] when() returned a Promise. Async predicates are not supported — the Promise is truthy and will always grant access. Use a sync predicate instead.`,\n      );\n    }\n\n    return result as boolean;\n  } catch (err) {\n    throw new WardPredicateError(entry.index, err);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Winner selection\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true if `challenger` would displace `current` as the pickWinner result.\n */\nexport function isOverriddenBy<TAction extends string, TData>(\n  current: CompiledEntry<TAction, TData>,\n  challenger: CompiledEntry<TAction, TData>,\n): boolean {\n  return (\n    challenger.priority > current.priority ||\n    (challenger.priority === current.priority && challenger.score > current.score) ||\n    (challenger.priority === current.priority &&\n      challenger.score === current.score &&\n      challenger.denyBonus > current.denyBonus)\n  );\n}\n\nexport function pickWinner<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  action: TAction,\n  data: TData | undefined,\n): CompiledEntry<TAction, TData> | undefined {\n  let winner: CompiledEntry<TAction, TData> | undefined;\n\n  for (const entry of entries) {\n    if (!matchesRule(entry, principal, resource, action, data)) continue;\n\n    if (!winner || isOverriddenBy(winner, entry)) {\n      winner = entry;\n    }\n  }\n\n  return winner;\n}\n\nexport function toDecision<TAction extends string, TData>(\n  winner: CompiledEntry<TAction, TData> | undefined,\n): WardDecision<TAction, TData> {\n  if (!winner) return { allowed: false, reason: 'no-matching-rule' };\n\n  if (winner.rule.effect === 'deny') {\n    return { allowed: false, reason: 'explicit-deny', rule: winner.rule as Readonly<WardRule<TAction, TData>> };\n  }\n\n  return { allowed: true, rule: winner.rule as Readonly<WardRule<TAction, TData>> };\n}\n","import type { CompiledEntry } from './_compile';\nimport type { WardConflict } from './types';\n\nimport { isOverriddenBy } from './_match';\nimport { ANONYMOUS, WILDCARD } from './constants';\nimport { patternCovers } from './resource';\n\n// ---------------------------------------------------------------------------\n// Role coverage helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true if every principal that satisfies `narrowRoles` also satisfies `broadRoles`.\n */\nfunction roleCoversRoles(broadRoles: readonly string[], narrowRoles: readonly string[]): boolean {\n  const narrowHasAnonymous = narrowRoles.includes(ANONYMOUS);\n  const narrowHasAuthenticated = narrowRoles.some((r) => r !== ANONYMOUS);\n\n  if (narrowHasAnonymous && !broadRoles.includes(ANONYMOUS)) return false;\n\n  if (narrowHasAuthenticated) {\n    if (broadRoles.includes(WILDCARD)) return true;\n\n    return narrowRoles.filter((r) => r !== ANONYMOUS).every((r) => broadRoles.includes(r));\n  }\n\n  return true;\n}\n\nfunction rolesSetsEqual(a: readonly string[], b: readonly string[]): boolean {\n  if (a.length !== b.length) return false;\n\n  const setA = new Set(a);\n\n  return b.every((r) => setA.has(r));\n}\n\n/** Returns true if every request that triggers `narrow` would also trigger `broad`. */\nfunction ruleCovers<TAction extends string, TData>(\n  broad: CompiledEntry<TAction, TData>,\n  narrow: CompiledEntry<TAction, TData>,\n): boolean {\n  return (\n    roleCoversRoles(broad.roles, narrow.roles) &&\n    patternCovers(broad.rule.resource as string, narrow.rule.resource as string) &&\n    patternCovers(broad.rule.action as string, narrow.rule.action as string)\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Conflict detection\n// ---------------------------------------------------------------------------\n\n/**\n * Detects conflicts between compiled entries.\n *\n * @complexity O(n²) in the number of rules. Scales to hundreds of rules\n * with negligible overhead; for very large auto-generated policies, use `maxConflicts`.\n */\nexport function computeConflicts<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  maxConflicts: number,\n): WardConflict<TAction, TData>[] {\n  const conflicts: WardConflict<TAction, TData>[] = [];\n\n  for (let i = 0; i < entries.length && conflicts.length < maxConflicts; i++) {\n    for (let j = i + 1; j < entries.length && conflicts.length < maxConflicts; j++) {\n      const a = entries[i];\n      const b = entries[j];\n\n      if (\n        !a.rule.when &&\n        !b.rule.when &&\n        rolesSetsEqual(a.roles, b.roles) &&\n        a.rule.resource === b.rule.resource &&\n        a.rule.action === b.rule.action\n      ) {\n        conflicts.push({\n          indexA: a.index,\n          indexB: b.index,\n          kind: 'duplicate',\n          ruleA: a.rule,\n          ruleB: b.rule,\n        });\n        continue;\n      }\n\n      const bCanOverrideA = isOverriddenBy(a, b);\n\n      if (!bCanOverrideA && !a.rule.when && ruleCovers(a, b)) {\n        conflicts.push({\n          kind: 'shadowed',\n          shadowedIndex: b.index,\n          shadowedRule: b.rule,\n          shadowingIndex: a.index,\n          shadowingRule: a.rule,\n        });\n      } else if (bCanOverrideA && !b.rule.when && ruleCovers(b, a)) {\n        conflicts.push({\n          kind: 'shadowed',\n          shadowedIndex: a.index,\n          shadowedRule: a.rule,\n          shadowingIndex: b.index,\n          shadowingRule: b.rule,\n        });\n      }\n    }\n  }\n\n  return conflicts;\n}\n","import type { CompiledEntry } from './_compile';\nimport type {\n  BoundWard,\n  Principal,\n  UserPrincipal,\n  Ward,\n  WardCheck,\n  WardConflict,\n  WardDecision,\n  WardDecisionResult,\n  WardOptions,\n  WardRule,\n  WardTrace,\n  WardTraceCandidate,\n} from './types';\n\nimport { compileEntry } from './_compile';\nimport { computeConflicts } from './_conflict';\nimport { assertUserPrincipal, isOverriddenBy, matchesRule, pickWinner, toDecision, validatePrincipal } from './_match';\nimport { WardConfigError } from './errors';\n\n// ---------------------------------------------------------------------------\n// Shared loop cores (validation-free; used by both public API and forUser)\n// ---------------------------------------------------------------------------\n\nfunction coreAllowedActions<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  knownActions: readonly TAction[],\n  data: TData | undefined,\n): TAction[] {\n  const seen = new Set<TAction>();\n  const result: TAction[] = [];\n\n  for (const action of knownActions) {\n    if (seen.has(action)) continue;\n\n    seen.add(action);\n\n    const winner = pickWinner(entries, principal, resource, action, data);\n\n    if (winner?.rule.effect === 'allow') result.push(action);\n  }\n\n  return result;\n}\n\nfunction coreRulesInScope<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  data: TData | undefined,\n): CompiledEntry<TAction, TData>['rule'][] {\n  const skipPredicate = data === undefined;\n  const result: CompiledEntry<TAction, TData>['rule'][] = [];\n\n  for (const entry of entries) {\n    if (!matchesRule(entry, principal, resource, undefined, data, skipPredicate)) continue;\n\n    result.push(entry.rule);\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Creates an authorization ward from a set of rules.\n *\n * **Winner selection** when multiple rules match a request:\n * 1. Higher `priority` wins.\n * 2. On priority tie, higher specificity score wins (exact > namespace-wildcard > global-wildcard,\n *    applied independently to role, resource, and action).\n * 3. On specificity tie, `deny` beats `allow` (denyBonus tiebreaker).\n * 4. On absolute tie (identical priority, specificity, and effect), the rule declared\n *    **first in the input array** wins.\n */\nexport function createWard<TAction extends string = string, TData = unknown>(\n  rules: readonly WardRule<TAction, TData>[] = [],\n  options: WardOptions<TAction, TData> = {},\n): Ward<TAction, TData> {\n  const { logger, maxConflicts = Infinity } = options;\n  const entries = rules.map((rule, i) => compileEntry(rule, i));\n\n  // -------------------------------------------------------------------------\n  // Core decision + logging\n  // -------------------------------------------------------------------------\n\n  function fireLogger(\n    principal: Principal,\n    resource: string,\n    action: TAction,\n    data: TData | undefined,\n    decision: WardDecision<TAction, TData>,\n  ): void {\n    if (!logger) return;\n\n    logger({ ...decision, action, data, principal, resource } as Parameters<typeof logger>[0]);\n  }\n\n  function evaluateAndLog(\n    principal: Principal,\n    resource: string,\n    action: TAction,\n    data: TData | undefined,\n  ): WardDecision<TAction, TData> {\n    const winner = pickWinner(entries, principal, resource, action, data);\n    const decision = toDecision(winner);\n\n    fireLogger(principal, resource, action, data, decision);\n\n    return decision;\n  }\n\n  // -------------------------------------------------------------------------\n  // Public API\n  // -------------------------------------------------------------------------\n\n  function explain(\n    principal: Principal,\n    resource: string,\n    action: TAction,\n    data?: TData,\n  ): WardDecision<TAction, TData> {\n    validatePrincipal(principal);\n\n    return evaluateAndLog(principal, resource, action, data);\n  }\n\n  function runCheckAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    return checks.map((check) => ({\n      ...evaluateAndLog(principal, check.resource, check.action, check.data),\n      action: check.action,\n      resource: check.resource,\n    }));\n  }\n\n  function checkAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    if (checks.length === 0) return [];\n\n    validatePrincipal(principal);\n\n    return runCheckAll(principal, checks);\n  }\n\n  function allowedActions(\n    principal: Principal,\n    resource: string,\n    knownActions: readonly TAction[],\n    data?: TData,\n  ): TAction[] {\n    validatePrincipal(principal);\n\n    return coreAllowedActions(entries, principal, resource, knownActions, data);\n  }\n\n  function rulesInScope(\n    principal: Principal,\n    resource: string,\n    data?: TData,\n  ): ReadonlyArray<Readonly<WardRule<TAction, TData>>> {\n    validatePrincipal(principal);\n\n    return coreRulesInScope(entries, principal, resource, data);\n  }\n\n  function trace(principal: Principal, resource: string, action: TAction, data?: TData): WardTrace<TAction, TData> {\n    validatePrincipal(principal);\n\n    const matching: CompiledEntry<TAction, TData>[] = [];\n\n    for (const entry of entries) {\n      if (matchesRule(entry, principal, resource, action, data)) {\n        matching.push(entry);\n      }\n    }\n\n    let winner: CompiledEntry<TAction, TData> | undefined;\n\n    for (const entry of matching) {\n      if (!winner || isOverriddenBy(winner, entry)) winner = entry;\n    }\n\n    const decision = toDecision(winner);\n\n    const candidates: WardTraceCandidate<TAction, TData>[] = matching.map((entry) => ({\n      index: entry.index,\n      priority: entry.priority,\n      rule: entry.rule,\n      score: entry.score,\n      won: entry === winner,\n    }));\n\n    return { candidates, decision };\n  }\n\n  function forUser(principal: UserPrincipal): BoundWard<TAction, TData> {\n    assertUserPrincipal(principal);\n\n    const snap: UserPrincipal = {\n      attributes: principal.attributes ? structuredClone(principal.attributes) : undefined,\n      id: principal.id,\n      roles: [...principal.roles],\n    };\n\n    return {\n      allowedActions: (resource, knownActions, data?) =>\n        coreAllowedActions(entries, snap, resource, knownActions, data),\n      checkAll: (checks) => (checks.length === 0 ? [] : runCheckAll(snap, checks)),\n      explain: (resource, action, data?) => evaluateAndLog(snap, resource, action, data),\n      rulesInScope: (resource, data?) => coreRulesInScope(entries, snap, resource, data),\n      trace: (resource, action, data?) => trace(snap, resource, action, data),\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // Conflict detection (lazy, cached)\n  // -------------------------------------------------------------------------\n\n  let conflictsCache: readonly WardConflict<TAction, TData>[] | undefined;\n\n  function detectConflicts(): readonly WardConflict<TAction, TData>[] {\n    return (conflictsCache ??= Object.freeze(computeConflicts(entries, maxConflicts)));\n  }\n\n  if (options.strict || options.onConflict) {\n    const conflicts = detectConflicts();\n\n    if (conflicts.length > 0) {\n      if (options.onConflict) conflicts.forEach(options.onConflict);\n\n      if (options.strict) {\n        const details = conflicts\n          .map((c) =>\n            c.kind === 'duplicate'\n              ? `Rule[${c.indexB}] ${c.kind} of Rule[${c.indexA}]`\n              : `Rule[${c.shadowedIndex}] ${c.kind} by Rule[${c.shadowingIndex}]`,\n          )\n          .join('; ');\n\n        throw new WardConfigError(`${conflicts.length} rule conflict(s) detected: ${details}`);\n      }\n    }\n  }\n\n  return { allowedActions, checkAll, detectConflicts, explain, forUser, rulesInScope, trace };\n}\n","import type { Principal, Ward, WardDecision } from './types';\n\nexport type WardRequest = Record<string, unknown>;\nexport type PrincipalExtractor<TReq extends WardRequest = WardRequest> = (req: TReq) => Principal | Promise<Principal>;\n\nexport type GuardResult<TAction extends string, TData> =\n  | { granted: true; principal: Principal }\n  | {\n      decision: WardDecision<TAction, TData>;\n      granted: false;\n      principal: Principal;\n      reason: 'explicit-deny' | 'no-matching-rule';\n    };\n\n/**\n * Evaluates a ward decision for a known `principal` and returns a `GuardResult`.\n * Use when you have already resolved the principal (e.g. from a session or JWT).\n *\n * For request-object based flows where the principal must be extracted asynchronously,\n * use `guardRequestWith` instead.\n *\n * @example\n * ```ts\n * // Express / Hono / any framework — write a 3-line adapter:\n * app.use('/posts', async (req, res, next) => {\n *   const result = await guardRequestWith(ward, req, extractPrincipal, 'posts', 'read');\n *   result.granted ? next() : res.status(403).json({ reason: result.reason });\n * });\n * ```\n */\nexport function guardRequest<TAction extends string, TData>(\n  ward: Ward<TAction, TData>,\n  principal: Principal,\n  resource: string,\n  action: TAction,\n  data?: TData,\n): GuardResult<TAction, TData> {\n  const decision = ward.explain(principal, resource, action, data);\n\n  if (decision.allowed) {\n    return { granted: true, principal };\n  }\n\n  return { decision, granted: false, principal, reason: decision.reason };\n}\n\n/**\n * Evaluates a ward decision by first extracting the principal from a request object,\n * then running the authorization check. The extractor may be async (e.g. to verify a JWT).\n *\n * Use `guardRequest` instead when the principal is already resolved.\n */\nexport async function guardRequestWith<TAction extends string, TData, TReq extends WardRequest>(\n  ward: Ward<TAction, TData>,\n  req: TReq,\n  extractPrincipal: PrincipalExtractor<TReq>,\n  resource: string,\n  action: TAction,\n  data?: TData,\n): Promise<GuardResult<TAction, TData>> {\n  const principal = await extractPrincipal(req);\n\n  return guardRequest(ward, principal, resource, action, data);\n}\n"],"mappings":"AAAA,IAAa,EAAW,IACX,EAAY,YC2BzB,SAAgB,EACd,EACA,EACA,EACA,EACA,EAC4B,CAC5B,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,SACA,GAAI,GAAS,WAAa,IAAA,GAA6C,CAAC,EAAlC,CAAE,SAAU,EAAQ,QAAS,EACnE,WACA,OACA,GAAI,GAAS,OAAS,IAAA,GAAqC,CAAC,EAA1B,CAAE,KAAM,EAAQ,IAAK,CACzD,EAAE,CACJ,CAiBA,SAAgB,EACd,EACA,EACA,EACA,EAC4B,CAC5B,OAAO,EAAQ,QAAS,EAAM,EAAU,EAAS,CAAO,CAC1D,CAaA,SAAgB,EACd,EACA,EACA,EACA,EAC4B,CAC5B,OAAO,EAAQ,OAAQ,EAAM,EAAU,EAAS,CAAO,CACzD,CAcA,IAAa,EAAY,CAKvB,IAAqB,GAAG,EAAqD,CAC3E,MAAQ,IAAQ,EAAM,MAAO,GAAM,EAAE,CAAG,CAAC,CAC3C,EAKA,IAAqB,EAAkD,CACrE,MAAQ,IAAQ,CAAC,EAAK,CAAG,CAC3B,EAMA,GAAoB,GAAG,EAAqD,CAC1E,MAAQ,IAAQ,EAAM,KAAM,GAAM,EAAE,CAAG,CAAC,CAC1C,EAgBA,KAAsB,EAA0D,CAC9E,OAAQ,CAAE,OAAM,eAAgB,CAC9B,GAAI,CAAC,GAAQ,OAAO,GAAS,SAAU,MAAO,GAE9C,IAAM,EAAS,EAIf,OAFK,OAAO,OAAO,EAAQ,CAAY,EAEhC,EAAO,KAAkB,EAAU,GAFO,EAGnD,CACF,CACF,EAYA,SAAgB,EAAsB,EAA0D,CAC9F,OAAO,EAAU,KAAK,CAAY,CACpC,CCnKA,IAAa,EAAb,MAAa,UAAkB,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,IAAI,OAAO,KACvB,OAAO,eAAe,KAAM,IAAI,OAAO,SAAS,CAClD,CAEA,OAAO,GAAG,EAAgC,CACxC,OAAO,aAAe,CACxB,CACF,EAGa,EAAb,cAAqC,CAAU,CAAC,EAgBnC,EAAb,cAAwC,CAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,IAAM,EAAM,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAEjE,MAAM,QAAQ,EAAU,WAAW,IAAO,CAAE,OAAM,CAAC,EACnD,KAAK,UAAY,CACnB,CACF,ECAA,SAAgB,EAAiD,EAAgC,EAAqB,CACpH,IAAM,EAAK,QAAQ,EAAM,GACnB,EAAQ,MAAM,QAAQ,EAAK,IAAI,EAAI,EAAK,KAAO,CAAC,EAAK,IAAI,EAE/D,GAAI,EAAM,SAAW,GAAK,EAAM,KAAM,GAAM,OAAO,GAAM,UAAY,CAAC,EAAE,KAAK,CAAC,EAC5E,MAAM,IAAI,EAAgB,GAAG,EAAG,+DAA+D,EAGjG,GAAI,OAAO,EAAK,UAAa,UAAY,CAAC,EAAK,SAAS,KAAK,EAC3D,MAAM,IAAI,EAAgB,GAAG,EAAG,qCAAqC,EAGvE,GAAK,EAAK,SAAoB,SAAS,GAAG,EACxC,MAAM,IAAI,EACR,GAAG,EAAG,aAAa,OAAO,EAAK,QAAQ,EAAE,kCAAkC,OAAO,EAAK,QAAQ,EAAE,IACnG,EAGF,GAAI,OAAO,EAAK,QAAW,UAAY,CAAE,EAAK,OAAkB,KAAK,EACnE,MAAM,IAAI,EAAgB,GAAG,EAAG,mCAAmC,EAGrE,GAAK,EAAK,OAAkB,SAAS,GAAG,EACtC,MAAM,IAAI,EACR,GAAG,EAAG,WAAW,OAAO,EAAK,MAAM,EAAE,kCAAkC,OAAO,EAAK,MAAM,EAAE,IAC7F,EAGF,GAAI,EAAK,SAAW,SAAW,EAAK,SAAW,OAC7C,MAAM,IAAI,EAAgB,GAAG,EAAG,kCAAkC,EAGpE,GAAI,EAAK,WAAa,IAAA,KAAc,OAAO,EAAK,UAAa,UAAY,CAAC,OAAO,SAAS,EAAK,QAAQ,GACrG,MAAM,IAAI,EAAgB,GAAG,EAAG,kCAAkC,EAGpE,GAAI,EAAK,OAAS,IAAA,IAAa,OAAO,EAAK,MAAS,WAClD,MAAM,IAAI,EAAgB,GAAG,EAAG,yBAAyB,CAE7D,CAYA,SAAgB,EAAa,EAAyB,CAKpD,OAJI,IAAA,IAA6B,EAE7B,EAAQ,SAAS,IAAI,EAAU,EAE5B,CACT,CAMA,SAAS,EAA2C,EAA4C,CAG9F,MAFkB,IAAK,KAAK,SAAA,GAAiB,EAE1B,EAAa,EAAK,QAAkB,EAAI,EAAa,EAAK,MAAgB,CAC/F,CAMA,SAAgB,EACd,EACA,EAC+B,CAC/B,EAAkB,EAAO,CAAK,EAE9B,IAAM,EAAW,MAAM,QAAQ,EAAM,IAAI,EAAI,CAAC,GAAG,EAAM,IAAI,EAAI,CAAC,EAAM,IAAI,EACpE,EAA2B,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAQ,CAAC,CAAC,EAE/D,EAAO,OAAO,OAAO,CACzB,OAAQ,EAAM,OACd,OAAQ,EAAM,OACd,SAAU,EAAM,UAAY,EAC5B,SAAU,EAAM,SAChB,KAAM,EACN,GAAI,EAAM,OAAS,IAAA,GAAmC,CAAC,EAAxB,CAAE,KAAM,EAAM,IAAK,CACpD,CAAC,EAEK,EAAQ,EAAY,CAAI,EACxB,EAAW,EAAK,SAGtB,MAAO,CAAE,UAFgB,IAAK,SAAW,QAErB,QAAO,WAAU,QAAO,OAAM,OAAM,CAC1D,CCvIA,IAAM,EAAQ,CAAE,WAA2C,cAQ3D,SAAgB,EAAM,EAAa,GAAG,EAAuB,CACvD,GAAO,QAAQ,MAAM,oBAAoB,IAAO,GAAG,CAAI,CAC7D,CCaA,SAAgB,EAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT,CAmBA,SAAgB,EAAc,EAAe,EAAyB,CAcpE,OAZI,IAAA,IAA2B,GAG3B,IAAA,IAA4B,GAI5B,EAAM,SAAS,IAAI,EACd,EAAO,WAAW,EAAM,MAAM,EAAG,EAAE,CAAC,EAItC,IAAU,CACnB,CCzDA,SAAgB,EAAoB,EAAgD,CAClF,GAAI,OAAO,GAAU,UAAY,CAAC,EAChC,MAAM,IAAI,EAAgB,6DAA6D,EAGzF,IAAM,EAAI,EAEV,GAAI,OAAO,EAAE,IAAO,UAAY,CAAC,EAAE,GAAG,KAAK,EACzC,MAAM,IAAI,EAAgB,kDAAkD,EAG9E,GAAI,CAAC,MAAM,QAAQ,EAAE,KAAK,GAAK,EAAE,MAAM,KAAM,GAAM,OAAO,GAAM,UAAY,CAAE,EAAa,KAAK,CAAC,EAC/F,MAAM,IAAI,EAAgB,gEAAgE,CAE9F,CAEA,SAAgB,EAAkB,EAA4B,CACxD,IAAc,MAChB,EAAoB,CAAS,CAEjC,CAOA,SAAgB,EAAsB,EAA0B,EAA+B,CAS7F,OARI,IAAc,KACT,EAAM,SAAS,CAAS,EAG7B,EAAM,MAAO,GAAM,IAAA,WAAe,EAAU,GAE5C,EAAM,SAAA,GAAiB,EAAU,GAE9B,EAAM,KAAM,GAAS,EAAU,MAAM,SAAS,CAAI,CAAC,CAC5D,CAaA,SAAgB,EACd,EACA,EACA,EACA,EACA,EACA,EAAgB,GACP,CAKT,GAJI,CAAC,EAAsB,EAAM,MAAO,CAAS,GAE7C,CAAC,EAAe,EAAM,KAAK,SAAoB,CAAQ,GAEvD,IAAW,IAAA,IAAa,CAAC,EAAe,EAAM,KAAK,OAAkB,CAAM,EAAG,MAAO,GAEzF,GAAI,GAAiB,CAAC,EAAM,KAAK,KAAM,MAAO,GAE9C,GAAI,IAAc,KAAM,MAAO,GAE/B,GAAI,CACF,IAAM,EAAkB,EAAM,KAAK,KAAK,CAAE,OAAM,WAAU,CAAC,EAQ3D,OANI,aAAkB,SACpB,EACE,QAAQ,EAAM,MAAM,oJACtB,EAGK,CACT,OAAS,EAAK,CACZ,MAAM,IAAI,EAAmB,EAAM,MAAO,CAAG,CAC/C,CACF,CASA,SAAgB,EACd,EACA,EACS,CACT,OACE,EAAW,SAAW,EAAQ,UAC7B,EAAW,WAAa,EAAQ,UAAY,EAAW,MAAQ,EAAQ,OACvE,EAAW,WAAa,EAAQ,UAC/B,EAAW,QAAU,EAAQ,OAC7B,EAAW,UAAY,EAAQ,SAErC,CAEA,SAAgB,EACd,EACA,EACA,EACA,EACA,EAC2C,CAC3C,IAAI,EAEJ,IAAK,IAAM,KAAS,EACb,EAAY,EAAO,EAAW,EAAU,EAAQ,CAAI,IAErD,CAAC,GAAU,EAAe,EAAQ,CAAK,KACzC,EAAS,GAIb,OAAO,CACT,CAEA,SAAgB,EACd,EAC8B,CAO9B,OANK,EAED,EAAO,KAAK,SAAW,OAClB,CAAE,QAAS,GAAO,OAAQ,gBAAiB,KAAM,EAAO,IAA2C,EAGrG,CAAE,QAAS,GAAM,KAAM,EAAO,IAA2C,EAN5D,CAAE,QAAS,GAAO,OAAQ,kBAAmB,CAOnE,CCpIA,SAAS,EAAgB,EAA+B,EAAyC,CAC/F,IAAM,EAAqB,EAAY,SAAS,CAAS,EACnD,EAAyB,EAAY,KAAM,GAAM,IAAM,CAAS,EAUtE,OARI,GAAsB,CAAC,EAAW,SAAA,WAAkB,EAAU,GAE9D,EACE,EAAW,SAAA,GAAiB,EAAU,GAEnC,EAAY,OAAQ,GAAM,IAAM,CAAS,CAAC,CAAC,MAAO,GAAM,EAAW,SAAS,CAAC,CAAC,EAGhF,EACT,CAEA,SAAS,EAAe,EAAsB,EAA+B,CAC3E,GAAI,EAAE,SAAW,EAAE,OAAQ,MAAO,GAElC,IAAM,EAAO,IAAI,IAAI,CAAC,EAEtB,OAAO,EAAE,MAAO,GAAM,EAAK,IAAI,CAAC,CAAC,CACnC,CAGA,SAAS,EACP,EACA,EACS,CACT,OACE,EAAgB,EAAM,MAAO,EAAO,KAAK,GACzC,EAAc,EAAM,KAAK,SAAoB,EAAO,KAAK,QAAkB,GAC3E,EAAc,EAAM,KAAK,OAAkB,EAAO,KAAK,MAAgB,CAE3E,CAYA,SAAgB,EACd,EACA,EACgC,CAChC,IAAM,EAA4C,CAAC,EAEnD,IAAK,IAAI,EAAI,EAAG,EAAI,EAAQ,QAAU,EAAU,OAAS,EAAc,IACrE,IAAK,IAAI,EAAI,EAAI,EAAG,EAAI,EAAQ,QAAU,EAAU,OAAS,EAAc,IAAK,CAC9E,IAAM,EAAI,EAAQ,GACZ,EAAI,EAAQ,GAElB,GACE,CAAC,EAAE,KAAK,MACR,CAAC,EAAE,KAAK,MACR,EAAe,EAAE,MAAO,EAAE,KAAK,GAC/B,EAAE,KAAK,WAAa,EAAE,KAAK,UAC3B,EAAE,KAAK,SAAW,EAAE,KAAK,OACzB,CACA,EAAU,KAAK,CACb,OAAQ,EAAE,MACV,OAAQ,EAAE,MACV,KAAM,YACN,MAAO,EAAE,KACT,MAAO,EAAE,IACX,CAAC,EACD,QACF,CAEA,IAAM,EAAgB,EAAe,EAAG,CAAC,EAErC,CAAC,GAAiB,CAAC,EAAE,KAAK,MAAQ,EAAW,EAAG,CAAC,EACnD,EAAU,KAAK,CACb,KAAM,WACN,cAAe,EAAE,MACjB,aAAc,EAAE,KAChB,eAAgB,EAAE,MAClB,cAAe,EAAE,IACnB,CAAC,EACQ,GAAiB,CAAC,EAAE,KAAK,MAAQ,EAAW,EAAG,CAAC,GACzD,EAAU,KAAK,CACb,KAAM,WACN,cAAe,EAAE,MACjB,aAAc,EAAE,KAChB,eAAgB,EAAE,MAClB,cAAe,EAAE,IACnB,CAAC,CAEL,CAGF,OAAO,CACT,CCrFA,SAAS,EACP,EACA,EACA,EACA,EACA,EACW,CACX,IAAM,EAAO,IAAI,IACX,EAAoB,CAAC,EAE3B,IAAK,IAAM,KAAU,EACf,EAAK,IAAI,CAAM,IAEnB,EAAK,IAAI,CAAM,EAEA,EAAW,EAAS,EAAW,EAAU,EAAQ,CAE5D,CAAA,EAAQ,KAAK,SAAW,SAAS,EAAO,KAAK,CAAM,GAGzD,OAAO,CACT,CAEA,SAAS,EACP,EACA,EACA,EACA,EACyC,CACzC,IAAM,EAAgB,IAAS,IAAA,GACzB,EAAkD,CAAC,EAEzD,IAAK,IAAM,KAAS,EACb,EAAY,EAAO,EAAW,EAAU,IAAA,GAAW,EAAM,CAAa,GAE3E,EAAO,KAAK,EAAM,IAAI,EAGxB,OAAO,CACT,CAiBA,SAAgB,EACd,EAA6C,CAAC,EAC9C,EAAuC,CAAC,EAClB,CACtB,GAAM,CAAE,SAAQ,eAAe,KAAa,EACtC,EAAU,EAAM,KAAK,EAAM,IAAM,EAAa,EAAM,CAAC,CAAC,EAM5D,SAAS,EACP,EACA,EACA,EACA,EACA,EACM,CACD,GAEL,EAAO,CAAE,GAAG,EAAU,SAAQ,OAAM,YAAW,UAAS,CAAiC,CAC3F,CAEA,SAAS,EACP,EACA,EACA,EACA,EAC8B,CAE9B,IAAM,EAAW,EADF,EAAW,EAAS,EAAW,EAAU,EAAQ,CACpC,CAAM,EAIlC,OAFA,EAAW,EAAW,EAAU,EAAQ,EAAM,CAAQ,EAE/C,CACT,CAMA,SAAS,EACP,EACA,EACA,EACA,EAC8B,CAG9B,OAFA,EAAkB,CAAS,EAEpB,EAAe,EAAW,EAAU,EAAQ,CAAI,CACzD,CAEA,SAAS,EACP,EACA,EACsC,CACtC,OAAO,EAAO,IAAK,IAAW,CAC5B,GAAG,EAAe,EAAW,EAAM,SAAU,EAAM,OAAQ,EAAM,IAAI,EACrE,OAAQ,EAAM,OACd,SAAU,EAAM,QAClB,EAAE,CACJ,CAEA,SAAS,EACP,EACA,EACsC,CAKtC,OAJI,EAAO,SAAW,EAAU,CAAC,GAEjC,EAAkB,CAAS,EAEpB,EAAY,EAAW,CAAM,EACtC,CAEA,SAAS,EACP,EACA,EACA,EACA,EACW,CAGX,OAFA,EAAkB,CAAS,EAEpB,EAAmB,EAAS,EAAW,EAAU,EAAc,CAAI,CAC5E,CAEA,SAAS,EACP,EACA,EACA,EACmD,CAGnD,OAFA,EAAkB,CAAS,EAEpB,EAAiB,EAAS,EAAW,EAAU,CAAI,CAC5D,CAEA,SAAS,EAAM,EAAsB,EAAkB,EAAiB,EAAyC,CAC/G,EAAkB,CAAS,EAE3B,IAAM,EAA4C,CAAC,EAEnD,IAAK,IAAM,KAAS,EACd,EAAY,EAAO,EAAW,EAAU,EAAQ,CAAI,GACtD,EAAS,KAAK,CAAK,EAIvB,IAAI,EAEJ,IAAK,IAAM,KAAS,GACd,CAAC,GAAU,EAAe,EAAQ,CAAK,KAAG,EAAS,GAGzD,IAAM,EAAW,EAAW,CAAM,EAUlC,MAAO,CAAE,WARgD,EAAS,IAAK,IAAW,CAChF,MAAO,EAAM,MACb,SAAU,EAAM,SAChB,KAAM,EAAM,KACZ,MAAO,EAAM,MACb,IAAK,IAAU,CACjB,EAES,EAAY,UAAS,CAChC,CAEA,SAAS,EAAQ,EAAqD,CACpE,EAAoB,CAAS,EAE7B,IAAM,EAAsB,CAC1B,WAAY,EAAU,WAAa,gBAAgB,EAAU,UAAU,EAAI,IAAA,GAC3E,GAAI,EAAU,GACd,MAAO,CAAC,GAAG,EAAU,KAAK,CAC5B,EAEA,MAAO,CACL,gBAAiB,EAAU,EAAc,IACvC,EAAmB,EAAS,EAAM,EAAU,EAAc,CAAI,EAChE,SAAW,GAAY,EAAO,SAAW,EAAI,CAAC,EAAI,EAAY,EAAM,CAAM,EAC1E,SAAU,EAAU,EAAQ,IAAU,EAAe,EAAM,EAAU,EAAQ,CAAI,EACjF,cAAe,EAAU,IAAU,EAAiB,EAAS,EAAM,EAAU,CAAI,EACjF,OAAQ,EAAU,EAAQ,IAAU,EAAM,EAAM,EAAU,EAAQ,CAAI,CACxE,CACF,CAMA,IAAI,EAEJ,SAAS,GAA2D,CAClE,MAAQ,KAAmB,OAAO,OAAO,EAAiB,EAAS,CAAY,CAAC,CAClF,CAEA,GAAI,EAAQ,QAAU,EAAQ,WAAY,CACxC,IAAM,EAAY,EAAgB,EAElC,GAAI,EAAU,OAAS,IACjB,EAAQ,YAAY,EAAU,QAAQ,EAAQ,UAAU,EAExD,EAAQ,QAAQ,CAClB,IAAM,EAAU,EACb,IAAK,GACJ,EAAE,OAAS,YACP,QAAQ,EAAE,OAAO,IAAI,EAAE,KAAK,WAAW,EAAE,OAAO,GAChD,QAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,WAAW,EAAE,eAAe,EACrE,CAAC,CACA,KAAK,IAAI,EAEZ,MAAM,IAAI,EAAgB,GAAG,EAAU,OAAO,8BAA8B,GAAS,CACvF,CAEJ,CAEA,MAAO,CAAE,iBAAgB,WAAU,kBAAiB,UAAS,UAAS,eAAc,OAAM,CAC5F,CClOA,SAAgB,EACd,EACA,EACA,EACA,EACA,EAC6B,CAC7B,IAAM,EAAW,EAAK,QAAQ,EAAW,EAAU,EAAQ,CAAI,EAM/D,OAJI,EAAS,QACJ,CAAE,QAAS,GAAM,WAAU,EAG7B,CAAE,WAAU,QAAS,GAAO,YAAW,OAAQ,EAAS,MAAO,CACxE,CAQA,eAAsB,EACpB,EACA,EACA,EACA,EACA,EACA,EACsC,CAGtC,OAAO,EAAa,EAAM,MAFF,EAAiB,CAAG,EAEP,EAAU,EAAQ,CAAI,CAC7D"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@vielzeug/ward",
+  "version": "1.0.2",
+  "description": "Role-based access control — typed permissions, wildcard patterns, and composable predicates",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    "./devtools": {
+      "source": "./src/devtools.ts",
+      "types": "./dist/devtools.d.ts",
+      "import": "./dist/devtools.js",
+      "require": "./dist/devtools.cjs"
+    },
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "vite build && pnpm run build:bundle && pnpm run build:types",
+    "build:types": "tsc -p tsconfig.declarations.json",
+    "fix": "eslint --fix src",
+    "lint": "eslint src",
+    "prepublishOnly": "pnpm run build",
+    "preview": "vite preview",
+    "test": "vitest",
+    "build:bundle": "vite build --config vite.bundle.config.ts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "~6.0.3",
+    "vite": "^8.1.3",
+    "vitest": "^4.1.9"
+  }
+}