@warlock.js/access 4.2.0

package/esm/middleware/gate.middleware.d.mts

@@ -0,0 +1,20 @@
+import { Middleware } from "@warlock.js/core";
+
+//#region ../@warlock.js/access/src/middleware/gate.middleware.d.ts
+/**
+ * Gate a route on a single permission (class-level). Stack it AFTER
+ * `authMiddleware`, which sets `request.user`.
+ *
+ * @example
+ * router.post("/orders", createOrder, {
+ *   middleware: [authMiddleware([]), gate("orders.create")],
+ * });
+ */
+declare function gate(permission: string): Middleware;
+/** Gate a route on holding ANY of the listed permissions. */
+declare function gateAny(permissions: string[]): Middleware;
+/** Gate a route on holding ALL of the listed permissions. */
+declare function gateAll(permissions: string[]): Middleware;
+//#endregion
+export { gate, gateAll, gateAny };
+//# sourceMappingURL=gate.middleware.d.mts.map

package/esm/middleware/gate.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/middleware/gate.middleware.ts"],"mappings":";;;;;AAoBA;;;;AAAoD;AASpD;;iBATgB,IAAA,CAAK,UAAA,WAAqB,UAAU;;iBASpC,OAAA,CAAQ,WAAA,aAAwB,UAAU;AAS1D;AAAA,iBAAgB,OAAA,CAAQ,WAAA,aAAwB,UAAU"}

package/esm/middleware/gate.middleware.mjs

@@ -0,0 +1,44 @@
+import { AccessErrorCodes } from "../utils/access-error-codes.mjs";
+import { can, canAll, canAny } from "../services/access.mjs";
+import { t } from "@warlock.js/core";
+
+//#region ../@warlock.js/access/src/middleware/gate.middleware.ts
+function deny(response) {
+	return response.forbidden({
+		error: t("access.errors.forbidden"),
+		errorCode: "EC100"
+	});
+}
+/**
+* Gate a route on a single permission (class-level). Stack it AFTER
+* `authMiddleware`, which sets `request.user`.
+*
+* @example
+* router.post("/orders", createOrder, {
+*   middleware: [authMiddleware([]), gate("orders.create")],
+* });
+*/
+function gate(permission) {
+	return async (request, response) => {
+		if (!request.user) return deny(response);
+		if (!await can(request.user, permission)) return deny(response);
+	};
+}
+/** Gate a route on holding ANY of the listed permissions. */
+function gateAny(permissions) {
+	return async (request, response) => {
+		if (!request.user) return deny(response);
+		if (!await canAny(request.user, permissions)) return deny(response);
+	};
+}
+/** Gate a route on holding ALL of the listed permissions. */
+function gateAll(permissions) {
+	return async (request, response) => {
+		if (!request.user) return deny(response);
+		if (!await canAll(request.user, permissions)) return deny(response);
+	};
+}
+
+//#endregion
+export { gate, gateAll, gateAny };
+//# sourceMappingURL=gate.middleware.mjs.map

package/esm/middleware/gate.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/middleware/gate.middleware.ts"],"sourcesContent":["import { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport { can, canAll, canAny } from \"../services/access\";\nimport { AccessErrorCodes } from \"../utils/access-error-codes\";\n\nfunction deny(response: Response) {\n  return response.forbidden({\n    error: t(\"access.errors.forbidden\"),\n    errorCode: AccessErrorCodes.Forbidden,\n  });\n}\n\n/**\n * Gate a route on a single permission (class-level). Stack it AFTER\n * `authMiddleware`, which sets `request.user`.\n *\n * @example\n * router.post(\"/orders\", createOrder, {\n *   middleware: [authMiddleware([]), gate(\"orders.create\")],\n * });\n */\nexport function gate(permission: string): Middleware {\n  return async (request: Request, response: Response) => {\n    if (!request.user) return deny(response);\n\n    if (!(await can(request.user, permission))) return deny(response);\n  };\n}\n\n/** Gate a route on holding ANY of the listed permissions. */\nexport function gateAny(permissions: string[]): Middleware {\n  return async (request: Request, response: Response) => {\n    if (!request.user) return deny(response);\n\n    if (!(await canAny(request.user, permissions))) return deny(response);\n  };\n}\n\n/** Gate a route on holding ALL of the listed permissions. */\nexport function gateAll(permissions: string[]): Middleware {\n  return async (request: Request, response: Response) => {\n    if (!request.user) return deny(response);\n\n    if (!(await canAll(request.user, permissions))) return deny(response);\n  };\n}\n"],"mappings":";;;;;AAIA,SAAS,KAAK,UAAoB;CAChC,OAAO,SAAS,UAAU;EACxB,OAAO,EAAE,yBAAyB;EAClC;CACF,CAAC;AACH;;;;;;;;;;AAWA,SAAgB,KAAK,YAAgC;CACnD,OAAO,OAAO,SAAkB,aAAuB;EACrD,IAAI,CAAC,QAAQ,MAAM,OAAO,KAAK,QAAQ;EAEvC,IAAI,CAAE,MAAM,IAAI,QAAQ,MAAM,UAAU,GAAI,OAAO,KAAK,QAAQ;CAClE;AACF;;AAGA,SAAgB,QAAQ,aAAmC;CACzD,OAAO,OAAO,SAAkB,aAAuB;EACrD,IAAI,CAAC,QAAQ,MAAM,OAAO,KAAK,QAAQ;EAEvC,IAAI,CAAE,MAAM,OAAO,QAAQ,MAAM,WAAW,GAAI,OAAO,KAAK,QAAQ;CACtE;AACF;;AAGA,SAAgB,QAAQ,aAAmC;CACzD,OAAO,OAAO,SAAkB,aAAuB;EACrD,IAAI,CAAC,QAAQ,MAAM,OAAO,KAAK,QAAQ;EAEvC,IAAI,CAAE,MAAM,OAAO,QAAQ,MAAM,WAAW,GAAI,OAAO,KAAK,QAAQ;CACtE;AACF"}

package/esm/middleware/index.d.mts

@@ -0,0 +1 @@
+import { gate, gateAll, gateAny } from "./gate.middleware.mjs";

package/esm/middleware/index.mjs

@@ -0,0 +1,3 @@
+import { gate, gateAll, gateAny } from "./gate.middleware.mjs";
+
+export {  };

package/esm/services/access-config.d.mts

@@ -0,0 +1,19 @@
+import { AccessConfigurations } from "../contracts/types.mjs";
+import { Auth } from "@warlock.js/auth";
+
+//#region ../@warlock.js/access/src/services/access-config.d.ts
+/**
+ * Register the access configuration. The framework's access connector calls this
+ * at boot with the default export of `src/config/access.ts`. It validates that a
+ * `resolver` is present, so a misconfigured authorization layer fails at STARTUP
+ * rather than on the first protected request.
+ *
+ * @example
+ * setAccessConfig({ resolver: new DefaultAccessResolver({ admin: ["*"] }) });
+ */
+declare function setAccessConfig(configuration: AccessConfigurations): void;
+/** Clear the active config. Used by the connector on dev-restart and by tests. */
+declare function resetAccessConfig(): void;
+//#endregion
+export { resetAccessConfig, setAccessConfig };
+//# sourceMappingURL=access-config.d.mts.map

package/esm/services/access-config.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-config.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/access-config.ts"],"mappings":";;;;;;AAsBA;;;;AAAmE;AAanE;;iBAbgB,eAAA,CAAgB,aAAmC,EAApB,oBAAoB;;iBAanD,iBAAA"}

package/esm/services/access-config.mjs

@@ -0,0 +1,50 @@
+import { AccessConfigError } from "../utils/access-config-error.mjs";
+
+//#region ../@warlock.js/access/src/services/access-config.ts
+/**
+* The active configuration, fed once at boot by the framework's access connector
+* via {@link setAccessConfig} (the connector reads `src/config/access.ts`).
+* Reading it before it's set throws {@link AccessConfigError} — a loud
+* misconfiguration, never a silent deny.
+*/
+let current;
+/**
+* Register the access configuration. The framework's access connector calls this
+* at boot with the default export of `src/config/access.ts`. It validates that a
+* `resolver` is present, so a misconfigured authorization layer fails at STARTUP
+* rather than on the first protected request.
+*
+* @example
+* setAccessConfig({ resolver: new DefaultAccessResolver({ admin: ["*"] }) });
+*/
+function setAccessConfig(configuration) {
+	if (!configuration?.resolver) throw new AccessConfigError("No access resolver configured. Set `resolver` in src/config/access.ts to a class implementing AccessResolver — the ejected DatabaseAccessResolver, or `new DefaultAccessResolver(rolesMap)` for a fixed-role catalog.");
+	current = configuration;
+}
+/** Clear the active config. Used by the connector on dev-restart and by tests. */
+function resetAccessConfig() {
+	current = void 0;
+}
+/** Accessors over the active access configuration. */
+const accessConfig = {
+	/**
+	* The configured resolver. Throws {@link AccessConfigError} if access was never
+	* configured (no `src/config/access.ts`, or the connector hasn't run).
+	*/
+	resolver() {
+		if (!current) throw new AccessConfigError("@warlock.js/access is not configured. Add src/config/access.ts (exporting a `resolver`) — it is wired at boot by the access connector.");
+		return current.resolver;
+	},
+	/** Cache TTL for resolved permission sets. */
+	cacheTtl() {
+		return current?.cache?.ttl ?? "10m";
+	},
+	/** Ambient tenant for this user, delegated to the resolver's optional hook. */
+	tenant(user) {
+		return this.resolver().resolveTenant?.(user);
+	}
+};
+
+//#endregion
+export { accessConfig, resetAccessConfig, setAccessConfig };
+//# sourceMappingURL=access-config.mjs.map

package/esm/services/access-config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-config.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/access-config.ts"],"sourcesContent":["import type { Auth } from \"@warlock.js/auth\";\nimport type { AccessResolver } from \"../contracts/access-resolver\";\nimport type { AccessConfigurations } from \"../contracts/types\";\nimport { AccessConfigError } from \"../utils/access-config-error\";\n\n/**\n * The active configuration, fed once at boot by the framework's access connector\n * via {@link setAccessConfig} (the connector reads `src/config/access.ts`).\n * Reading it before it's set throws {@link AccessConfigError} — a loud\n * misconfiguration, never a silent deny.\n */\nlet current: AccessConfigurations | undefined;\n\n/**\n * Register the access configuration. The framework's access connector calls this\n * at boot with the default export of `src/config/access.ts`. It validates that a\n * `resolver` is present, so a misconfigured authorization layer fails at STARTUP\n * rather than on the first protected request.\n *\n * @example\n * setAccessConfig({ resolver: new DefaultAccessResolver({ admin: [\"*\"] }) });\n */\nexport function setAccessConfig(configuration: AccessConfigurations): void {\n  if (!configuration?.resolver) {\n    throw new AccessConfigError(\n      \"No access resolver configured. Set `resolver` in src/config/access.ts to a class \" +\n        \"implementing AccessResolver — the ejected DatabaseAccessResolver, or \" +\n        \"`new DefaultAccessResolver(rolesMap)` for a fixed-role catalog.\",\n    );\n  }\n\n  current = configuration;\n}\n\n/** Clear the active config. Used by the connector on dev-restart and by tests. */\nexport function resetAccessConfig(): void {\n  current = undefined;\n}\n\n/** Accessors over the active access configuration. */\nexport const accessConfig = {\n  /**\n   * The configured resolver. Throws {@link AccessConfigError} if access was never\n   * configured (no `src/config/access.ts`, or the connector hasn't run).\n   */\n  resolver(): AccessResolver {\n    if (!current) {\n      throw new AccessConfigError(\n        \"@warlock.js/access is not configured. Add src/config/access.ts (exporting a `resolver`) \" +\n          \"— it is wired at boot by the access connector.\",\n      );\n    }\n\n    return current.resolver;\n  },\n\n  /** Cache TTL for resolved permission sets. */\n  cacheTtl(): string | number {\n    return current?.cache?.ttl ?? \"10m\";\n  },\n\n  /** Ambient tenant for this user, delegated to the resolver's optional hook. */\n  tenant(user: Auth): string | undefined {\n    return this.resolver().resolveTenant?.(user);\n  },\n};\n"],"mappings":";;;;;;;;;AAWA,IAAI;;;;;;;;;;AAWJ,SAAgB,gBAAgB,eAA2C;CACzE,IAAI,CAAC,eAAe,UAClB,MAAM,IAAI,kBACR,uNAGF;CAGF,UAAU;AACZ;;AAGA,SAAgB,oBAA0B;CACxC,UAAU;AACZ;;AAGA,MAAa,eAAe;;;;;CAK1B,WAA2B;EACzB,IAAI,CAAC,SACH,MAAM,IAAI,kBACR,wIAEF;EAGF,OAAO,QAAQ;CACjB;;CAGA,WAA4B;EAC1B,OAAO,SAAS,OAAO,OAAO;CAChC;;CAGA,OAAO,MAAgC;EACrC,OAAO,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI;CAC7C;AACF"}

package/esm/services/access.d.mts

@@ -0,0 +1,51 @@
+import { AccessContext } from "../contracts/types.mjs";
+import { flush } from "./engine.mjs";
+import { Auth } from "@warlock.js/auth";
+
+//#region ../@warlock.js/access/src/services/access.d.ts
+/** Whether the user holds `permission` (and passes its policy when a resource is given). */
+declare function can(user: Auth, permission: string, context?: AccessContext): Promise<boolean>;
+/** Inverse of {@link can}. */
+declare function cannot(user: Auth, permission: string, context?: AccessContext): Promise<boolean>;
+/** Whether the user holds EVERY listed permission. Short-circuits on the first miss. */
+declare function canAll(user: Auth, permissions: string[], context?: AccessContext): Promise<boolean>;
+/** Whether the user holds ANY listed permission. Short-circuits on the first hit. */
+declare function canAny(user: Auth, permissions: string[], context?: AccessContext): Promise<boolean>;
+/** Assert the user holds `permission`; throw `ForbiddenError` (403) otherwise. */
+declare function authorize(user: Auth, permission: string, context?: AccessContext): Promise<void>;
+/** Assert the user holds EVERY listed permission; throw otherwise. */
+declare function authorizeAll(user: Auth, permissions: string[], context?: AccessContext): Promise<void>;
+/** Assert the user holds ANY listed permission; throw otherwise. */
+declare function authorizeAny(user: Auth, permissions: string[], context?: AccessContext): Promise<void>;
+/** Whether the user has the given role. */
+declare function hasRole(user: Auth, role: string, tenant?: string): Promise<boolean>;
+/** Whether the user has ANY of the given roles. */
+declare function hasAnyRole(user: Auth, roles: string[], tenant?: string): Promise<boolean>;
+/** Whether the user has ALL of the given roles. */
+declare function hasAllRoles(user: Auth, roles: string[], tenant?: string): Promise<boolean>;
+/**
+ * The access facade — every check plus `flush` to drop a user's cached set.
+ * Role assignment lives on the ejected `UserRole` model in app-land; callers do
+ * `UserRole.assign(...)` then `access.flush(user, tenant)`.
+ *
+ * @example
+ * import { access } from "@warlock.js/access";
+ * if (await access.can(user, "orders.update", { resource: order })) { ... }
+ * await access.flush(user, "tenant-1");
+ */
+declare const access: {
+  can: typeof can;
+  cannot: typeof cannot;
+  canAll: typeof canAll;
+  canAny: typeof canAny;
+  authorize: typeof authorize;
+  authorizeAll: typeof authorizeAll;
+  authorizeAny: typeof authorizeAny;
+  hasRole: typeof hasRole;
+  hasAnyRole: typeof hasAnyRole;
+  hasAllRoles: typeof hasAllRoles; /** Drop the user's cached role/permission set (call after you mutate role rows). */
+  flush: typeof flush;
+};
+//#endregion
+export { access, authorize, authorizeAll, authorizeAny, can, canAll, canAny, cannot, hasAllRoles, hasAnyRole, hasRole };
+//# sourceMappingURL=access.d.mts.map

package/esm/services/access.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/access.ts"],"mappings":";;;;;;iBAOgB,GAAA,CACd,IAAA,EAAM,IAAA,EACN,UAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAJH;AAAA,iBASsB,MAAA,CACpB,IAAA,EAAM,IAAA,EACN,UAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBAKmB,MAAA,CACpB,IAAA,EAAM,IAAA,EACN,WAAA,YACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBASmB,MAAA,CACpB,IAAA,EAAM,IAAA,EACN,WAAA,YACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBAemB,SAAA,CACpB,IAAA,EAAM,IAAA,EACN,UAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBAKmB,YAAA,CACpB,IAAA,EAAM,IAAA,EACN,WAAA,YACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBAKmB,YAAA,CACpB,IAAA,EAAM,IAAA,EACN,WAAA,YACA,OAAA,GAAU,aAAA,GACT,OAAA;;iBAKmB,OAAA,CACpB,IAAA,EAAM,IAAA,EACN,IAAA,UACA,MAAA,YACC,OAAO;;iBAKY,UAAA,CACpB,IAAA,EAAM,IAAA,EACN,KAAA,YACA,MAAA,YACC,OAAO;AAjFV;AAAA,iBAwFsB,WAAA,CACpB,IAAA,EAAM,IAAA,EACN,KAAA,YACA,MAAA,YACC,OAAO;;;;;;;;;;;cAgBG,MAAA;;;;;;;;;;mCA/FH"}

package/esm/services/access.mjs

@@ -0,0 +1,80 @@
+import { AccessErrorCodes } from "../utils/access-error-codes.mjs";
+import { check, flush, rolesFor } from "./engine.mjs";
+import { ForbiddenError, t } from "@warlock.js/core";
+
+//#region ../@warlock.js/access/src/services/access.ts
+/** Whether the user holds `permission` (and passes its policy when a resource is given). */
+function can(user, permission, context) {
+	return check(user, permission, context);
+}
+/** Inverse of {@link can}. */
+async function cannot(user, permission, context) {
+	return !await can(user, permission, context);
+}
+/** Whether the user holds EVERY listed permission. Short-circuits on the first miss. */
+async function canAll(user, permissions, context) {
+	for (const permission of permissions) if (!await can(user, permission, context)) return false;
+	return true;
+}
+/** Whether the user holds ANY listed permission. Short-circuits on the first hit. */
+async function canAny(user, permissions, context) {
+	for (const permission of permissions) if (await can(user, permission, context)) return true;
+	return false;
+}
+function forbidden() {
+	throw new ForbiddenError(t("access.errors.forbidden"), { errorCode: "EC100" });
+}
+/** Assert the user holds `permission`; throw `ForbiddenError` (403) otherwise. */
+async function authorize(user, permission, context) {
+	if (!await can(user, permission, context)) forbidden();
+}
+/** Assert the user holds EVERY listed permission; throw otherwise. */
+async function authorizeAll(user, permissions, context) {
+	if (!await canAll(user, permissions, context)) forbidden();
+}
+/** Assert the user holds ANY listed permission; throw otherwise. */
+async function authorizeAny(user, permissions, context) {
+	if (!await canAny(user, permissions, context)) forbidden();
+}
+/** Whether the user has the given role. */
+async function hasRole(user, role, tenant) {
+	return (await rolesFor(user, tenant)).includes(role);
+}
+/** Whether the user has ANY of the given roles. */
+async function hasAnyRole(user, roles, tenant) {
+	const held = await rolesFor(user, tenant);
+	return roles.some((role) => held.includes(role));
+}
+/** Whether the user has ALL of the given roles. */
+async function hasAllRoles(user, roles, tenant) {
+	const held = await rolesFor(user, tenant);
+	return roles.every((role) => held.includes(role));
+}
+/**
+* The access facade — every check plus `flush` to drop a user's cached set.
+* Role assignment lives on the ejected `UserRole` model in app-land; callers do
+* `UserRole.assign(...)` then `access.flush(user, tenant)`.
+*
+* @example
+* import { access } from "@warlock.js/access";
+* if (await access.can(user, "orders.update", { resource: order })) { ... }
+* await access.flush(user, "tenant-1");
+*/
+const access = {
+	can,
+	cannot,
+	canAll,
+	canAny,
+	authorize,
+	authorizeAll,
+	authorizeAny,
+	hasRole,
+	hasAnyRole,
+	hasAllRoles,
+	/** Drop the user's cached role/permission set (call after you mutate role rows). */
+	flush
+};
+
+//#endregion
+export { access, authorize, authorizeAll, authorizeAny, can, canAll, canAny, cannot, hasAllRoles, hasAnyRole, hasRole };
+//# sourceMappingURL=access.mjs.map

package/esm/services/access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.mjs","names":["flushUser"],"sources":["../../../../../../../@warlock.js/access/src/services/access.ts"],"sourcesContent":["import type { Auth } from \"@warlock.js/auth\";\nimport { ForbiddenError, t } from \"@warlock.js/core\";\nimport type { AccessContext } from \"../contracts/types\";\nimport { AccessErrorCodes } from \"../utils/access-error-codes\";\nimport { check, flush as flushUser, rolesFor } from \"./engine\";\n\n/** Whether the user holds `permission` (and passes its policy when a resource is given). */\nexport function can(\n  user: Auth,\n  permission: string,\n  context?: AccessContext,\n): Promise<boolean> {\n  return check(user, permission, context);\n}\n\n/** Inverse of {@link can}. */\nexport async function cannot(\n  user: Auth,\n  permission: string,\n  context?: AccessContext,\n): Promise<boolean> {\n  return !(await can(user, permission, context));\n}\n\n/** Whether the user holds EVERY listed permission. Short-circuits on the first miss. */\nexport async function canAll(\n  user: Auth,\n  permissions: string[],\n  context?: AccessContext,\n): Promise<boolean> {\n  for (const permission of permissions) {\n    if (!(await can(user, permission, context))) return false;\n  }\n\n  return true;\n}\n\n/** Whether the user holds ANY listed permission. Short-circuits on the first hit. */\nexport async function canAny(\n  user: Auth,\n  permissions: string[],\n  context?: AccessContext,\n): Promise<boolean> {\n  for (const permission of permissions) {\n    if (await can(user, permission, context)) return true;\n  }\n\n  return false;\n}\n\nfunction forbidden(): never {\n  throw new ForbiddenError(t(\"access.errors.forbidden\"), {\n    errorCode: AccessErrorCodes.Forbidden,\n  });\n}\n\n/** Assert the user holds `permission`; throw `ForbiddenError` (403) otherwise. */\nexport async function authorize(\n  user: Auth,\n  permission: string,\n  context?: AccessContext,\n): Promise<void> {\n  if (!(await can(user, permission, context))) forbidden();\n}\n\n/** Assert the user holds EVERY listed permission; throw otherwise. */\nexport async function authorizeAll(\n  user: Auth,\n  permissions: string[],\n  context?: AccessContext,\n): Promise<void> {\n  if (!(await canAll(user, permissions, context))) forbidden();\n}\n\n/** Assert the user holds ANY listed permission; throw otherwise. */\nexport async function authorizeAny(\n  user: Auth,\n  permissions: string[],\n  context?: AccessContext,\n): Promise<void> {\n  if (!(await canAny(user, permissions, context))) forbidden();\n}\n\n/** Whether the user has the given role. */\nexport async function hasRole(\n  user: Auth,\n  role: string,\n  tenant?: string,\n): Promise<boolean> {\n  return (await rolesFor(user, tenant)).includes(role);\n}\n\n/** Whether the user has ANY of the given roles. */\nexport async function hasAnyRole(\n  user: Auth,\n  roles: string[],\n  tenant?: string,\n): Promise<boolean> {\n  const held = await rolesFor(user, tenant);\n\n  return roles.some((role) => held.includes(role));\n}\n\n/** Whether the user has ALL of the given roles. */\nexport async function hasAllRoles(\n  user: Auth,\n  roles: string[],\n  tenant?: string,\n): Promise<boolean> {\n  const held = await rolesFor(user, tenant);\n\n  return roles.every((role) => held.includes(role));\n}\n\n/**\n * The access facade — every check plus `flush` to drop a user's cached set.\n * Role assignment lives on the ejected `UserRole` model in app-land; callers do\n * `UserRole.assign(...)` then `access.flush(user, tenant)`.\n *\n * @example\n * import { access } from \"@warlock.js/access\";\n * if (await access.can(user, \"orders.update\", { resource: order })) { ... }\n * await access.flush(user, \"tenant-1\");\n */\nexport const access = {\n  can,\n  cannot,\n  canAll,\n  canAny,\n  authorize,\n  authorizeAll,\n  authorizeAny,\n  hasRole,\n  hasAnyRole,\n  hasAllRoles,\n  /** Drop the user's cached role/permission set (call after you mutate role rows). */\n  flush: flushUser,\n};\n"],"mappings":";;;;;;AAOA,SAAgB,IACd,MACA,YACA,SACkB;CAClB,OAAO,MAAM,MAAM,YAAY,OAAO;AACxC;;AAGA,eAAsB,OACpB,MACA,YACA,SACkB;CAClB,OAAO,CAAE,MAAM,IAAI,MAAM,YAAY,OAAO;AAC9C;;AAGA,eAAsB,OACpB,MACA,aACA,SACkB;CAClB,KAAK,MAAM,cAAc,aACvB,IAAI,CAAE,MAAM,IAAI,MAAM,YAAY,OAAO,GAAI,OAAO;CAGtD,OAAO;AACT;;AAGA,eAAsB,OACpB,MACA,aACA,SACkB;CAClB,KAAK,MAAM,cAAc,aACvB,IAAI,MAAM,IAAI,MAAM,YAAY,OAAO,GAAG,OAAO;CAGnD,OAAO;AACT;AAEA,SAAS,YAAmB;CAC1B,MAAM,IAAI,eAAe,EAAE,yBAAyB,GAAG,EACrD,mBACF,CAAC;AACH;;AAGA,eAAsB,UACpB,MACA,YACA,SACe;CACf,IAAI,CAAE,MAAM,IAAI,MAAM,YAAY,OAAO,GAAI,UAAU;AACzD;;AAGA,eAAsB,aACpB,MACA,aACA,SACe;CACf,IAAI,CAAE,MAAM,OAAO,MAAM,aAAa,OAAO,GAAI,UAAU;AAC7D;;AAGA,eAAsB,aACpB,MACA,aACA,SACe;CACf,IAAI,CAAE,MAAM,OAAO,MAAM,aAAa,OAAO,GAAI,UAAU;AAC7D;;AAGA,eAAsB,QACpB,MACA,MACA,QACkB;CAClB,QAAQ,MAAM,SAAS,MAAM,MAAM,EAAC,CAAE,SAAS,IAAI;AACrD;;AAGA,eAAsB,WACpB,MACA,OACA,QACkB;CAClB,MAAM,OAAO,MAAM,SAAS,MAAM,MAAM;CAExC,OAAO,MAAM,MAAM,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;;AAGA,eAAsB,YACpB,MACA,OACA,QACkB;CAClB,MAAM,OAAO,MAAM,SAAS,MAAM,MAAM;CAExC,OAAO,MAAM,OAAO,SAAS,KAAK,SAAS,IAAI,CAAC;AAClD;;;;;;;;;;;AAYA,MAAa,SAAS;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEOA;AACT"}

package/esm/services/default-resolver.d.mts

@@ -0,0 +1,27 @@
+import { AccessResolver } from "../contracts/access-resolver.mjs";
+import { RolesMap } from "../contracts/types.mjs";
+import { Auth } from "@warlock.js/auth";
+
+//#region ../@warlock.js/access/src/services/default-resolver.d.ts
+/**
+ * The zero-config resolver: reads a user's roles from a model field and maps
+ * them to permissions through your `roles` catalog. Works out of the box for
+ * both a `roles` array column and a single `role` column.
+ *
+ * Swap `readRoles` to read from anywhere else (a relation, a token claim); for
+ * a different storage shape entirely, implement {@link AccessResolver} directly.
+ *
+ * @example
+ * new DefaultAccessResolver({ editor: ["orders.*"], viewer: ["orders.view"] });
+ * new DefaultAccessResolver(rolesMap, (user) => user.get("memberRoles"));
+ */
+declare class DefaultAccessResolver implements AccessResolver {
+  private readonly roles;
+  private readonly readRoles;
+  constructor(roles: RolesMap, readRoles?: (user: Auth) => unknown);
+  resolveRoles(user: Auth): Promise<string[]>;
+  resolvePermissions(user: Auth): Promise<string[]>;
+}
+//#endregion
+export { DefaultAccessResolver };
+//# sourceMappingURL=default-resolver.d.mts.map

package/esm/services/default-resolver.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-resolver.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/default-resolver.ts"],"mappings":";;;;;;;AAyBA;;;;;;;;;;cAAa,qBAAA,YAAiC,cAAA;EAAA,iBAEzB,KAAA;EAAA,iBACA,SAAA;cADA,KAAA,EAAO,QAAA,EACP,SAAA,IAAY,IAAA,EAAM,IAAA;EAIxB,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA;EAI1B,kBAAA,CAAmB,IAAA,EAAM,IAAA,GAAO,OAAA;AAAA"}

package/esm/services/default-resolver.mjs

@@ -0,0 +1,35 @@
+//#region ../@warlock.js/access/src/services/default-resolver.ts
+/** Coerce a roles value (`undefined` / single string / array) into a string array. */
+function toRoleList(value) {
+	if (Array.isArray(value)) return value;
+	if (typeof value === "string" && value.length > 0) return [value];
+	return [];
+}
+/**
+* The zero-config resolver: reads a user's roles from a model field and maps
+* them to permissions through your `roles` catalog. Works out of the box for
+* both a `roles` array column and a single `role` column.
+*
+* Swap `readRoles` to read from anywhere else (a relation, a token claim); for
+* a different storage shape entirely, implement {@link AccessResolver} directly.
+*
+* @example
+* new DefaultAccessResolver({ editor: ["orders.*"], viewer: ["orders.view"] });
+* new DefaultAccessResolver(rolesMap, (user) => user.get("memberRoles"));
+*/
+var DefaultAccessResolver = class {
+	constructor(roles, readRoles = (user) => user.get("roles") ?? user.get("role")) {
+		this.roles = roles;
+		this.readRoles = readRoles;
+	}
+	async resolveRoles(user) {
+		return toRoleList(await this.readRoles(user));
+	}
+	async resolvePermissions(user) {
+		return (await this.resolveRoles(user)).flatMap((role) => Object.prototype.hasOwnProperty.call(this.roles, role) ? this.roles[role] : []);
+	}
+};
+
+//#endregion
+export { DefaultAccessResolver };
+//# sourceMappingURL=default-resolver.mjs.map

package/esm/services/default-resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-resolver.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/default-resolver.ts"],"sourcesContent":["import type { Auth } from \"@warlock.js/auth\";\nimport type { AccessResolver } from \"../contracts/access-resolver\";\nimport type { RolesMap } from \"../contracts/types\";\n\n/** Coerce a roles value (`undefined` / single string / array) into a string array. */\nfunction toRoleList(value: unknown): string[] {\n  if (Array.isArray(value)) return value as string[];\n\n  if (typeof value === \"string\" && value.length > 0) return [value];\n\n  return [];\n}\n\n/**\n * The zero-config resolver: reads a user's roles from a model field and maps\n * them to permissions through your `roles` catalog. Works out of the box for\n * both a `roles` array column and a single `role` column.\n *\n * Swap `readRoles` to read from anywhere else (a relation, a token claim); for\n * a different storage shape entirely, implement {@link AccessResolver} directly.\n *\n * @example\n * new DefaultAccessResolver({ editor: [\"orders.*\"], viewer: [\"orders.view\"] });\n * new DefaultAccessResolver(rolesMap, (user) => user.get(\"memberRoles\"));\n */\nexport class DefaultAccessResolver implements AccessResolver {\n  public constructor(\n    private readonly roles: RolesMap,\n    private readonly readRoles: (user: Auth) => unknown = (user) =>\n      user.get(\"roles\") ?? user.get(\"role\"),\n  ) {}\n\n  public async resolveRoles(user: Auth): Promise<string[]> {\n    return toRoleList(await this.readRoles(user));\n  }\n\n  public async resolvePermissions(user: Auth): Promise<string[]> {\n    const roles = await this.resolveRoles(user);\n\n    // Guard against a role named `__proto__` / `constructor` resolving to an\n    // inherited (non-array) value.\n    return roles.flatMap((role) =>\n      Object.prototype.hasOwnProperty.call(this.roles, role)\n        ? this.roles[role]\n        : [],\n    );\n  }\n}\n"],"mappings":";;AAKA,SAAS,WAAW,OAA0B;CAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO;CAEjC,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK;CAEhE,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,IAAa,wBAAb,MAA6D;CAC3D,AAAO,YACL,AAAiB,OACjB,AAAiB,aAAsC,SACrD,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,MAAM,GACtC;EAHiB;EACA;CAEhB;CAEH,MAAa,aAAa,MAA+B;EACvD,OAAO,WAAW,MAAM,KAAK,UAAU,IAAI,CAAC;CAC9C;CAEA,MAAa,mBAAmB,MAA+B;EAK7D,QAAO,MAJa,KAAK,aAAa,IAAI,EAI9B,CAAC,SAAS,SACpB,OAAO,UAAU,eAAe,KAAK,KAAK,OAAO,IAAI,IACjD,KAAK,MAAM,QACX,CAAC,CACP;CACF;AACF"}

package/esm/services/engine.d.mts

@@ -0,0 +1,8 @@
+import { Auth } from "@warlock.js/auth";
+
+//#region ../@warlock.js/access/src/services/engine.d.ts
+/** Drop the cached role/permission sets for a user (after any out-of-band role change). */
+declare function flush(user: Auth, tenant?: string): Promise<void>;
+//#endregion
+export { flush };
+//# sourceMappingURL=engine.d.mts.map

package/esm/services/engine.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/engine.ts"],"mappings":";;;;iBAsEsB,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,MAAA,YAAkB,OAAO"}

package/esm/services/engine.mjs

@@ -0,0 +1,87 @@
+import { AccessConfigError } from "../utils/access-config-error.mjs";
+import { accessConfig } from "./access-config.mjs";
+import { matchesPermission } from "./matcher.mjs";
+import { getPolicy } from "./policies.mjs";
+import { cache } from "@warlock.js/cache";
+import { log } from "@warlock.js/logger";
+
+//#region ../@warlock.js/access/src/services/engine.ts
+const PERMISSIONS_PREFIX = "access.perms.";
+const ROLES_PREFIX = "access.roles.";
+/** Resolve the effective tenant for a check (explicit → ambient → undefined). */
+function tenantFor(user, context) {
+	return context.tenant ?? accessConfig.tenant(user);
+}
+function cacheKey(prefix, user, tenant) {
+	const segment = (value) => encodeURIComponent(String(value));
+	return `${prefix}${segment(user.userType)}.${segment(user.id)}.${segment(tenant ?? "_")}`;
+}
+/**
+* Read a list through the cache, falling back to the loader.
+*
+* The cache is **best-effort**: a cache failure degrades to the loader (the
+* source of truth) and is logged, never denied. A loader failure propagates —
+* so the DECISION fails closed in {@link check}.
+*/
+async function cached(key, loader) {
+	try {
+		const hit = await cache.get(key);
+		if (hit) return hit;
+	} catch (error) {
+		log.error("access", "cache", error);
+	}
+	const value = await loader();
+	try {
+		await cache.set(key, value, { ttl: accessConfig.cacheTtl() });
+	} catch (error) {
+		log.error("access", "cache", error);
+	}
+	return value;
+}
+/** The user's effective permission set for a tenant (cached). */
+function permissionsFor(user, tenant) {
+	return cached(cacheKey(PERMISSIONS_PREFIX, user, tenant), () => accessConfig.resolver().resolvePermissions(user, tenant));
+}
+/** The user's roles for a tenant (cached). */
+function rolesFor(user, tenant) {
+	return cached(cacheKey(ROLES_PREFIX, user, tenant), () => accessConfig.resolver().resolveRoles(user, tenant));
+}
+/** Drop the cached role/permission sets for a user (after any out-of-band role change). */
+async function flush(user, tenant) {
+	try {
+		await cache.remove(cacheKey(PERMISSIONS_PREFIX, user, tenant));
+		await cache.remove(cacheKey(ROLES_PREFIX, user, tenant));
+	} catch (error) {
+		log.error("access", "cache", error);
+	}
+}
+/**
+* The core decision: does the user hold `permission`, and — when a `resource`
+* is supplied — does its policy pass too?
+*
+* Fails CLOSED: any error while resolving the decision denies (and logs).
+*/
+async function check(user, permission, context = {}) {
+	try {
+		const tenant = tenantFor(user, context);
+		const permissions = await permissionsFor(user, tenant);
+		if (!matchesPermission(permissions, permission)) return false;
+		const policy = getPolicy(permission);
+		if (policy === void 0 || context.resource === void 0) return true;
+		const roles = await rolesFor(user, tenant);
+		return Boolean(await policy(user, context.resource, {
+			...context,
+			tenant,
+			hasRole: (role) => roles.includes(role),
+			hasPermission: (perm) => matchesPermission(permissions, perm)
+		}));
+	} catch (error) {
+		if (error instanceof AccessConfigError) throw error;
+		log.error("access", "check", error);
+		return false;
+	}
+}
+
+//#endregion
+export { check, flush, rolesFor };
+//# sourceMappingURL=engine.mjs.map

package/esm/services/engine.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/engine.ts"],"sourcesContent":["import type { Auth } from \"@warlock.js/auth\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { AccessContext } from \"../contracts/types\";\nimport { AccessConfigError } from \"../utils/access-config-error\";\nimport { accessConfig } from \"./access-config\";\nimport { matchesPermission } from \"./matcher\";\nimport { getPolicy } from \"./policies\";\n\nconst PERMISSIONS_PREFIX = \"access.perms.\";\nconst ROLES_PREFIX = \"access.roles.\";\n\n/** Resolve the effective tenant for a check (explicit → ambient → undefined). */\nfunction tenantFor(user: Auth, context: AccessContext): string | undefined {\n  return context.tenant ?? accessConfig.tenant(user);\n}\n\nfunction cacheKey(prefix: string, user: Auth, tenant?: string): string {\n  // Encode each segment so a `.` in an id or tenant can't collide two distinct\n  // principals onto the same cache key (and serve one's grants to the other).\n  const segment = (value: unknown) => encodeURIComponent(String(value));\n\n  return `${prefix}${segment(user.userType)}.${segment(user.id)}.${segment(tenant ?? \"_\")}`;\n}\n\n/**\n * Read a list through the cache, falling back to the loader.\n *\n * The cache is **best-effort**: a cache failure degrades to the loader (the\n * source of truth) and is logged, never denied. A loader failure propagates —\n * so the DECISION fails closed in {@link check}.\n */\nasync function cached(\n  key: string,\n  loader: () => Promise<string[]>,\n): Promise<string[]> {\n  try {\n    const hit = await cache.get<string[]>(key);\n\n    if (hit) return hit;\n  } catch (error) {\n    log.error(\"access\", \"cache\", error);\n  }\n\n  const value = await loader();\n\n  try {\n    await cache.set(key, value, { ttl: accessConfig.cacheTtl() });\n  } catch (error) {\n    log.error(\"access\", \"cache\", error);\n  }\n\n  return value;\n}\n\n/** The user's effective permission set for a tenant (cached). */\nexport function permissionsFor(user: Auth, tenant?: string): Promise<string[]> {\n  return cached(cacheKey(PERMISSIONS_PREFIX, user, tenant), () =>\n    accessConfig.resolver().resolvePermissions(user, tenant),\n  );\n}\n\n/** The user's roles for a tenant (cached). */\nexport function rolesFor(user: Auth, tenant?: string): Promise<string[]> {\n  return cached(cacheKey(ROLES_PREFIX, user, tenant), () =>\n    accessConfig.resolver().resolveRoles(user, tenant),\n  );\n}\n\n/** Drop the cached role/permission sets for a user (after any out-of-band role change). */\nexport async function flush(user: Auth, tenant?: string): Promise<void> {\n  try {\n    await cache.remove(cacheKey(PERMISSIONS_PREFIX, user, tenant));\n    await cache.remove(cacheKey(ROLES_PREFIX, user, tenant));\n  } catch (error) {\n    log.error(\"access\", \"cache\", error);\n  }\n}\n\n/**\n * The core decision: does the user hold `permission`, and — when a `resource`\n * is supplied — does its policy pass too?\n *\n * Fails CLOSED: any error while resolving the decision denies (and logs).\n */\nexport async function check(\n  user: Auth,\n  permission: string,\n  context: AccessContext = {},\n): Promise<boolean> {\n  try {\n    const tenant = tenantFor(user, context);\n    const permissions = await permissionsFor(user, tenant);\n\n    if (!matchesPermission(permissions, permission)) return false;\n\n    const policy = getPolicy(permission);\n\n    // A policy only runs on an instance check (a resource was supplied);\n    // class-level checks (`gate`) stop at the grant.\n    if (policy === undefined || context.resource === undefined) return true;\n\n    const roles = await rolesFor(user, tenant);\n\n    return Boolean(\n      await policy(user, context.resource, {\n        ...context,\n        tenant,\n        hasRole: (role) => roles.includes(role),\n        hasPermission: (perm) => matchesPermission(permissions, perm),\n      }),\n    );\n  } catch (error) {\n    if (error instanceof AccessConfigError) throw error; // misconfig is loud, not a silent deny\n\n    log.error(\"access\", \"check\", error);\n\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;AASA,MAAM,qBAAqB;AAC3B,MAAM,eAAe;;AAGrB,SAAS,UAAU,MAAY,SAA4C;CACzE,OAAO,QAAQ,UAAU,aAAa,OAAO,IAAI;AACnD;AAEA,SAAS,SAAS,QAAgB,MAAY,QAAyB;CAGrE,MAAM,WAAW,UAAmB,mBAAmB,OAAO,KAAK,CAAC;CAEpE,OAAO,GAAG,SAAS,QAAQ,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,EAAE,EAAE,GAAG,QAAQ,UAAU,GAAG;AACxF;;;;;;;;AASA,eAAe,OACb,KACA,QACmB;CACnB,IAAI;EACF,MAAM,MAAM,MAAM,MAAM,IAAc,GAAG;EAEzC,IAAI,KAAK,OAAO;CAClB,SAAS,OAAO;EACd,IAAI,MAAM,UAAU,SAAS,KAAK;CACpC;CAEA,MAAM,QAAQ,MAAM,OAAO;CAE3B,IAAI;EACF,MAAM,MAAM,IAAI,KAAK,OAAO,EAAE,KAAK,aAAa,SAAS,EAAE,CAAC;CAC9D,SAAS,OAAO;EACd,IAAI,MAAM,UAAU,SAAS,KAAK;CACpC;CAEA,OAAO;AACT;;AAGA,SAAgB,eAAe,MAAY,QAAoC;CAC7E,OAAO,OAAO,SAAS,oBAAoB,MAAM,MAAM,SACrD,aAAa,SAAS,CAAC,CAAC,mBAAmB,MAAM,MAAM,CACzD;AACF;;AAGA,SAAgB,SAAS,MAAY,QAAoC;CACvE,OAAO,OAAO,SAAS,cAAc,MAAM,MAAM,SAC/C,aAAa,SAAS,CAAC,CAAC,aAAa,MAAM,MAAM,CACnD;AACF;;AAGA,eAAsB,MAAM,MAAY,QAAgC;CACtE,IAAI;EACF,MAAM,MAAM,OAAO,SAAS,oBAAoB,MAAM,MAAM,CAAC;EAC7D,MAAM,MAAM,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC;CACzD,SAAS,OAAO;EACd,IAAI,MAAM,UAAU,SAAS,KAAK;CACpC;AACF;;;;;;;AAQA,eAAsB,MACpB,MACA,YACA,UAAyB,CAAC,GACR;CAClB,IAAI;EACF,MAAM,SAAS,UAAU,MAAM,OAAO;EACtC,MAAM,cAAc,MAAM,eAAe,MAAM,MAAM;EAErD,IAAI,CAAC,kBAAkB,aAAa,UAAU,GAAG,OAAO;EAExD,MAAM,SAAS,UAAU,UAAU;EAInC,IAAI,WAAW,UAAa,QAAQ,aAAa,QAAW,OAAO;EAEnE,MAAM,QAAQ,MAAM,SAAS,MAAM,MAAM;EAEzC,OAAO,QACL,MAAM,OAAO,MAAM,QAAQ,UAAU;GACnC,GAAG;GACH;GACA,UAAU,SAAS,MAAM,SAAS,IAAI;GACtC,gBAAgB,SAAS,kBAAkB,aAAa,IAAI;EAC9D,CAAC,CACH;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,mBAAmB,MAAM;EAE9C,IAAI,MAAM,UAAU,SAAS,KAAK;EAElC,OAAO;CACT;AACF"}

package/esm/services/index.d.mts

@@ -0,0 +1,5 @@
+import { flush } from "./engine.mjs";
+import { access, authorize, authorizeAll, authorizeAny, can, canAll, canAny, cannot, hasAllRoles, hasAnyRole, hasRole } from "./access.mjs";
+import { DefaultAccessResolver } from "./default-resolver.mjs";
+import { clearPolicies, definePolicy } from "./policies.mjs";
+import { resetAccessConfig, setAccessConfig } from "./access-config.mjs";

package/esm/services/index.mjs

@@ -0,0 +1,7 @@
+import { resetAccessConfig, setAccessConfig } from "./access-config.mjs";
+import { clearPolicies, definePolicy } from "./policies.mjs";
+import { flush } from "./engine.mjs";
+import { access, authorize, authorizeAll, authorizeAny, can, canAll, canAny, cannot, hasAllRoles, hasAnyRole, hasRole } from "./access.mjs";
+import { DefaultAccessResolver } from "./default-resolver.mjs";
+
+export {  };

package/esm/services/matcher.mjs

@@ -0,0 +1,22 @@
+//#region ../@warlock.js/access/src/services/matcher.ts
+/**
+* Whether a set of granted permission patterns covers a requested permission.
+*
+* Supports three forms:
+* - exact — `"orders.update"` covers `"orders.update"`
+* - global — `"*"` covers everything (the super-grant)
+* - prefix wildcard — `"orders.*"` covers `"orders.update"` and `"orders.update.status"`
+*
+* `"orders.*"` does NOT cover the bare `"orders"` (no trailing segment).
+*/
+function matchesPermission(granted, permission) {
+	for (const pattern of granted) {
+		if (pattern === "*" || pattern === permission) return true;
+		if (pattern.endsWith(".*") && permission.startsWith(pattern.slice(0, -1))) return true;
+	}
+	return false;
+}
+
+//#endregion
+export { matchesPermission };
+//# sourceMappingURL=matcher.mjs.map

package/esm/services/matcher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/matcher.ts"],"sourcesContent":["/**\n * Whether a set of granted permission patterns covers a requested permission.\n *\n * Supports three forms:\n * - exact — `\"orders.update\"` covers `\"orders.update\"`\n * - global — `\"*\"` covers everything (the super-grant)\n * - prefix wildcard — `\"orders.*\"` covers `\"orders.update\"` and `\"orders.update.status\"`\n *\n * `\"orders.*\"` does NOT cover the bare `\"orders\"` (no trailing segment).\n */\nexport function matchesPermission(granted: string[], permission: string): boolean {\n  for (const pattern of granted) {\n    if (pattern === \"*\" || pattern === permission) {\n      return true;\n    }\n\n    // \"orders.*\" → prefix \"orders.\" — matches any nested permission.\n    if (pattern.endsWith(\".*\") && permission.startsWith(pattern.slice(0, -1))) {\n      return true;\n    }\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;AAUA,SAAgB,kBAAkB,SAAmB,YAA6B;CAChF,KAAK,MAAM,WAAW,SAAS;EAC7B,IAAI,YAAY,OAAO,YAAY,YACjC,OAAO;EAIT,IAAI,QAAQ,SAAS,IAAI,KAAK,WAAW,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,GACtE,OAAO;CAEX;CAEA,OAAO;AACT"}

package/esm/services/policies.d.mts

@@ -0,0 +1,17 @@
+import { PolicyFn } from "../contracts/types.mjs";
+
+//#region ../@warlock.js/access/src/services/policies.d.ts
+/**
+ * Register an ABAC condition for a permission. It runs ON TOP of the RBAC grant
+ * whenever an authorization check carries a `resource` — letting you express
+ * "...but only their own / only in their tenant / only while pending".
+ *
+ * @example
+ * definePolicy("orders.update", (user, order) => order.get("customer_id") === user.id);
+ */
+declare function definePolicy(permission: string, policy: PolicyFn): void;
+/** Remove every registered policy. Primarily for tests. */
+declare function clearPolicies(): void;
+//#endregion
+export { clearPolicies, definePolicy };
+//# sourceMappingURL=policies.d.mts.map

package/esm/services/policies.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/policies.ts"],"mappings":";;;;;AAYA;;;;;;iBAAgB,YAAA,CAAa,UAAA,UAAoB,MAAA,EAAQ,QAAQ;AAUjE;AAAA,iBAAgB,aAAA"}

package/esm/services/policies.mjs

@@ -0,0 +1,25 @@
+//#region ../@warlock.js/access/src/services/policies.ts
+const policies = /* @__PURE__ */ new Map();
+/**
+* Register an ABAC condition for a permission. It runs ON TOP of the RBAC grant
+* whenever an authorization check carries a `resource` — letting you express
+* "...but only their own / only in their tenant / only while pending".
+*
+* @example
+* definePolicy("orders.update", (user, order) => order.get("customer_id") === user.id);
+*/
+function definePolicy(permission, policy) {
+	policies.set(permission, policy);
+}
+/** The policy registered for a permission, if any. */
+function getPolicy(permission) {
+	return policies.get(permission);
+}
+/** Remove every registered policy. Primarily for tests. */
+function clearPolicies() {
+	policies.clear();
+}
+
+//#endregion
+export { clearPolicies, definePolicy, getPolicy };
+//# sourceMappingURL=policies.mjs.map

package/esm/services/policies.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.mjs","names":[],"sources":["../../../../../../../@warlock.js/access/src/services/policies.ts"],"sourcesContent":["import type { PolicyFn } from \"../contracts/types\";\n\nconst policies = new Map<string, PolicyFn>();\n\n/**\n * Register an ABAC condition for a permission. It runs ON TOP of the RBAC grant\n * whenever an authorization check carries a `resource` — letting you express\n * \"...but only their own / only in their tenant / only while pending\".\n *\n * @example\n * definePolicy(\"orders.update\", (user, order) => order.get(\"customer_id\") === user.id);\n */\nexport function definePolicy(permission: string, policy: PolicyFn): void {\n  policies.set(permission, policy);\n}\n\n/** The policy registered for a permission, if any. */\nexport function getPolicy(permission: string): PolicyFn | undefined {\n  return policies.get(permission);\n}\n\n/** Remove every registered policy. Primarily for tests. */\nexport function clearPolicies(): void {\n  policies.clear();\n}\n"],"mappings":";AAEA,MAAM,2BAAW,IAAI,IAAsB;;;;;;;;;AAU3C,SAAgB,aAAa,YAAoB,QAAwB;CACvE,SAAS,IAAI,YAAY,MAAM;AACjC;;AAGA,SAAgB,UAAU,YAA0C;CAClE,OAAO,SAAS,IAAI,UAAU;AAChC;;AAGA,SAAgB,gBAAsB;CACpC,SAAS,MAAM;AACjB"}

package/esm/utils/access-config-error.d.mts

@@ -0,0 +1,12 @@
+//#region ../@warlock.js/access/src/utils/access-config-error.d.ts
+/**
+ * Thrown when `@warlock.js/access` is misconfigured (e.g. no resolver). Unlike a
+ * runtime resolution failure — which fails CLOSED (denies) — a config error is a
+ * developer mistake, so the engine re-throws it LOUD instead of silently denying.
+ */
+declare class AccessConfigError extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { AccessConfigError };
+//# sourceMappingURL=access-config-error.d.mts.map

package/esm/utils/access-config-error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-config-error.d.mts","names":[],"sources":["../../../../../../../@warlock.js/access/src/utils/access-config-error.ts"],"mappings":";;AAKA;;;;cAAa,iBAAA,SAA0B,KAAK;cACvB,OAAA;AAAA"}