@zap-studio/permit 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# @zap-studio/permit
+
+## 0.1.0
+
+### Minor Changes
+
+- 0627885: Initial release of @zap-studio/permit - a type-safe, declarative authorization library for TypeScript.
+
+  Features:
+
+  - Declarative policy creation with `createPolicy()`
+  - Policy rules: `allow()`, `deny()`, and `when()` for conditional access
+  - Condition combinators: `and()`, `or()`, `not()`, and `has()`
+  - Role-based access control with `hasRole()` and role hierarchies
+  - Policy merging with `mergePolicies()` (deny-overrides) and `mergePoliciesAny()` (allow-overrides)
+  - Standard Schema support (Zod, Valibot, ArkType, etc.)
+  - Full TypeScript support with type inference
+  - `PolicyError` class for authorization errors
+  - `assertNever()` helper for exhaustive type checking

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Alexandre Trotel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,268 @@
+# @zap-studio/permit
+
+A type-safe, declarative authorization library for TypeScript with [Standard Schema](https://standardschema.dev/) support.
+
+## Features
+
+- Full type safety with TypeScript
+- Standard Schema support (Zod, Valibot, ArkType, etc.)
+- Declarative policy definitions
+- Role hierarchy support
+- Composable conditions (`and`, `or`, `not`)
+- Policy merging strategies
+
+## Installation
+
+```bash
+pnpm add @zap-studio/permit
+# or
+npm install @zap-studio/permit
+```
+
+## Quick Start
+
+```ts
+import { z } from "zod";
+import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+import type { Resources, Actions } from "@zap-studio/permit/types";
+
+// 1. Define your resource schemas
+const resources = {
+  post: z.object({
+    id: z.string(),
+    authorId: z.string(),
+    visibility: z.enum(["public", "private"]),
+  }),
+  comment: z.object({
+    id: z.string(),
+    postId: z.string(),
+    authorId: z.string(),
+  }),
+} satisfies Resources;
+
+// 2. Define actions per resource
+const actions = {
+  post: ["read", "write", "delete"],
+  comment: ["read", "write"],
+} as const satisfies Actions<typeof resources>;
+
+// 3. Define your context type
+type AppContext = {
+  user: { id: string; role: "guest" | "user" | "admin" };
+};
+
+// 4. Create your policy
+const policy = createPolicy<AppContext>({
+  resources,
+  actions,
+  rules: {
+    post: {
+      read: when((ctx, action, resource) => resource.visibility === "public"),
+      write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+      delete: deny(),
+    },
+    comment: {
+      read: allow(),
+      write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+    },
+  },
+});
+
+// 5. Check permissions
+const ctx: AppContext = { user: { id: "user-1", role: "user" } };
+const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+
+policy.can(ctx, "read", "post", post); // true
+policy.can(ctx, "write", "post", post); // true (user is author)
+policy.can(ctx, "delete", "post", post); // false (always denied)
+```
+
+## API Reference
+
+### Policy Builders
+
+#### `allow()`
+
+Returns a policy function that always allows the action.
+
+```ts
+rules: {
+  post: {
+    read: allow(), // Anyone can read
+  },
+}
+```
+
+#### `deny()`
+
+Returns a policy function that always denies the action.
+
+```ts
+rules: {
+  post: {
+    delete: deny(), // No one can delete
+  },
+}
+```
+
+#### `when(condition)`
+
+Returns a policy function that allows or denies based on a condition.
+
+```ts
+rules: {
+  post: {
+    write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+  },
+}
+```
+
+### Condition Combinators
+
+#### `and(...conditions)`
+
+Returns a condition that is true only if all conditions are true.
+
+```ts
+const isOwnerAndPublished = and(
+  (ctx, action, resource) => ctx.user.id === resource.authorId,
+  (ctx, action, resource) => resource.status === "published"
+);
+```
+
+#### `or(...conditions)`
+
+Returns a condition that is true if any condition is true.
+
+```ts
+const isOwnerOrAdmin = or(
+  (ctx, action, resource) => ctx.user.id === resource.authorId,
+  (ctx, action, resource) => ctx.user.role === "admin"
+);
+```
+
+#### `not(condition)`
+
+Returns a condition that negates another condition.
+
+```ts
+const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+```
+
+### Context Helpers
+
+#### `has(key, value)`
+
+Checks if a context property equals a specific value.
+
+```ts
+rules: {
+  post: {
+    write: when(has("role", "admin")),
+  },
+}
+```
+
+#### `hasRole(role, hierarchy?)`
+
+Checks if the user has a specific role, with optional hierarchy support.
+
+```ts
+const hierarchy = {
+  guest: [],
+  user: ["guest"],
+  admin: ["user"],
+};
+
+rules: {
+  post: {
+    read: when(hasRole("guest", hierarchy)), // Admins and users inherit guest permissions
+  },
+}
+```
+
+### Policy Merging
+
+#### `mergePolicies(...policies)`
+
+Merges policies with "deny-overrides" strategy. All policies must allow for the action to be permitted.
+
+```ts
+const merged = mergePolicies(basePolicy, restrictivePolicy);
+```
+
+#### `mergePoliciesAny(...policies)`
+
+Merges policies with "allow-overrides" strategy. Any policy allowing is sufficient.
+
+```ts
+const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+```
+
+## Type Helpers
+
+### `Resources`
+
+Type helper for defining resource schemas with `satisfies`.
+
+```ts
+const resources = {
+  post: z.object({ id: z.string() }),
+} satisfies Resources;
+```
+
+### `Actions<TResources>`
+
+Type helper for defining actions with `satisfies`. Ensures action keys match resource keys.
+
+```ts
+const actions = {
+  post: ["read", "write"],
+} as const satisfies Actions<typeof resources>;
+```
+
+### `InferResource<TResources, K>`
+
+Infers the TypeScript type for a specific resource.
+
+```ts
+type Post = InferResource<typeof resources, "post">;
+// { id: string }
+```
+
+### `InferAction<TActions, K>`
+
+Infers the action union type for a specific resource.
+
+```ts
+type PostAction = InferAction<typeof actions, "post">;
+// "read" | "write"
+```
+
+## Standard Schema Support
+
+This library uses [Standard Schema](https://standardschema.dev/) for resource validation, which means it works with any compatible schema library:
+
+- [Zod](https://zod.dev/)
+- [Valibot](https://valibot.dev/)
+- [ArkType](https://arktype.io/)
+
+```ts
+// With Zod
+import { z } from "zod";
+const resources = {
+  post: z.object({ id: z.string() }),
+} satisfies Resources;
+
+// With Valibot
+import * as v from "valibot";
+const resources = {
+  post: v.object({ id: v.string() }),
+} satisfies Resources;
+
+// With ArkType
+import { type } from "arktype";
+const resources = {
+  post: type({ id: "string" }),
+} satisfies Resources;
+```

package/dist/errors.d.mts

@@ -0,0 +1,11 @@
+//#region src/errors.d.ts
+/**
+* Represents an error that occurs during policy evaluation or enforcement.
+* Use this error to indicate issues related to policy logic, configuration, or execution.
+*/
+declare class PolicyError extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { PolicyError };
+//# sourceMappingURL=errors.d.mts.map

package/dist/errors.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;AAIA;;;cAAa,WAAA,SAAoB,KAAA"}

package/dist/errors.mjs

@@ -0,0 +1,15 @@
+//#region src/errors.ts
+/**
+* Represents an error that occurs during policy evaluation or enforcement.
+* Use this error to indicate issues related to policy logic, configuration, or execution.
+*/
+var PolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PolicyError";
+	}
+};
+
+//#endregion
+export { PolicyError };
+//# sourceMappingURL=errors.mjs.map

package/dist/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;AAIA,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO"}

package/dist/helpers.d.mts

@@ -0,0 +1,27 @@
+//#region src/helpers.d.ts
+/**
+* Ensures that a value of type `never` is actually never encountered at runtime.
+* This is useful for exhaustive checks on discriminated unions.
+*
+* @example
+* ```ts
+* type Action = 'read' | 'write'
+*
+* function performAction(action: Action) {
+*   switch (action) {
+*     case 'read':
+*       console.log('Reading...')
+*       break
+*     case 'write':
+*       console.log('Writing...')
+*       break
+*     default:
+*       assertNever(action) // TypeScript will error if a new Action is added but not handled
+*   }
+* }
+* ```
+*/
+declare function assertNever(value: never): never;
+//#endregion
+export { assertNever };
+//# sourceMappingURL=helpers.d.mts.map

package/dist/helpers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.mts","names":[],"sources":["../src/helpers.ts"],"sourcesContent":[],"mappings":";;AAsBA;;;;;;;;;;;;;;;;;;;;;iBAAgB,WAAA"}

package/dist/helpers.mjs

@@ -0,0 +1,30 @@
+//#region src/helpers.ts
+/**
+* Ensures that a value of type `never` is actually never encountered at runtime.
+* This is useful for exhaustive checks on discriminated unions.
+*
+* @example
+* ```ts
+* type Action = 'read' | 'write'
+*
+* function performAction(action: Action) {
+*   switch (action) {
+*     case 'read':
+*       console.log('Reading...')
+*       break
+*     case 'write':
+*       console.log('Writing...')
+*       break
+*     default:
+*       assertNever(action) // TypeScript will error if a new Action is added but not handled
+*   }
+* }
+* ```
+*/
+function assertNever(value) {
+	throw new Error(`Unexpected value: ${value}`);
+}
+
+//#endregion
+export { assertNever };
+//# sourceMappingURL=helpers.mjs.map

package/dist/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport function assertNever(value: never): never {\n  throw new Error(`Unexpected value: ${value}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,YAAY,OAAqB;AAC/C,OAAM,IAAI,MAAM,qBAAqB,QAAQ"}

package/dist/index.d.mts

@@ -0,0 +1,257 @@
+import { c as PermitConfig, d as Resources, f as Role, i as Context, l as Policy, n as Actions, p as RoleHierarchy, r as ConditionFn, u as PolicyFn } from "./types-Bd4zClp0.mjs";
+
+//#region src/index.d.ts
+
+/**
+* Returns a policy function that always allows the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: allow(), // Always allow reading posts
+*     },
+*   },
+* });
+* ```
+*/
+declare function allow<TContext extends Context, TAction extends string = string, TResource = unknown>(): PolicyFn<TContext, TAction, TResource>;
+/**
+* Returns a policy function that always denies the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       delete: deny(), // Never allow deleting posts
+*     },
+*   },
+* });
+* ```
+*/
+declare function deny<TContext extends Context, TAction extends string = string, TResource = unknown>(): PolicyFn<TContext, TAction, TResource>;
+/**
+* Returns a policy function that allows or denies based on a condition.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+* ```
+*/
+declare function when<TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>): PolicyFn<TContext, TAction, TResource>;
+/**
+* Returns a condition function that returns `true` if all conditions are met.
+*
+* @example
+* ```ts
+* const isOwnerAndPublished = and(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => resource.status === "published"
+* );
+*
+* rules: {
+*   post: {
+*     delete: when(isOwnerAndPublished),
+*   },
+* }
+* ```
+*/
+declare function and<TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]): ConditionFn<TContext, TAction, TResource>;
+/**
+* Returns a condition function that returns `true` if any condition is met.
+*
+* @example
+* ```ts
+* const isOwnerOrAdmin = or(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => ctx.user.role === "admin"
+* );
+*
+* rules: {
+*   post: {
+*     write: when(isOwnerOrAdmin),
+*   },
+* }
+* ```
+*/
+declare function or<TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]): ConditionFn<TContext, TAction, TResource>;
+/**
+* Returns a condition function that negates another condition.
+*
+* @example
+* ```ts
+* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+*
+* rules: {
+*   post: {
+*     like: when(isNotOwner), // Can only like posts you don't own
+*   },
+* }
+* ```
+*/
+declare function not<TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>): ConditionFn<TContext, TAction, TResource>;
+/**
+* Returns a condition function that checks if a context property equals a value.
+*
+* @example
+* ```ts
+* rules: {
+*   post: {
+*     write: when(has("role", "admin")), // Only admins can write
+*   },
+* }
+* ```
+*/
+declare function has<TContext extends Context, K extends keyof TContext>(key: K, value: TContext[K]): ConditionFn<TContext>;
+/**
+* Collects all roles including inherited ones from a role hierarchy.
+*
+* @example
+* ```ts
+* type Role = "guest" | "user" | "admin";
+*
+* const hierarchy: RoleHierarchy<Role> = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* collectInheritedRoles(["admin"], hierarchy);
+* // Returns: Set { "admin", "user", "guest" }
+* ```
+*/
+declare function collectInheritedRoles<TRole extends Role = Role>(roles: TRole[], hierarchy: RoleHierarchy<TRole>): Set<TRole>;
+/**
+* Returns a condition function that checks if the user has a specific role.
+* Supports role hierarchy for inherited permissions.
+*
+* @example
+* ```ts
+* // Without hierarchy
+* rules: {
+*   post: {
+*     delete: when(hasRole("admin")),
+*   },
+* }
+*
+* // With hierarchy
+* const hierarchy = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* rules: {
+*   post: {
+*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
+*   },
+* }
+* ```
+*/
+declare function hasRole<TContext extends Context & {
+  role: Role | Role[];
+}, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
+declare function hasRole<TContext extends Context & {
+  role: TRole | TRole[];
+}, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
+/**
+* Creates a type-safe policy from resource schemas, actions, and rules.
+*
+* @example
+* ```ts
+* import { z } from "zod";
+* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+* import type { Resources, Actions } from "@zap-studio/permit/types";
+*
+* // Define resource schemas
+* const resources = {
+*   post: z.object({
+*     id: z.string(),
+*     authorId: z.string(),
+*     visibility: z.enum(["public", "private"]),
+*   }),
+*   comment: z.object({
+*     id: z.string(),
+*     postId: z.string(),
+*     authorId: z.string(),
+*   }),
+* } satisfies Resources;
+*
+* // Define actions per resource
+* const actions = {
+*   post: ["read", "write", "delete"],
+*   comment: ["read", "write"],
+* } as const satisfies Actions<typeof resources>;
+*
+* // Define context type
+* type AppContext = { user: { id: string; role: string } };
+*
+* // Create the policy
+* const policy = createPolicy<AppContext>({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: when((ctx, action, resource) => resource.visibility === "public"),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*       delete: deny(),
+*     },
+*     comment: {
+*       read: allow(),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+*
+* // Check permissions
+* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+* policy.can(ctx, "read", "post", post); // true
+* policy.can(ctx, "write", "post", post); // depends on ctx.user.id
+* ```
+*/
+declare function createPolicy<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>): Policy<TContext, TResources, TActions>;
+/**
+* Merges multiple policies into one using "deny-overrides" strategy.
+* If any policy denies, the merged policy denies. All must allow for the result to allow.
+*
+* @example
+* ```ts
+* const basePolicy = createPolicy({ ... });
+* const adminPolicy = createPolicy({ ... });
+*
+* const merged = mergePolicies(basePolicy, adminPolicy);
+* // Both policies must allow for the action to be permitted
+* ```
+*/
+declare function mergePolicies<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions>;
+/**
+* Merges multiple policies into one using "allow-overrides" strategy.
+* If any policy allows, the merged policy allows. All must deny for the result to deny.
+*
+* @example
+* ```ts
+* const guestPolicy = createPolicy({ ... });
+* const memberPolicy = createPolicy({ ... });
+*
+* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+* // If either policy allows, the action is permitted
+* ```
+*/
+declare function mergePoliciesAny<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions>;
+//#endregion
+export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;AA8BA;;;;;;;AAwBA;;;;;;;AAwBgB,iBAhDA,KAgDA,CACG,iBAhDA,OAgDA,EAIM,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAS,CAAA,CAAA,EAjDvC,QAiDuC,CAjD9B,QAiD8B,EAjDpB,OAiDoB,EAjDX,SAiDW,CAAA;;;;;;;AAuB5C;;;;;;;;;;AAMG,iBA1Da,IA0Db,CAsBH,iBA/EmB,OA+EH,EACG,gBAAA,MAAA,GAAA,MAAA,EAIU,YAAA,OAAA,CAAU,CAAA,CAAA,EAjFlC,QAiFkC,CAjFzB,QAiFyB,EAjFf,OAiFe,EAjFN,SAiFM,CAAA;;;;;;;;AAoBvC;;;;;;;;;AAMG,iBAvFa,IAuFb,CAAA,iBAtFgB,OAsFhB,EAgBH,gBAAgB,MAAA,GAAA,MAAA,EAAqB,YAAA,OAAA,CAAyB,CAAA,SAAA,EAlGjD,WAkGiD,CAlGrC,QAkGqC,EAlG3B,OAkG2B,EAlGlB,SAkGkB,CAAA,CAAA,EAjG3D,QAiG2D,CAjGlD,QAiGkD,EAjGxC,OAiGwC,EAjG/B,SAiG+B,CAAA;;;;;;;AAwB9D;;;;;;;;;AA6CA;;AACqC,iBAjJrB,GAiJqB,CAAO,iBAhJzB,OAgJyB,EAGpC,gBAAA,MAAA,GAAA,MAAA,EAAmB,YAAA,OAAA,CAAU,CAAA,GAAA,UAAA,EA/IpB,WA+IoB,CA/IR,QA+IQ,EA/IE,OA+IF,EA/IW,SA+IX,CAAA,EAAA,CAAA,EA9IlC,WA8IkC,CA9ItB,QA8IsB,EA9IZ,OA8IY,EA9IH,SA8IG,CAAA;;;;AAErC;;;;;;;;;;;;;;AAuFgB,iBAjNA,EAiNA,CACG,iBAjNA,OAiNA,EACE,gBAAA,MAAA,GAAA,MAAA,EAAY,YAAA,OAAA,CACN,CAAA,GAAA,UAAA,EA/MV,WA+MU,CA/ME,QA+MF,EA/MY,OA+MZ,EA/MqB,SA+MrB,CAAA,EAAA,CAAA,EA9MxB,WA8MwB,CA9MZ,QA8MY,EA9MF,OA8ME,EA9MO,SA8MP,CAAA;;;;;;;;;;;;;AAsC3B;;AAEqB,iBAnOL,GAmOK,CAAY,iBAlOd,OAkOc,EACN,gBAAA,MAAA,GAAA,MAAA,EAAR,YAAA,OAAA,CAA8B,CAAA,SAAA,EA/NpC,WA+NoC,CA/NxB,QA+NwB,EA/Nd,OA+Nc,EA/NL,SA+NK,CAAA,CAAA,EA9N9C,WA8N8C,CA9NlC,QA8NkC,EA9NxB,OA8NwB,EA9Nf,SA8Ne,CAAA;;;;;;;;;;;AAkCjD;;AAEqB,iBAlPL,GAkPK,CAAY,iBAlPI,OAkPJ,EACN,UAAA,MAnPmC,QAmPnC,CAAR,CAAA,GAAA,EAlPZ,CAkPY,EAAA,KAAA,EAjPV,QAiPU,CAjPD,CAiPC,CAAA,CAAA,EAhPhB,WAgPgB,CAhPJ,QAgPI,CAAA;;;;;;;;;;;;;;;;;;iBA3NH,oCAAoC,OAAO,aAClD,oBACI,cAAc,SACxB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CS,yBACG;QAAkB,OAAO;+DAGpC,OAAO,YAAY,UAAU,SAAS;iBAE9B,yBACG;QAAkB,QAAQ;uEAG7B,OAAO,YAEf,kBACK,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+ElB,8BACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,qBAEvC,aAAa,UAAU,YAAY,YAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;iBAmChB,+BACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,0BAElC,OAAO,UAAU,YAAY,cACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;iBA+BhB,kCACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,0BAElC,OAAO,UAAU,YAAY,cACzC,OAAO,UAAU,YAAY"}

package/dist/index.mjs

@@ -0,0 +1,269 @@
+//#region src/index.ts
+/**
+* Returns a policy function that always allows the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: allow(), // Always allow reading posts
+*     },
+*   },
+* });
+* ```
+*/
+function allow() {
+	return () => "allow";
+}
+/**
+* Returns a policy function that always denies the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       delete: deny(), // Never allow deleting posts
+*     },
+*   },
+* });
+* ```
+*/
+function deny() {
+	return () => "deny";
+}
+/**
+* Returns a policy function that allows or denies based on a condition.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+* ```
+*/
+function when(condition) {
+	return (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
+}
+/**
+* Returns a condition function that returns `true` if all conditions are met.
+*
+* @example
+* ```ts
+* const isOwnerAndPublished = and(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => resource.status === "published"
+* );
+*
+* rules: {
+*   post: {
+*     delete: when(isOwnerAndPublished),
+*   },
+* }
+* ```
+*/
+function and(...conditions) {
+	return (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
+}
+/**
+* Returns a condition function that returns `true` if any condition is met.
+*
+* @example
+* ```ts
+* const isOwnerOrAdmin = or(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => ctx.user.role === "admin"
+* );
+*
+* rules: {
+*   post: {
+*     write: when(isOwnerOrAdmin),
+*   },
+* }
+* ```
+*/
+function or(...conditions) {
+	return (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
+}
+/**
+* Returns a condition function that negates another condition.
+*
+* @example
+* ```ts
+* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+*
+* rules: {
+*   post: {
+*     like: when(isNotOwner), // Can only like posts you don't own
+*   },
+* }
+* ```
+*/
+function not(condition) {
+	return (context, action, resource) => !condition(context, action, resource);
+}
+/**
+* Returns a condition function that checks if a context property equals a value.
+*
+* @example
+* ```ts
+* rules: {
+*   post: {
+*     write: when(has("role", "admin")), // Only admins can write
+*   },
+* }
+* ```
+*/
+function has(key, value) {
+	return (context) => context[key] === value;
+}
+/**
+* Collects all roles including inherited ones from a role hierarchy.
+*
+* @example
+* ```ts
+* type Role = "guest" | "user" | "admin";
+*
+* const hierarchy: RoleHierarchy<Role> = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* collectInheritedRoles(["admin"], hierarchy);
+* // Returns: Set { "admin", "user", "guest" }
+* ```
+*/
+function collectInheritedRoles(roles, hierarchy) {
+	const inherited = /* @__PURE__ */ new Set();
+	function add(role) {
+		if (!inherited.has(role)) {
+			inherited.add(role);
+			(hierarchy[role] ?? []).forEach(add);
+		}
+	}
+	roles.forEach(add);
+	return inherited;
+}
+function hasRole(role, hierarchy) {
+	return (context) => {
+		const userRoles = Array.isArray(context.role) ? context.role : [context.role];
+		if (!hierarchy) return userRoles.includes(role);
+		return collectInheritedRoles(userRoles, hierarchy).has(role);
+	};
+}
+/**
+* Creates a type-safe policy from resource schemas, actions, and rules.
+*
+* @example
+* ```ts
+* import { z } from "zod";
+* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+* import type { Resources, Actions } from "@zap-studio/permit/types";
+*
+* // Define resource schemas
+* const resources = {
+*   post: z.object({
+*     id: z.string(),
+*     authorId: z.string(),
+*     visibility: z.enum(["public", "private"]),
+*   }),
+*   comment: z.object({
+*     id: z.string(),
+*     postId: z.string(),
+*     authorId: z.string(),
+*   }),
+* } satisfies Resources;
+*
+* // Define actions per resource
+* const actions = {
+*   post: ["read", "write", "delete"],
+*   comment: ["read", "write"],
+* } as const satisfies Actions<typeof resources>;
+*
+* // Define context type
+* type AppContext = { user: { id: string; role: string } };
+*
+* // Create the policy
+* const policy = createPolicy<AppContext>({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: when((ctx, action, resource) => resource.visibility === "public"),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*       delete: deny(),
+*     },
+*     comment: {
+*       read: allow(),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+*
+* // Check permissions
+* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+* policy.can(ctx, "read", "post", post); // true
+* policy.can(ctx, "write", "post", post); // depends on ctx.user.id
+* ```
+*/
+function createPolicy(config) {
+	const { rules } = config;
+	return { can(context, action, resourceType, resource) {
+		const policyFn = rules[resourceType][action];
+		if (!policyFn) return false;
+		return policyFn(context, action, resource) === "allow";
+	} };
+}
+/**
+* Merges multiple policies into one using "deny-overrides" strategy.
+* If any policy denies, the merged policy denies. All must allow for the result to allow.
+*
+* @example
+* ```ts
+* const basePolicy = createPolicy({ ... });
+* const adminPolicy = createPolicy({ ... });
+*
+* const merged = mergePolicies(basePolicy, adminPolicy);
+* // Both policies must allow for the action to be permitted
+* ```
+*/
+function mergePolicies(...policies) {
+	return { can(context, action, resourceType, resource) {
+		for (const policy of policies) if (!policy.can(context, action, resourceType, resource)) return false;
+		return true;
+	} };
+}
+/**
+* Merges multiple policies into one using "allow-overrides" strategy.
+* If any policy allows, the merged policy allows. All must deny for the result to deny.
+*
+* @example
+* ```ts
+* const guestPolicy = createPolicy({ ... });
+* const memberPolicy = createPolicy({ ... });
+*
+* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+* // If either policy allows, the action is permitted
+* ```
+*/
+function mergePoliciesAny(...policies) {
+	return { can(context, action, resourceType, resource) {
+		return policies.some((policy) => policy.can(context, action, resourceType, resource));
+	} };
+}
+
+//#endregion
+export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport function allow<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"allow\";\n}\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport function deny<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"deny\";\n}\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport function when<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  condition: ConditionFn<TContext, TAction, TResource>\n): PolicyFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n}\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport function and<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport function or<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport function not<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  condition: ConditionFn<TContext, TAction, TResource>\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) => !condition(context, action, resource);\n}\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport function has<TContext extends Context, K extends keyof TContext>(\n  key: K,\n  value: TContext[K]\n): ConditionFn<TContext> {\n  return (context) => context[key] === value;\n}\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport function collectInheritedRoles<TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> {\n  const inherited = new Set<TRole>();\n\n  function add(role: TRole) {\n    if (!inherited.has(role)) {\n      inherited.add(role);\n      const parents = hierarchy[role] ?? [];\n      parents.forEach(add); // recursively add parent roles\n    }\n  }\n\n  roles.forEach(add);\n  return inherited;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport function hasRole<\n  TContext extends Context & { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends Context & { role: TRole | TRole[] },\n  TAction extends string = string,\n  TResource = unknown,\n  TRole extends Role = Role,\n>(\n  role: TRole,\n  hierarchy: RoleHierarchy<TRole>\n): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends Context & { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  role: Role,\n  hierarchy?: RoleHierarchy<Role>\n): ConditionFn<TContext, TAction, TResource> {\n  return (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (!hierarchy) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n}\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * policy.can(ctx, \"read\", \"post\", post); // true\n * policy.can(ctx, \"write\", \"post\", post); // depends on ctx.user.id\n * ```\n */\nexport function createPolicy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> {\n  const { rules } = config;\n\n  return {\n    can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): boolean {\n      const resourceRules = rules[resourceType];\n      const policyFn = resourceRules[action];\n\n      if (!policyFn) {\n        return false;\n      }\n\n      return policyFn(context, action, resource) === \"allow\";\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport function mergePolicies<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> {\n  return {\n    can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): boolean {\n      for (const policy of policies) {\n        if (!policy.can(context, action, resourceType, resource)) {\n          return false;\n        }\n      }\n      return true;\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport function mergePoliciesAny<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> {\n  return {\n    can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): boolean {\n      return policies.some((policy) =>\n        policy.can(context, action, resourceType, resource)\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,SAAgB,QAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,OAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,KAKd,WACwC;AACxC,SAAQ,SAAS,QAAQ,aACvB,UAAU,SAAS,QAAQ,SAAS,GAAG,UAAU;;;;;;;;;;;;;;;;;;;AAoBrD,SAAgB,IAKd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;;;;AAoBzE,SAAgB,GAKd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,SAAgB,IAKd,WAC2C;AAC3C,SAAQ,SAAS,QAAQ,aAAa,CAAC,UAAU,SAAS,QAAQ,SAAS;;;;;;;;;;;;;;AAe7E,SAAgB,IACd,KACA,OACuB;AACvB,SAAQ,YAAY,QAAQ,SAAS;;;;;;;;;;;;;;;;;;;AAoBvC,SAAgB,sBACd,OACA,WACY;CACZ,MAAM,4BAAY,IAAI,KAAY;CAElC,SAAS,IAAI,MAAa;AACxB,MAAI,CAAC,UAAU,IAAI,KAAK,EAAE;AACxB,aAAU,IAAI,KAAK;AAEnB,IADgB,UAAU,SAAS,EAAE,EAC7B,QAAQ,IAAI;;;AAIxB,OAAM,QAAQ,IAAI;AAClB,QAAO;;AA8CT,SAAgB,QAKd,MACA,WAC2C;AAC3C,SAAQ,YAAY;EAClB,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,GACzC,QAAQ,OACR,CAAC,QAAQ,KAAK;AAElB,MAAI,CAAC,UACH,QAAO,UAAU,SAAS,KAAK;AAIjC,SADkB,sBAAsB,WAAW,UAAU,CAC5C,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2D9B,SAAgB,aAKd,QACwC;CACxC,MAAM,EAAE,UAAU;AAElB,QAAO,EACL,IACE,SACA,QACA,cACA,UACS;EAET,MAAM,WADgB,MAAM,cACG;AAE/B,MAAI,CAAC,SACH,QAAO;AAGT,SAAO,SAAS,SAAS,QAAQ,SAAS,KAAK;IAElD;;;;;;;;;;;;;;;AAgBH,SAAgB,cAKd,GAAG,UACqC;AACxC,QAAO,EACL,IACE,SACA,QACA,cACA,UACS;AACT,OAAK,MAAM,UAAU,SACnB,KAAI,CAAC,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CACtD,QAAO;AAGX,SAAO;IAEV;;;;;;;;;;;;;;;AAgBH,SAAgB,iBAKd,GAAG,UACqC;AACxC,QAAO,EACL,IACE,SACA,QACA,cACA,UACS;AACT,SAAO,SAAS,MAAM,WACpB,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CACpD;IAEJ"}

package/dist/types-Bd4zClp0.d.mts

@@ -0,0 +1,134 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+
+//#region src/types.d.ts
+
+/**
+* Represents the possible outcomes of a policy decision.
+* - "allow": The action is permitted.
+* - "deny": The action is not permitted.
+*/
+type Decision = "allow" | "deny";
+/**
+* Represents the context in which a policy decision is made.
+* Can include user information, environment, or any relevant data.
+*/
+type Context<TContext = unknown> = TContext;
+/**
+* Represents a role within the system.
+*/
+type Role<TRole extends string = string> = TRole;
+/**
+* Represents a role hierarchy within the system.
+* Maps each role to an array of roles it inherits from.
+*
+* @example
+* ```ts
+* type Roles = "guest" | "user" | "admin";
+*
+* const hierarchy: RoleHierarchy<Roles> = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+* ```
+*/
+type RoleHierarchy<TRole extends Role = Role> = Record<TRole, TRole[]>;
+/**
+* Type helper for defining resource schemas using Standard Schema.
+* Use with `satisfies` to ensure type safety when defining resources.
+*
+* @example
+* ```ts
+* import { z } from "zod";
+* import type { Resources } from "@zap-studio/permit/types";
+*
+* const resources = {
+*   post: z.object({ id: z.string(), authorId: z.string() }),
+*   comment: z.object({ id: z.string(), postId: z.string() }),
+* } satisfies Resources;
+* ```
+*/
+type Resources<TResourceKey extends string = string> = Record<TResourceKey, StandardSchemaV1>;
+/**
+* Type helper for defining actions per resource.
+* Use with `satisfies` to ensure keys match the resource definitions.
+*
+* @example
+* ```ts
+* import type { Actions } from "@zap-studio/permit/types";
+*
+* const actions = {
+*   post: ["read", "write", "delete"],
+*   comment: ["read", "write"],
+* } as const satisfies Actions<typeof resources>;
+* ```
+*/
+type Actions<TResources extends Resources> = { [K in keyof TResources]: readonly string[] };
+/**
+* Infers the output type from a Standard Schema.
+*/
+type InferResource<TResources extends Resources, TResourceKey extends keyof TResources> = StandardSchemaV1.InferOutput<TResources[TResourceKey]>;
+/**
+* Infers the action union type for a specific resource.
+*/
+type InferAction<TActions extends Record<string, readonly string[]>, K$1 extends keyof TActions> = TActions[K$1][number];
+/**
+* A function that determines whether a given action on a resource is allowed in a specific context.
+*/
+type PolicyFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => Decision;
+/**
+* A function that evaluates a condition for a given action and resource in a specific context.
+*/
+type ConditionFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => boolean;
+/**
+* Maps actions to their corresponding policy functions for a specific resource.
+*/
+type ActionPolicyMap<TContext extends Context, TAction extends string = string, TResource = unknown> = { [A in TAction]?: PolicyFn<TContext, A, TResource> };
+/**
+* Defines the rules for each resource and action combination.
+* Each resource key maps to an object where each action key maps to a policy function.
+*/
+type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TActions, K>, InferResource<TResources, K>> };
+/**
+* Configuration object for creating a permit policy.
+*
+* @example
+* ```ts
+* const config: PermitConfig<MyContext> = {
+*   resources,
+*   actions,
+*   rules: {
+*     post: { read: allow(), write: deny() },
+*   },
+* };
+* ```
+*/
+type PermitConfig<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = {
+  resources: TResources;
+  actions: TActions;
+  rules: Rules<TContext, TResources, TActions>;
+};
+/**
+* Represents a policy object that can evaluate permissions.
+* The `can` method checks if a given action is permitted on a resource in a specific context.
+*
+* @example
+* ```ts
+* const policy: Policy<MyContext> = createPolicy({
+*   resources,
+*   actions,
+*   rules: { ... },
+* });
+*
+* policy.can(ctx, "read", "post", postData); // true or false
+* ```
+*/
+type Policy<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = {
+  /**
+  * Determines if the specified action is permitted on the resource in the given context.
+  */
+  can<K$1 extends keyof TResources & keyof TActions>(context: TContext, action: InferAction<TActions, K$1>, resourceType: K$1, resource: InferResource<TResources, K$1>): boolean;
+};
+//#endregion
+export { Decision as a, PermitConfig as c, Resources as d, Role as f, Context as i, Policy as l, Rules as m, Actions as n, InferAction as o, RoleHierarchy as p, ConditionFn as r, InferResource as s, ActionPolicyMap as t, PolicyFn as u };
+//# sourceMappingURL=types-Bd4zClp0.d.mts.map

package/dist/types-Bd4zClp0.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-Bd4zClp0.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAMA;AAKA;AAiBY,KA5BA,QAAA,GA4BA,OAAA,GAAA,MAAA;;;;;AAA2C,KAtB3C,OAsB2C,CAAA,WAAA,OAAA,CAAA,GAtBb,QAsBa;;AAiBvD;;AAEE,KApCU,IAoCV,CAAA,cAAA,MAAA,GAAA,MAAA,CAAA,GApCgD,KAoChD;;;AAiBF;AAOA;;;;;;;AAQA;;;;;AAGa,KAtDD,aAsDC,CAAA,cAtD2B,IAsD3B,GAtDkC,IAsDlC,CAAA,GAtD0C,MAsD1C,CAtDiD,KAsDjD,EAtDwD,KAsDxD,EAAA,CAAA;AAKb;;;;;;;AASA;;;;;;AASA;;AAKQ,KAjEI,SAiEJ,CAAA,qBAAA,MAAA,GAAA,MAAA,CAAA,GAjEsD,MAiEtD,CAhEN,YAgEM,EA/DN,gBA+DM,CAAA;;;;;;AAOR;;;;;;;;;AAKiC,KA1DrB,OA0DqB,CAAA,mBA1DM,SA0DN,CAAA,GAAA,QAAA,MAzDnB,UAyDmB,GAAA,SAAA,MAAA,EAAA,EAAA;;;;AAE7B,KArDQ,aAqDR,CACc,mBArDG,SAqDH,EAAY,qBAAA,MApDD,UAoDC,CAA1B,GAnDA,gBAAA,CAAiB,WAmDjB,CAnD6B,UAmD7B,CAnDwC,YAmDxC,CAAA,CAAA;;;AAkBJ;AACmB,KAjEP,WAiEO,CACE,iBAjEF,MAiEE,CAAA,MAAA,EAAA,SAAA,MAAA,EAAA,CAAA,EAAY,YAAA,MAhEf,QAgEe,CACN,GAhEvB,QAgEuB,CAhEd,GAgEc,CAAA,CAAA,MAAA,CAAA;;;;AAEd,KA7DD,QA6DC,CACF,iBA7DQ,OA6DR,EACI,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAY,GAAA,CAAA,OAAA,EA3DvB,QA2DuB,EAAA,MAAA,EA3DL,OA2DK,EAAA,QAAA,EA3Dc,SA2Dd,EAAA,GA3D4B,QA2D5B;;;AAkBrC;AACmB,KAzEP,WAyEO,CACE,iBAzEF,OAyEE,EAAY,gBAAA,MAAA,GAAA,MAAA,EACN,YAAA,OAAA,CAAR,GAAA,CAAA,OAAA,EAvEL,QAuEK,EAAA,MAAA,EAvEa,OAuEb,EAAA,QAAA,EAvEgC,SAuEhC,EAAA,GAAA,OAAA;;;;AAKsB,KAvE7B,eAuE6B,CAC5B,iBAvEM,OAuEN,EACW,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAtB,GAAA,QApEJ,OAoEI,IApEO,QAoEP,CApEgB,QAoEhB,EApE0B,CAoE1B,EApE6B,SAoE7B,CAAA,EAAA;;;;;AAEE,KA/DF,KA+DE,kBA9DK,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,6BAEnC,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;KAkBlB,8BACO,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ;aAEpC;WACF;SACF,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;KAkBzB,wBACO,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ;;;;wBAK3B,mBAAmB,mBAC5B,kBACD,YAAY,UAAU,oBAChB,eACJ,cAAc,YAAY"}

package/dist/types.d.mts

@@ -0,0 +1,2 @@
+import { a as Decision, c as PermitConfig, d as Resources, f as Role, i as Context, l as Policy, m as Rules, n as Actions, o as InferAction, p as RoleHierarchy, r as ConditionFn, s as InferResource, t as ActionPolicyMap, u as PolicyFn } from "./types-Bd4zClp0.mjs";
+export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };

package/dist/types.mjs

@@ -0,0 +1 @@
+export {  };

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@zap-studio/permit",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "private": false,
+  "homepage": "https://www.zapstudio.dev/packages/permit",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zap-studio/monorepo.git",
+    "directory": "packages/permit"
+  },
+  "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
+  "keywords": [
+    "authorization",
+    "permissions",
+    "access-control",
+    "rbac",
+    "abac",
+    "policy",
+    "typescript",
+    "standard-schema",
+    "zod",
+    "valibot",
+    "arktype"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md",
+    "LICENSE.md",
+    "README.md"
+  ],
+  "dependencies": {
+    "@standard-schema/spec": "^1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.2",
+    "@vitest/coverage-v8": "^4.0.15",
+    "tsdown": "^0.18.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.15",
+    "@zap-studio/tsdown-config": "0.0.0",
+    "@zap-studio/typescript-config": "0.0.0",
+    "@zap-studio/vitest-config": "0.0.0"
+  },
+  "exports": {
+    ".": "./dist/index.mjs",
+    "./errors": "./dist/errors.mjs",
+    "./helpers": "./dist/helpers.mjs",
+    "./types": "./dist/types.mjs",
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "scripts": {
+    "build": "tsdown --config tsdown.config.ts",
+    "check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest --watch"
+  }
+}