@vielzeug/ward 3.0.0 → 26.10.1

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport { WardConfigError } from './errors';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection — order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 4. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const tappers = new Set<(event: WardEvent<TAction, TResource, TAttributes>) => void>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    if (tappers.size === 0) return;\n\n    const event = Object.freeze({ decision, input, type: 'decision' as const });\n    for (const tapper of tappers) {\n      try {\n        tapper(event);\n      } catch {}\n    }\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    knownActions: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const seen = new Set<TAction>();\n\n    return input.knownActions.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  function tap(\n    handler: (event: WardEvent<TAction, TResource, TAttributes>) => void,\n    options?: { readonly signal?: AbortSignal },\n  ): () => void {\n    if (typeof handler !== 'function') throw new WardConfigError('tap handler must be a function');\n    if (options?.signal?.aborted) return () => {};\n\n    tappers.add(handler);\n    const onAbort = () => tappers.delete(handler);\n    options?.signal?.addEventListener('abort', onAbort, { once: true });\n\n    return () => {\n      tappers.delete(handler);\n      options?.signal?.removeEventListener('abort', onAbort);\n    };\n  }\n\n  return { allowedActions, checkAll, decide, forPrincipal, rules: compiled, tap };\n}\n"],"mappings":";;;;AA6BA,SAAgB,EAKd,IAGM,CAAC,GACgC;CACvC,IAAM,IAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,GAAM,MAAU,EAAY,GAAM,CAAK,CAAC,CAAC,GACpF,oBAAU,IAAI,IAAiE;CAErF,SAAS,EACP,GACA,GAC+C;EAC/C,IAAM,IAAa,EAAsB,CAAK;EAE9C,KAAK,IAAI,IAAQ,GAAG,IAAQ,EAAS,QAAQ,KAAS;GACpD,IAAM,IAAO,EAAS;GAEtB,IAAI,EAAY,GAAM,GAAO,CAAU,GAAG;IACxC,IAAM,IAAW,OAAO,OAAO;KAC7B,QAAQ,EAAK;KACb,SAAS;KACT,QAAQ,QAAQ,EAAM,IAAI,EAAK,WAAW,UAAU,WAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS;KAC1H;IACF,CAAC;IAGD,OADI,KAAM,EAAa,GAAY,CAAQ,GACpC;GACT;EACF;EAEA,IAAM,IAAW,OAAO,OAAO;GAC7B,QAAQ;GACR,SAAS;GACT,QAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS;EACjF,CAAC;EAGD,OADI,KAAM,EAAa,GAAY,CAAQ,GACpC;CACT;CAEA,SAAS,EACP,GACA,GACM;EACN,IAAI,EAAQ,SAAS,GAAG;EAExB,IAAM,IAAQ,OAAO,OAAO;GAAE;GAAU;GAAO,MAAM;EAAoB,CAAC;EAC1E,KAAK,IAAM,KAAU,GACnB,IAAI;GACF,EAAO,CAAK;EACd,QAAQ,CAAC;CAEb;CAEA,SAAS,EACP,GAC+C;EAC/C,OAAO,EAAS,GAAO,EAAI;CAC7B;CAEA,SAAS,EACP,GACiD;EACjD,OAAO,EAAO,IAAI,CAAM;CAC1B;CAEA,SAAS,EAAe,GAKV;EACZ,IAAM,oBAAO,IAAI,IAAa;EAE9B,OAAO,EAAM,aAAa,QAAQ,MAChC,CAAI,EAAK,IAAI,CAAM,MACnB,EAAK,IAAI,CAAM,GACR,EAAS;GAAE,GAAG;GAAO;EAAO,GAAG,EAAK,CAAC,CAAC,WAAW,QACzD;CACH;CAEA,SAAS,EAAa,GAAmE;EACvF,IAAM,IAAW,EAAkB,CAAS;EAE5C,OAAO;GACL,iBAAiB,MAAU,EAAe;IAAE,GAAG;IAAO,WAAW;GAAS,CAAC;GAC3E,WAAW,MAAW,EAAS,EAAO,KAAK,OAAW;IAAE,GAAG;IAAO,WAAW;GAAS,EAAE,CAAC;GACzF,SAAS,MAAU,EAAO;IAAE,GAAG;IAAO,WAAW;GAAS,CAAC;EAC7D;CACF;CAEA,SAAS,EACP,GACA,GACY;EACZ,IAAI,OAAO,KAAY,YAAY,MAAM,IAAI,EAAgB,gCAAgC;EAC7F,IAAI,GAAS,QAAQ,SAAS,aAAa,CAAC;EAE5C,EAAQ,IAAI,CAAO;EACnB,IAAM,UAAgB,EAAQ,OAAO,CAAO;EAG5C,OAFA,GAAS,QAAQ,iBAAiB,SAAS,GAAS,EAAE,MAAM,GAAK,CAAC,SAErD;GAEX,AADA,EAAQ,OAAO,CAAO,GACtB,GAAS,QAAQ,oBAAoB,SAAS,CAAO;EACvD;CACF;CAEA,OAAO;EAAE;EAAgB;EAAU;EAAQ;EAAc,OAAO;EAAU;CAAI;AAChF"}
+{"version":3,"file":"factory.js","names":[],"sources":["../src/factory.ts"],"sourcesContent":["import { tapper } from '@vielzeug/arsenal';\n\nimport { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection: order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Its declarative `roles` (if any) include the principal's role, `ANONYMOUS`\n *    matches a null principal, and `WILDCARD` matches any authenticated principal.\n * 4. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 5. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const knownActions = Object.freeze([\n    ...new Set(\n      compiled.flatMap((rule) => (rule.effect === 'allow' && !rule.action.includes('*') ? [rule.action] : [])),\n    ),\n  ]) as readonly TAction[];\n  const tappers = tapper<WardEvent<TAction, TResource, TAttributes>>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    tappers.emit(Object.freeze({ decision, input, type: 'decision' as const }));\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    filter?: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const candidates = input.filter ?? knownActions;\n    const seen = new Set<TAction>();\n\n    return candidates.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  return {\n    allowedActions,\n    checkAll,\n    decide,\n    forPrincipal,\n    knownActions,\n    rules: compiled,\n    tap: (handler, options) => tappers.tap(handler, options),\n  };\n}\n"],"mappings":"mLAgCA,SAAgB,WAKd,EAGM,CAAC,EACgC,CACvC,IAAM,EAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,EAAM,IAAU,EAAY,EAAM,CAAK,CAAC,CAAC,EACpF,EAAe,OAAO,OAAO,CACjC,GAAG,IAAI,IACL,EAAS,QAAS,GAAU,EAAK,SAAW,SAAW,CAAC,EAAK,OAAO,SAAS,GAAG,EAAI,CAAC,EAAK,MAAM,EAAI,CAAC,CAAE,CACzG,CACF,CAAC,EACK,EAAU,EAAmD,EAEnE,SAAS,SACP,EACA,EAC+C,CAC/C,IAAM,EAAa,EAAsB,CAAK,EAE9C,IAAK,IAAI,EAAQ,EAAG,EAAQ,EAAS,OAAQ,IAAS,CACpD,IAAM,EAAO,EAAS,GAEtB,GAAI,EAAY,EAAM,EAAO,CAAU,EAAG,CACxC,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,EAAK,OACb,QAAS,GACT,OAAQ,QAAQ,EAAM,IAAI,EAAK,SAAW,QAAU,SAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS,GAC1H,MACF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CACF,CAEA,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,OACR,QAAS,GACT,OAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS,iBACjF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CAEA,SAAS,aACP,EACA,EACM,CACN,EAAQ,KAAK,OAAO,OAAO,CAAE,WAAU,QAAO,KAAM,UAAoB,CAAC,CAAC,CAC5E,CAEA,SAAS,OACP,EAC+C,CAC/C,OAAO,SAAS,EAAO,EAAI,CAC7B,CAEA,SAAS,SACP,EACiD,CACjD,OAAO,EAAO,IAAI,MAAM,CAC1B,CAEA,SAAS,eAAe,EAKV,CACZ,IAAM,EAAa,EAAM,QAAU,EAC7B,EAAO,IAAI,IAEjB,OAAO,EAAW,OAAQ,GACxB,CAAI,EAAK,IAAI,CAAM,IACnB,EAAK,IAAI,CAAM,EACR,SAAS,CAAE,GAAG,EAAO,QAAO,EAAG,EAAK,CAAC,CAAC,SAAW,QACzD,CACH,CAEA,SAAS,aAAa,EAAmE,CACvF,IAAM,EAAW,EAAkB,CAAS,EAE5C,MAAO,CACL,eAAiB,GAAU,eAAe,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,EAC3E,SAAW,GAAW,SAAS,EAAO,IAAK,IAAW,CAAE,GAAG,EAAO,UAAW,CAAS,EAAE,CAAC,EACzF,OAAS,GAAU,OAAO,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,CAC7D,CACF,CAEA,MAAO,CACL,eACA,SACA,OACA,aACA,eACA,MAAO,EACP,KAAM,EAAS,IAAY,EAAQ,IAAI,EAAS,CAAO,CACzD,CACF"}

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./constants.cjs"),t=require("./errors.cjs"),n=require("./resource.cjs"),r=require("./factory.cjs"),i=require("./rules.cjs");exports.ANONYMOUS=e.ANONYMOUS,exports.WILDCARD=e.WILDCARD,exports.WardConditionError=t.WardConditionError,exports.WardConfigError=t.WardConfigError,exports.WardError=t.WardError,exports.allow=i.allow,exports.createWard=r.createWard,exports.deny=i.deny,exports.matchesPattern=n.matchesPattern,exports.patternCovers=n.patternCovers,exports.predicate=i.predicate;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./constants.cjs"),t=require("./errors.cjs"),n=require("./resource.cjs"),r=require("./factory.cjs"),i=require("./rules.cjs");exports.ANONYMOUS=e.ANONYMOUS,exports.WILDCARD=e.WILDCARD,exports.WardConditionError=t.WardConditionError,exports.WardConfigError=t.WardConfigError,exports.WardError=t.WardError,exports.allow=i.allow,exports.createWard=r.createWard,exports.deny=i.deny,exports.matchesPattern=n.matchesPattern,exports.predicate=i.predicate;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { ANONYMOUS, WILDCARD } from './constants';
 export { WardConditionError, WardConfigError, WardError } from './errors';
 export { createWard } from './factory';
-export { matchesPattern, patternCovers } from './resource';
+export { matchesPattern } from './resource';
 export { allow, deny, predicate } from './rules';
-export type { BoundWard, BoundWardAllowedActionsInput, BoundWardDecisionInput, Principal, UserPrincipal, Ward, WardAllowedActionsInput, WardAttributes, WardAttributeValue, WardCondition, WardConditionInput, WardDecision, WardDecisionInput, WardEvent, WardPattern, WardRule, } from './types';
+export type { BoundWard, BoundWardDecisionInput, Principal, UserPrincipal, Ward, WardAttributes, WardAttributeValue, WardCondition, WardConditionInput, WardDecision, WardDecisionInput, WardEvent, WardPattern, WardRule, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,sBAAsB,EACtB,SAAS,EACT,aAAa,EACb,IAAI,EACJ,uBAAuB,EACvB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,SAAS,EACT,aAAa,EACb,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,6 +1 @@
-import { ANONYMOUS as e, WILDCARD as t } from "./constants.js";
-import { WardConditionError as n, WardConfigError as r, WardError as i } from "./errors.js";
-import { matchesPattern as a, patternCovers as o } from "./resource.js";
-import { createWard as s } from "./factory.js";
-import { allow as c, deny as l, predicate as u } from "./rules.js";
-export { e as ANONYMOUS, t as WILDCARD, n as WardConditionError, r as WardConfigError, i as WardError, c as allow, s as createWard, l as deny, a as matchesPattern, o as patternCovers, u as predicate };
+import{ANONYMOUS as e,WILDCARD as t}from"./constants.js";import{WardConditionError as n,WardConfigError as r,WardError as i}from"./errors.js";import{matchesPattern as a}from"./resource.js";import{createWard as o}from"./factory.js";import{allow as s,deny as c,predicate as l}from"./rules.js";export{e as ANONYMOUS,t as WILDCARD,n as WardConditionError,r as WardConfigError,i as WardError,s as allow,o as createWard,c as deny,a as matchesPattern,l as predicate};

package/dist/resource.cjs

@@ -1,2 +1,2 @@
-require("./constants.cjs");function e(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}function t(e,t){return e===`*`?!0:t===`*`?!1:e.endsWith(`:*`)?t.startsWith(e.slice(0,-1)):e===t}exports.matchesPattern=e,exports.patternCovers=t;
+require("./constants.cjs");function matchesPattern(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}exports.matchesPattern=matchesPattern;
 //# sourceMappingURL=resource.cjs.map

package/dist/resource.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"resource.cjs","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n"],"mappings":"2BAuBA,SAAgB,EAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT,CAmBA,SAAgB,EAAc,EAAe,EAAyB,CAcpE,OAZI,IAAA,IAA2B,GAG3B,IAAA,IAA4B,GAI5B,EAAM,SAAS,IAAI,EACd,EAAO,WAAW,EAAM,MAAM,EAAG,EAAE,CAAC,EAItC,IAAU,CACnB"}
+{"version":3,"file":"resource.cjs","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true: global wildcard\n * matchesPattern('posts',    'posts')       // true: exact\n * matchesPattern('posts:*',  'posts:123')  // true: namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false: different namespace\n * matchesPattern('posts:42', 'posts:42')   // true: exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true: action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false: different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n"],"mappings":"2BAuBA,SAAgB,eAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT"}

package/dist/resource.d.ts

@@ -11,31 +11,13 @@
  *             `read:*`  matches `read:own`, `read:all`, etc.
  *
  * @example
- * matchesPattern('*',        'posts:123')  // true  — global wildcard
- * matchesPattern('posts',    'posts')       // true  — exact
- * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard
- * matchesPattern('posts:*',  'comments:1') // false — different namespace
- * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id
- * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard
- * matchesPattern('read:*',   'write:all')  // false — different action namespace
+ * matchesPattern('*',        'posts:123')  // true: global wildcard
+ * matchesPattern('posts',    'posts')       // true: exact
+ * matchesPattern('posts:*',  'posts:123')  // true: namespace wildcard
+ * matchesPattern('posts:*',  'comments:1') // false: different namespace
+ * matchesPattern('posts:42', 'posts:42')   // true: exact namespaced id
+ * matchesPattern('read:*',   'read:own')   // true: action namespace wildcard
+ * matchesPattern('read:*',   'write:all')  // false: different action namespace
  */
 export declare function matchesPattern(pattern: string, value: string): boolean;
-/**
- * Returns true if every concrete value that matches `narrow` also matches `broad`.
- * This is the coverage relation used for rule conflict detection.
- *
- * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact
- *
- * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this
- * function explicitly documents and tests the coverage semantics so it remains
- * correct if new pattern syntax is added in the future.
- *
- * @example
- * patternCovers('*',       'posts:*')   // true  — * covers everything
- * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact
- * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself
- * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard
- * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace
- */
-export declare function patternCovers(broad: string, narrow: string): boolean;
 //# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAatE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAepE"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAatE"}

package/dist/resource.js

@@ -1,17 +1,2 @@
-import "./constants.js";
-//#region src/resource.ts
-function e(e, t) {
-	if (e === "*" || e === t) return !0;
-	if (e.endsWith(":*")) {
-		let n = e.slice(0, -1);
-		return t.startsWith(n);
-	}
-	return !1;
-}
-function t(e, t) {
-	return e === "*" ? !0 : t === "*" ? !1 : e.endsWith(":*") ? t.startsWith(e.slice(0, -1)) : e === t;
-}
-//#endregion
-export { e as matchesPattern, t as patternCovers };
-
+import"./constants.js";function matchesPattern(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}export{matchesPattern};
 //# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n"],"mappings":";;AAuBA,SAAgB,EAAe,GAAiB,GAAwB;CAGtE,IAFI,MAAA,OAEA,MAAY,GAAO,OAAO;CAG9B,IAAI,EAAQ,SAAS,IAAI,GAAG;EAC1B,IAAM,IAAK,EAAQ,MAAM,GAAG,EAAE;EAE9B,OAAO,EAAM,WAAW,CAAE;CAC5B;CAEA,OAAO;AACT;AAmBA,SAAgB,EAAc,GAAe,GAAyB;CAcpE,OAZI,MAAA,MAA2B,KAG3B,MAAA,MAA4B,KAI5B,EAAM,SAAS,IAAI,IACd,EAAO,WAAW,EAAM,MAAM,GAAG,EAAE,CAAC,IAItC,MAAU;AACnB"}
+{"version":3,"file":"resource.js","names":[],"sources":["../src/resource.ts"],"sourcesContent":["import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true: global wildcard\n * matchesPattern('posts',    'posts')       // true: exact\n * matchesPattern('posts:*',  'posts:123')  // true: namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false: different namespace\n * matchesPattern('posts:42', 'posts:42')   // true: exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true: action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false: different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n"],"mappings":"uBAuBA,SAAgB,eAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT"}

package/dist/rules.cjs

@@ -1,2 +1,2 @@
-require("./constants.cjs");function e(e){let t=Object.freeze(Array.isArray(e)?[...e]:[e]);return({principal:e})=>t.some(t=>t===`anonymous`?e===null:t===`*`?e!==null:e?.roles.includes(t))}function t(t,n,r,i,a){let o=e(n),s=a?.when?e=>o(e)&&a.when(e):o;return i.map(e=>({action:e,condition:s,effect:t,resource:r}))}var n=(e,n,r,i)=>t(`allow`,e,n,r,i),r=(e,n,r,i)=>t(`deny`,e,n,r,i),i={and:(...e)=>t=>e.every(e=>e(t)),hasRole:e=>({principal:t})=>t?.roles.includes(e)??!1,not:e=>t=>!e(t),or:(...e)=>t=>e.some(e=>e(t)),owns:e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id};exports.allow=n,exports.deny=r,exports.predicate=i;
+function buildRules(e,t,n,r,i){let a=Object.freeze(Array.isArray(t)?[...t]:[t]);return r.map(t=>({action:t,...i?.when===void 0?{}:{condition:i.when},effect:e,resource:n,roles:a}))}var allow=(e,t,n,r)=>buildRules(`allow`,e,t,n,r),deny=(e,t,n,r)=>buildRules(`deny`,e,t,n,r),owns=e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id,and=(...e)=>t=>e.every(e=>e(t)),or=(...e)=>t=>e.some(e=>e(t)),not=e=>t=>!e(t),e={and,not,or,owns};exports.allow=allow,exports.deny=deny,exports.predicate=e;
 //# sourceMappingURL=rules.cjs.map

package/dist/rules.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"rules.cjs","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import { ANONYMOUS, WILDCARD } from './constants';\nimport type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction roleCondition<TAttributes extends WardAttributes>(\n  role: string | readonly string[],\n): WardCondition<TAttributes> {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return ({ principal }) =>\n    roles.some((candidate) =>\n      candidate === ANONYMOUS\n        ? principal === null\n        : candidate === WILDCARD\n          ? principal !== null\n          : principal?.roles.includes(candidate),\n    );\n}\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const matchesRole = roleCondition<TAttributes>(role);\n  const condition = options?.when\n    ? (input: Parameters<WardCondition<TAttributes>>[0]) => matchesRole(input) && options.when!(input)\n    : matchesRole;\n\n  return actions.map((action) => ({ action, condition, effect, resource }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst hasRole =\n  <TAttributes extends WardAttributes = WardAttributes>(role: string): WardCondition<TAttributes> =>\n  ({ principal }) =>\n    principal?.roles.includes(role) ?? false;\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, hasRole, not, or, owns } as const;\n"],"mappings":"2BAOA,SAAS,EACP,EAC4B,CAC5B,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAQ,CAAE,eACR,EAAM,KAAM,GACV,IAAA,YACI,IAAc,KACd,IAAA,IACE,IAAc,KACd,GAAW,MAAM,SAAS,CAAS,CAC3C,CACJ,CAEA,SAAS,EACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAc,EAA2B,CAAI,EAC7C,EAAY,GAAS,KACtB,GAAqD,EAAY,CAAK,GAAK,EAAQ,KAAM,CAAK,EAC/F,EAEJ,OAAO,EAAQ,IAAK,IAAY,CAAE,SAAQ,YAAW,SAAQ,UAAS,EAAE,CAC1E,CAEA,IAAa,GAKX,EACA,EACA,EACA,IACgD,EAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,GAKX,EACA,EACA,EACA,IACgD,EAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EA+BxF,EAAY,CAAE,KAjBvB,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAcpB,QA5BwB,IACrD,CAAE,eACD,GAAW,MAAM,SAAS,CAAI,GAAK,GA0BE,IALrC,GAED,GACC,CAAC,EAAU,CAAK,EAE0B,IAX1C,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAQD,KAvB9C,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,EAoBT"}
+{"version":3,"file":"rules.cjs","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return actions.map((action) => ({\n    action,\n    ...(options?.when === undefined ? {} : { condition: options.when }),\n    effect,\n    resource,\n    roles,\n  }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, not, or, owns } as const;\n"],"mappings":"AAMA,SAAS,WACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,GAAI,GAAS,OAAS,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAQ,IAAK,EACjE,SACA,WACA,OACF,EAAE,CACJ,CAEA,IAAa,OAKX,EACA,EACA,EACA,IACgD,WAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,MAKX,EACA,EACA,EACA,IACgD,WAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EAE/F,KAEF,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,GAC1D,KAEF,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAC9C,IAEF,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAC7C,IAEF,GAED,GACC,CAAC,EAAU,CAAK,EAEP,EAAY,CAAE,IAAK,IAAK,GAAI,IAAK"}

package/dist/rules.d.ts

@@ -6,7 +6,6 @@ export declare const allow: <TAction extends string = string, TResource extends
 export declare const deny: <TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes>(role: string | readonly string[], resource: WardPattern<TResource>, actions: readonly WardPattern<TAction>[], options?: RuleOptions<TAttributes>) => WardRule<TAction, TResource, TAttributes>[];
 export declare const predicate: {
     readonly and: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(...conditions: readonly WardCondition<TAttributes>[]) => WardCondition<TAttributes>;
-    readonly hasRole: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(role: string) => WardCondition<TAttributes>;
     readonly not: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(condition: WardCondition<TAttributes>) => WardCondition<TAttributes>;
     readonly or: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(...conditions: readonly WardCondition<TAttributes>[]) => WardCondition<TAttributes>;
     readonly owns: <TAttributes extends WardAttributes = Readonly<Record<string, import("./types").WardAttributeValue>>>(attribute: keyof TAttributes & string) => WardCondition<TAttributes>;

package/dist/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEpF,KAAK,WAAW,CAAC,WAAW,SAAS,cAAc,IAAI,QAAQ,CAAC;IAC9D,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CACnC,CAAC,CAAC;AAgCH,eAAO,MAAM,KAAK,GAChB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA2D,CAAC;AAExG,eAAO,MAAM,IAAI,GACf,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA0D,CAAC;AA+BvG,eAAO,MAAM,SAAS;mBAlBnB,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;uBAZ5B,WAAW,SAAS,cAAc,yEAAyB,MAAM,KAAG,aAAa,CAAC,WAAW,CAAC;mBAsB9F,WAAW,SAAS,cAAc,8EACtB,aAAa,CAAC,WAAW,CAAC,KACpC,aAAa,CAAC,WAAW,CAAC;kBAR5B,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;oBAd5B,WAAW,SAAS,cAAc,8EACtB,MAAM,WAAW,GAAG,MAAM,KACpC,aAAa,CAAC,WAAW,CAAC;CAsBkC,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEpF,KAAK,WAAW,CAAC,WAAW,SAAS,cAAc,IAAI,QAAQ,CAAC;IAC9D,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CACnC,CAAC,CAAC;AAoBH,eAAO,MAAM,KAAK,GAChB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA2D,CAAC;AAExG,eAAO,MAAM,IAAI,GACf,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,EAEnD,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,UAAU,WAAW,CAAC,SAAS,CAAC,EAChC,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,EACxC,UAAU,WAAW,CAAC,WAAW,CAAC,KACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAA0D,CAAC;AA2BvG,eAAO,MAAM,SAAS;mBAlBnB,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;mBAU5B,WAAW,SAAS,cAAc,8EACtB,aAAa,CAAC,WAAW,CAAC,KACpC,aAAa,CAAC,WAAW,CAAC;kBAR5B,WAAW,SAAS,cAAc,kFAClB,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,KACnD,aAAa,CAAC,WAAW,CAAC;oBAd5B,WAAW,SAAS,cAAc,8EACtB,MAAM,WAAW,GAAG,MAAM,KACpC,aAAa,CAAC,WAAW,CAAC;CAsByB,CAAC"}

package/dist/rules.js

@@ -1,26 +1,2 @@
-import "./constants.js";
-//#region src/rules.ts
-function e(e) {
-	let t = Object.freeze(Array.isArray(e) ? [...e] : [e]);
-	return ({ principal: e }) => t.some((t) => t === "anonymous" ? e === null : t === "*" ? e !== null : e?.roles.includes(t));
-}
-function t(t, n, r, i, a) {
-	let o = e(n), s = a?.when ? (e) => o(e) && a.when(e) : o;
-	return i.map((e) => ({
-		action: e,
-		condition: s,
-		effect: t,
-		resource: r
-	}));
-}
-var n = (e, n, r, i) => t("allow", e, n, r, i), r = (e, n, r, i) => t("deny", e, n, r, i), i = {
-	and: (...e) => (t) => e.every((e) => e(t)),
-	hasRole: (e) => ({ principal: t }) => t?.roles.includes(e) ?? !1,
-	not: (e) => (t) => !e(t),
-	or: (...e) => (t) => e.some((e) => e(t)),
-	owns: (e) => ({ attributes: t, principal: n }) => n !== null && t?.[e] === n.id
-};
-//#endregion
-export { n as allow, r as deny, i as predicate };
-
+function buildRules(e,t,n,r,i){let a=Object.freeze(Array.isArray(t)?[...t]:[t]);return r.map(t=>({action:t,...i?.when===void 0?{}:{condition:i.when},effect:e,resource:n,roles:a}))}var allow=(e,t,n,r)=>buildRules(`allow`,e,t,n,r),deny=(e,t,n,r)=>buildRules(`deny`,e,t,n,r),owns=e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id,and=(...e)=>t=>e.every(e=>e(t)),or=(...e)=>t=>e.some(e=>e(t)),not=e=>t=>!e(t),e={and,not,or,owns};export{allow,deny,e as predicate};
 //# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import { ANONYMOUS, WILDCARD } from './constants';\nimport type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction roleCondition<TAttributes extends WardAttributes>(\n  role: string | readonly string[],\n): WardCondition<TAttributes> {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return ({ principal }) =>\n    roles.some((candidate) =>\n      candidate === ANONYMOUS\n        ? principal === null\n        : candidate === WILDCARD\n          ? principal !== null\n          : principal?.roles.includes(candidate),\n    );\n}\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const matchesRole = roleCondition<TAttributes>(role);\n  const condition = options?.when\n    ? (input: Parameters<WardCondition<TAttributes>>[0]) => matchesRole(input) && options.when!(input)\n    : matchesRole;\n\n  return actions.map((action) => ({ action, condition, effect, resource }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst hasRole =\n  <TAttributes extends WardAttributes = WardAttributes>(role: string): WardCondition<TAttributes> =>\n  ({ principal }) =>\n    principal?.roles.includes(role) ?? false;\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, hasRole, not, or, owns } as const;\n"],"mappings":";;AAOA,SAAS,EACP,GAC4B;CAC5B,IAAM,IAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAI,CAAC;CAEpE,QAAQ,EAAE,mBACR,EAAM,MAAM,MACV,MAAA,cACI,MAAc,OACd,MAAA,MACE,MAAc,OACd,GAAW,MAAM,SAAS,CAAS,CAC3C;AACJ;AAEA,SAAS,EACP,GACA,GACA,GACA,GACA,GAC6C;CAC7C,IAAM,IAAc,EAA2B,CAAI,GAC7C,IAAY,GAAS,QACtB,MAAqD,EAAY,CAAK,KAAK,EAAQ,KAAM,CAAK,IAC/F;CAEJ,OAAO,EAAQ,KAAK,OAAY;EAAE;EAAQ;EAAW;EAAQ;CAAS,EAAE;AAC1E;AAEA,IAAa,KAKX,GACA,GACA,GACA,MACgD,EAAW,SAAS,GAAM,GAAU,GAAS,CAAO,GAEzF,KAKX,GACA,GACA,GACA,MACgD,EAAW,QAAQ,GAAM,GAAU,GAAS,CAAO,GA+BxF,IAAY;CAAE,MAjBvB,GAAG,OAEJ,MACC,EAAW,OAAO,MAAc,EAAU,CAAK,CAAC;CAcpB,UA5BwB,OACrD,EAAE,mBACD,GAAW,MAAM,SAAS,CAAI,KAAK;CA0BE,MALrC,OAED,MACC,CAAC,EAAU,CAAK;CAE0B,KAX1C,GAAG,OAEJ,MACC,EAAW,MAAM,MAAc,EAAU,CAAK,CAAC;CAQD,OAvB9C,OAED,EAAE,eAAY,mBACb,MAAc,QAAQ,IAAa,OAAe,EAAU;AAoBT"}
+{"version":3,"file":"rules.js","names":[],"sources":["../src/rules.ts"],"sourcesContent":["import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return actions.map((action) => ({\n    action,\n    ...(options?.when === undefined ? {} : { condition: options.when }),\n    effect,\n    resource,\n    roles,\n  }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, not, or, owns } as const;\n"],"mappings":"AAMA,SAAS,WACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,GAAI,GAAS,OAAS,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAQ,IAAK,EACjE,SACA,WACA,OACF,EAAE,CACJ,CAEA,IAAa,OAKX,EACA,EACA,EACA,IACgD,WAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,MAKX,EACA,EACA,EACA,IACgD,WAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EAE/F,KAEF,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,GAC1D,KAEF,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAC9C,IAEF,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAC7C,IAEF,GAED,GACC,CAAC,EAAU,CAAK,EAEP,EAAY,CAAE,IAAK,IAAK,GAAI,IAAK"}

package/dist/types.d.ts

@@ -21,6 +21,12 @@ export type WardRule<TAction extends string = string, TResource extends string =
     condition?: WardCondition<TAttributes>;
     effect: 'allow' | 'deny';
     resource: WardPattern<TResource>;
+    /**
+     * Roles this rule applies to, evaluated beside action, resource, and
+     * attributes. `ANONYMOUS` matches a null principal, `WILDCARD` matches any
+     * authenticated principal. Omit to match every principal.
+     */
+    roles?: readonly string[];
 }>;
 type MatchedWardDecision<TAction extends string, TResource extends string, TAttributes extends WardAttributes> = Readonly<{
     effect: 'allow' | 'deny';
@@ -42,13 +48,6 @@ export type WardDecisionInput<TAction extends string = string, TResource extends
     resource: TResource;
 }>;
 export type BoundWardDecisionInput<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = Omit<WardDecisionInput<TAction, TResource, TAttributes>, 'principal'>;
-export type WardAllowedActionsInput<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = Readonly<{
-    attributes?: TAttributes;
-    knownActions: readonly TAction[];
-    principal?: Principal;
-    resource: TResource;
-}>;
-export type BoundWardAllowedActionsInput<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = Omit<WardAllowedActionsInput<TAction, TResource, TAttributes>, 'principal'>;
 export type WardEvent<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = Readonly<{
     decision: WardDecision<TAction, TResource, TAttributes>;
     input: WardDecisionInput<TAction, TResource, TAttributes> & {
@@ -56,13 +55,18 @@ export type WardEvent<TAction extends string = string, TResource extends string
     };
     type: 'decision';
 }>;
-export type BoundWard<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = {
-    allowedActions(input: BoundWardAllowedActionsInput<TAction, TResource, TAttributes>): TAction[];
-    checkAll(inputs: readonly BoundWardDecisionInput<TAction, TResource, TAttributes>[]): WardDecision<TAction, TResource, TAttributes>[];
-    decide(input: BoundWardDecisionInput<TAction, TResource, TAttributes>): WardDecision<TAction, TResource, TAttributes>;
-};
+export type BoundWard<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = Pick<Ward<TAction, TResource, TAttributes>, 'allowedActions' | 'checkAll' | 'decide'>;
 export type Ward<TAction extends string = string, TResource extends string = string, TAttributes extends WardAttributes = WardAttributes> = {
-    allowedActions(input: WardAllowedActionsInput<TAction, TResource, TAttributes>): TAction[];
+    /**
+     * The actions this ward's rule set can ever allow, in declaration order.
+     * Derived from the compiled rules; exact (non-pattern) actions only, since
+     * wildcard actions have no enumerable value.
+     */
+    readonly knownActions: readonly TAction[];
+    /** Actions the input is allowed to perform, drawn from {@link Ward.knownActions} unless filtered. */
+    allowedActions(input: Omit<WardDecisionInput<TAction, TResource, TAttributes>, 'action'> & {
+        filter?: readonly TAction[];
+    }): TAction[];
     checkAll(inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[]): WardDecision<TAction, TResource, TAttributes>[];
     decide(input: WardDecisionInput<TAction, TResource, TAttributes>): WardDecision<TAction, TResource, TAttributes>;
     forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes>;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,MAAM,GACN,MAAM,GACN,IAAI,GACJ,SAAS,kBAAkB,EAAE,GAC7B;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAEnD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE1E,MAAM,MAAM,WAAW,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG,OAAO,QAAQ,GAAG,GAAG,MAAM,IAAI,CAAC;AAE1F,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC;AAE7C,MAAM,MAAM,kBAAkB,CAAC,WAAW,SAAS,cAAc,GAAG,cAAc,IAAI,QAAQ,CAAC;IAC7F,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,MAAM,aAAa,CAAC,WAAW,SAAS,cAAc,GAAG,cAAc,IAAI,CAC/E,KAAK,EAAE,kBAAkB,CAAC,WAAW,CAAC,KACnC,OAAO,CAAC;AAEb,MAAM,MAAM,QAAQ,CAClB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,KAAK,mBAAmB,CACtB,OAAO,SAAS,MAAM,EACtB,SAAS,SAAS,MAAM,EACxB,WAAW,SAAS,cAAc,IAChC,QAAQ,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,KAAK,uBAAuB,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,YAAY,CACtB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,uBAAuB,CAAC;AAEnF,MAAM,MAAM,iBAAiB,CAC3B,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,MAAM,sBAAsB,CAChC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,CACjC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,MAAM,4BAA4B,CACtC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;AAEhF,MAAM,MAAM,SAAS,CACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,CACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD;IACF,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,EAAE,CAAC;IAChG,QAAQ,CACN,MAAM,EAAE,SAAS,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,GACzE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;CACvH,CAAC;AAEF,MAAM,MAAM,IAAI,CACd,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD;IACF,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,EAAE,CAAC;IAC3F,QAAQ,CACN,MAAM,EAAE,SAAS,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,GACpE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjH,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACrE,GAAG,CACD,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,IAAI,EACpE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC1C,MAAM,IAAI,CAAC;CACf,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,MAAM,GACN,MAAM,GACN,IAAI,GACJ,SAAS,kBAAkB,EAAE,GAC7B;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAEnD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE1E,MAAM,MAAM,WAAW,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG,OAAO,QAAQ,GAAG,GAAG,MAAM,IAAI,CAAC;AAE1F,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC;AAE7C,MAAM,MAAM,kBAAkB,CAAC,WAAW,SAAS,cAAc,GAAG,cAAc,IAAI,QAAQ,CAAC;IAC7F,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,MAAM,aAAa,CAAC,WAAW,SAAS,cAAc,GAAG,cAAc,IAAI,CAC/E,KAAK,EAAE,kBAAkB,CAAC,WAAW,CAAC,KACnC,OAAO,CAAC;AAEb,MAAM,MAAM,QAAQ,CAClB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAEH,KAAK,mBAAmB,CACtB,OAAO,SAAS,MAAM,EACtB,SAAS,SAAS,MAAM,EACxB,WAAW,SAAS,cAAc,IAChC,QAAQ,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,KAAK,uBAAuB,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,YAAY,CACtB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,uBAAuB,CAAC;AAEnF,MAAM,MAAM,iBAAiB,CAC3B,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,MAAM,sBAAsB,CAChC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;AAE1E,MAAM,MAAM,SAAS,CACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,QAAQ,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,CACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC;AAE1F,MAAM,MAAM,IAAI,CACd,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,WAAW,SAAS,cAAc,GAAG,cAAc,IACjD;IACF;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IAC1C,qGAAqG;IACrG,cAAc,CACZ,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,GAAG;QAC1E,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;KAC7B,GACA,OAAO,EAAE,CAAC;IACb,QAAQ,CACN,MAAM,EAAE,SAAS,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,GACpE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjH,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACrE,GAAG,CACD,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,IAAI,EACpE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC1C,MAAM,IAAI,CAAC;CACf,CAAC"}

package/dist/ward.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=`*`,t=`anonymous`,n=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},r=class extends n{},i=class extends n{ruleIndex;constructor(e,t){super(`Rule[${e}].condition failed`,{cause:t}),this.ruleIndex=e}};function a(e,t,n){if(e===null||typeof e==`boolean`||typeof e==`string`)return e;if(typeof e==`number`){if(!Number.isFinite(e))throw new r(`${t} must contain only finite numbers`);return e}if(typeof e!=`object`)throw new r(`${t} must contain only JSON-compatible values`);if(n.has(e))throw new r(`${t} must not contain circular references`);let i=Object.getPrototypeOf(e);if(!Array.isArray(e)&&i!==Object.prototype&&i!==null)throw new r(`${t} must contain only arrays and plain objects`);n.add(e);try{return Object.freeze(Array.isArray(e)?Array.from(e,(e,r)=>a(e,`${t}[${r}]`,n)):Object.fromEntries(Object.keys(e).map(r=>[r,a(e[r],`${t}.${r}`,n)])))}finally{n.delete(e)}}function o(e,t){if(e!==void 0){if(typeof e!=`object`||!e||Array.isArray(e))throw new r(`${t} must be a plain object`);return a(e,t,new Set)}}function s(e,t){let n=`Rule[${t}]`;if(typeof e!=`object`||!e||Array.isArray(e))throw new r(`${n} must be a plain object`);let i=Object.getPrototypeOf(e);if(i!==Object.prototype&&i!==null)throw new r(`${n} must be a plain object`);if(typeof e.action!=`string`||!e.action.trim())throw new r(`${n}.action must be a non-empty string`);if(e.action.endsWith(`:`))throw new r(`${n}.action '${e.action}' ends with ':' — did you mean '${e.action}*'?`);if(typeof e.resource!=`string`||!e.resource.trim())throw new r(`${n}.resource must be a non-empty string`);if(e.resource.endsWith(`:`))throw new r(`${n}.resource '${e.resource}' ends with ':' — did you mean '${e.resource}*'?`);if(e.effect!==`allow`&&e.effect!==`deny`)throw new r(`${n}.effect must be "allow" or "deny"`);if(e.condition!==void 0&&typeof e.condition!=`function`)throw new r(`${n}.condition must be a function`);return Object.freeze({action:e.action,...e.attributes===void 0?{}:{attributes:o(e.attributes,`${n}.attributes`)},...e.condition===void 0?{}:{condition:e.condition},effect:e.effect,resource:e.resource})}function c(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}function l(e,t){return e===`*`?!0:t===`*`?!1:e.endsWith(`:*`)?t.startsWith(e.slice(0,-1)):e===t}function u(e){if(typeof e!=`object`||!e)throw new r(`Invalid principal: expected { id: string, roles: string[] }`);let t=e;if(typeof t.id!=`string`||!t.id.trim())throw new r(`Invalid principal: id must be a non-empty string`);if(!Array.isArray(t.roles)||t.roles.some(e=>typeof e!=`string`||!e.trim()))throw new r(`Invalid principal: roles must be an array of non-empty strings`)}function d(e){return e==null?null:(u(e),Object.freeze({...e.attributes===void 0?{}:{attributes:o(e.attributes,`Principal.attributes`)},id:e.id,roles:Object.freeze([...e.roles])}))}function f(e){if(typeof e.action!=`string`||!e.action.trim())throw new r(`Decision.action must be a non-empty string`);if(typeof e.resource!=`string`||!e.resource.trim())throw new r(`Decision.resource must be a non-empty string`);return Object.freeze({action:e.action,...e.attributes===void 0?{}:{attributes:o(e.attributes,`Decision.attributes`)},principal:d(e.principal),resource:e.resource})}function p(e,t){if(Object.is(e,t))return!0;if(typeof e!=`object`||typeof t!=`object`||e===null||t===null)return!1;if(Array.isArray(e)||Array.isArray(t))return Array.isArray(e)&&Array.isArray(t)&&e.length===t.length&&e.every((e,n)=>p(e,t[n]));let n=e,r=t,i=Object.keys(n),a=Object.keys(r);return i.length===a.length&&i.every(e=>Object.hasOwn(r,e)&&p(n[e],r[e]))}function m(e,t){return e?t?Object.keys(e).every(n=>Object.hasOwn(t,n)&&p(e[n],t[n])):!1:!0}function h(e){return typeof e==`object`&&!!e&&`then`in e&&typeof e.then==`function`||typeof e==`function`&&`then`in e&&typeof e.then==`function`}function g(e,t,n){if(!c(e.action,n.action)||!c(e.resource,n.resource)||!m(e.attributes,n.attributes))return!1;if(!e.condition)return!0;try{let t=e.condition({attributes:n.attributes,principal:n.principal});if(h(t))throw TypeError(`Async conditions are not supported; return a boolean`);if(typeof t!=`boolean`)throw TypeError(`Conditions must return a boolean`);return t}catch(e){throw new i(t,e)}}function _(e=[]){let t=Object.freeze(e.flat().map((e,t)=>s(e,t))),n=new Set;function i(e,n){let r=f(e);for(let e=0;e<t.length;e++){let i=t[e];if(g(i,e,r)){let t=Object.freeze({effect:i.effect,matched:!0,reason:`rule[${e}] ${i.effect===`allow`?`allows`:`denies`} '${r.action}' on '${r.resource}'`,rule:i});return n&&a(r,t),t}}let i=Object.freeze({effect:`deny`,matched:!1,reason:`no matching rule for '${r.action}' on '${r.resource}' (default deny)`});return n&&a(r,i),i}function a(e,t){if(n.size===0)return;let r=Object.freeze({decision:t,input:e,type:`decision`});for(let e of n)try{e(r)}catch{}}function o(e){return i(e,!0)}function c(e){return e.map(o)}function l(e){let t=new Set;return e.knownActions.filter(n=>!t.has(n)&&(t.add(n),i({...e,action:n},!1).effect===`allow`))}function u(e){let t=d(e);return{allowedActions:e=>l({...e,principal:t}),checkAll:e=>c(e.map(e=>({...e,principal:t}))),decide:e=>o({...e,principal:t})}}function p(e,t){if(typeof e!=`function`)throw new r(`tap handler must be a function`);if(t?.signal?.aborted)return()=>{};n.add(e);let i=()=>n.delete(e);return t?.signal?.addEventListener(`abort`,i,{once:!0}),()=>{n.delete(e),t?.signal?.removeEventListener(`abort`,i)}}return{allowedActions:l,checkAll:c,decide:o,forPrincipal:u,rules:t,tap:p}}function v(e){let t=Object.freeze(Array.isArray(e)?[...e]:[e]);return({principal:e})=>t.some(t=>t===`anonymous`?e===null:t===`*`?e!==null:e?.roles.includes(t))}function y(e,t,n,r,i){let a=v(t),o=i?.when?e=>a(e)&&i.when(e):a;return r.map(t=>({action:t,condition:o,effect:e,resource:n}))}var b=(e,t,n,r)=>y(`allow`,e,t,n,r),x=(e,t,n,r)=>y(`deny`,e,t,n,r),S={and:(...e)=>t=>e.every(e=>e(t)),hasRole:e=>({principal:t})=>t?.roles.includes(e)??!1,not:e=>t=>!e(t),or:(...e)=>t=>e.some(e=>e(t)),owns:e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id};exports.ANONYMOUS=t,exports.WILDCARD=e,exports.WardConditionError=i,exports.WardConfigError=r,exports.WardError=n,exports.allow=b,exports.createWard=_,exports.deny=x,exports.matchesPattern=c,exports.patternCovers=l,exports.predicate=S;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@vielzeug/arsenal");var t=`*`,n=`anonymous`,WardError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},WardConfigError=class extends WardError{},WardConditionError=class extends WardError{ruleIndex;constructor(e,t){super(`Rule[${e}].condition failed`,{cause:t}),this.ruleIndex=e}};function snapshotValue(e,t,n){if(e===null||typeof e==`boolean`||typeof e==`string`)return e;if(typeof e==`number`){if(!Number.isFinite(e))throw new WardConfigError(`${t} must contain only finite numbers`);return e}if(typeof e!=`object`)throw new WardConfigError(`${t} must contain only JSON-compatible values`);if(n.has(e))throw new WardConfigError(`${t} must not contain circular references`);let r=Object.getPrototypeOf(e);if(!Array.isArray(e)&&r!==Object.prototype&&r!==null)throw new WardConfigError(`${t} must contain only arrays and plain objects`);n.add(e);try{return Object.freeze(Array.isArray(e)?Array.from(e,(e,r)=>snapshotValue(e,`${t}[${r}]`,n)):Object.fromEntries(Object.keys(e).map(r=>[r,snapshotValue(e[r],`${t}.${r}`,n)])))}finally{n.delete(e)}}function snapshotAttributes(e,t){if(e!==void 0){if(typeof e!=`object`||!e||Array.isArray(e))throw new WardConfigError(`${t} must be a plain object`);return snapshotValue(e,t,new Set)}}function compileRule(e,t){let n=`Rule[${t}]`;if(typeof e!=`object`||!e||Array.isArray(e))throw new WardConfigError(`${n} must be a plain object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw new WardConfigError(`${n} must be a plain object`);if(typeof e.action!=`string`||!e.action.trim())throw new WardConfigError(`${n}.action must be a non-empty string`);if(e.action.endsWith(`:`))throw new WardConfigError(`${n}.action '${e.action}' ends with ':': did you mean '${e.action}*'?`);if(typeof e.resource!=`string`||!e.resource.trim())throw new WardConfigError(`${n}.resource must be a non-empty string`);if(e.resource.endsWith(`:`))throw new WardConfigError(`${n}.resource '${e.resource}' ends with ':': did you mean '${e.resource}*'?`);if(e.effect!==`allow`&&e.effect!==`deny`)throw new WardConfigError(`${n}.effect must be "allow" or "deny"`);if(e.condition!==void 0&&typeof e.condition!=`function`)throw new WardConfigError(`${n}.condition must be a function`);if(e.roles!==void 0&&(!Array.isArray(e.roles)||e.roles.some(e=>typeof e!=`string`||!e.trim())))throw new WardConfigError(`${n}.roles must be an array of non-empty strings`);return Object.freeze({action:e.action,...e.attributes===void 0?{}:{attributes:snapshotAttributes(e.attributes,`${n}.attributes`)},...e.condition===void 0?{}:{condition:e.condition},effect:e.effect,resource:e.resource,...e.roles===void 0?{}:{roles:Object.freeze([...e.roles])}})}function matchesPattern(e,t){if(e===`*`||e===t)return!0;if(e.endsWith(`:*`)){let n=e.slice(0,-1);return t.startsWith(n)}return!1}function assertUserPrincipal(e){if(typeof e!=`object`||!e)throw new WardConfigError(`Invalid principal: expected { id: string, roles: string[] }`);let t=e;if(typeof t.id!=`string`||!t.id.trim())throw new WardConfigError(`Invalid principal: id must be a non-empty string`);if(!Array.isArray(t.roles)||t.roles.some(e=>typeof e!=`string`||!e.trim()))throw new WardConfigError(`Invalid principal: roles must be an array of non-empty strings`)}function snapshotPrincipal(e){return e==null?null:(assertUserPrincipal(e),Object.freeze({...e.attributes===void 0?{}:{attributes:snapshotAttributes(e.attributes,`Principal.attributes`)},id:e.id,roles:Object.freeze([...e.roles])}))}function snapshotDecisionInput(e){if(typeof e.action!=`string`||!e.action.trim())throw new WardConfigError(`Decision.action must be a non-empty string`);if(typeof e.resource!=`string`||!e.resource.trim())throw new WardConfigError(`Decision.resource must be a non-empty string`);return Object.freeze({action:e.action,...e.attributes===void 0?{}:{attributes:snapshotAttributes(e.attributes,`Decision.attributes`)},principal:snapshotPrincipal(e.principal),resource:e.resource})}function deepEqual(e,t){if(Object.is(e,t))return!0;if(typeof e!=`object`||typeof t!=`object`||e===null||t===null)return!1;if(Array.isArray(e)||Array.isArray(t))return Array.isArray(e)&&Array.isArray(t)&&e.length===t.length&&e.every((e,n)=>deepEqual(e,t[n]));let n=e,r=t,i=Object.keys(n),a=Object.keys(r);return i.length===a.length&&i.every(e=>Object.hasOwn(r,e)&&deepEqual(n[e],r[e]))}function attributesMatch(e,t){return e?t?Object.keys(e).every(n=>Object.hasOwn(t,n)&&deepEqual(e[n],t[n])):!1:!0}function rolesMatch(e,t){return!e||e.some(e=>e===`anonymous`?t===null:e===`*`?t!==null:t?.roles.includes(e)??!1)}function isThenable(e){return typeof e==`object`&&!!e&&`then`in e&&typeof e.then==`function`||typeof e==`function`&&`then`in e&&typeof e.then==`function`}function ruleMatches(e,t,n){if(!matchesPattern(e.action,n.action)||!matchesPattern(e.resource,n.resource)||!rolesMatch(e.roles,n.principal)||!attributesMatch(e.attributes,n.attributes))return!1;if(!e.condition)return!0;try{let t=e.condition({attributes:n.attributes,principal:n.principal});if(isThenable(t))throw TypeError(`Async conditions are not supported; return a boolean`);if(typeof t!=`boolean`)throw TypeError(`Conditions must return a boolean`);return t}catch(e){throw new WardConditionError(t,e)}}function createWard(t=[]){let n=Object.freeze(t.flat().map((e,t)=>compileRule(e,t))),r=Object.freeze([...new Set(n.flatMap(e=>e.effect===`allow`&&!e.action.includes(`*`)?[e.action]:[]))]),i=(0,e.tapper)();function evaluate(e,t){let r=snapshotDecisionInput(e);for(let e=0;e<n.length;e++){let i=n[e];if(ruleMatches(i,e,r)){let n=Object.freeze({effect:i.effect,matched:!0,reason:`rule[${e}] ${i.effect===`allow`?`allows`:`denies`} '${r.action}' on '${r.resource}'`,rule:i});return t&&emitDecision(r,n),n}}let i=Object.freeze({effect:`deny`,matched:!1,reason:`no matching rule for '${r.action}' on '${r.resource}' (default deny)`});return t&&emitDecision(r,i),i}function emitDecision(e,t){i.emit(Object.freeze({decision:t,input:e,type:`decision`}))}function decide(e){return evaluate(e,!0)}function checkAll(e){return e.map(decide)}function allowedActions(e){let t=e.filter??r,n=new Set;return t.filter(t=>!n.has(t)&&(n.add(t),evaluate({...e,action:t},!1).effect===`allow`))}function forPrincipal(e){let t=snapshotPrincipal(e);return{allowedActions:e=>allowedActions({...e,principal:t}),checkAll:e=>checkAll(e.map(e=>({...e,principal:t}))),decide:e=>decide({...e,principal:t})}}return{allowedActions,checkAll,decide,forPrincipal,knownActions:r,rules:n,tap:(e,t)=>i.tap(e,t)}}function buildRules(e,t,n,r,i){let a=Object.freeze(Array.isArray(t)?[...t]:[t]);return r.map(t=>({action:t,...i?.when===void 0?{}:{condition:i.when},effect:e,resource:n,roles:a}))}var allow=(e,t,n,r)=>buildRules(`allow`,e,t,n,r),deny=(e,t,n,r)=>buildRules(`deny`,e,t,n,r),owns=e=>({attributes:t,principal:n})=>n!==null&&t?.[e]===n.id,and=(...e)=>t=>e.every(e=>e(t)),or=(...e)=>t=>e.some(e=>e(t)),not=e=>t=>!e(t),r={and,not,or,owns};exports.ANONYMOUS=n,exports.WILDCARD=t,exports.WardConditionError=WardConditionError,exports.WardConfigError=WardConfigError,exports.WardError=WardError,exports.allow=allow,exports.createWard=createWard,exports.deny=deny,exports.matchesPattern=matchesPattern,exports.predicate=r;
 //# sourceMappingURL=ward.cjs.map

package/dist/ward.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ward.cjs","names":[],"sources":["../src/constants.ts","../src/errors.ts","../src/_compile.ts","../src/resource.ts","../src/_match.ts","../src/factory.ts","../src/rules.ts"],"sourcesContent":["export const WILDCARD = '*' as const;\nexport const ANONYMOUS = 'anonymous' as const;\n","/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition, decision attributes, or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/** Thrown when an application-provided rule condition fails. */\nexport class WardConditionError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    super(`Rule[${ruleIndex}].condition failed`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n","import { WardConfigError } from './errors';\nimport type { WardAttributes, WardAttributeValue, WardRule } from './types';\n\nfunction snapshotValue(value: unknown, path: string, ancestors: Set<object>): WardAttributeValue {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;\n\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new WardConfigError(`${path} must contain only finite numbers`);\n    return value;\n  }\n\n  if (typeof value !== 'object') {\n    throw new WardConfigError(`${path} must contain only JSON-compatible values`);\n  }\n\n  if (ancestors.has(value)) throw new WardConfigError(`${path} must not contain circular references`);\n\n  const prototype = Object.getPrototypeOf(value);\n  if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null) {\n    throw new WardConfigError(`${path} must contain only arrays and plain objects`);\n  }\n\n  ancestors.add(value);\n\n  try {\n    if (Array.isArray(value)) {\n      return Object.freeze(Array.from(value, (item, index) => snapshotValue(item, `${path}[${index}]`, ancestors)));\n    }\n\n    return Object.freeze(\n      Object.fromEntries(\n        Object.keys(value).map((key) => [\n          key,\n          snapshotValue((value as Record<string, unknown>)[key], `${path}.${key}`, ancestors),\n        ]),\n      ),\n    );\n  } finally {\n    ancestors.delete(value);\n  }\n}\n\nexport function snapshotAttributes(value: unknown, path: string): WardAttributes | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new WardConfigError(`${path} must be a plain object`);\n  }\n\n  return snapshotValue(value, path, new Set()) as WardAttributes;\n}\n\n/**\n * Validates and snapshots a single rule definition at ward-creation time.\n * Throws {@link WardConfigError} with a `Rule[index]`-prefixed message on failure.\n */\nexport function compileRule<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  rule: WardRule<TAction, TResource, TAttributes>,\n  index: number,\n): WardRule<TAction, TResource, TAttributes> {\n  const at = `Rule[${index}]`;\n\n  if (typeof rule !== 'object' || rule === null || Array.isArray(rule)) {\n    throw new WardConfigError(`${at} must be a plain object`);\n  }\n  const prototype = Object.getPrototypeOf(rule);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new WardConfigError(`${at} must be a plain object`);\n  }\n\n  if (typeof rule.action !== 'string' || !rule.action.trim()) {\n    throw new WardConfigError(`${at}.action must be a non-empty string`);\n  }\n\n  if (rule.action.endsWith(':')) {\n    throw new WardConfigError(`${at}.action '${rule.action}' ends with ':' — did you mean '${rule.action}*'?`);\n  }\n\n  if (typeof rule.resource !== 'string' || !rule.resource.trim()) {\n    throw new WardConfigError(`${at}.resource must be a non-empty string`);\n  }\n\n  if (rule.resource.endsWith(':')) {\n    throw new WardConfigError(`${at}.resource '${rule.resource}' ends with ':' — did you mean '${rule.resource}*'?`);\n  }\n\n  if (rule.effect !== 'allow' && rule.effect !== 'deny') {\n    throw new WardConfigError(`${at}.effect must be \"allow\" or \"deny\"`);\n  }\n\n  if (rule.condition !== undefined && typeof rule.condition !== 'function') {\n    throw new WardConfigError(`${at}.condition must be a function`);\n  }\n\n  return Object.freeze({\n    action: rule.action,\n    ...(rule.attributes === undefined ? {} : { attributes: snapshotAttributes(rule.attributes, `${at}.attributes`) }),\n    ...(rule.condition === undefined ? {} : { condition: rule.condition }),\n    effect: rule.effect,\n    resource: rule.resource,\n  }) as WardRule<TAction, TResource, TAttributes>;\n}\n","import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true  — global wildcard\n * matchesPattern('posts',    'posts')       // true  — exact\n * matchesPattern('posts:*',  'posts:123')  // true  — namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false — different namespace\n * matchesPattern('posts:42', 'posts:42')   // true  — exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true  — action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false — different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n\n/**\n * Returns true if every concrete value that matches `narrow` also matches `broad`.\n * This is the coverage relation used for rule conflict detection.\n *\n * Pattern hierarchy (most to least permissive): `*` > `ns:*` > exact\n *\n * Unlike `matchesPattern(broad, narrow)` — which works accidentally — this\n * function explicitly documents and tests the coverage semantics so it remains\n * correct if new pattern syntax is added in the future.\n *\n * @example\n * patternCovers('*',       'posts:*')   // true  — * covers everything\n * patternCovers('posts:*', 'posts:123') // true  — namespace covers exact\n * patternCovers('posts:*', 'posts:*')  // true  — same pattern covers itself\n * patternCovers('posts:*', '*')         // false — namespace does not cover global wildcard\n * patternCovers('posts',   'posts:*')   // false — exact does not cover namespace\n */\nexport function patternCovers(broad: string, narrow: string): boolean {\n  // Global wildcard covers everything\n  if (broad === WILDCARD) return true;\n\n  // Nothing else covers global wildcard\n  if (narrow === WILDCARD) return false;\n\n  // Namespace wildcard: covers any value starting with the same namespace prefix,\n  // including nested namespace wildcards (\"posts:*\" covers \"posts:sub:*\") and exact IDs.\n  if (broad.endsWith(':*')) {\n    return narrow.startsWith(broad.slice(0, -1));\n  }\n\n  // Exact only covers itself\n  return broad === narrow;\n}\n","import { snapshotAttributes } from './_compile';\nimport { WardConditionError, WardConfigError } from './errors';\nimport { matchesPattern } from './resource';\nimport type {\n  Principal,\n  UserPrincipal,\n  WardAttributes,\n  WardAttributeValue,\n  WardDecisionInput,\n  WardRule,\n} from './types';\n\n/** Asserts that `input` is a valid `UserPrincipal`. Throws with a clear message otherwise. */\nexport function assertUserPrincipal(input: unknown): asserts input is UserPrincipal {\n  if (typeof input !== 'object' || !input) {\n    throw new WardConfigError('Invalid principal: expected { id: string, roles: string[] }');\n  }\n\n  const principal = input as Record<string, unknown>;\n\n  if (typeof principal.id !== 'string' || !principal.id.trim()) {\n    throw new WardConfigError('Invalid principal: id must be a non-empty string');\n  }\n\n  if (!Array.isArray(principal.roles) || principal.roles.some((role) => typeof role !== 'string' || !role.trim())) {\n    throw new WardConfigError('Invalid principal: roles must be an array of non-empty strings');\n  }\n}\n\nexport function snapshotPrincipal(principal: Principal | undefined): Principal {\n  if (principal === undefined || principal === null) return null;\n\n  assertUserPrincipal(principal);\n\n  return Object.freeze({\n    ...(principal.attributes === undefined\n      ? {}\n      : { attributes: snapshotAttributes(principal.attributes, 'Principal.attributes') }),\n    id: principal.id,\n    roles: Object.freeze([...principal.roles]),\n  });\n}\n\nexport function snapshotDecisionInput<\n  TAction extends string,\n  TResource extends string,\n  TAttributes extends WardAttributes,\n>(\n  input: WardDecisionInput<TAction, TResource, TAttributes>,\n): WardDecisionInput<TAction, TResource, TAttributes> & {\n  principal: Principal;\n} {\n  if (typeof input.action !== 'string' || !input.action.trim()) {\n    throw new WardConfigError('Decision.action must be a non-empty string');\n  }\n  if (typeof input.resource !== 'string' || !input.resource.trim()) {\n    throw new WardConfigError('Decision.resource must be a non-empty string');\n  }\n\n  return Object.freeze({\n    action: input.action,\n    ...(input.attributes === undefined\n      ? {}\n      : { attributes: snapshotAttributes(input.attributes, 'Decision.attributes') as TAttributes }),\n    principal: snapshotPrincipal(input.principal),\n    resource: input.resource,\n  });\n}\n\nfunction deepEqual(left: WardAttributeValue, right: WardAttributeValue): boolean {\n  if (Object.is(left, right)) return true;\n  if (typeof left !== 'object' || typeof right !== 'object' || left === null || right === null) return false;\n  if (Array.isArray(left) || Array.isArray(right)) {\n    return (\n      Array.isArray(left) &&\n      Array.isArray(right) &&\n      left.length === right.length &&\n      left.every((value, index) => deepEqual(value, right[index]))\n    );\n  }\n\n  const leftRecord = left as Record<string, WardAttributeValue>;\n  const rightRecord = right as Record<string, WardAttributeValue>;\n  const leftKeys = Object.keys(leftRecord);\n  const rightKeys = Object.keys(rightRecord);\n\n  return (\n    leftKeys.length === rightKeys.length &&\n    leftKeys.every((key) => Object.hasOwn(rightRecord, key) && deepEqual(leftRecord[key], rightRecord[key]))\n  );\n}\n\nexport function attributesMatch(expected: WardAttributes | undefined, actual: WardAttributes | undefined): boolean {\n  if (!expected) return true;\n  if (!actual) return false;\n\n  return Object.keys(expected).every((key) => Object.hasOwn(actual, key) && deepEqual(expected[key], actual[key]));\n}\n\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return (\n    (typeof value === 'object' && value !== null && 'then' in value && typeof value.then === 'function') ||\n    (typeof value === 'function' && 'then' in value && typeof value.then === 'function')\n  );\n}\n\nexport function ruleMatches<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  rule: WardRule<TAction, TResource, TAttributes>,\n  index: number,\n  input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n): boolean {\n  if (!matchesPattern(rule.action, input.action)) return false;\n  if (!matchesPattern(rule.resource, input.resource)) return false;\n  if (!attributesMatch(rule.attributes, input.attributes)) return false;\n  if (!rule.condition) return true;\n\n  try {\n    const result: unknown = rule.condition({ attributes: input.attributes, principal: input.principal });\n\n    if (isThenable(result)) {\n      throw new TypeError('Async conditions are not supported; return a boolean');\n    }\n    if (typeof result !== 'boolean') {\n      throw new TypeError('Conditions must return a boolean');\n    }\n\n    return result;\n  } catch (error) {\n    throw new WardConditionError(index, error);\n  }\n}\n","import { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport { WardConfigError } from './errors';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection — order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 4. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const tappers = new Set<(event: WardEvent<TAction, TResource, TAttributes>) => void>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    if (tappers.size === 0) return;\n\n    const event = Object.freeze({ decision, input, type: 'decision' as const });\n    for (const tapper of tappers) {\n      try {\n        tapper(event);\n      } catch {}\n    }\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    knownActions: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const seen = new Set<TAction>();\n\n    return input.knownActions.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  function tap(\n    handler: (event: WardEvent<TAction, TResource, TAttributes>) => void,\n    options?: { readonly signal?: AbortSignal },\n  ): () => void {\n    if (typeof handler !== 'function') throw new WardConfigError('tap handler must be a function');\n    if (options?.signal?.aborted) return () => {};\n\n    tappers.add(handler);\n    const onAbort = () => tappers.delete(handler);\n    options?.signal?.addEventListener('abort', onAbort, { once: true });\n\n    return () => {\n      tappers.delete(handler);\n      options?.signal?.removeEventListener('abort', onAbort);\n    };\n  }\n\n  return { allowedActions, checkAll, decide, forPrincipal, rules: compiled, tap };\n}\n","import { ANONYMOUS, WILDCARD } from './constants';\nimport type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction roleCondition<TAttributes extends WardAttributes>(\n  role: string | readonly string[],\n): WardCondition<TAttributes> {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return ({ principal }) =>\n    roles.some((candidate) =>\n      candidate === ANONYMOUS\n        ? principal === null\n        : candidate === WILDCARD\n          ? principal !== null\n          : principal?.roles.includes(candidate),\n    );\n}\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const matchesRole = roleCondition<TAttributes>(role);\n  const condition = options?.when\n    ? (input: Parameters<WardCondition<TAttributes>>[0]) => matchesRole(input) && options.when!(input)\n    : matchesRole;\n\n  return actions.map((action) => ({ action, condition, effect, resource }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst hasRole =\n  <TAttributes extends WardAttributes = WardAttributes>(role: string): WardCondition<TAttributes> =>\n  ({ principal }) =>\n    principal?.roles.includes(role) ?? false;\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, hasRole, not, or, owns } as const;\n"],"mappings":"mEAAA,IAAa,EAAW,IACX,EAAY,YCAZ,EAAb,cAA+B,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAGa,EAAb,cAAqC,CAAU,CAAC,EAGnC,EAAb,cAAwC,CAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,MAAM,QAAQ,EAAU,oBAAqB,CAAE,OAAM,CAAC,EACtD,KAAK,UAAY,CACnB,CACF,ECjBA,SAAS,EAAc,EAAgB,EAAc,EAA4C,CAC/F,GAAI,IAAU,MAAQ,OAAO,GAAU,WAAa,OAAO,GAAU,SAAU,OAAO,EAEtF,GAAI,OAAO,GAAU,SAAU,CAC7B,GAAI,CAAC,OAAO,SAAS,CAAK,EAAG,MAAM,IAAI,EAAgB,GAAG,EAAK,kCAAkC,EACjG,OAAO,CACT,CAEA,GAAI,OAAO,GAAU,SACnB,MAAM,IAAI,EAAgB,GAAG,EAAK,0CAA0C,EAG9E,GAAI,EAAU,IAAI,CAAK,EAAG,MAAM,IAAI,EAAgB,GAAG,EAAK,sCAAsC,EAElG,IAAM,EAAY,OAAO,eAAe,CAAK,EAC7C,GAAI,CAAC,MAAM,QAAQ,CAAK,GAAK,IAAc,OAAO,WAAa,IAAc,KAC3E,MAAM,IAAI,EAAgB,GAAG,EAAK,4CAA4C,EAGhF,EAAU,IAAI,CAAK,EAEnB,GAAI,CAKF,OAHS,OAAO,OADZ,MAAM,QAAQ,CAAK,EACA,MAAM,KAAK,GAAQ,EAAM,IAAU,EAAc,EAAM,GAAG,EAAK,GAAG,EAAM,GAAI,CAAS,CAAC,EAI3G,OAAO,YACL,OAAO,KAAK,CAAK,CAAC,CAAC,IAAK,GAAQ,CAC9B,EACA,EAAe,EAAkC,GAAM,GAAG,EAAK,GAAG,IAAO,CAAS,CACpF,CAAC,CACH,CAT4G,CAWhH,QAAU,CACR,EAAU,OAAO,CAAK,CACxB,CACF,CAEA,SAAgB,EAAmB,EAAgB,EAA0C,CACvF,OAAU,IAAA,GACd,IAAI,OAAO,GAAU,WAAY,GAAkB,MAAM,QAAQ,CAAK,EACpE,MAAM,IAAI,EAAgB,GAAG,EAAK,wBAAwB,EAG5D,OAAO,EAAc,EAAO,EAAM,IAAI,GAAK,CAHiB,CAI9D,CAMA,SAAgB,EACd,EACA,EAC2C,CAC3C,IAAM,EAAK,QAAQ,EAAM,GAEzB,GAAI,OAAO,GAAS,WAAY,GAAiB,MAAM,QAAQ,CAAI,EACjE,MAAM,IAAI,EAAgB,GAAG,EAAG,wBAAwB,EAE1D,IAAM,EAAY,OAAO,eAAe,CAAI,EAC5C,GAAI,IAAc,OAAO,WAAa,IAAc,KAClD,MAAM,IAAI,EAAgB,GAAG,EAAG,wBAAwB,EAG1D,GAAI,OAAO,EAAK,QAAW,UAAY,CAAC,EAAK,OAAO,KAAK,EACvD,MAAM,IAAI,EAAgB,GAAG,EAAG,mCAAmC,EAGrE,GAAI,EAAK,OAAO,SAAS,GAAG,EAC1B,MAAM,IAAI,EAAgB,GAAG,EAAG,WAAW,EAAK,OAAO,kCAAkC,EAAK,OAAO,IAAI,EAG3G,GAAI,OAAO,EAAK,UAAa,UAAY,CAAC,EAAK,SAAS,KAAK,EAC3D,MAAM,IAAI,EAAgB,GAAG,EAAG,qCAAqC,EAGvE,GAAI,EAAK,SAAS,SAAS,GAAG,EAC5B,MAAM,IAAI,EAAgB,GAAG,EAAG,aAAa,EAAK,SAAS,kCAAkC,EAAK,SAAS,IAAI,EAGjH,GAAI,EAAK,SAAW,SAAW,EAAK,SAAW,OAC7C,MAAM,IAAI,EAAgB,GAAG,EAAG,kCAAkC,EAGpE,GAAI,EAAK,YAAc,IAAA,IAAa,OAAO,EAAK,WAAc,WAC5D,MAAM,IAAI,EAAgB,GAAG,EAAG,8BAA8B,EAGhE,OAAO,OAAO,OAAO,CACnB,OAAQ,EAAK,OACb,GAAI,EAAK,aAAe,IAAA,GAAY,CAAC,EAAI,CAAE,WAAY,EAAmB,EAAK,WAAY,GAAG,EAAG,YAAY,CAAE,EAC/G,GAAI,EAAK,YAAc,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAK,SAAU,EACpE,OAAQ,EAAK,OACb,SAAU,EAAK,QACjB,CAAC,CACH,CC7EA,SAAgB,EAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT,CAmBA,SAAgB,EAAc,EAAe,EAAyB,CAcpE,OAZI,IAAA,IAA2B,GAG3B,IAAA,IAA4B,GAI5B,EAAM,SAAS,IAAI,EACd,EAAO,WAAW,EAAM,MAAM,EAAG,EAAE,CAAC,EAItC,IAAU,CACnB,CCzDA,SAAgB,EAAoB,EAAgD,CAClF,GAAI,OAAO,GAAU,UAAY,CAAC,EAChC,MAAM,IAAI,EAAgB,6DAA6D,EAGzF,IAAM,EAAY,EAElB,GAAI,OAAO,EAAU,IAAO,UAAY,CAAC,EAAU,GAAG,KAAK,EACzD,MAAM,IAAI,EAAgB,kDAAkD,EAG9E,GAAI,CAAC,MAAM,QAAQ,EAAU,KAAK,GAAK,EAAU,MAAM,KAAM,GAAS,OAAO,GAAS,UAAY,CAAC,EAAK,KAAK,CAAC,EAC5G,MAAM,IAAI,EAAgB,gEAAgE,CAE9F,CAEA,SAAgB,EAAkB,EAA6C,CAK7E,OAJI,GAAyC,KAAa,MAE1D,EAAoB,CAAS,EAEtB,OAAO,OAAO,CACnB,GAAI,EAAU,aAAe,IAAA,GACzB,CAAC,EACD,CAAE,WAAY,EAAmB,EAAU,WAAY,sBAAsB,CAAE,EACnF,GAAI,EAAU,GACd,MAAO,OAAO,OAAO,CAAC,GAAG,EAAU,KAAK,CAAC,CAC3C,CAAC,EACH,CAEA,SAAgB,EAKd,EAGA,CACA,GAAI,OAAO,EAAM,QAAW,UAAY,CAAC,EAAM,OAAO,KAAK,EACzD,MAAM,IAAI,EAAgB,4CAA4C,EAExE,GAAI,OAAO,EAAM,UAAa,UAAY,CAAC,EAAM,SAAS,KAAK,EAC7D,MAAM,IAAI,EAAgB,8CAA8C,EAG1E,OAAO,OAAO,OAAO,CACnB,OAAQ,EAAM,OACd,GAAI,EAAM,aAAe,IAAA,GACrB,CAAC,EACD,CAAE,WAAY,EAAmB,EAAM,WAAY,qBAAqB,CAAiB,EAC7F,UAAW,EAAkB,EAAM,SAAS,EAC5C,SAAU,EAAM,QAClB,CAAC,CACH,CAEA,SAAS,EAAU,EAA0B,EAAoC,CAC/E,GAAI,OAAO,GAAG,EAAM,CAAK,EAAG,MAAO,GACnC,GAAI,OAAO,GAAS,UAAY,OAAO,GAAU,UAAY,IAAS,MAAQ,IAAU,KAAM,MAAO,GACrG,GAAI,MAAM,QAAQ,CAAI,GAAK,MAAM,QAAQ,CAAK,EAC5C,OACE,MAAM,QAAQ,CAAI,GAClB,MAAM,QAAQ,CAAK,GACnB,EAAK,SAAW,EAAM,QACtB,EAAK,OAAO,EAAO,IAAU,EAAU,EAAO,EAAM,EAAM,CAAC,EAI/D,IAAM,EAAa,EACb,EAAc,EACd,EAAW,OAAO,KAAK,CAAU,EACjC,EAAY,OAAO,KAAK,CAAW,EAEzC,OACE,EAAS,SAAW,EAAU,QAC9B,EAAS,MAAO,GAAQ,OAAO,OAAO,EAAa,CAAG,GAAK,EAAU,EAAW,GAAM,EAAY,EAAI,CAAC,CAE3G,CAEA,SAAgB,EAAgB,EAAsC,EAA6C,CAIjH,OAHK,EACA,EAEE,OAAO,KAAK,CAAQ,CAAC,CAAC,MAAO,GAAQ,OAAO,OAAO,EAAQ,CAAG,GAAK,EAAU,EAAS,GAAM,EAAO,EAAI,CAAC,EAF3F,GADE,EAIxB,CAEA,SAAS,EAAW,EAA+C,CACjE,OACG,OAAO,GAAU,YAAY,GAAkB,SAAU,GAAS,OAAO,EAAM,MAAS,YACxF,OAAO,GAAU,YAAc,SAAU,GAAS,OAAO,EAAM,MAAS,UAE7E,CAEA,SAAgB,EACd,EACA,EACA,EACS,CAGT,GAFI,CAAC,EAAe,EAAK,OAAQ,EAAM,MAAM,GACzC,CAAC,EAAe,EAAK,SAAU,EAAM,QAAQ,GAC7C,CAAC,EAAgB,EAAK,WAAY,EAAM,UAAU,EAAG,MAAO,GAChE,GAAI,CAAC,EAAK,UAAW,MAAO,GAE5B,GAAI,CACF,IAAM,EAAkB,EAAK,UAAU,CAAE,WAAY,EAAM,WAAY,UAAW,EAAM,SAAU,CAAC,EAEnG,GAAI,EAAW,CAAM,EACnB,MAAU,UAAU,sDAAsD,EAE5E,GAAI,OAAO,GAAW,UACpB,MAAU,UAAU,kCAAkC,EAGxD,OAAO,CACT,OAAS,EAAO,CACd,MAAM,IAAI,EAAmB,EAAO,CAAK,CAC3C,CACF,CCrGA,SAAgB,EAKd,EAGM,CAAC,EACgC,CACvC,IAAM,EAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,EAAM,IAAU,EAAY,EAAM,CAAK,CAAC,CAAC,EACpF,EAAU,IAAI,IAEpB,SAAS,EACP,EACA,EAC+C,CAC/C,IAAM,EAAa,EAAsB,CAAK,EAE9C,IAAK,IAAI,EAAQ,EAAG,EAAQ,EAAS,OAAQ,IAAS,CACpD,IAAM,EAAO,EAAS,GAEtB,GAAI,EAAY,EAAM,EAAO,CAAU,EAAG,CACxC,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,EAAK,OACb,QAAS,GACT,OAAQ,QAAQ,EAAM,IAAI,EAAK,SAAW,QAAU,SAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS,GAC1H,MACF,CAAC,EAGD,OADI,GAAM,EAAa,EAAY,CAAQ,EACpC,CACT,CACF,CAEA,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,OACR,QAAS,GACT,OAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS,iBACjF,CAAC,EAGD,OADI,GAAM,EAAa,EAAY,CAAQ,EACpC,CACT,CAEA,SAAS,EACP,EACA,EACM,CACN,GAAI,EAAQ,OAAS,EAAG,OAExB,IAAM,EAAQ,OAAO,OAAO,CAAE,WAAU,QAAO,KAAM,UAAoB,CAAC,EAC1E,IAAK,IAAM,KAAU,EACnB,GAAI,CACF,EAAO,CAAK,CACd,MAAQ,CAAC,CAEb,CAEA,SAAS,EACP,EAC+C,CAC/C,OAAO,EAAS,EAAO,EAAI,CAC7B,CAEA,SAAS,EACP,EACiD,CACjD,OAAO,EAAO,IAAI,CAAM,CAC1B,CAEA,SAAS,EAAe,EAKV,CACZ,IAAM,EAAO,IAAI,IAEjB,OAAO,EAAM,aAAa,OAAQ,GAChC,CAAI,EAAK,IAAI,CAAM,IACnB,EAAK,IAAI,CAAM,EACR,EAAS,CAAE,GAAG,EAAO,QAAO,EAAG,EAAK,CAAC,CAAC,SAAW,QACzD,CACH,CAEA,SAAS,EAAa,EAAmE,CACvF,IAAM,EAAW,EAAkB,CAAS,EAE5C,MAAO,CACL,eAAiB,GAAU,EAAe,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,EAC3E,SAAW,GAAW,EAAS,EAAO,IAAK,IAAW,CAAE,GAAG,EAAO,UAAW,CAAS,EAAE,CAAC,EACzF,OAAS,GAAU,EAAO,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,CAC7D,CACF,CAEA,SAAS,EACP,EACA,EACY,CACZ,GAAI,OAAO,GAAY,WAAY,MAAM,IAAI,EAAgB,gCAAgC,EAC7F,GAAI,GAAS,QAAQ,QAAS,UAAa,CAAC,EAE5C,EAAQ,IAAI,CAAO,EACnB,IAAM,MAAgB,EAAQ,OAAO,CAAO,EAG5C,OAFA,GAAS,QAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,MAErD,CACX,EAAQ,OAAO,CAAO,EACtB,GAAS,QAAQ,oBAAoB,QAAS,CAAO,CACvD,CACF,CAEA,MAAO,CAAE,iBAAgB,WAAU,SAAQ,eAAc,MAAO,EAAU,KAAI,CAChF,CCxIA,SAAS,EACP,EAC4B,CAC5B,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAQ,CAAE,eACR,EAAM,KAAM,GACV,IAAA,YACI,IAAc,KACd,IAAA,IACE,IAAc,KACd,GAAW,MAAM,SAAS,CAAS,CAC3C,CACJ,CAEA,SAAS,EACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAc,EAA2B,CAAI,EAC7C,EAAY,GAAS,KACtB,GAAqD,EAAY,CAAK,GAAK,EAAQ,KAAM,CAAK,EAC/F,EAEJ,OAAO,EAAQ,IAAK,IAAY,CAAE,SAAQ,YAAW,SAAQ,UAAS,EAAE,CAC1E,CAEA,IAAa,GAKX,EACA,EACA,EACA,IACgD,EAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,GAKX,EACA,EACA,EACA,IACgD,EAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EA+BxF,EAAY,CAAE,KAjBvB,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAcpB,QA5BwB,IACrD,CAAE,eACD,GAAW,MAAM,SAAS,CAAI,GAAK,GA0BE,IALrC,GAED,GACC,CAAC,EAAU,CAAK,EAE0B,IAX1C,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAQD,KAvB9C,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,EAoBT"}
+{"version":3,"file":"ward.cjs","names":[],"sources":["../src/constants.ts","../src/errors.ts","../src/_compile.ts","../src/resource.ts","../src/_match.ts","../src/factory.ts","../src/rules.ts"],"sourcesContent":["export const WILDCARD = '*' as const;\nexport const ANONYMOUS = 'anonymous' as const;\n","/** Base class for all ward errors. Use `instanceof WardError` to catch any ward-originated error. */\nexport class WardError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Thrown when a rule definition, decision attributes, or principal is malformed. */\nexport class WardConfigError extends WardError {}\n\n/** Thrown when an application-provided rule condition fails. */\nexport class WardConditionError extends WardError {\n  readonly ruleIndex: number;\n\n  constructor(ruleIndex: number, cause: unknown) {\n    super(`Rule[${ruleIndex}].condition failed`, { cause });\n    this.ruleIndex = ruleIndex;\n  }\n}\n","import { WardConfigError } from './errors';\nimport type { WardAttributes, WardAttributeValue, WardRule } from './types';\n\nfunction snapshotValue(value: unknown, path: string, ancestors: Set<object>): WardAttributeValue {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;\n\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new WardConfigError(`${path} must contain only finite numbers`);\n    return value;\n  }\n\n  if (typeof value !== 'object') {\n    throw new WardConfigError(`${path} must contain only JSON-compatible values`);\n  }\n\n  if (ancestors.has(value)) throw new WardConfigError(`${path} must not contain circular references`);\n\n  const prototype = Object.getPrototypeOf(value);\n  if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null) {\n    throw new WardConfigError(`${path} must contain only arrays and plain objects`);\n  }\n\n  ancestors.add(value);\n\n  try {\n    if (Array.isArray(value)) {\n      return Object.freeze(Array.from(value, (item, index) => snapshotValue(item, `${path}[${index}]`, ancestors)));\n    }\n\n    return Object.freeze(\n      Object.fromEntries(\n        Object.keys(value).map((key) => [\n          key,\n          snapshotValue((value as Record<string, unknown>)[key], `${path}.${key}`, ancestors),\n        ]),\n      ),\n    );\n  } finally {\n    ancestors.delete(value);\n  }\n}\n\nexport function snapshotAttributes(value: unknown, path: string): WardAttributes | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new WardConfigError(`${path} must be a plain object`);\n  }\n\n  return snapshotValue(value, path, new Set()) as WardAttributes;\n}\n\n/**\n * Validates and snapshots a single rule definition at ward-creation time.\n * Throws {@link WardConfigError} with a `Rule[index]`-prefixed message on failure.\n */\nexport function compileRule<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  rule: WardRule<TAction, TResource, TAttributes>,\n  index: number,\n): WardRule<TAction, TResource, TAttributes> {\n  const at = `Rule[${index}]`;\n\n  if (typeof rule !== 'object' || rule === null || Array.isArray(rule)) {\n    throw new WardConfigError(`${at} must be a plain object`);\n  }\n  const prototype = Object.getPrototypeOf(rule);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new WardConfigError(`${at} must be a plain object`);\n  }\n\n  if (typeof rule.action !== 'string' || !rule.action.trim()) {\n    throw new WardConfigError(`${at}.action must be a non-empty string`);\n  }\n\n  if (rule.action.endsWith(':')) {\n    throw new WardConfigError(`${at}.action '${rule.action}' ends with ':': did you mean '${rule.action}*'?`);\n  }\n\n  if (typeof rule.resource !== 'string' || !rule.resource.trim()) {\n    throw new WardConfigError(`${at}.resource must be a non-empty string`);\n  }\n\n  if (rule.resource.endsWith(':')) {\n    throw new WardConfigError(`${at}.resource '${rule.resource}' ends with ':': did you mean '${rule.resource}*'?`);\n  }\n\n  if (rule.effect !== 'allow' && rule.effect !== 'deny') {\n    throw new WardConfigError(`${at}.effect must be \"allow\" or \"deny\"`);\n  }\n\n  if (rule.condition !== undefined && typeof rule.condition !== 'function') {\n    throw new WardConfigError(`${at}.condition must be a function`);\n  }\n\n  if (rule.roles !== undefined) {\n    if (!Array.isArray(rule.roles) || rule.roles.some((role) => typeof role !== 'string' || !role.trim())) {\n      throw new WardConfigError(`${at}.roles must be an array of non-empty strings`);\n    }\n  }\n\n  return Object.freeze({\n    action: rule.action,\n    ...(rule.attributes === undefined ? {} : { attributes: snapshotAttributes(rule.attributes, `${at}.attributes`) }),\n    ...(rule.condition === undefined ? {} : { condition: rule.condition }),\n    effect: rule.effect,\n    resource: rule.resource,\n    ...(rule.roles === undefined ? {} : { roles: Object.freeze([...rule.roles]) }),\n  }) as WardRule<TAction, TResource, TAttributes>;\n}\n","import { WILDCARD } from './constants';\n\n/**\n * Matches a rule pattern against a concrete value string.\n * Works for both resource patterns and action patterns (action hierarchy).\n *\n * Matching rules (evaluated in order):\n * 1. `WILDCARD` (`*`) matches any value string.\n * 2. An exact string matches itself.\n * 3. A colon-namespaced pattern ending in `:*` (e.g. `posts:*` or `read:*`)\n *    matches any string that starts with the given namespace prefix followed by `:`.\n *    Example: `posts:*` matches `posts:123`, `posts:draft:42`, etc.\n *             `read:*`  matches `read:own`, `read:all`, etc.\n *\n * @example\n * matchesPattern('*',        'posts:123')  // true: global wildcard\n * matchesPattern('posts',    'posts')       // true: exact\n * matchesPattern('posts:*',  'posts:123')  // true: namespace wildcard\n * matchesPattern('posts:*',  'comments:1') // false: different namespace\n * matchesPattern('posts:42', 'posts:42')   // true: exact namespaced id\n * matchesPattern('read:*',   'read:own')   // true: action namespace wildcard\n * matchesPattern('read:*',   'write:all')  // false: different action namespace\n */\nexport function matchesPattern(pattern: string, value: string): boolean {\n  if (pattern === WILDCARD) return true;\n\n  if (pattern === value) return true;\n\n  // Namespace wildcard: \"namespace:*\" matches \"namespace:anything\"\n  if (pattern.endsWith(':*')) {\n    const ns = pattern.slice(0, -1); // keep the trailing colon as prefix delimiter\n\n    return value.startsWith(ns);\n  }\n\n  return false;\n}\n","import { snapshotAttributes } from './_compile';\nimport { ANONYMOUS, WILDCARD } from './constants';\nimport { WardConditionError, WardConfigError } from './errors';\nimport { matchesPattern } from './resource';\nimport type {\n  Principal,\n  UserPrincipal,\n  WardAttributes,\n  WardAttributeValue,\n  WardDecisionInput,\n  WardRule,\n} from './types';\n\n/** Asserts that `input` is a valid `UserPrincipal`. Throws with a clear message otherwise. */\nexport function assertUserPrincipal(input: unknown): asserts input is UserPrincipal {\n  if (typeof input !== 'object' || !input) {\n    throw new WardConfigError('Invalid principal: expected { id: string, roles: string[] }');\n  }\n\n  const principal = input as Record<string, unknown>;\n\n  if (typeof principal.id !== 'string' || !principal.id.trim()) {\n    throw new WardConfigError('Invalid principal: id must be a non-empty string');\n  }\n\n  if (!Array.isArray(principal.roles) || principal.roles.some((role) => typeof role !== 'string' || !role.trim())) {\n    throw new WardConfigError('Invalid principal: roles must be an array of non-empty strings');\n  }\n}\n\nexport function snapshotPrincipal(principal: Principal | undefined): Principal {\n  if (principal === undefined || principal === null) return null;\n\n  assertUserPrincipal(principal);\n\n  return Object.freeze({\n    ...(principal.attributes === undefined\n      ? {}\n      : { attributes: snapshotAttributes(principal.attributes, 'Principal.attributes') }),\n    id: principal.id,\n    roles: Object.freeze([...principal.roles]),\n  });\n}\n\nexport function snapshotDecisionInput<\n  TAction extends string,\n  TResource extends string,\n  TAttributes extends WardAttributes,\n>(\n  input: WardDecisionInput<TAction, TResource, TAttributes>,\n): WardDecisionInput<TAction, TResource, TAttributes> & {\n  principal: Principal;\n} {\n  if (typeof input.action !== 'string' || !input.action.trim()) {\n    throw new WardConfigError('Decision.action must be a non-empty string');\n  }\n  if (typeof input.resource !== 'string' || !input.resource.trim()) {\n    throw new WardConfigError('Decision.resource must be a non-empty string');\n  }\n\n  return Object.freeze({\n    action: input.action,\n    ...(input.attributes === undefined\n      ? {}\n      : { attributes: snapshotAttributes(input.attributes, 'Decision.attributes') as TAttributes }),\n    principal: snapshotPrincipal(input.principal),\n    resource: input.resource,\n  });\n}\n\nfunction deepEqual(left: WardAttributeValue, right: WardAttributeValue): boolean {\n  if (Object.is(left, right)) return true;\n  if (typeof left !== 'object' || typeof right !== 'object' || left === null || right === null) return false;\n  if (Array.isArray(left) || Array.isArray(right)) {\n    return (\n      Array.isArray(left) &&\n      Array.isArray(right) &&\n      left.length === right.length &&\n      left.every((value, index) => deepEqual(value, right[index]))\n    );\n  }\n\n  const leftRecord = left as Record<string, WardAttributeValue>;\n  const rightRecord = right as Record<string, WardAttributeValue>;\n  const leftKeys = Object.keys(leftRecord);\n  const rightKeys = Object.keys(rightRecord);\n\n  return (\n    leftKeys.length === rightKeys.length &&\n    leftKeys.every((key) => Object.hasOwn(rightRecord, key) && deepEqual(leftRecord[key], rightRecord[key]))\n  );\n}\n\nexport function attributesMatch(expected: WardAttributes | undefined, actual: WardAttributes | undefined): boolean {\n  if (!expected) return true;\n  if (!actual) return false;\n\n  return Object.keys(expected).every((key) => Object.hasOwn(actual, key) && deepEqual(expected[key], actual[key]));\n}\n\n/**\n * Declarative role check: `ANONYMOUS` matches a null principal, `WILDCARD`\n * matches any authenticated principal, an exact role must be in the principal's\n * roles. A rule without `roles` matches every principal.\n */\nfunction rolesMatch(expected: readonly string[] | undefined, principal: Principal): boolean {\n  if (!expected) return true;\n\n  return expected.some((candidate) =>\n    candidate === ANONYMOUS\n      ? principal === null\n      : candidate === WILDCARD\n        ? principal !== null\n        : (principal?.roles.includes(candidate) ?? false),\n  );\n}\n\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return (\n    (typeof value === 'object' && value !== null && 'then' in value && typeof value.then === 'function') ||\n    (typeof value === 'function' && 'then' in value && typeof value.then === 'function')\n  );\n}\n\nexport function ruleMatches<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  rule: WardRule<TAction, TResource, TAttributes>,\n  index: number,\n  input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n): boolean {\n  if (!matchesPattern(rule.action, input.action)) return false;\n  if (!matchesPattern(rule.resource, input.resource)) return false;\n  if (!rolesMatch(rule.roles, input.principal)) return false;\n  if (!attributesMatch(rule.attributes, input.attributes)) return false;\n  if (!rule.condition) return true;\n\n  try {\n    const result: unknown = rule.condition({ attributes: input.attributes, principal: input.principal });\n\n    if (isThenable(result)) {\n      throw new TypeError('Async conditions are not supported; return a boolean');\n    }\n    if (typeof result !== 'boolean') {\n      throw new TypeError('Conditions must return a boolean');\n    }\n\n    return result;\n  } catch (error) {\n    throw new WardConditionError(index, error);\n  }\n}\n","import { tapper } from '@vielzeug/arsenal';\n\nimport { compileRule } from './_compile';\nimport { ruleMatches, snapshotDecisionInput, snapshotPrincipal } from './_match';\nimport type {\n  BoundWard,\n  Principal,\n  Ward,\n  WardAttributes,\n  WardDecision,\n  WardDecisionInput,\n  WardEvent,\n  WardRule,\n} from './types';\n\n/**\n * Creates an authorization ward from an ordered list of rules.\n *\n * **Decision model**: rules are evaluated in declaration order; the first rule\n * that matches the request wins. If no rule matches, the decision is **deny**\n * (default deny). There is no priority, specificity scoring, or conflict\n * detection: order is the only tiebreaker.\n *\n * A rule matches when:\n * 1. Its `action` pattern matches the requested action (`*` or `ns:*` or exact).\n * 2. Its `resource` pattern matches the requested resource.\n * 3. Its declarative `roles` (if any) include the principal's role, `ANONYMOUS`\n *    matches a null principal, and `WILDCARD` matches any authenticated principal.\n * 4. Every key in its declarative `attributes` is present and equal in the\n *    request's `attributes` (deep equality).\n * 5. Its `condition` escape-hatch callback (if any) returns `true`.\n */\nexport function createWard<\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  rules: readonly (\n    | WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>\n    | readonly WardRule<NoInfer<TAction>, NoInfer<TResource>, NoInfer<TAttributes>>[]\n  )[] = [],\n): Ward<TAction, TResource, TAttributes> {\n  const compiled = Object.freeze(rules.flat().map((rule, index) => compileRule(rule, index)));\n  const knownActions = Object.freeze([\n    ...new Set(\n      compiled.flatMap((rule) => (rule.effect === 'allow' && !rule.action.includes('*') ? [rule.action] : [])),\n    ),\n  ]) as readonly TAction[];\n  const tappers = tapper<WardEvent<TAction, TResource, TAttributes>>();\n\n  function evaluate(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n    emit: boolean,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    const normalized = snapshotDecisionInput(input);\n\n    for (let index = 0; index < compiled.length; index++) {\n      const rule = compiled[index];\n\n      if (ruleMatches(rule, index, normalized)) {\n        const decision = Object.freeze({\n          effect: rule.effect,\n          matched: true,\n          reason: `rule[${index}] ${rule.effect === 'allow' ? 'allows' : 'denies'} '${normalized.action}' on '${normalized.resource}'`,\n          rule,\n        }) as WardDecision<TAction, TResource, TAttributes>;\n\n        if (emit) emitDecision(normalized, decision);\n        return decision;\n      }\n    }\n\n    const decision = Object.freeze({\n      effect: 'deny',\n      matched: false,\n      reason: `no matching rule for '${normalized.action}' on '${normalized.resource}' (default deny)`,\n    }) as WardDecision<TAction, TResource, TAttributes>;\n\n    if (emit) emitDecision(normalized, decision);\n    return decision;\n  }\n\n  function emitDecision(\n    input: WardDecisionInput<TAction, TResource, TAttributes> & { principal: Principal },\n    decision: WardDecision<TAction, TResource, TAttributes>,\n  ): void {\n    tappers.emit(Object.freeze({ decision, input, type: 'decision' as const }));\n  }\n\n  function decide(\n    input: WardDecisionInput<TAction, TResource, TAttributes>,\n  ): WardDecision<TAction, TResource, TAttributes> {\n    return evaluate(input, true);\n  }\n\n  function checkAll(\n    inputs: readonly WardDecisionInput<TAction, TResource, TAttributes>[],\n  ): WardDecision<TAction, TResource, TAttributes>[] {\n    return inputs.map(decide);\n  }\n\n  function allowedActions(input: {\n    attributes?: TAttributes;\n    filter?: readonly TAction[];\n    principal?: Principal;\n    resource: TResource;\n  }): TAction[] {\n    const candidates = input.filter ?? knownActions;\n    const seen = new Set<TAction>();\n\n    return candidates.filter((action) => {\n      if (seen.has(action)) return false;\n      seen.add(action);\n      return evaluate({ ...input, action }, false).effect === 'allow';\n    });\n  }\n\n  function forPrincipal(principal?: Principal): BoundWard<TAction, TResource, TAttributes> {\n    const snapshot = snapshotPrincipal(principal);\n\n    return {\n      allowedActions: (input) => allowedActions({ ...input, principal: snapshot }),\n      checkAll: (inputs) => checkAll(inputs.map((input) => ({ ...input, principal: snapshot }))),\n      decide: (input) => decide({ ...input, principal: snapshot }),\n    };\n  }\n\n  return {\n    allowedActions,\n    checkAll,\n    decide,\n    forPrincipal,\n    knownActions,\n    rules: compiled,\n    tap: (handler, options) => tappers.tap(handler, options),\n  };\n}\n","import type { WardAttributes, WardCondition, WardPattern, WardRule } from './types';\n\ntype RuleOptions<TAttributes extends WardAttributes> = Readonly<{\n  when?: WardCondition<TAttributes>;\n}>;\n\nfunction buildRules<TAction extends string, TResource extends string, TAttributes extends WardAttributes>(\n  effect: 'allow' | 'deny',\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] {\n  const roles = Object.freeze(Array.isArray(role) ? [...role] : [role]);\n\n  return actions.map((action) => ({\n    action,\n    ...(options?.when === undefined ? {} : { condition: options.when }),\n    effect,\n    resource,\n    roles,\n  }));\n}\n\nexport const allow = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('allow', role, resource, actions, options);\n\nexport const deny = <\n  TAction extends string = string,\n  TResource extends string = string,\n  TAttributes extends WardAttributes = WardAttributes,\n>(\n  role: string | readonly string[],\n  resource: WardPattern<TResource>,\n  actions: readonly WardPattern<TAction>[],\n  options?: RuleOptions<TAttributes>,\n): WardRule<TAction, TResource, TAttributes>[] => buildRules('deny', role, resource, actions, options);\n\nconst owns =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    attribute: keyof TAttributes & string,\n  ): WardCondition<TAttributes> =>\n  ({ attributes, principal }) =>\n    principal !== null && attributes?.[attribute] === principal.id;\nconst and =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.every((condition) => condition(input));\nconst or =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    ...conditions: readonly WardCondition<TAttributes>[]\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    conditions.some((condition) => condition(input));\nconst not =\n  <TAttributes extends WardAttributes = WardAttributes>(\n    condition: WardCondition<TAttributes>,\n  ): WardCondition<TAttributes> =>\n  (input) =>\n    !condition(input);\n\nexport const predicate = { and, not, or, owns } as const;\n"],"mappings":"sGAAA,IAAa,EAAW,IACX,EAAY,YCAZ,UAAb,cAA+B,KAAM,CACnC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAGa,gBAAb,cAAqC,SAAU,CAAC,EAGnC,mBAAb,cAAwC,SAAU,CAChD,UAEA,YAAY,EAAmB,EAAgB,CAC7C,MAAM,QAAQ,EAAU,oBAAqB,CAAE,OAAM,CAAC,EACtD,KAAK,UAAY,CACnB,CACF,ECjBA,SAAS,cAAc,EAAgB,EAAc,EAA4C,CAC/F,GAAI,IAAU,MAAQ,OAAO,GAAU,WAAa,OAAO,GAAU,SAAU,OAAO,EAEtF,GAAI,OAAO,GAAU,SAAU,CAC7B,GAAI,CAAC,OAAO,SAAS,CAAK,EAAG,MAAM,IAAI,gBAAgB,GAAG,EAAK,kCAAkC,EACjG,OAAO,CACT,CAEA,GAAI,OAAO,GAAU,SACnB,MAAM,IAAI,gBAAgB,GAAG,EAAK,0CAA0C,EAG9E,GAAI,EAAU,IAAI,CAAK,EAAG,MAAM,IAAI,gBAAgB,GAAG,EAAK,sCAAsC,EAElG,IAAM,EAAY,OAAO,eAAe,CAAK,EAC7C,GAAI,CAAC,MAAM,QAAQ,CAAK,GAAK,IAAc,OAAO,WAAa,IAAc,KAC3E,MAAM,IAAI,gBAAgB,GAAG,EAAK,4CAA4C,EAGhF,EAAU,IAAI,CAAK,EAEnB,GAAI,CAKF,OAHS,OAAO,OADZ,MAAM,QAAQ,CAAK,EACA,MAAM,KAAK,GAAQ,EAAM,IAAU,cAAc,EAAM,GAAG,EAAK,GAAG,EAAM,GAAI,CAAS,CAAC,EAI3G,OAAO,YACL,OAAO,KAAK,CAAK,CAAC,CAAC,IAAK,GAAQ,CAC9B,EACA,cAAe,EAAkC,GAAM,GAAG,EAAK,GAAG,IAAO,CAAS,CACpF,CAAC,CACH,CAT4G,CAWhH,QAAU,CACR,EAAU,OAAO,CAAK,CACxB,CACF,CAEA,SAAgB,mBAAmB,EAAgB,EAA0C,CACvF,OAAU,IAAA,GACd,IAAI,OAAO,GAAU,WAAY,GAAkB,MAAM,QAAQ,CAAK,EACpE,MAAM,IAAI,gBAAgB,GAAG,EAAK,wBAAwB,EAG5D,OAAO,cAAc,EAAO,EAAM,IAAI,GAAK,CAHiB,CAI9D,CAMA,SAAgB,YACd,EACA,EAC2C,CAC3C,IAAM,EAAK,QAAQ,EAAM,GAEzB,GAAI,OAAO,GAAS,WAAY,GAAiB,MAAM,QAAQ,CAAI,EACjE,MAAM,IAAI,gBAAgB,GAAG,EAAG,wBAAwB,EAE1D,IAAM,EAAY,OAAO,eAAe,CAAI,EAC5C,GAAI,IAAc,OAAO,WAAa,IAAc,KAClD,MAAM,IAAI,gBAAgB,GAAG,EAAG,wBAAwB,EAG1D,GAAI,OAAO,EAAK,QAAW,UAAY,CAAC,EAAK,OAAO,KAAK,EACvD,MAAM,IAAI,gBAAgB,GAAG,EAAG,mCAAmC,EAGrE,GAAI,EAAK,OAAO,SAAS,GAAG,EAC1B,MAAM,IAAI,gBAAgB,GAAG,EAAG,WAAW,EAAK,OAAO,iCAAiC,EAAK,OAAO,IAAI,EAG1G,GAAI,OAAO,EAAK,UAAa,UAAY,CAAC,EAAK,SAAS,KAAK,EAC3D,MAAM,IAAI,gBAAgB,GAAG,EAAG,qCAAqC,EAGvE,GAAI,EAAK,SAAS,SAAS,GAAG,EAC5B,MAAM,IAAI,gBAAgB,GAAG,EAAG,aAAa,EAAK,SAAS,iCAAiC,EAAK,SAAS,IAAI,EAGhH,GAAI,EAAK,SAAW,SAAW,EAAK,SAAW,OAC7C,MAAM,IAAI,gBAAgB,GAAG,EAAG,kCAAkC,EAGpE,GAAI,EAAK,YAAc,IAAA,IAAa,OAAO,EAAK,WAAc,WAC5D,MAAM,IAAI,gBAAgB,GAAG,EAAG,8BAA8B,EAGhE,GAAI,EAAK,QAAU,IAAA,KACb,CAAC,MAAM,QAAQ,EAAK,KAAK,GAAK,EAAK,MAAM,KAAM,GAAS,OAAO,GAAS,UAAY,CAAC,EAAK,KAAK,CAAC,GAClG,MAAM,IAAI,gBAAgB,GAAG,EAAG,6CAA6C,EAIjF,OAAO,OAAO,OAAO,CACnB,OAAQ,EAAK,OACb,GAAI,EAAK,aAAe,IAAA,GAAY,CAAC,EAAI,CAAE,WAAY,mBAAmB,EAAK,WAAY,GAAG,EAAG,YAAY,CAAE,EAC/G,GAAI,EAAK,YAAc,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAK,SAAU,EACpE,OAAQ,EAAK,OACb,SAAU,EAAK,SACf,GAAI,EAAK,QAAU,IAAA,GAAY,CAAC,EAAI,CAAE,MAAO,OAAO,OAAO,CAAC,GAAG,EAAK,KAAK,CAAC,CAAE,CAC9E,CAAC,CACH,CCpFA,SAAgB,eAAe,EAAiB,EAAwB,CAGtE,GAFI,IAAA,KAEA,IAAY,EAAO,MAAO,GAG9B,GAAI,EAAQ,SAAS,IAAI,EAAG,CAC1B,IAAM,EAAK,EAAQ,MAAM,EAAG,EAAE,EAE9B,OAAO,EAAM,WAAW,CAAE,CAC5B,CAEA,MAAO,EACT,CCtBA,SAAgB,oBAAoB,EAAgD,CAClF,GAAI,OAAO,GAAU,UAAY,CAAC,EAChC,MAAM,IAAI,gBAAgB,6DAA6D,EAGzF,IAAM,EAAY,EAElB,GAAI,OAAO,EAAU,IAAO,UAAY,CAAC,EAAU,GAAG,KAAK,EACzD,MAAM,IAAI,gBAAgB,kDAAkD,EAG9E,GAAI,CAAC,MAAM,QAAQ,EAAU,KAAK,GAAK,EAAU,MAAM,KAAM,GAAS,OAAO,GAAS,UAAY,CAAC,EAAK,KAAK,CAAC,EAC5G,MAAM,IAAI,gBAAgB,gEAAgE,CAE9F,CAEA,SAAgB,kBAAkB,EAA6C,CAK7E,OAJI,GAAyC,KAAa,MAE1D,oBAAoB,CAAS,EAEtB,OAAO,OAAO,CACnB,GAAI,EAAU,aAAe,IAAA,GACzB,CAAC,EACD,CAAE,WAAY,mBAAmB,EAAU,WAAY,sBAAsB,CAAE,EACnF,GAAI,EAAU,GACd,MAAO,OAAO,OAAO,CAAC,GAAG,EAAU,KAAK,CAAC,CAC3C,CAAC,EACH,CAEA,SAAgB,sBAKd,EAGA,CACA,GAAI,OAAO,EAAM,QAAW,UAAY,CAAC,EAAM,OAAO,KAAK,EACzD,MAAM,IAAI,gBAAgB,4CAA4C,EAExE,GAAI,OAAO,EAAM,UAAa,UAAY,CAAC,EAAM,SAAS,KAAK,EAC7D,MAAM,IAAI,gBAAgB,8CAA8C,EAG1E,OAAO,OAAO,OAAO,CACnB,OAAQ,EAAM,OACd,GAAI,EAAM,aAAe,IAAA,GACrB,CAAC,EACD,CAAE,WAAY,mBAAmB,EAAM,WAAY,qBAAqB,CAAiB,EAC7F,UAAW,kBAAkB,EAAM,SAAS,EAC5C,SAAU,EAAM,QAClB,CAAC,CACH,CAEA,SAAS,UAAU,EAA0B,EAAoC,CAC/E,GAAI,OAAO,GAAG,EAAM,CAAK,EAAG,MAAO,GACnC,GAAI,OAAO,GAAS,UAAY,OAAO,GAAU,UAAY,IAAS,MAAQ,IAAU,KAAM,MAAO,GACrG,GAAI,MAAM,QAAQ,CAAI,GAAK,MAAM,QAAQ,CAAK,EAC5C,OACE,MAAM,QAAQ,CAAI,GAClB,MAAM,QAAQ,CAAK,GACnB,EAAK,SAAW,EAAM,QACtB,EAAK,OAAO,EAAO,IAAU,UAAU,EAAO,EAAM,EAAM,CAAC,EAI/D,IAAM,EAAa,EACb,EAAc,EACd,EAAW,OAAO,KAAK,CAAU,EACjC,EAAY,OAAO,KAAK,CAAW,EAEzC,OACE,EAAS,SAAW,EAAU,QAC9B,EAAS,MAAO,GAAQ,OAAO,OAAO,EAAa,CAAG,GAAK,UAAU,EAAW,GAAM,EAAY,EAAI,CAAC,CAE3G,CAEA,SAAgB,gBAAgB,EAAsC,EAA6C,CAIjH,OAHK,EACA,EAEE,OAAO,KAAK,CAAQ,CAAC,CAAC,MAAO,GAAQ,OAAO,OAAO,EAAQ,CAAG,GAAK,UAAU,EAAS,GAAM,EAAO,EAAI,CAAC,EAF3F,GADE,EAIxB,CAOA,SAAS,WAAW,EAAyC,EAA+B,CAG1F,MAFA,CAAK,GAEE,EAAS,KAAM,GACpB,IAAA,YACI,IAAc,KACd,IAAA,IACE,IAAc,KACb,GAAW,MAAM,SAAS,CAAS,GAAK,EACjD,CACF,CAEA,SAAS,WAAW,EAA+C,CACjE,OACG,OAAO,GAAU,YAAY,GAAkB,SAAU,GAAS,OAAO,EAAM,MAAS,YACxF,OAAO,GAAU,YAAc,SAAU,GAAS,OAAO,EAAM,MAAS,UAE7E,CAEA,SAAgB,YACd,EACA,EACA,EACS,CAIT,GAHI,CAAC,eAAe,EAAK,OAAQ,EAAM,MAAM,GACzC,CAAC,eAAe,EAAK,SAAU,EAAM,QAAQ,GAC7C,CAAC,WAAW,EAAK,MAAO,EAAM,SAAS,GACvC,CAAC,gBAAgB,EAAK,WAAY,EAAM,UAAU,EAAG,MAAO,GAChE,GAAI,CAAC,EAAK,UAAW,MAAO,GAE5B,GAAI,CACF,IAAM,EAAkB,EAAK,UAAU,CAAE,WAAY,EAAM,WAAY,UAAW,EAAM,SAAU,CAAC,EAEnG,GAAI,WAAW,CAAM,EACnB,MAAU,UAAU,sDAAsD,EAE5E,GAAI,OAAO,GAAW,UACpB,MAAU,UAAU,kCAAkC,EAGxD,OAAO,CACT,OAAS,EAAO,CACd,MAAM,IAAI,mBAAmB,EAAO,CAAK,CAC3C,CACF,CCrHA,SAAgB,WAKd,EAGM,CAAC,EACgC,CACvC,IAAM,EAAW,OAAO,OAAO,EAAM,KAAK,CAAC,CAAC,KAAK,EAAM,IAAU,YAAY,EAAM,CAAK,CAAC,CAAC,EACpF,EAAe,OAAO,OAAO,CACjC,GAAG,IAAI,IACL,EAAS,QAAS,GAAU,EAAK,SAAW,SAAW,CAAC,EAAK,OAAO,SAAS,GAAG,EAAI,CAAC,EAAK,MAAM,EAAI,CAAC,CAAE,CACzG,CACF,CAAC,EACK,GAAA,EAAU,EAAA,OAAA,CAAmD,EAEnE,SAAS,SACP,EACA,EAC+C,CAC/C,IAAM,EAAa,sBAAsB,CAAK,EAE9C,IAAK,IAAI,EAAQ,EAAG,EAAQ,EAAS,OAAQ,IAAS,CACpD,IAAM,EAAO,EAAS,GAEtB,GAAI,YAAY,EAAM,EAAO,CAAU,EAAG,CACxC,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,EAAK,OACb,QAAS,GACT,OAAQ,QAAQ,EAAM,IAAI,EAAK,SAAW,QAAU,SAAW,SAAS,IAAI,EAAW,OAAO,QAAQ,EAAW,SAAS,GAC1H,MACF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CACF,CAEA,IAAM,EAAW,OAAO,OAAO,CAC7B,OAAQ,OACR,QAAS,GACT,OAAQ,yBAAyB,EAAW,OAAO,QAAQ,EAAW,SAAS,iBACjF,CAAC,EAGD,OADI,GAAM,aAAa,EAAY,CAAQ,EACpC,CACT,CAEA,SAAS,aACP,EACA,EACM,CACN,EAAQ,KAAK,OAAO,OAAO,CAAE,WAAU,QAAO,KAAM,UAAoB,CAAC,CAAC,CAC5E,CAEA,SAAS,OACP,EAC+C,CAC/C,OAAO,SAAS,EAAO,EAAI,CAC7B,CAEA,SAAS,SACP,EACiD,CACjD,OAAO,EAAO,IAAI,MAAM,CAC1B,CAEA,SAAS,eAAe,EAKV,CACZ,IAAM,EAAa,EAAM,QAAU,EAC7B,EAAO,IAAI,IAEjB,OAAO,EAAW,OAAQ,GACxB,CAAI,EAAK,IAAI,CAAM,IACnB,EAAK,IAAI,CAAM,EACR,SAAS,CAAE,GAAG,EAAO,QAAO,EAAG,EAAK,CAAC,CAAC,SAAW,QACzD,CACH,CAEA,SAAS,aAAa,EAAmE,CACvF,IAAM,EAAW,kBAAkB,CAAS,EAE5C,MAAO,CACL,eAAiB,GAAU,eAAe,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,EAC3E,SAAW,GAAW,SAAS,EAAO,IAAK,IAAW,CAAE,GAAG,EAAO,UAAW,CAAS,EAAE,CAAC,EACzF,OAAS,GAAU,OAAO,CAAE,GAAG,EAAO,UAAW,CAAS,CAAC,CAC7D,CACF,CAEA,MAAO,CACL,eACA,SACA,OACA,aACA,eACA,MAAO,EACP,KAAM,EAAS,IAAY,EAAQ,IAAI,EAAS,CAAO,CACzD,CACF,CClIA,SAAS,WACP,EACA,EACA,EACA,EACA,EAC6C,CAC7C,IAAM,EAAQ,OAAO,OAAO,MAAM,QAAQ,CAAI,EAAI,CAAC,GAAG,CAAI,EAAI,CAAC,CAAI,CAAC,EAEpE,OAAO,EAAQ,IAAK,IAAY,CAC9B,SACA,GAAI,GAAS,OAAS,IAAA,GAAY,CAAC,EAAI,CAAE,UAAW,EAAQ,IAAK,EACjE,SACA,WACA,OACF,EAAE,CACJ,CAEA,IAAa,OAKX,EACA,EACA,EACA,IACgD,WAAW,QAAS,EAAM,EAAU,EAAS,CAAO,EAEzF,MAKX,EACA,EACA,EACA,IACgD,WAAW,OAAQ,EAAM,EAAU,EAAS,CAAO,EAE/F,KAEF,IAED,CAAE,aAAY,eACb,IAAc,MAAQ,IAAa,KAAe,EAAU,GAC1D,KAEF,GAAG,IAEJ,GACC,EAAW,MAAO,GAAc,EAAU,CAAK,CAAC,EAC9C,IAEF,GAAG,IAEJ,GACC,EAAW,KAAM,GAAc,EAAU,CAAK,CAAC,EAC7C,IAEF,GAED,GACC,CAAC,EAAU,CAAK,EAEP,EAAY,CAAE,IAAK,IAAK,GAAI,IAAK"}