@vielzeug/ward 2.3.0 → 26.10.0

package/dist/errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/**\n * Thrown when a `when` predicate in a ward rule throws an exception.\n *\n * Catch this to distinguish predicate failures from other errors:\n * ```ts\n * try {\n *   ward.explain(principal, resource, action, data);\n * } catch (e) {\n *   if (e instanceof WardPredicateError) {\n *     console.error(`Predicate in Rule[${e.ruleIndex}] threw`, e.cause);\n *   }\n * }\n * ```\n */\nexport class WardPredicateError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    const msg = cause instanceof Error ? cause.message : String(cause);\n\n    super(`Rule[${ruleIndex}] threw: ${msg}`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n"],"mappings":"AACA,IAAa,EAAb,cAA+B,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAGa,EAAb,cAAqC,CAAU,CAAC,EAgBnC,EAAb,cAAwC,CAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,IAAM,EAAM,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAEjE,MAAM,QAAQ,EAAU,WAAW,IAAO,CAAE,OAAM,CAAC,EACnD,KAAK,UAAY,CACnB,CACF"}
+{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition, decision attributes, or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/** Thrown when an application-provided rule condition fails. */\nexport class WardConditionError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    super(`Rule[${ruleIndex}].condition failed`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n"],"mappings":"AACA,IAAa,UAAb,cAA+B,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAGa,gBAAb,cAAqC,SAAU,CAAC,EAGnC,mBAAb,cAAwC,SAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,MAAM,QAAQ,EAAU,oBAAqB,CAAE,OAAM,CAAC,EACtD,KAAK,UAAY,CACnB,CACF"}

package/dist/errors.d.ts

@@ -2,24 +2,11 @@
 export declare class WardError extends Error {
     constructor(message: string, opts?: ErrorOptions);
 }
-/** Thrown when a rule definition or principal is malformed. */
+/** Thrown when a rule definition, decision attributes, or principal is malformed. */
 export declare class WardConfigError extends WardError {
 }
-/**
- * Thrown when a `when` predicate in a ward rule throws an exception.
- *
- * Catch this to distinguish predicate failures from other errors:
- * ```ts
- * try {
- *   ward.explain(principal, resource, action, data);
- * } catch (e) {
- *   if (e instanceof WardPredicateError) {
- *     console.error(`Predicate in Rule[${e.ruleIndex}] threw`, e.cause);
- *   }
- * }
- * ```
- */
-export declare class WardPredicateError extends WardError {
+/** Thrown when an application-provided rule condition fails. */
+export declare class WardConditionError extends WardError {
     readonly ruleIndex: number;
     constructor(ruleIndex: number, cause: unknown);
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED,+DAA+D;AAC/D,qBAAa,eAAgB,SAAQ,SAAS;CAAG;AAEjD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAM9C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED,qFAAqF;AACrF,qBAAa,eAAgB,SAAQ,SAAS;CAAG;AAEjD,gEAAgE;AAChE,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAI9C"}

package/dist/errors.js

@@ -1,16 +1,2 @@
-//#region src/errors.ts
-var e = class extends Error {
-	constructor(e, t) {
-		super(e, t), this.name = new.target.name, Object.setPrototypeOf(this, new.target.prototype);
-	}
-}, t = class extends e {}, n = class extends e {
-	ruleIndex;
-	constructor(e, t) {
-		let n = t instanceof Error ? t.message : String(t);
-		super(`Rule[${e}] threw: ${n}`, { cause: t }), this.ruleIndex = e;
-	}
-};
-//#endregion
-export { t as WardConfigError, e as WardError, n as WardPredicateError };
-
+var WardError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},WardConfigError=class extends WardError{},WardConditionError=class extends WardError{ruleIndex;constructor(e,t){super(`Rule[${e}].condition failed`,{cause:t}),this.ruleIndex=e}};export{WardConditionError,WardConfigError,WardError};
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/**\n * Thrown when a `when` predicate in a ward rule throws an exception.\n *\n * Catch this to distinguish predicate failures from other errors:\n * ```ts\n * try {\n *   ward.explain(principal, resource, action, data);\n * } catch (e) {\n *   if (e instanceof WardPredicateError) {\n *     console.error(`Predicate in Rule[${e.ruleIndex}] threw`, e.cause);\n *   }\n * }\n * ```\n */\nexport class WardPredicateError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    const msg = cause instanceof Error ? cause.message : String(cause);\n\n    super(`Rule[${ruleIndex}] threw: ${msg}`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n"],"mappings":";AACA,IAAa,IAAb,cAA+B,MAAM;CACnC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAM,GAAS,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAGa,IAAb,cAAqC,EAAU,CAAC,GAgBnC,IAAb,cAAwC,EAAU;CAChD;CAEA,YAAY,GAAmB,GAAgB;EAC7C,IAAM,IAAM,aAAiB,QAAQ,EAAM,UAAU,OAAO,CAAK;EAGjE,AADA,MAAM,QAAQ,EAAU,WAAW,KAAO,EAAE,SAAM,CAAC,GACnD,KAAK,YAAY;CACnB;AACF"}
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition, decision attributes, or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/** Thrown when an application-provided rule condition fails. */\nexport class WardConditionError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    super(`Rule[${ruleIndex}].condition failed`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n"],"mappings":"AACA,IAAa,UAAb,cAA+B,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAGa,gBAAb,cAAqC,SAAU,CAAC,EAGnC,mBAAb,cAAwC,SAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,MAAM,QAAQ,EAAU,oBAAqB,CAAE,OAAM,CAAC,EACtD,KAAK,UAAY,CACnB,CACF"}

package/dist/factory.cjs

@@ -1,2 +1,2 @@
-const e=require("./errors.cjs"),t=require("./_compile.cjs"),n=require("./_match.cjs"),r=require("./_conflict.cjs");var i=require("./_dev.cjs").warnAnonymousPredicates;function a(e,t,r,i,a){let o=new Set,s=[];for(let c of i)o.has(c)||(o.add(c),n.pickWinner(e,t,r,c,a)?.rule.effect===`allow`&&s.push(c));return s}function o(e,t,r,i){let a=i===void 0,o=[];for(let s of e)n.matchesRule(s,t,r,void 0,i,a)&&o.push(s.rule);return o}function s(s=[],c={}){if(c.maxConflicts!==void 0&&(!Number.isFinite(c.maxConflicts)||c.maxConflicts<0))throw new e.WardConfigError(`maxConflicts must be a finite non-negative number.`);if(c.onConflict!==void 0&&typeof c.onConflict!=`function`)throw new e.WardConfigError(`onConflict must be a function.`);let{maxConflicts:l=1/0}=c,u=new Set,d=[];for(let e of s)if(Array.isArray(e))for(let t of e)d.push(t);else d.push(e);let f=d.map((e,n)=>t.compileEntry(e,n));i(f);function p(e){if(u.size!==0)for(let t of u)try{t(e)}catch{}}function m(e,t,r,i){let a=n.pickWinner(f,e,t,r,i),o=n.toDecision(a);return p({action:r,data:i,decision:o,principal:e,resource:t}),o}function h(e){let{action:t,data:r,principal:i,resource:a}=e;return n.validatePrincipal(i),m(i,a,t,r)}function g(e,t){return t.map(t=>({...m(e,t.resource,t.action,t.data),action:t.action,resource:t.resource}))}function _(e,t){return t.length===0?[]:(n.validatePrincipal(e),g(e,t))}function v(e){let{data:t,knownActions:r,principal:i,resource:o}=e;return n.validatePrincipal(i),a(f,i,o,r,t)}function y(e){let{data:t,principal:r,resource:i}=e;return n.validatePrincipal(r),o(f,r,i,t)}function b(e){let{action:t,data:r,principal:i,resource:a}=e;n.validatePrincipal(i);let o=[];for(let e of f)n.matchesRule(e,i,a,t,r)&&o.push(e);let s;for(let e of o)(!s||n.isOverriddenBy(s,e))&&(s=e);let c=n.toDecision(s);return{candidates:o.map(e=>({index:e.index,priority:e.priority,rule:e.rule,score:e.score,won:e===s})),decision:c}}function x(e){n.assertUserPrincipal(e);let t={attributes:e.attributes?structuredClone(e.attributes):void 0,id:e.id,roles:[...e.roles]};return{allowedActions:e=>a(f,t,e.resource,e.knownActions,e.data),checkAll:e=>e.length===0?[]:g(t,e),explain:e=>m(t,e.resource,e.action,e.data),rulesInScope:e=>o(f,t,e.resource,e.data),trace:e=>b({action:e.action,data:e.data,principal:t,resource:e.resource})}}let S;function C(){return S??=Object.freeze(r.computeConflicts(f,l))}if(c.strict||c.onConflict){let t=C();if(t.length>0&&(c.onConflict&&t.forEach(c.onConflict),c.strict)){let n=t.map(e=>e.kind===`duplicate`?`Rule[${e.indexB}] ${e.kind} of Rule[${e.indexA}]`:`Rule[${e.shadowedIndex}] ${e.kind} by Rule[${e.shadowingIndex}]`).join(`; `);throw new e.WardConfigError(`${t.length} rule conflict(s) detected: ${n}`)}}function w(e,t){u.add(e);let n=()=>u.delete(e);if(t?.signal){if(t.signal.aborted)return u.delete(e),()=>{};t.signal.addEventListener(`abort`,n,{once:!0})}return()=>{u.delete(e),t?.signal?.removeEventListener(`abort`,n)}}return{allowedActions:v,checkAll:_,detectConflicts:C,explain:h,forUser:x,rulesInScope:y,tap:w,trace:b}}exports.createWard=s;
+const e=require("./_compile.cjs"),t=require("./_match.cjs");let n=require("@vielzeug/arsenal");function createWard(r=[]){let i=Object.freeze(r.flat().map((t,n)=>e.compileRule(t,n))),a=Object.freeze([...new Set(i.flatMap(e=>e.effect===`allow`&&!e.action.includes(`*`)?[e.action]:[]))]),o=(0,n.tapper)();function evaluate(e,n){let r=t.snapshotDecisionInput(e);for(let e=0;e<i.length;e++){let a=i[e];if(t.ruleMatches(a,e,r)){let t=Object.freeze({effect:a.effect,matched:!0,reason:`rule[${e}] ${a.effect===`allow`?`allows`:`denies`} '${r.action}' on '${r.resource}'`,rule:a});return n&&emitDecision(r,t),t}}let a=Object.freeze({effect:`deny`,matched:!1,reason:`no matching rule for '${r.action}' on '${r.resource}' (default deny)`});return n&&emitDecision(r,a),a}function emitDecision(e,t){o.emit(Object.freeze({decision:t,input:e,type:`decision`}))}function decide(e){return evaluate(e,!0)}function checkAll(e){return e.map(decide)}function allowedActions(e){let t=e.filter??a,n=new Set;return t.filter(t=>!n.has(t)&&(n.add(t),evaluate({...e,action:t},!1).effect===`allow`))}function forPrincipal(e){let n=t.snapshotPrincipal(e);return{allowedActions:e=>allowedActions({...e,principal:n}),checkAll:e=>checkAll(e.map(e=>({...e,principal:n}))),decide:e=>decide({...e,principal:n})}}return{allowedActions,checkAll,decide,forPrincipal,knownActions:a,rules:i,tap:(e,t)=>o.tap(e,t)}}exports.createWard=createWard;
 //# sourceMappingURL=factory.cjs.map

package/dist/factory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory.cjs","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import type { CompiledEntry } from './_compile';\nimport { compileEntry } from './_compile';\nimport { computeConflicts } from './_conflict';\nimport { warnAnonymousPredicates } from './_dev';\nimport { assertUserPrincipal, isOverriddenBy, matchesRule, pickWinner, toDecision, validatePrincipal } from './_match';\nimport { WardConfigError } from './errors';\nimport type {\n  BoundWard,\n  BoundWardAllowedActionsInput,\n  BoundWardDecisionInput,\n  BoundWardRulesInScopeInput,\n  NormalizedWardRule,\n  Principal,\n  UserPrincipal,\n  Ward,\n  WardAllowedActionsInput,\n  WardCheck,\n  WardConflict,\n  WardDecision,\n  WardDecisionInput,\n  WardDecisionResult,\n  WardEvent,\n  WardOptions,\n  WardRule,\n  WardRulesInScopeInput,\n  WardTrace,\n  WardTraceCandidate,\n} from './types';\n\nconst warn = warnAnonymousPredicates;\n\n// ---------------------------------------------------------------------------\n// Shared loop cores (validation-free; used by both public API and forUser)\n// ---------------------------------------------------------------------------\n\nfunction coreAllowedActions<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  knownActions: readonly TAction[],\n  data: TData | undefined,\n): TAction[] {\n  const seen = new Set<TAction>();\n  const result: TAction[] = [];\n\n  for (const action of knownActions) {\n    if (seen.has(action)) continue;\n\n    seen.add(action);\n\n    const winner = pickWinner(entries, principal, resource, action, data);\n\n    if (winner?.rule.effect === 'allow') result.push(action);\n  }\n\n  return result;\n}\n\nfunction coreRulesInScope<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  data: TData | undefined,\n): NormalizedWardRule<TAction, TData>[] {\n  const skipPredicate = data === undefined;\n  const result: NormalizedWardRule<TAction, TData>[] = [];\n\n  for (const entry of entries) {\n    if (!matchesRule(entry, principal, resource, undefined, data, skipPredicate)) continue;\n\n    result.push(entry.rule as NormalizedWardRule<TAction, TData>);\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Creates an authorization ward from a set of rules.\n *\n * **Winner selection** when multiple rules match a request:\n * 1. Higher `priority` wins.\n * 2. On priority tie, higher specificity score wins (exact > namespace-wildcard > global-wildcard,\n *    applied independently to role, resource, and action).\n * 3. On specificity tie, `deny` beats `allow` (denyBonus tiebreaker).\n * 4. On absolute tie (identical priority, specificity, and effect), the rule declared\n *    **first in the input array** wins.\n */\nexport function createWard<TAction extends string = string, TData = unknown>(\n  rules: readonly (WardRule<TAction, TData> | readonly WardRule<TAction, TData>[])[] = [],\n  options: WardOptions<TAction, TData> = {},\n): Ward<TAction, TData> {\n  if (options.maxConflicts !== undefined) {\n    if (!Number.isFinite(options.maxConflicts) || options.maxConflicts < 0) {\n      throw new WardConfigError('maxConflicts must be a finite non-negative number.');\n    }\n  }\n\n  if (options.onConflict !== undefined && typeof options.onConflict !== 'function') {\n    throw new WardConfigError('onConflict must be a function.');\n  }\n\n  const { maxConflicts = Infinity } = options;\n  const tappers = new Set<(event: WardEvent<TAction, TData>) => void>();\n  const flat: WardRule<TAction, TData>[] = [];\n\n  for (const entry of rules) {\n    if (Array.isArray(entry)) {\n      for (const rule of entry) flat.push(rule);\n    } else {\n      flat.push(entry as WardRule<TAction, TData>);\n    }\n  }\n\n  const entries = flat.map((rule, i) => compileEntry(rule, i));\n\n  // Warn in development when an ANONYMOUS-role rule has a predicate.\n  warn(entries);\n\n  // -------------------------------------------------------------------------\n  // Core decision + logging\n  // -------------------------------------------------------------------------\n\n  function emitTap(event: WardEvent<TAction, TData>): void {\n    if (tappers.size === 0) return;\n    for (const tapper of tappers) {\n      try {\n        tapper(event);\n      } catch {\n        // Observability must not affect ward behavior.\n      }\n    }\n  }\n\n  function evaluateAndLog(\n    principal: Principal,\n    resource: string,\n    action: TAction,\n    data: TData | undefined,\n  ): WardDecision<TAction, TData> {\n    const winner = pickWinner(entries, principal, resource, action, data);\n    const decision = toDecision(winner);\n\n    emitTap({ action, data, decision, principal, resource });\n\n    return decision;\n  }\n\n  // -------------------------------------------------------------------------\n  // Public API\n  // -------------------------------------------------------------------------\n  // Request objects avoid call-site ambiguity between resource/action/data and\n  // make later API growth additive instead of positional-breaking.\n\n  function explain(input: WardDecisionInput<TAction, TData>): WardDecision<TAction, TData> {\n    const { action, data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return evaluateAndLog(principal, resource, action, data);\n  }\n\n  function runCheckAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    return checks.map((check) => ({\n      ...evaluateAndLog(principal, check.resource, check.action, check.data),\n      action: check.action,\n      resource: check.resource,\n    }));\n  }\n\n  function checkAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    if (checks.length === 0) return [];\n\n    validatePrincipal(principal);\n\n    return runCheckAll(principal, checks);\n  }\n\n  function allowedActions(input: WardAllowedActionsInput<TAction, TData>): TAction[] {\n    const { data, knownActions, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return coreAllowedActions(entries, principal, resource, knownActions, data);\n  }\n\n  function rulesInScope(\n    input: WardRulesInScopeInput<TData>,\n  ): ReadonlyArray<Readonly<NormalizedWardRule<TAction, TData>>> {\n    const { data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return coreRulesInScope(entries, principal, resource, data);\n  }\n\n  function trace(input: WardDecisionInput<TAction, TData>): WardTrace<TAction, TData> {\n    const { action, data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    const matching: CompiledEntry<TAction, TData>[] = [];\n\n    for (const entry of entries) {\n      if (matchesRule(entry, principal, resource, action, data)) {\n        matching.push(entry);\n      }\n    }\n\n    let winner: CompiledEntry<TAction, TData> | undefined;\n\n    for (const entry of matching) {\n      if (!winner || isOverriddenBy(winner, entry)) winner = entry;\n    }\n\n    const decision = toDecision(winner);\n\n    const candidates: WardTraceCandidate<TAction, TData>[] = matching.map((entry) => ({\n      index: entry.index,\n      priority: entry.priority,\n      rule: entry.rule,\n      score: entry.score,\n      won: entry === winner,\n    }));\n\n    return { candidates, decision };\n  }\n\n  function forUser(principal: UserPrincipal): BoundWard<TAction, TData> {\n    assertUserPrincipal(principal);\n\n    const snap: UserPrincipal = {\n      attributes: principal.attributes ? structuredClone(principal.attributes) : undefined,\n      id: principal.id,\n      roles: [...principal.roles],\n    };\n\n    return {\n      allowedActions: (input: BoundWardAllowedActionsInput<TAction, TData>) =>\n        coreAllowedActions(entries, snap, input.resource, input.knownActions, input.data),\n      checkAll: (checks) => (checks.length === 0 ? [] : runCheckAll(snap, checks)),\n      explain: (input: BoundWardDecisionInput<TAction, TData>) =>\n        evaluateAndLog(snap, input.resource, input.action, input.data),\n      rulesInScope: (input: BoundWardRulesInScopeInput<TData>) =>\n        coreRulesInScope(entries, snap, input.resource, input.data),\n      trace: (input: BoundWardDecisionInput<TAction, TData>) =>\n        trace({ action: input.action, data: input.data, principal: snap, resource: input.resource }),\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // Conflict detection (lazy, cached)\n  // -------------------------------------------------------------------------\n\n  let conflictsCache: readonly WardConflict<TAction, TData>[] | undefined;\n\n  function detectConflicts(): readonly WardConflict<TAction, TData>[] {\n    return (conflictsCache ??= Object.freeze(computeConflicts(entries, maxConflicts)));\n  }\n\n  if (options.strict || options.onConflict) {\n    const conflicts = detectConflicts();\n\n    if (conflicts.length > 0) {\n      if (options.onConflict) conflicts.forEach(options.onConflict);\n\n      if (options.strict) {\n        const details = conflicts\n          .map((c) =>\n            c.kind === 'duplicate'\n              ? `Rule[${c.indexB}] ${c.kind} of Rule[${c.indexA}]`\n              : `Rule[${c.shadowedIndex}] ${c.kind} by Rule[${c.shadowingIndex}]`,\n          )\n          .join('; ');\n\n        throw new WardConfigError(`${conflicts.length} rule conflict(s) detected: ${details}`);\n      }\n    }\n  }\n\n  function tap(handler: (event: WardEvent<TAction, TData>) => void, opts?: { signal?: AbortSignal }): () => void {\n    tappers.add(handler);\n\n    const onAbort = () => tappers.delete(handler);\n\n    if (opts?.signal) {\n      if (opts.signal.aborted) {\n        tappers.delete(handler);\n        return () => {};\n      }\n      opts.signal.addEventListener('abort', onAbort, { once: true });\n    }\n\n    return () => {\n      tappers.delete(handler);\n      opts?.signal?.removeEventListener('abort', onAbort);\n    };\n  }\n\n  return { allowedActions, checkAll, detectConflicts, explain, forUser, rulesInScope, tap, trace };\n}\n"],"mappings":"mHA6BA,IAAM,sBAAO,CAAA,CAAA,wBAMb,SAAS,EACP,EACA,EACA,EACA,EACA,EACW,CACX,IAAM,EAAO,IAAI,IACX,EAAoB,CAAC,EAE3B,IAAK,IAAM,KAAU,EACf,EAAK,IAAI,CAAM,IAEnB,EAAK,IAAI,CAAM,EAEA,EAAA,WAAW,EAAS,EAAW,EAAU,EAAQ,CAE5D,CAAA,EAAQ,KAAK,SAAW,SAAS,EAAO,KAAK,CAAM,GAGzD,OAAO,CACT,CAEA,SAAS,EACP,EACA,EACA,EACA,EACsC,CACtC,IAAM,EAAgB,IAAS,IAAA,GACzB,EAA+C,CAAC,EAEtD,IAAK,IAAM,KAAS,EACb,EAAA,YAAY,EAAO,EAAW,EAAU,IAAA,GAAW,EAAM,CAAa,GAE3E,EAAO,KAAK,EAAM,IAA0C,EAG9D,OAAO,CACT,CAiBA,SAAgB,EACd,EAAqF,CAAC,EACtF,EAAuC,CAAC,EAClB,CACtB,GAAI,EAAQ,eAAiB,IAAA,KACvB,CAAC,OAAO,SAAS,EAAQ,YAAY,GAAK,EAAQ,aAAe,GACnE,MAAM,IAAI,EAAA,gBAAgB,oDAAoD,EAIlF,GAAI,EAAQ,aAAe,IAAA,IAAa,OAAO,EAAQ,YAAe,WACpE,MAAM,IAAI,EAAA,gBAAgB,gCAAgC,EAG5D,GAAM,CAAE,eAAe,KAAa,EAC9B,EAAU,IAAI,IACd,EAAmC,CAAC,EAE1C,IAAK,IAAM,KAAS,EAClB,GAAI,MAAM,QAAQ,CAAK,EACrB,IAAK,IAAM,KAAQ,EAAO,EAAK,KAAK,CAAI,OAExC,EAAK,KAAK,CAAiC,EAI/C,IAAM,EAAU,EAAK,KAAK,EAAM,IAAM,EAAA,aAAa,EAAM,CAAC,CAAC,EAG3D,EAAK,CAAO,EAMZ,SAAS,EAAQ,EAAwC,CACnD,KAAQ,OAAS,EACrB,IAAK,IAAM,KAAU,EACnB,GAAI,CACF,EAAO,CAAK,CACd,MAAQ,CAER,CAEJ,CAEA,SAAS,EACP,EACA,EACA,EACA,EAC8B,CAC9B,IAAM,EAAS,EAAA,WAAW,EAAS,EAAW,EAAU,EAAQ,CAAI,EAC9D,EAAW,EAAA,WAAW,CAAM,EAIlC,OAFA,EAAQ,CAAE,SAAQ,OAAM,WAAU,YAAW,UAAS,CAAC,EAEhD,CACT,CAQA,SAAS,EAAQ,EAAwE,CACvF,GAAM,CAAE,SAAQ,OAAM,YAAW,YAAa,EAI9C,OAFA,EAAA,kBAAkB,CAAS,EAEpB,EAAe,EAAW,EAAU,EAAQ,CAAI,CACzD,CAEA,SAAS,EACP,EACA,EACsC,CACtC,OAAO,EAAO,IAAK,IAAW,CAC5B,GAAG,EAAe,EAAW,EAAM,SAAU,EAAM,OAAQ,EAAM,IAAI,EACrE,OAAQ,EAAM,OACd,SAAU,EAAM,QAClB,EAAE,CACJ,CAEA,SAAS,EACP,EACA,EACsC,CAKtC,OAJI,EAAO,SAAW,EAAU,CAAC,GAEjC,EAAA,kBAAkB,CAAS,EAEpB,EAAY,EAAW,CAAM,EACtC,CAEA,SAAS,EAAe,EAA2D,CACjF,GAAM,CAAE,OAAM,eAAc,YAAW,YAAa,EAIpD,OAFA,EAAA,kBAAkB,CAAS,EAEpB,EAAmB,EAAS,EAAW,EAAU,EAAc,CAAI,CAC5E,CAEA,SAAS,EACP,EAC6D,CAC7D,GAAM,CAAE,OAAM,YAAW,YAAa,EAItC,OAFA,EAAA,kBAAkB,CAAS,EAEpB,EAAiB,EAAS,EAAW,EAAU,CAAI,CAC5D,CAEA,SAAS,EAAM,EAAqE,CAClF,GAAM,CAAE,SAAQ,OAAM,YAAW,YAAa,EAE9C,EAAA,kBAAkB,CAAS,EAE3B,IAAM,EAA4C,CAAC,EAEnD,IAAK,IAAM,KAAS,EACd,EAAA,YAAY,EAAO,EAAW,EAAU,EAAQ,CAAI,GACtD,EAAS,KAAK,CAAK,EAIvB,IAAI,EAEJ,IAAK,IAAM,KAAS,GACd,CAAC,GAAU,EAAA,eAAe,EAAQ,CAAK,KAAG,EAAS,GAGzD,IAAM,EAAW,EAAA,WAAW,CAAM,EAUlC,MAAO,CAAE,WARgD,EAAS,IAAK,IAAW,CAChF,MAAO,EAAM,MACb,SAAU,EAAM,SAChB,KAAM,EAAM,KACZ,MAAO,EAAM,MACb,IAAK,IAAU,CACjB,EAES,EAAY,UAAS,CAChC,CAEA,SAAS,EAAQ,EAAqD,CACpE,EAAA,oBAAoB,CAAS,EAE7B,IAAM,EAAsB,CAC1B,WAAY,EAAU,WAAa,gBAAgB,EAAU,UAAU,EAAI,IAAA,GAC3E,GAAI,EAAU,GACd,MAAO,CAAC,GAAG,EAAU,KAAK,CAC5B,EAEA,MAAO,CACL,eAAiB,GACf,EAAmB,EAAS,EAAM,EAAM,SAAU,EAAM,aAAc,EAAM,IAAI,EAClF,SAAW,GAAY,EAAO,SAAW,EAAI,CAAC,EAAI,EAAY,EAAM,CAAM,EAC1E,QAAU,GACR,EAAe,EAAM,EAAM,SAAU,EAAM,OAAQ,EAAM,IAAI,EAC/D,aAAe,GACb,EAAiB,EAAS,EAAM,EAAM,SAAU,EAAM,IAAI,EAC5D,MAAQ,GACN,EAAM,CAAE,OAAQ,EAAM,OAAQ,KAAM,EAAM,KAAM,UAAW,EAAM,SAAU,EAAM,QAAS,CAAC,CAC/F,CACF,CAMA,IAAI,EAEJ,SAAS,GAA2D,CAClE,MAAQ,KAAmB,OAAO,OAAO,EAAA,iBAAiB,EAAS,CAAY,CAAC,CAClF,CAEA,GAAI,EAAQ,QAAU,EAAQ,WAAY,CACxC,IAAM,EAAY,EAAgB,EAElC,GAAI,EAAU,OAAS,IACjB,EAAQ,YAAY,EAAU,QAAQ,EAAQ,UAAU,EAExD,EAAQ,QAAQ,CAClB,IAAM,EAAU,EACb,IAAK,GACJ,EAAE,OAAS,YACP,QAAQ,EAAE,OAAO,IAAI,EAAE,KAAK,WAAW,EAAE,OAAO,GAChD,QAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,WAAW,EAAE,eAAe,EACrE,CAAC,CACA,KAAK,IAAI,EAEZ,MAAM,IAAI,EAAA,gBAAgB,GAAG,EAAU,OAAO,8BAA8B,GAAS,CACvF,CAEJ,CAEA,SAAS,EAAI,EAAqD,EAA6C,CAC7G,EAAQ,IAAI,CAAO,EAEnB,IAAM,MAAgB,EAAQ,OAAO,CAAO,EAE5C,GAAI,GAAM,OAAQ,CAChB,GAAI,EAAK,OAAO,QAEd,OADA,EAAQ,OAAO,CAAO,MACT,CAAC,EAEhB,EAAK,OAAO,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,CAC/D,CAEA,UAAa,CACX,EAAQ,OAAO,CAAO,EACtB,GAAM,QAAQ,oBAAoB,QAAS,CAAO,CACpD,CACF,CAEA,MAAO,CAAE,iBAAgB,WAAU,kBAAiB,UAAS,UAAS,eAAc,MAAK,OAAM,CACjG"}
+{"version":3,"file":"factory.cjs","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import { tapper } from '@vielzeug/arsenal';\n\nimport { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection — order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Its declarative `roles` (if any) include the principal's role, `ANONYMOUS`\n *    matches a null principal, and `WILDCARD` matches any authenticated principal.\n * 4. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 5. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const knownActions = Object.freeze([\n    ...new Set(\n      compiled.flatMap((rule) => (rule.effect === 'allow' && !rule.action.includes('*') ? [rule.action] : [])),\n    ),\n  ]) as readonly TAction[];\n  const tappers = tapper<WardEvent<TAction, TResource, TAttributes>>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    tappers.emit(Object.freeze({ decision, input, type: 'decision' as const }));\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    filter?: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const candidates = input.filter ?? knownActions;\n    const seen = new Set<TAction>();\n\n    return candidates.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  return {\n    allowedActions,\n    checkAll,\n    decide,\n    forPrincipal,\n    knownActions,\n    rules: compiled,\n    tap: (handler, options) => tappers.tap(handler, options),\n  };\n}\n"],"mappings":"+FAgCA,SAAgB,WAKd,EAGM,CAAC,EACgC,CACvC,IAAM,EAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,EAAM,IAAU,EAAA,YAAY,EAAM,CAAK,CAAC,CAAC,EACpF,EAAe,OAAO,OAAO,CACjC,GAAG,IAAI,IACL,EAAS,QAAS,GAAU,EAAK,SAAW,SAAW,CAAC,EAAK,OAAO,SAAS,GAAG,EAAI,CAAC,EAAK,MAAM,EAAI,CAAC,CAAE,CACzG,CACF,CAAC,EACK,GAAA,EAAU,EAAA,OAAA,CAAmD,EAEnE,SAAS,SACP,EACA,EAC+C,CAC/C,IAAM,EAAa,EAAA,sBAAsB,CAAK,EAE9C,IAAK,IAAI,EAAQ,EAAG,EAAQ,EAAS,OAAQ,IAAS,CACpD,IAAM,EAAO,EAAS,GAEtB,GAAI,EAAA,YAAY,EAAM,EAAO,CAAU,EAAG,CACxC,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,EAAK,OACb,QAAS,GACT,OAAQ,QAAQ,EAAM,IAAI,EAAK,SAAW,QAAU,SAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS,GAC1H,MACF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CACF,CAEA,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,OACR,QAAS,GACT,OAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS,iBACjF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CAEA,SAAS,aACP,EACA,EACM,CACN,EAAQ,KAAK,OAAO,OAAO,CAAE,WAAU,QAAO,KAAM,UAAoB,CAAC,CAAC,CAC5E,CAEA,SAAS,OACP,EAC+C,CAC/C,OAAO,SAAS,EAAO,EAAI,CAC7B,CAEA,SAAS,SACP,EACiD,CACjD,OAAO,EAAO,IAAI,MAAM,CAC1B,CAEA,SAAS,eAAe,EAKV,CACZ,IAAM,EAAa,EAAM,QAAU,EAC7B,EAAO,IAAI,IAEjB,OAAO,EAAW,OAAQ,GACxB,CAAI,EAAK,IAAI,CAAM,IACnB,EAAK,IAAI,CAAM,EACR,SAAS,CAAE,GAAG,EAAO,QAAO,EAAG,EAAK,CAAC,CAAC,SAAW,QACzD,CACH,CAEA,SAAS,aAAa,EAAmE,CACvF,IAAM,EAAW,EAAA,kBAAkB,CAAS,EAE5C,MAAO,CACL,eAAiB,GAAU,eAAe,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,EAC3E,SAAW,GAAW,SAAS,EAAO,IAAK,IAAW,CAAE,GAAG,EAAO,UAAW,CAAS,EAAE,CAAC,EACzF,OAAS,GAAU,OAAO,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,CAC7D,CACF,CAEA,MAAO,CACL,eACA,SACA,OACA,aACA,eACA,MAAO,EACP,KAAM,EAAS,IAAY,EAAQ,IAAI,EAAS,CAAO,CACzD,CACF"}

package/dist/factory.d.ts

@@ -1,14 +1,20 @@
-import type { Ward, WardOptions, WardRule } from './types';
+import type { Ward, WardAttributes, WardRule } from './types';
 /**
- * Creates an authorization ward from a set of rules.
+ * Creates an authorization ward from an ordered list of rules.
  *
- * **Winner selection** when multiple rules match a request:
- * 1. Higher `priority` wins.
- * 2. On priority tie, higher specificity score wins (exact > namespace-wildcard > global-wildcard,
- *    applied independently to role, resource, and action).
- * 3. On specificity tie, `deny` beats `allow` (denyBonus tiebreaker).
- * 4. On absolute tie (identical priority, specificity, and effect), the rule declared
- *    **first in the input array** wins.
+ * **Decision model**: rules are evaluated in declaration order; the first rule
+ * that matches the request wins. If no rule matches, the decision is **deny**
+ * (default deny). There is no priority, specificity scoring, or conflict
+ * detection — order is the only tiebreaker.
+ *
+ * A rule matches when:
+ * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).
+ * 2. Its `resource` pattern matches the requested resource.
+ * 3. Its declarative `roles` (if any) include the principal's role, `ANONYMOUS`
+ *    matches a null principal, and `WILDCARD` matches any authenticated principal.
+ * 4. Every key in its declarative `attributes` is present and equal in the
+ *    request's `attributes` (deep equality).
+ * 5. Its `condition` escape-hatch callback (if any) returns `true`.
  */
-export declare function createWard<TAction extends string = string, TData = unknown>(rules?: readonly (WardRule<TAction, TData> | readonly WardRule<TAction, TData>[])[], options?: WardOptions<TAction, TData>): Ward<TAction, TData>;
+export declare function createWard<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes>(rules?: readonly (WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>> | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[])[]): Ward<TAction, TResource, TAttributes>;
 //# sourceMappingURL=factory.d.ts.map

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAQV,IAAI,EAQJ,WAAW,EACX,QAAQ,EAIT,MAAM,SAAS,CAAC;AAqDjB;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,KAAK,GAAG,OAAO,EACzE,KAAK,GAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,SAAS,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAO,EACvF,OAAO,GAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAM,GACxC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAuNtB"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,IAAI,EACJ,cAAc,EAId,QAAQ,EACT,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CACxB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,KAAK,GAAE,SAAS,CACZ,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,GACpE,SAAS,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAClF,EAAO,GACP,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CA+FvC"}

package/dist/factory.js

@@ -1,138 +1,2 @@
-import { WardConfigError as e } from "./errors.js";
-import { compileEntry as t } from "./_compile.js";
-import { assertUserPrincipal as n, isOverriddenBy as r, matchesRule as i, pickWinner as a, toDecision as o, validatePrincipal as s } from "./_match.js";
-import { computeConflicts as c } from "./_conflict.js";
-import { warnAnonymousPredicates as l } from "./_dev.js";
-//#region src/factory.ts
-var u = l;
-function d(e, t, n, r, i) {
-	let o = /* @__PURE__ */ new Set(), s = [];
-	for (let c of r) o.has(c) || (o.add(c), a(e, t, n, c, i)?.rule.effect === "allow" && s.push(c));
-	return s;
-}
-function f(e, t, n, r) {
-	let a = r === void 0, o = [];
-	for (let s of e) i(s, t, n, void 0, r, a) && o.push(s.rule);
-	return o;
-}
-function p(l = [], p = {}) {
-	if (p.maxConflicts !== void 0 && (!Number.isFinite(p.maxConflicts) || p.maxConflicts < 0)) throw new e("maxConflicts must be a finite non-negative number.");
-	if (p.onConflict !== void 0 && typeof p.onConflict != "function") throw new e("onConflict must be a function.");
-	let { maxConflicts: m = Infinity } = p, h = /* @__PURE__ */ new Set(), g = [];
-	for (let e of l) if (Array.isArray(e)) for (let t of e) g.push(t);
-	else g.push(e);
-	let _ = g.map((e, n) => t(e, n));
-	u(_);
-	function v(e) {
-		if (h.size !== 0) for (let t of h) try {
-			t(e);
-		} catch {}
-	}
-	function y(e, t, n, r) {
-		let i = a(_, e, t, n, r), s = o(i);
-		return v({
-			action: n,
-			data: r,
-			decision: s,
-			principal: e,
-			resource: t
-		}), s;
-	}
-	function b(e) {
-		let { action: t, data: n, principal: r, resource: i } = e;
-		return s(r), y(r, i, t, n);
-	}
-	function x(e, t) {
-		return t.map((t) => ({
-			...y(e, t.resource, t.action, t.data),
-			action: t.action,
-			resource: t.resource
-		}));
-	}
-	function S(e, t) {
-		return t.length === 0 ? [] : (s(e), x(e, t));
-	}
-	function C(e) {
-		let { data: t, knownActions: n, principal: r, resource: i } = e;
-		return s(r), d(_, r, i, n, t);
-	}
-	function w(e) {
-		let { data: t, principal: n, resource: r } = e;
-		return s(n), f(_, n, r, t);
-	}
-	function T(e) {
-		let { action: t, data: n, principal: a, resource: c } = e;
-		s(a);
-		let l = [];
-		for (let e of _) i(e, a, c, t, n) && l.push(e);
-		let u;
-		for (let e of l) (!u || r(u, e)) && (u = e);
-		let d = o(u);
-		return {
-			candidates: l.map((e) => ({
-				index: e.index,
-				priority: e.priority,
-				rule: e.rule,
-				score: e.score,
-				won: e === u
-			})),
-			decision: d
-		};
-	}
-	function E(e) {
-		n(e);
-		let t = {
-			attributes: e.attributes ? structuredClone(e.attributes) : void 0,
-			id: e.id,
-			roles: [...e.roles]
-		};
-		return {
-			allowedActions: (e) => d(_, t, e.resource, e.knownActions, e.data),
-			checkAll: (e) => e.length === 0 ? [] : x(t, e),
-			explain: (e) => y(t, e.resource, e.action, e.data),
-			rulesInScope: (e) => f(_, t, e.resource, e.data),
-			trace: (e) => T({
-				action: e.action,
-				data: e.data,
-				principal: t,
-				resource: e.resource
-			})
-		};
-	}
-	let D;
-	function O() {
-		return D ??= Object.freeze(c(_, m));
-	}
-	if (p.strict || p.onConflict) {
-		let t = O();
-		if (t.length > 0 && (p.onConflict && t.forEach(p.onConflict), p.strict)) {
-			let n = t.map((e) => e.kind === "duplicate" ? `Rule[${e.indexB}] ${e.kind} of Rule[${e.indexA}]` : `Rule[${e.shadowedIndex}] ${e.kind} by Rule[${e.shadowingIndex}]`).join("; ");
-			throw new e(`${t.length} rule conflict(s) detected: ${n}`);
-		}
-	}
-	function k(e, t) {
-		h.add(e);
-		let n = () => h.delete(e);
-		if (t?.signal) {
-			if (t.signal.aborted) return h.delete(e), () => {};
-			t.signal.addEventListener("abort", n, { once: !0 });
-		}
-		return () => {
-			h.delete(e), t?.signal?.removeEventListener("abort", n);
-		};
-	}
-	return {
-		allowedActions: C,
-		checkAll: S,
-		detectConflicts: O,
-		explain: b,
-		forUser: E,
-		rulesInScope: w,
-		tap: k,
-		trace: T
-	};
-}
-//#endregion
-export { p as createWard };
-
+import{compileRule as e}from"./_compile.js";import{ruleMatches as t,snapshotDecisionInput as n,snapshotPrincipal as r}from"./_match.js";import{tapper as i}from"@vielzeug/arsenal";function createWard(a=[]){let o=Object.freeze(a.flat().map((t,n)=>e(t,n))),s=Object.freeze([...new Set(o.flatMap(e=>e.effect===`allow`&&!e.action.includes(`*`)?[e.action]:[]))]),c=i();function evaluate(e,r){let i=n(e);for(let e=0;e<o.length;e++){let n=o[e];if(t(n,e,i)){let t=Object.freeze({effect:n.effect,matched:!0,reason:`rule[${e}] ${n.effect===`allow`?`allows`:`denies`} '${i.action}' on '${i.resource}'`,rule:n});return r&&emitDecision(i,t),t}}let a=Object.freeze({effect:`deny`,matched:!1,reason:`no matching rule for '${i.action}' on '${i.resource}' (default deny)`});return r&&emitDecision(i,a),a}function emitDecision(e,t){c.emit(Object.freeze({decision:t,input:e,type:`decision`}))}function decide(e){return evaluate(e,!0)}function checkAll(e){return e.map(decide)}function allowedActions(e){let t=e.filter??s,n=new Set;return t.filter(t=>!n.has(t)&&(n.add(t),evaluate({...e,action:t},!1).effect===`allow`))}function forPrincipal(e){let t=r(e);return{allowedActions:e=>allowedActions({...e,principal:t}),checkAll:e=>checkAll(e.map(e=>({...e,principal:t}))),decide:e=>decide({...e,principal:t})}}return{allowedActions,checkAll,decide,forPrincipal,knownActions:s,rules:o,tap:(e,t)=>c.tap(e,t)}}export{createWard};
 //# sourceMappingURL=factory.js.map

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import type { CompiledEntry } from './_compile';\nimport { compileEntry } from './_compile';\nimport { computeConflicts } from './_conflict';\nimport { warnAnonymousPredicates } from './_dev';\nimport { assertUserPrincipal, isOverriddenBy, matchesRule, pickWinner, toDecision, validatePrincipal } from './_match';\nimport { WardConfigError } from './errors';\nimport type {\n  BoundWard,\n  BoundWardAllowedActionsInput,\n  BoundWardDecisionInput,\n  BoundWardRulesInScopeInput,\n  NormalizedWardRule,\n  Principal,\n  UserPrincipal,\n  Ward,\n  WardAllowedActionsInput,\n  WardCheck,\n  WardConflict,\n  WardDecision,\n  WardDecisionInput,\n  WardDecisionResult,\n  WardEvent,\n  WardOptions,\n  WardRule,\n  WardRulesInScopeInput,\n  WardTrace,\n  WardTraceCandidate,\n} from './types';\n\nconst warn = warnAnonymousPredicates;\n\n// ---------------------------------------------------------------------------\n// Shared loop cores (validation-free; used by both public API and forUser)\n// ---------------------------------------------------------------------------\n\nfunction coreAllowedActions<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  knownActions: readonly TAction[],\n  data: TData | undefined,\n): TAction[] {\n  const seen = new Set<TAction>();\n  const result: TAction[] = [];\n\n  for (const action of knownActions) {\n    if (seen.has(action)) continue;\n\n    seen.add(action);\n\n    const winner = pickWinner(entries, principal, resource, action, data);\n\n    if (winner?.rule.effect === 'allow') result.push(action);\n  }\n\n  return result;\n}\n\nfunction coreRulesInScope<TAction extends string, TData>(\n  entries: CompiledEntry<TAction, TData>[],\n  principal: Principal,\n  resource: string,\n  data: TData | undefined,\n): NormalizedWardRule<TAction, TData>[] {\n  const skipPredicate = data === undefined;\n  const result: NormalizedWardRule<TAction, TData>[] = [];\n\n  for (const entry of entries) {\n    if (!matchesRule(entry, principal, resource, undefined, data, skipPredicate)) continue;\n\n    result.push(entry.rule as NormalizedWardRule<TAction, TData>);\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Creates an authorization ward from a set of rules.\n *\n * **Winner selection** when multiple rules match a request:\n * 1. Higher `priority` wins.\n * 2. On priority tie, higher specificity score wins (exact > namespace-wildcard > global-wildcard,\n *    applied independently to role, resource, and action).\n * 3. On specificity tie, `deny` beats `allow` (denyBonus tiebreaker).\n * 4. On absolute tie (identical priority, specificity, and effect), the rule declared\n *    **first in the input array** wins.\n */\nexport function createWard<TAction extends string = string, TData = unknown>(\n  rules: readonly (WardRule<TAction, TData> | readonly WardRule<TAction, TData>[])[] = [],\n  options: WardOptions<TAction, TData> = {},\n): Ward<TAction, TData> {\n  if (options.maxConflicts !== undefined) {\n    if (!Number.isFinite(options.maxConflicts) || options.maxConflicts < 0) {\n      throw new WardConfigError('maxConflicts must be a finite non-negative number.');\n    }\n  }\n\n  if (options.onConflict !== undefined && typeof options.onConflict !== 'function') {\n    throw new WardConfigError('onConflict must be a function.');\n  }\n\n  const { maxConflicts = Infinity } = options;\n  const tappers = new Set<(event: WardEvent<TAction, TData>) => void>();\n  const flat: WardRule<TAction, TData>[] = [];\n\n  for (const entry of rules) {\n    if (Array.isArray(entry)) {\n      for (const rule of entry) flat.push(rule);\n    } else {\n      flat.push(entry as WardRule<TAction, TData>);\n    }\n  }\n\n  const entries = flat.map((rule, i) => compileEntry(rule, i));\n\n  // Warn in development when an ANONYMOUS-role rule has a predicate.\n  warn(entries);\n\n  // -------------------------------------------------------------------------\n  // Core decision + logging\n  // -------------------------------------------------------------------------\n\n  function emitTap(event: WardEvent<TAction, TData>): void {\n    if (tappers.size === 0) return;\n    for (const tapper of tappers) {\n      try {\n        tapper(event);\n      } catch {\n        // Observability must not affect ward behavior.\n      }\n    }\n  }\n\n  function evaluateAndLog(\n    principal: Principal,\n    resource: string,\n    action: TAction,\n    data: TData | undefined,\n  ): WardDecision<TAction, TData> {\n    const winner = pickWinner(entries, principal, resource, action, data);\n    const decision = toDecision(winner);\n\n    emitTap({ action, data, decision, principal, resource });\n\n    return decision;\n  }\n\n  // -------------------------------------------------------------------------\n  // Public API\n  // -------------------------------------------------------------------------\n  // Request objects avoid call-site ambiguity between resource/action/data and\n  // make later API growth additive instead of positional-breaking.\n\n  function explain(input: WardDecisionInput<TAction, TData>): WardDecision<TAction, TData> {\n    const { action, data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return evaluateAndLog(principal, resource, action, data);\n  }\n\n  function runCheckAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    return checks.map((check) => ({\n      ...evaluateAndLog(principal, check.resource, check.action, check.data),\n      action: check.action,\n      resource: check.resource,\n    }));\n  }\n\n  function checkAll(\n    principal: Principal,\n    checks: readonly WardCheck<TAction, TData>[],\n  ): WardDecisionResult<TAction, TData>[] {\n    if (checks.length === 0) return [];\n\n    validatePrincipal(principal);\n\n    return runCheckAll(principal, checks);\n  }\n\n  function allowedActions(input: WardAllowedActionsInput<TAction, TData>): TAction[] {\n    const { data, knownActions, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return coreAllowedActions(entries, principal, resource, knownActions, data);\n  }\n\n  function rulesInScope(\n    input: WardRulesInScopeInput<TData>,\n  ): ReadonlyArray<Readonly<NormalizedWardRule<TAction, TData>>> {\n    const { data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    return coreRulesInScope(entries, principal, resource, data);\n  }\n\n  function trace(input: WardDecisionInput<TAction, TData>): WardTrace<TAction, TData> {\n    const { action, data, principal, resource } = input;\n\n    validatePrincipal(principal);\n\n    const matching: CompiledEntry<TAction, TData>[] = [];\n\n    for (const entry of entries) {\n      if (matchesRule(entry, principal, resource, action, data)) {\n        matching.push(entry);\n      }\n    }\n\n    let winner: CompiledEntry<TAction, TData> | undefined;\n\n    for (const entry of matching) {\n      if (!winner || isOverriddenBy(winner, entry)) winner = entry;\n    }\n\n    const decision = toDecision(winner);\n\n    const candidates: WardTraceCandidate<TAction, TData>[] = matching.map((entry) => ({\n      index: entry.index,\n      priority: entry.priority,\n      rule: entry.rule,\n      score: entry.score,\n      won: entry === winner,\n    }));\n\n    return { candidates, decision };\n  }\n\n  function forUser(principal: UserPrincipal): BoundWard<TAction, TData> {\n    assertUserPrincipal(principal);\n\n    const snap: UserPrincipal = {\n      attributes: principal.attributes ? structuredClone(principal.attributes) : undefined,\n      id: principal.id,\n      roles: [...principal.roles],\n    };\n\n    return {\n      allowedActions: (input: BoundWardAllowedActionsInput<TAction, TData>) =>\n        coreAllowedActions(entries, snap, input.resource, input.knownActions, input.data),\n      checkAll: (checks) => (checks.length === 0 ? [] : runCheckAll(snap, checks)),\n      explain: (input: BoundWardDecisionInput<TAction, TData>) =>\n        evaluateAndLog(snap, input.resource, input.action, input.data),\n      rulesInScope: (input: BoundWardRulesInScopeInput<TData>) =>\n        coreRulesInScope(entries, snap, input.resource, input.data),\n      trace: (input: BoundWardDecisionInput<TAction, TData>) =>\n        trace({ action: input.action, data: input.data, principal: snap, resource: input.resource }),\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // Conflict detection (lazy, cached)\n  // -------------------------------------------------------------------------\n\n  let conflictsCache: readonly WardConflict<TAction, TData>[] | undefined;\n\n  function detectConflicts(): readonly WardConflict<TAction, TData>[] {\n    return (conflictsCache ??= Object.freeze(computeConflicts(entries, maxConflicts)));\n  }\n\n  if (options.strict || options.onConflict) {\n    const conflicts = detectConflicts();\n\n    if (conflicts.length > 0) {\n      if (options.onConflict) conflicts.forEach(options.onConflict);\n\n      if (options.strict) {\n        const details = conflicts\n          .map((c) =>\n            c.kind === 'duplicate'\n              ? `Rule[${c.indexB}] ${c.kind} of Rule[${c.indexA}]`\n              : `Rule[${c.shadowedIndex}] ${c.kind} by Rule[${c.shadowingIndex}]`,\n          )\n          .join('; ');\n\n        throw new WardConfigError(`${conflicts.length} rule conflict(s) detected: ${details}`);\n      }\n    }\n  }\n\n  function tap(handler: (event: WardEvent<TAction, TData>) => void, opts?: { signal?: AbortSignal }): () => void {\n    tappers.add(handler);\n\n    const onAbort = () => tappers.delete(handler);\n\n    if (opts?.signal) {\n      if (opts.signal.aborted) {\n        tappers.delete(handler);\n        return () => {};\n      }\n      opts.signal.addEventListener('abort', onAbort, { once: true });\n    }\n\n    return () => {\n      tappers.delete(handler);\n      opts?.signal?.removeEventListener('abort', onAbort);\n    };\n  }\n\n  return { allowedActions, checkAll, detectConflicts, explain, forUser, rulesInScope, tap, trace };\n}\n"],"mappings":";;;;;;AA6BA,IAAM,IAAO;AAMb,SAAS,EACP,GACA,GACA,GACA,GACA,GACW;CACX,IAAM,oBAAO,IAAI,IAAa,GACxB,IAAoB,CAAC;CAE3B,KAAK,IAAM,KAAU,GACf,EAAK,IAAI,CAAM,MAEnB,EAAK,IAAI,CAAM,GAEA,EAAW,GAAS,GAAW,GAAU,GAAQ,CAE5D,CAAA,EAAQ,KAAK,WAAW,WAAS,EAAO,KAAK,CAAM;CAGzD,OAAO;AACT;AAEA,SAAS,EACP,GACA,GACA,GACA,GACsC;CACtC,IAAM,IAAgB,MAAS,KAAA,GACzB,IAA+C,CAAC;CAEtD,KAAK,IAAM,KAAS,GACb,EAAY,GAAO,GAAW,GAAU,KAAA,GAAW,GAAM,CAAa,KAE3E,EAAO,KAAK,EAAM,IAA0C;CAG9D,OAAO;AACT;AAiBA,SAAgB,EACd,IAAqF,CAAC,GACtF,IAAuC,CAAC,GAClB;CACtB,IAAI,EAAQ,iBAAiB,KAAA,MACvB,CAAC,OAAO,SAAS,EAAQ,YAAY,KAAK,EAAQ,eAAe,IACnE,MAAM,IAAI,EAAgB,oDAAoD;CAIlF,IAAI,EAAQ,eAAe,KAAA,KAAa,OAAO,EAAQ,cAAe,YACpE,MAAM,IAAI,EAAgB,gCAAgC;CAG5D,IAAM,EAAE,kBAAe,aAAa,GAC9B,oBAAU,IAAI,IAAgD,GAC9D,IAAmC,CAAC;CAE1C,KAAK,IAAM,KAAS,GAClB,IAAI,MAAM,QAAQ,CAAK,GACrB,KAAK,IAAM,KAAQ,GAAO,EAAK,KAAK,CAAI;MAExC,EAAK,KAAK,CAAiC;CAI/C,IAAM,IAAU,EAAK,KAAK,GAAM,MAAM,EAAa,GAAM,CAAC,CAAC;CAG3D,EAAK,CAAO;CAMZ,SAAS,EAAQ,GAAwC;EACnD,MAAQ,SAAS,GACrB,KAAK,IAAM,KAAU,GACnB,IAAI;GACF,EAAO,CAAK;EACd,QAAQ,CAER;CAEJ;CAEA,SAAS,EACP,GACA,GACA,GACA,GAC8B;EAC9B,IAAM,IAAS,EAAW,GAAS,GAAW,GAAU,GAAQ,CAAI,GAC9D,IAAW,EAAW,CAAM;EAIlC,OAFA,EAAQ;GAAE;GAAQ;GAAM;GAAU;GAAW;EAAS,CAAC,GAEhD;CACT;CAQA,SAAS,EAAQ,GAAwE;EACvF,IAAM,EAAE,WAAQ,SAAM,cAAW,gBAAa;EAI9C,OAFA,EAAkB,CAAS,GAEpB,EAAe,GAAW,GAAU,GAAQ,CAAI;CACzD;CAEA,SAAS,EACP,GACA,GACsC;EACtC,OAAO,EAAO,KAAK,OAAW;GAC5B,GAAG,EAAe,GAAW,EAAM,UAAU,EAAM,QAAQ,EAAM,IAAI;GACrE,QAAQ,EAAM;GACd,UAAU,EAAM;EAClB,EAAE;CACJ;CAEA,SAAS,EACP,GACA,GACsC;EAKtC,OAJI,EAAO,WAAW,IAAU,CAAC,KAEjC,EAAkB,CAAS,GAEpB,EAAY,GAAW,CAAM;CACtC;CAEA,SAAS,EAAe,GAA2D;EACjF,IAAM,EAAE,SAAM,iBAAc,cAAW,gBAAa;EAIpD,OAFA,EAAkB,CAAS,GAEpB,EAAmB,GAAS,GAAW,GAAU,GAAc,CAAI;CAC5E;CAEA,SAAS,EACP,GAC6D;EAC7D,IAAM,EAAE,SAAM,cAAW,gBAAa;EAItC,OAFA,EAAkB,CAAS,GAEpB,EAAiB,GAAS,GAAW,GAAU,CAAI;CAC5D;CAEA,SAAS,EAAM,GAAqE;EAClF,IAAM,EAAE,WAAQ,SAAM,cAAW,gBAAa;EAE9C,EAAkB,CAAS;EAE3B,IAAM,IAA4C,CAAC;EAEnD,KAAK,IAAM,KAAS,GAClB,AAAI,EAAY,GAAO,GAAW,GAAU,GAAQ,CAAI,KACtD,EAAS,KAAK,CAAK;EAIvB,IAAI;EAEJ,KAAK,IAAM,KAAS,GAClB,CAAI,CAAC,KAAU,EAAe,GAAQ,CAAK,OAAG,IAAS;EAGzD,IAAM,IAAW,EAAW,CAAM;EAUlC,OAAO;GAAE,YARgD,EAAS,KAAK,OAAW;IAChF,OAAO,EAAM;IACb,UAAU,EAAM;IAChB,MAAM,EAAM;IACZ,OAAO,EAAM;IACb,KAAK,MAAU;GACjB,EAES;GAAY;EAAS;CAChC;CAEA,SAAS,EAAQ,GAAqD;EACpE,EAAoB,CAAS;EAE7B,IAAM,IAAsB;GAC1B,YAAY,EAAU,aAAa,gBAAgB,EAAU,UAAU,IAAI,KAAA;GAC3E,IAAI,EAAU;GACd,OAAO,CAAC,GAAG,EAAU,KAAK;EAC5B;EAEA,OAAO;GACL,iBAAiB,MACf,EAAmB,GAAS,GAAM,EAAM,UAAU,EAAM,cAAc,EAAM,IAAI;GAClF,WAAW,MAAY,EAAO,WAAW,IAAI,CAAC,IAAI,EAAY,GAAM,CAAM;GAC1E,UAAU,MACR,EAAe,GAAM,EAAM,UAAU,EAAM,QAAQ,EAAM,IAAI;GAC/D,eAAe,MACb,EAAiB,GAAS,GAAM,EAAM,UAAU,EAAM,IAAI;GAC5D,QAAQ,MACN,EAAM;IAAE,QAAQ,EAAM;IAAQ,MAAM,EAAM;IAAM,WAAW;IAAM,UAAU,EAAM;GAAS,CAAC;EAC/F;CACF;CAMA,IAAI;CAEJ,SAAS,IAA2D;EAClE,OAAQ,MAAmB,OAAO,OAAO,EAAiB,GAAS,CAAY,CAAC;CAClF;CAEA,IAAI,EAAQ,UAAU,EAAQ,YAAY;EACxC,IAAM,IAAY,EAAgB;EAElC,IAAI,EAAU,SAAS,MACjB,EAAQ,cAAY,EAAU,QAAQ,EAAQ,UAAU,GAExD,EAAQ,SAAQ;GAClB,IAAM,IAAU,EACb,KAAK,MACJ,EAAE,SAAS,cACP,QAAQ,EAAE,OAAO,IAAI,EAAE,KAAK,WAAW,EAAE,OAAO,KAChD,QAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,WAAW,EAAE,eAAe,EACrE,CAAC,CACA,KAAK,IAAI;GAEZ,MAAM,IAAI,EAAgB,GAAG,EAAU,OAAO,8BAA8B,GAAS;EACvF;CAEJ;CAEA,SAAS,EAAI,GAAqD,GAA6C;EAC7G,EAAQ,IAAI,CAAO;EAEnB,IAAM,UAAgB,EAAQ,OAAO,CAAO;EAE5C,IAAI,GAAM,QAAQ;GAChB,IAAI,EAAK,OAAO,SAEd,OADA,EAAQ,OAAO,CAAO,SACT,CAAC;GAEhB,EAAK,OAAO,iBAAiB,SAAS,GAAS,EAAE,MAAM,GAAK,CAAC;EAC/D;EAEA,aAAa;GAEX,AADA,EAAQ,OAAO,CAAO,GACtB,GAAM,QAAQ,oBAAoB,SAAS,CAAO;EACpD;CACF;CAEA,OAAO;EAAE;EAAgB;EAAU;EAAiB;EAAS;EAAS;EAAc;EAAK;CAAM;AACjG"}
+{"version":3,"file":"factory.js","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import { tapper } from '@vielzeug/arsenal';\n\nimport { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection — order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Its declarative `roles` (if any) include the principal's role, `ANONYMOUS`\n *    matches a null principal, and `WILDCARD` matches any authenticated principal.\n * 4. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 5. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const knownActions = Object.freeze([\n    ...new Set(\n      compiled.flatMap((rule) => (rule.effect === 'allow' && !rule.action.includes('*') ? [rule.action] : [])),\n    ),\n  ]) as readonly TAction[];\n  const tappers = tapper<WardEvent<TAction, TResource, TAttributes>>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    tappers.emit(Object.freeze({ decision, input, type: 'decision' as const }));\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    filter?: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const candidates = input.filter ?? knownActions;\n    const seen = new Set<TAction>();\n\n    return candidates.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  return {\n    allowedActions,\n    checkAll,\n    decide,\n    forPrincipal,\n    knownActions,\n    rules: compiled,\n    tap: (handler, options) => tappers.tap(handler, options),\n  };\n}\n"],"mappings":"mLAgCA,SAAgB,WAKd,EAGM,CAAC,EACgC,CACvC,IAAM,EAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,EAAM,IAAU,EAAY,EAAM,CAAK,CAAC,CAAC,EACpF,EAAe,OAAO,OAAO,CACjC,GAAG,IAAI,IACL,EAAS,QAAS,GAAU,EAAK,SAAW,SAAW,CAAC,EAAK,OAAO,SAAS,GAAG,EAAI,CAAC,EAAK,MAAM,EAAI,CAAC,CAAE,CACzG,CACF,CAAC,EACK,EAAU,EAAmD,EAEnE,SAAS,SACP,EACA,EAC+C,CAC/C,IAAM,EAAa,EAAsB,CAAK,EAE9C,IAAK,IAAI,EAAQ,EAAG,EAAQ,EAAS,OAAQ,IAAS,CACpD,IAAM,EAAO,EAAS,GAEtB,GAAI,EAAY,EAAM,EAAO,CAAU,EAAG,CACxC,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,EAAK,OACb,QAAS,GACT,OAAQ,QAAQ,EAAM,IAAI,EAAK,SAAW,QAAU,SAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS,GAC1H,MACF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CACF,CAEA,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,OACR,QAAS,GACT,OAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS,iBACjF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CAEA,SAAS,aACP,EACA,EACM,CACN,EAAQ,KAAK,OAAO,OAAO,CAAE,WAAU,QAAO,KAAM,UAAoB,CAAC,CAAC,CAC5E,CAEA,SAAS,OACP,EAC+C,CAC/C,OAAO,SAAS,EAAO,EAAI,CAC7B,CAEA,SAAS,SACP,EACiD,CACjD,OAAO,EAAO,IAAI,MAAM,CAC1B,CAEA,SAAS,eAAe,EAKV,CACZ,IAAM,EAAa,EAAM,QAAU,EAC7B,EAAO,IAAI,IAEjB,OAAO,EAAW,OAAQ,GACxB,CAAI,EAAK,IAAI,CAAM,IACnB,EAAK,IAAI,CAAM,EACR,SAAS,CAAE,GAAG,EAAO,QAAO,EAAG,EAAK,CAAC,CAAC,SAAW,QACzD,CACH,CAEA,SAAS,aAAa,EAAmE,CACvF,IAAM,EAAW,EAAkB,CAAS,EAE5C,MAAO,CACL,eAAiB,GAAU,eAAe,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,EAC3E,SAAW,GAAW,SAAS,EAAO,IAAK,IAAW,CAAE,GAAG,EAAO,UAAW,CAAS,EAAE,CAAC,EACzF,OAAS,GAAU,OAAO,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,CAC7D,CACF,CAEA,MAAO,CACL,eACA,SACA,OACA,aACA,eACA,MAAO,EACP,KAAM,EAAS,IAAY,EAAQ,IAAI,EAAS,CAAO,CACzD,CACF"}

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./builder.cjs"),t=require("./constants.cjs"),n=require("./errors.cjs"),r=require("./resource.cjs"),i=require("./factory.cjs");exports.ANONYMOUS=t.ANONYMOUS,exports.WILDCARD=t.WILDCARD,exports.WardConfigError=n.WardConfigError,exports.WardError=n.WardError,exports.WardPredicateError=n.WardPredicateError,exports.allow=e.allow,exports.createWard=i.createWard,exports.deny=e.deny,exports.matchesPattern=r.matchesPattern,exports.patternCovers=r.patternCovers,exports.predicate=e.predicate;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./constants.cjs"),t=require("./errors.cjs"),n=require("./resource.cjs"),r=require("./factory.cjs"),i=require("./rules.cjs");exports.ANONYMOUS=e.ANONYMOUS,exports.WILDCARD=e.WILDCARD,exports.WardConditionError=t.WardConditionError,exports.WardConfigError=t.WardConfigError,exports.WardError=t.WardError,exports.allow=i.allow,exports.createWard=r.createWard,exports.deny=i.deny,exports.matchesPattern=n.matchesPattern,exports.predicate=i.predicate;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export { allow, deny, predicate } from './builder';
 export { ANONYMOUS, WILDCARD } from './constants';
-export { WardConfigError, WardError, WardPredicateError } from './errors';
+export { WardConditionError, WardConfigError, WardError } from './errors';
 export { createWard } from './factory';
-export { matchesPattern, patternCovers } from './resource';
-export type { BoundWard, BoundWardAllowedActionsInput, BoundWardDecisionInput, BoundWardRulesInScopeInput, ConflictKind, NormalizedWardRule, Principal, RuleContext, UserPrincipal, Ward, WardAllowedActionsInput, WardCheck, WardConflict, WardDecision, WardDecisionInput, WardDecisionResult, WardEvent, WardOptions, WardPredicate, WardRule, WardRulesInScopeInput, WardTrace, WardTraceCandidate, } from './types';
+export { matchesPattern } from './resource';
+export { allow, deny, predicate } from './rules';
+export type { BoundWard, BoundWardDecisionInput, Principal, UserPrincipal, Ward, WardAttributes, WardAttributeValue, WardCondition, WardConditionInput, WardDecision, WardDecisionInput, WardEvent, WardPattern, WardRule, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,aAAa,EACb,IAAI,EACJ,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,aAAa,EACb,QAAQ,EACR,qBAAqB,EACrB,SAAS,EACT,kBAAkB,GACnB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,SAAS,EACT,aAAa,EACb,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,6 +1 @@
-import { allow as e, deny as t, predicate as n } from "./builder.js";
-import { ANONYMOUS as r, WILDCARD as i } from "./constants.js";
-import { WardConfigError as a, WardError as o, WardPredicateError as s } from "./errors.js";
-import { matchesPattern as c, patternCovers as l } from "./resource.js";
-import { createWard as u } from "./factory.js";
-export { r as ANONYMOUS, i as WILDCARD, a as WardConfigError, o as WardError, s as WardPredicateError, e as allow, u as createWard, t as deny, c as matchesPattern, l as patternCovers, n as predicate };
+import{ANONYMOUS as e,WILDCARD as t}from"./constants.js";import{WardConditionError as n,WardConfigError as r,WardError as i}from"./errors.js";import{matchesPattern as a}from"./resource.js";import{createWard as o}from"./factory.js";import{allow as s,deny as c,predicate as l}from"./rules.js";export{e as ANONYMOUS,t as WILDCARD,n as WardConditionError,r as WardConfigError,i as WardError,s as allow,o as createWard,c as deny,a as matchesPattern,l as predicate};

package/dist/resource.cjs

@@ -1,2 +1,2 @@
-require("./constants.cjs");function e(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}function t(e,t){return e===`*`?!0:t===`*`?!1:e.endsWith(`:*`)?t.startsWith(e.slice(0,-1)):e===t}exports.matchesPattern=e,exports.patternCovers=t;
+require("./constants.cjs");function matchesPattern(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}exports.matchesPattern=matchesPattern;
 //# sourceMappingURL=resource.cjs.map

package/dist/resource.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"resource.cjs","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n"],"mappings":"2BAuBA,SAAgB,EAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT,CAmBA,SAAgB,EAAc,EAAe,EAAyB,CAcpE,OAZI,IAAA,IAA2B,GAG3B,IAAA,IAA4B,GAI5B,EAAM,SAAS,IAAI,EACd,EAAO,WAAW,EAAM,MAAM,EAAG,EAAE,CAAC,EAItC,IAAU,CACnB"}
+{"version":3,"file":"resource.cjs","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n"],"mappings":"2BAuBA,SAAgB,eAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT"}

package/dist/resource.d.ts

@@ -20,22 +20,4 @@
  * matchesPattern('read:*',   'write:all')  // false — different action namespace
  */
 export declare function matchesPattern(pattern: string, value: string): boolean;
-/**
- * Returns true if every concrete value that matches `narrow` also matches `broad`.
- * This is the coverage relation used for rule conflict detection.
- *
- * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact
- *
- * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this
- * function explicitly documents and tests the coverage semantics so it remains
- * correct if new pattern syntax is added in the future.
- *
- * @example
- * patternCovers('*',       'posts:*')   // true  — * covers everything
- * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact
- * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself
- * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard
- * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace
- */
-export declare function patternCovers(broad: string, narrow: string): boolean;
 //# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAatE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAepE"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAatE"}

package/dist/resource.js

@@ -1,17 +1,2 @@
-import "./constants.js";
-//#region src/resource.ts
-function e(e, t) {
-	if (e === "*" || e === t) return !0;
-	if (e.endsWith(":*")) {
-		let n = e.slice(0, -1);
-		return t.startsWith(n);
-	}
-	return !1;
-}
-function t(e, t) {
-	return e === "*" ? !0 : t === "*" ? !1 : e.endsWith(":*") ? t.startsWith(e.slice(0, -1)) : e === t;
-}
-//#endregion
-export { e as matchesPattern, t as patternCovers };
-
+import"./constants.js";function matchesPattern(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}export{matchesPattern};
 //# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n"],"mappings":";;AAuBA,SAAgB,EAAe,GAAiB,GAAwB;CAGtE,IAFI,MAAA,OAEA,MAAY,GAAO,OAAO;CAG9B,IAAI,EAAQ,SAAS,IAAI,GAAG;EAC1B,IAAM,IAAK,EAAQ,MAAM,GAAG,EAAE;EAE9B,OAAO,EAAM,WAAW,CAAE;CAC5B;CAEA,OAAO;AACT;AAmBA,SAAgB,EAAc,GAAe,GAAyB;CAcpE,OAZI,MAAA,MAA2B,KAG3B,MAAA,MAA4B,KAI5B,EAAM,SAAS,IAAI,IACd,EAAO,WAAW,EAAM,MAAM,GAAG,EAAE,CAAC,IAItC,MAAU;AACnB"}
+{"version":3,"file":"resource.js","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n"],"mappings":"uBAuBA,SAAgB,eAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT"}

package/dist/rules.cjs

@@ -0,0 +1,2 @@
+function buildRules(e,t,n,r,i){let a=Object.freeze(Array.isArray(t)?[...t]:[t]);return r.map(t=>({action:t,...i?.when===void 0?{}:{condition:i.when},effect:e,resource:n,roles:a}))}var allow=(e,t,n,r)=>buildRules(`allow`,e,t,n,r),deny=(e,t,n,r)=>buildRules(`deny`,e,t,n,r),owns=e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id,and=(...e)=>t=>e.every(e=>e(t)),or=(...e)=>t=>e.some(e=>e(t)),not=e=>t=>!e(t),e={and,not,or,owns};exports.allow=allow,exports.deny=deny,exports.predicate=e;
+//# sourceMappingURL=rules.cjs.map

package/dist/rules.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.cjs","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return actions.map((action) => ({\n    action,\n    ...(options?.when === undefined ? {} : { condition: options.when }),\n    effect,\n    resource,\n    roles,\n  }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, not, or, owns } as const;\n"],"mappings":"AAMA,SAAS,WACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,GAAI,GAAS,OAAS,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAQ,IAAK,EACjE,SACA,WACA,OACF,EAAE,CACJ,CAEA,IAAa,OAKX,EACA,EACA,EACA,IACgD,WAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,MAKX,EACA,EACA,EACA,IACgD,WAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EAE/F,KAEF,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,GAC1D,KAEF,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAC9C,IAEF,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAC7C,IAEF,GAED,GACC,CAAC,EAAU,CAAK,EAEP,EAAY,CAAE,IAAK,IAAK,GAAI,IAAK"}

package/dist/rules.d.ts

@@ -0,0 +1,14 @@
+import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';
+type RuleOptions<TAttributes extends WardAttributes> = Readonly<{
+    when?: WardCondition<TAttributes>;
+}>;
+export declare const allow: <TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes>(role: string | readonly string[], resource: WardPattern<TResource>, actions: readonly WardPattern<TAction>[], options?: RuleOptions<TAttributes>) => WardRule<TAction, TResource, TAttributes>[];
+export declare const deny: <TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes>(role: string | readonly string[], resource: WardPattern<TResource>, actions: readonly WardPattern<TAction>[], options?: RuleOptions<TAttributes>) => WardRule<TAction, TResource, TAttributes>[];
+export declare const predicate: {
+    readonly and: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(...conditions: readonly WardCondition<TAttributes>[]) => WardCondition<TAttributes>;
+    readonly not: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(condition: WardCondition<TAttributes>) => WardCondition<TAttributes>;
+    readonly or: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(...conditions: readonly WardCondition<TAttributes>[]) => WardCondition<TAttributes>;
+    readonly owns: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(attribute: keyof TAttributes & string) => WardCondition<TAttributes>;
+};
+export {};
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEpF,KAAK,WAAW,CAAC,WAAW,SAAS,cAAc,IAAI,QAAQ,CAAC;IAC9D,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CACnC,CAAC,CAAC;AAoBH,eAAO,MAAM,KAAK,GAChB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA2D,CAAC;AAExG,eAAO,MAAM,IAAI,GACf,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA0D,CAAC;AA2BvG,eAAO,MAAM,SAAS;mBAlBnB,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;mBAU5B,WAAW,SAAS,cAAc,8EACtB,aAAa,CAAC,WAAW,CAAC,KACpC,aAAa,CAAC,WAAW,CAAC;kBAR5B,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;oBAd5B,WAAW,SAAS,cAAc,8EACtB,MAAM,WAAW,GAAG,MAAM,KACpC,aAAa,CAAC,WAAW,CAAC;CAsByB,CAAC"}

package/dist/rules.js

@@ -0,0 +1,2 @@
+function buildRules(e,t,n,r,i){let a=Object.freeze(Array.isArray(t)?[...t]:[t]);return r.map(t=>({action:t,...i?.when===void 0?{}:{condition:i.when},effect:e,resource:n,roles:a}))}var allow=(e,t,n,r)=>buildRules(`allow`,e,t,n,r),deny=(e,t,n,r)=>buildRules(`deny`,e,t,n,r),owns=e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id,and=(...e)=>t=>e.every(e=>e(t)),or=(...e)=>t=>e.some(e=>e(t)),not=e=>t=>!e(t),e={and,not,or,owns};export{allow,deny,e as predicate};
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return actions.map((action) => ({\n    action,\n    ...(options?.when === undefined ? {} : { condition: options.when }),\n    effect,\n    resource,\n    roles,\n  }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, not, or, owns } as const;\n"],"mappings":"AAMA,SAAS,WACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,GAAI,GAAS,OAAS,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAQ,IAAK,EACjE,SACA,WACA,OACF,EAAE,CACJ,CAEA,IAAa,OAKX,EACA,EACA,EACA,IACgD,WAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,MAKX,EACA,EACA,EACA,IACgD,WAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EAE/F,KAEF,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,GAC1D,KAEF,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAC9C,IAEF,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAC7C,IAEF,GAED,GACC,CAAC,EAAU,CAAK,EAEP,EAAY,CAAE,IAAK,IAAK,GAAI,IAAK"}