@zap-studio/permit 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @zap-studio/permit
 
+## 0.3.0
+
+### Minor Changes
+
+- fe60f55: Change `policy.can()` to use a single permission string plus the resource object.
+
+  `policy.can(ctx, "read", "post", post)` is replaced by
+  `policy.can(ctx, "post:read", post)`.
+
+  This is a breaking API change in the `0.x` line. Docs and examples now use the
+  new permission-string format consistently.
+
+## 0.2.2
+
+### Patch Changes
+
+- e26293e: Updated dependencies.
+  - @zap-studio/validation@0.3.2
+
 ## 0.2.1
 
 ### Patch Changes
@@ -7,7 +26,6 @@
 - 5ea3d3b: Updated dependencies.
   - @zap-studio/validation@0.3.1
 
-
 ## 0.2.0
 
 ### Changed

package/{LICENSE.md → LICENSE}

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Alexandre Trotel
+Copyright (c) 2026 Alexandre Trotel
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -72,9 +72,9 @@ const policy = createPolicy<AppContext>({
 const ctx: AppContext = { user: { id: "user-1", role: "user" } };
 const post = { id: "1", authorId: "user-1", visibility: "public" as const };
 
-await policy.can(ctx, "read", "post", post); // true
-await policy.can(ctx, "write", "post", post); // true (user is author)
-await policy.can(ctx, "delete", "post", post); // false (always denied)
+await policy.can(ctx, "post:read", post); // true
+await policy.can(ctx, "post:write", post); // true (user is author)
+await policy.can(ctx, "post:delete", post); // false (always denied)
 ```
 
 ## API Reference
@@ -126,7 +126,7 @@ Returns a condition that is true only if all conditions are true.
 ```ts
 const isOwnerAndPublished = and(
   (ctx, action, resource) => ctx.user.id === resource.authorId,
-  (ctx, action, resource) => resource.status === "published"
+  (ctx, action, resource) => resource.status === "published",
 );
 ```
 
@@ -137,7 +137,7 @@ Returns a condition that is true if any condition is true.
 ```ts
 const isOwnerOrAdmin = or(
   (ctx, action, resource) => ctx.user.id === resource.authorId,
-  (ctx, action, resource) => ctx.user.role === "admin"
+  (ctx, action, resource) => ctx.user.role === "admin",
 );
 ```
 

package/bin/intent.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Auto-generated by @tanstack/intent setup
+// Exposes the intent end-user CLI for consumers of this library.
+await import("@tanstack/intent/intent-library");

package/dist/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;AAIA;;;cAAa,WAAA,SAAoB,KAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;AAIA;;;cAAa,WAAA,SAAoB,KAAA;EAC/B,WAAA,CAAY,OAAA;AAAA"}

package/dist/errors.mjs

@@ -9,7 +9,7 @@ var PolicyError = class extends Error {
 		this.name = "PolicyError";
 	}
 };
-
 //#endregion
 export { PolicyError };
+
 //# sourceMappingURL=errors.mjs.map

package/dist/helpers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.mts","names":[],"sources":["../src/helpers.ts"],"sourcesContent":[],"mappings":";;AAsBA;;;;;;;;;;;;;;;;;;;;;iBAAgB,WAAA"}
+{"version":3,"file":"helpers.d.mts","names":[],"sources":["../src/helpers.ts"],"mappings":";;AAsBA;;;;;;;;;;;;;;;;;;;;;iBAAgB,WAAA,CAAY,KAAA"}

package/dist/helpers.mjs

@@ -22,9 +22,9 @@
 * ```
 */
 function assertNever(value) {
-	throw new Error(`Unexpected value: ${value}`);
+	throw new Error(`Unexpected value: ${String(value)}`);
 }
-
 //#endregion
 export { assertNever };
+
 //# sourceMappingURL=helpers.mjs.map

package/dist/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport function assertNever(value: never): never {\n  throw new Error(`Unexpected value: ${value}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,YAAY,OAAqB;AAC/C,OAAM,IAAI,MAAM,qBAAqB,QAAQ"}
+{"version":3,"file":"helpers.mjs","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport function assertNever(value: never): never {\n  throw new Error(`Unexpected value: ${String(value)}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,YAAY,OAAqB;AAC/C,OAAM,IAAI,MAAM,qBAAqB,OAAO,MAAM,GAAG"}

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import { Actions, ConditionFn, Context, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy } from "./types.mjs";
 
 //#region src/index.d.ts
-
 /**
 * Returns a policy function that always allows the action.
 *
@@ -162,10 +161,10 @@ declare function collectInheritedRoles<TRole extends Role = Role>(roles: TRole[]
 * }
 * ```
 */
-declare function hasRole<TContext extends Context & {
+declare function hasRole<TContext extends {
   role: Role | Role[];
 }, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
-declare function hasRole<TContext extends Context & {
+declare function hasRole<TContext extends {
   role: TRole | TRole[];
 }, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
 /**

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;AAiCA;;;;;;;AAwBA;;;;;;;AAwBgB,iBAhDA,KAgDA,CACG,iBAhDA,OAgDA,EAIM,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAS,CAAA,CAAA,EAjDvC,QAiDuC,CAjD9B,QAiD8B,EAjDpB,OAiDoB,EAjDX,SAiDW,CAAA;;;;;;;AAuB5C;;;;;;;;;;AAMG,iBA1Da,IA0Db,CAsBH,iBA/EmB,OA+EH,EACG,gBAAA,MAAA,GAAA,MAAA,EAIU,YAAA,OAAA,CAAU,CAAA,CAAA,EAjFlC,QAiFkC,CAjFzB,QAiFyB,EAjFf,OAiFe,EAjFN,SAiFM,CAAA;;;;;;;;AAoBvC;;;;;;;;;AAMG,iBAvFa,IAuFb,CAAA,iBAtFgB,OAsFhB,EAgBH,gBAAgB,MAAA,GAAA,MAAA,EAAqB,YAAA,OAAA,CAAyB,CAAA,SAAA,EAlGjD,WAkGiD,CAlGrC,QAkGqC,EAlG3B,OAkG2B,EAlGlB,SAkGkB,CAAA,CAAA,EAjG3D,QAiG2D,CAjGlD,QAiGkD,EAjGxC,OAiGwC,EAjG/B,SAiG+B,CAAA;;;;;;;AAwB9D;;;;;;;;;AA6CA;;AACqC,iBAjJrB,GAiJqB,CAAO,iBAhJzB,OAgJyB,EAGpC,gBAAA,MAAA,GAAA,MAAA,EAAmB,YAAA,OAAA,CAAU,CAAA,GAAA,UAAA,EA/IpB,WA+IoB,CA/IR,QA+IQ,EA/IE,OA+IF,EA/IW,SA+IX,CAAA,EAAA,CAAA,EA9IlC,WA8IkC,CA9ItB,QA8IsB,EA9IZ,OA8IY,EA9IH,SA8IG,CAAA;;;;AAErC;;;;;;;;;;;;;;AAuFgB,iBAjNA,EAiNA,CACG,iBAjNA,OAiNA,EACE,gBAAA,MAAA,GAAA,MAAA,EAAY,YAAA,OAAA,CACN,CAAA,GAAA,UAAA,EA/MV,WA+MU,CA/ME,QA+MF,EA/MY,OA+MZ,EA/MqB,SA+MrB,CAAA,EAAA,CAAA,EA9MxB,WA8MwB,CA9MZ,QA8MY,EA9MF,OA8ME,EA9MO,SA8MP,CAAA;;;;;;;;;;;;;AAoG3B;;AAEqB,iBAjSL,GAiSK,CAAY,iBAhSd,OAgSc,EACN,gBAAA,MAAA,GAAA,MAAA,EAAR,YAAA,OAAA,CAA8B,CAAA,SAAA,EA7RpC,WA6RoC,CA7RxB,QA6RwB,EA7Rd,OA6Rc,EA7RL,SA6RK,CAAA,CAAA,EA5R9C,WA4R8C,CA5RlC,QA4RkC,EA5RxB,OA4RwB,EA5Rf,SA4Re,CAAA;;;;;;;;;;;AAqCjD;;AAEqB,iBAnTL,GAmTK,CAAY,iBAnTI,OAmTJ,EACN,UAAA,MApTmC,QAoTnC,CAAR,CAAA,GAAA,EAnTZ,CAmTY,EAAA,KAAA,EAlTV,QAkTU,CAlTD,CAkTC,CAAA,CAAA,EAjThB,WAiTgB,CAjTJ,QAiTI,CAAA;;;;;;;;;;;;;;;;;;iBA5RH,oCAAoC,OAAO,aAClD,oBACI,cAAc,SACxB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CS,yBACG;QAAkB,OAAO;+DAGpC,OAAO,YAAY,UAAU,SAAS;iBAE9B,yBACG;QAAkB,QAAQ;uEAG7B,OAAO,YAEf,kBACK,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+ElB,8BACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,qBAEvC,aAAa,UAAU,YAAY,YAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;iBAiGhB,+BACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,0BAElC,OAAO,UAAU,YAAY,cACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;iBAkChB,kCACG,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ,0BAElC,OAAO,UAAU,YAAY,cACzC,OAAO,UAAU,YAAY"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;AAkCA;;;;;;;;;;;;;;iBAAgB,KAAA,kBACG,OAAA,uDAAA,CAAA,GAGd,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;;AAoBjC;;;;;;;;;;;;;;;iBAAgB,IAAA,kBACG,OAAA,uDAAA,CAAA,GAGd,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;AAoBjC;;;;;;;;;;;;;;;;AAAA,iBAAgB,IAAA,kBACG,OAAA,uDAAA,CAGjB,SAAA,EAAW,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,IAAa,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;AAqBrF;;;;;;;;;iBAAgB,GAAA,kBAAqB,OAAA,uDAAA,CAAA,GAChC,UAAA,EAAY,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,MAC7C,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;;;;;;;;AAsBlC;;iBAAgB,EAAA,kBAAoB,OAAA,uDAAA,CAAA,GAC/B,UAAA,EAAY,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,MAC7C,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;;;;;;;iBAmBlB,GAAA,kBAAqB,OAAA,uDAAA,CACnC,SAAA,EAAW,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,IACzC,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;AAFlC;;;;;;;;;iBAkBgB,GAAA,kBAAqB,OAAA,kBAAyB,QAAA,CAAA,CAC5D,GAAA,EAAK,CAAA,EACL,KAAA,EAAO,QAAA,CAAS,CAAA,IACf,WAAA,CAAY,QAAA;;;;;;;;;;;;;;;;;AAHf;iBAwBgB,qBAAA,eAAoC,IAAA,GAAO,IAAA,CAAA,CACzD,KAAA,EAAO,KAAA,IACP,SAAA,EAAW,aAAA,CAAc,KAAA,IACxB,GAAA,CAAI,KAAA;;;;;;;;;;;;;;;;;;;;;;;;AAHP;;;;iBA6CgB,OAAA;EACK,IAAA,EAAM,IAAA,GAAO,IAAA;AAAA,wDAAA,CAGhC,IAAA,EAAM,IAAA,GAAO,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;AAAA,iBAE9B,OAAA;EACK,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,uEAGnB,IAAA,GAAO,IAAA,CAAA,CACrB,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,aAAA,CAAc,KAAA,IAAS,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;AAXhF;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;;;;;;;;;;;;;;;;;;;;;;;iBA+EgB,YAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAC/C,MAAA,EAAQ,YAAA,CAAa,QAAA,EAAU,UAAA,EAAY,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA;;;;;;;;AAJtF;;;;;;iBAgGgB,aAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAAA,GAC5C,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA,MAAc,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA;;;;;;;;;;;;;;iBAkCvE,gBAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAAA,GAC5C,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA,MAAc,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA"}

package/dist/index.mjs

@@ -1,6 +1,5 @@
 import { PolicyError } from "./errors.mjs";
 import { createStandardValidator } from "@zap-studio/validation";
-
 //#region src/index.ts
 /**
 * Returns a policy function that always allows the action.
@@ -300,7 +299,7 @@ function mergePoliciesAny(...policies) {
 		return false;
 	} };
 }
-
 //#endregion
 export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { StandardSchemaV1 } from \"@standard-schema/spec\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\nimport { PolicyError } from \"./errors\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport function allow<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"allow\";\n}\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport function deny<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"deny\";\n}\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport function when<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  condition: ConditionFn<TContext, TAction, TResource>\n): PolicyFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n}\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport function and<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport function or<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport function not<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  condition: ConditionFn<TContext, TAction, TResource>\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) => !condition(context, action, resource);\n}\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport function has<TContext extends Context, K extends keyof TContext>(\n  key: K,\n  value: TContext[K]\n): ConditionFn<TContext> {\n  return (context) => context[key] === value;\n}\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport function collectInheritedRoles<TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> {\n  const inherited = new Set<TRole>();\n\n  function add(role: TRole) {\n    if (!inherited.has(role)) {\n      inherited.add(role);\n      const parents = hierarchy[role] ?? [];\n      parents.forEach(add); // recursively add parent roles\n    }\n  }\n\n  roles.forEach(add);\n  return inherited;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport function hasRole<\n  TContext extends Context & { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends Context & { role: TRole | TRole[] },\n  TAction extends string = string,\n  TResource = unknown,\n  TRole extends Role = Role,\n>(\n  role: TRole,\n  hierarchy: RoleHierarchy<TRole>\n): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends Context & { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(\n  role: Role,\n  hierarchy?: RoleHierarchy<Role>\n): ConditionFn<TContext, TAction, TResource> {\n  return (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (!hierarchy) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n}\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"read\", \"post\", post); // true\n * await policy.can(ctx, \"write\", \"post\", post); // depends on ctx.user.id\n * ```\n */\nexport function createPolicy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (!validator) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value as InferResource<TResources, K>;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  for (const key of Object.keys(resources) as Array<keyof TResources>) {\n    const schema = resources[key];\n    if (!schema) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const allowedActions = actions[resourceType];\n      if (!allowedActions) {\n        return false;\n      }\n      if (!allowedActions.includes(action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (!validatedResource) {\n        return false;\n      }\n\n      const resourceRules = rules[resourceType];\n      if (!resourceRules) {\n        return false;\n      }\n\n      const policyFn = resourceRules[action];\n\n      if (!policyFn) {\n        return false;\n      }\n\n      try {\n        return policyFn(context, action, validatedResource) === \"allow\";\n      } catch (error) {\n        console.warn(\n          `Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`\n        );\n        return false;\n      }\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport function mergePolicies<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        if (!(await policy.can(context, action, resourceType, resource))) {\n          return false;\n        }\n      }\n      return true;\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport function mergePoliciesAny<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        if (await policy.can(context, action, resourceType, resource)) {\n          return true;\n        }\n      }\n      return false;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,QAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,OAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,KAKd,WACwC;AACxC,SAAQ,SAAS,QAAQ,aACvB,UAAU,SAAS,QAAQ,SAAS,GAAG,UAAU;;;;;;;;;;;;;;;;;;;AAoBrD,SAAgB,IAKd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;;;;AAoBzE,SAAgB,GAKd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,SAAgB,IAKd,WAC2C;AAC3C,SAAQ,SAAS,QAAQ,aAAa,CAAC,UAAU,SAAS,QAAQ,SAAS;;;;;;;;;;;;;;AAe7E,SAAgB,IACd,KACA,OACuB;AACvB,SAAQ,YAAY,QAAQ,SAAS;;;;;;;;;;;;;;;;;;;AAoBvC,SAAgB,sBACd,OACA,WACY;CACZ,MAAM,4BAAY,IAAI,KAAY;CAElC,SAAS,IAAI,MAAa;AACxB,MAAI,CAAC,UAAU,IAAI,KAAK,EAAE;AACxB,aAAU,IAAI,KAAK;AAEnB,IADgB,UAAU,SAAS,EAAE,EAC7B,QAAQ,IAAI;;;AAIxB,OAAM,QAAQ,IAAI;AAClB,QAAO;;AA8CT,SAAgB,QAKd,MACA,WAC2C;AAC3C,SAAQ,YAAY;EAClB,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,GACzC,QAAQ,OACR,CAAC,QAAQ,KAAK;AAElB,MAAI,CAAC,UACH,QAAO,UAAU,SAAS,KAAK;AAIjC,SADkB,sBAAsB,WAAW,UAAU,CAC5C,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2D9B,SAAgB,aAKd,QACwC;CACxC,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,KAGpB;CAEH,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,aAAa;AAC9C,MAAI,CAAC,UACH,QAAO;AAET,MAAI;GACF,MAAM,SAAS,MAAM,UAAU,SAAS;AACxC,OAAI,OAAO,OACT,QAAO;AAET,UAAO,OAAO;WACP,OAAO;AACd,WAAQ,KACN,kCAAkC,OAAO,aAAa,CAAC,IAAI,OAAO,MAAM,GACzE;AACD,UAAO;;;AAIX,MAAK,MAAM,OAAO,OAAO,KAAK,UAAU,EAA6B;EACnE,MAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OACH,OAAM,IAAI,YAAY,gCAAgC,OAAO,IAAI,GAAG;EAEtE,MAAM,YAAY,wBAAwB,OAAO;AACjD,aAAW,IAAI,KAAK,OAAO,UAAmB,UAAU,MAAM,CAAC;;AAGjE,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;EAClB,MAAM,iBAAiB,QAAQ;AAC/B,MAAI,CAAC,eACH,QAAO;AAET,MAAI,CAAC,eAAe,SAAS,OAAO,CAClC,QAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,SACD;AACD,MAAI,CAAC,kBACH,QAAO;EAGT,MAAM,gBAAgB,MAAM;AAC5B,MAAI,CAAC,cACH,QAAO;EAGT,MAAM,WAAW,cAAc;AAE/B,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;AACF,UAAO,SAAS,SAAS,QAAQ,kBAAkB,KAAK;WACjD,OAAO;AACd,WAAQ,KACN,+BAA+B,OAAO,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,IAAI,OAAO,MAAM,GACxF;AACD,UAAO;;IAGZ;;;;;;;;;;;;;;;AAgBH,SAAgB,cAKd,GAAG,UACqC;AACxC,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,SACnB,KAAI,CAAE,MAAM,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CAC7D,QAAO;AAGX,SAAO;IAEV;;;;;;;;;;;;;;;AAgBH,SAAgB,iBAKd,GAAG,UACqC;AACxC,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,SACnB,KAAI,MAAM,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CAC3D,QAAO;AAGX,SAAO;IAEV"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport function allow<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"allow\";\n}\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport function deny<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"deny\";\n}\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport function when<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(condition: ConditionFn<TContext, TAction, TResource>): PolicyFn<TContext, TAction, TResource> {\n  return (context, action, resource) => (condition(context, action, resource) ? \"allow\" : \"deny\");\n}\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport function and<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport function or<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport function not<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  condition: ConditionFn<TContext, TAction, TResource>,\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) => !condition(context, action, resource);\n}\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport function has<TContext extends Context, K extends keyof TContext>(\n  key: K,\n  value: TContext[K],\n): ConditionFn<TContext> {\n  return (context) => context[key] === value;\n}\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport function collectInheritedRoles<TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>,\n): Set<TRole> {\n  const inherited = new Set<TRole>();\n\n  function add(role: TRole) {\n    if (!inherited.has(role)) {\n      inherited.add(role);\n      const parents = hierarchy[role] ?? [];\n      parents.forEach(add); // recursively add parent roles\n    }\n  }\n\n  roles.forEach(add);\n  return inherited;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: TRole | TRole[] },\n  TAction extends string = string,\n  TResource = unknown,\n  TRole extends Role = Role,\n>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role, hierarchy?: RoleHierarchy<Role>): ConditionFn<TContext, TAction, TResource> {\n  return (context) => {\n    const userRoles = Array.isArray(context.role) ? context.role : [context.role];\n\n    if (!hierarchy) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n}\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"read\", \"post\", post); // true\n * await policy.can(ctx, \"write\", \"post\", post); // depends on ctx.user.id\n * ```\n */\nexport function createPolicy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(config: PermitConfig<TContext, TResources, TActions>): Policy<TContext, TResources, TActions> {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>,\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (!validator) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value as InferResource<TResources, K>;\n    } catch (error) {\n      console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);\n      return null;\n    }\n  };\n\n  for (const key of Object.keys(resources) as Array<keyof TResources>) {\n    const schema = resources[key];\n    if (!schema) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      const allowedActions = actions[resourceType];\n      if (!allowedActions) {\n        return false;\n      }\n      if (!allowedActions.includes(action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(resourceType, resource);\n      if (!validatedResource) {\n        return false;\n      }\n\n      const resourceRules = rules[resourceType];\n      if (!resourceRules) {\n        return false;\n      }\n\n      const policyFn = resourceRules[action];\n\n      if (!policyFn) {\n        return false;\n      }\n\n      try {\n        return policyFn(context, action, validatedResource) === \"allow\";\n      } catch (error) {\n        console.warn(\n          `Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`,\n        );\n        return false;\n      }\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport function mergePolicies<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        if (!(await policy.can(context, action, resourceType, resource))) {\n          return false;\n        }\n      }\n      return true;\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport function mergePoliciesAny<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      action: InferAction<TActions, K>,\n      resourceType: K,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        if (await policy.can(context, action, resourceType, resource)) {\n          return true;\n        }\n      }\n      return false;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,QAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,OAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,KAId,WAA8F;AAC9F,SAAQ,SAAS,QAAQ,aAAc,UAAU,SAAS,QAAQ,SAAS,GAAG,UAAU;;;;;;;;;;;;;;;;;;;AAoB1F,SAAgB,IACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;;;;AAoBzE,SAAgB,GACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,SAAgB,IACd,WAC2C;AAC3C,SAAQ,SAAS,QAAQ,aAAa,CAAC,UAAU,SAAS,QAAQ,SAAS;;;;;;;;;;;;;;AAe7E,SAAgB,IACd,KACA,OACuB;AACvB,SAAQ,YAAY,QAAQ,SAAS;;;;;;;;;;;;;;;;;;;AAoBvC,SAAgB,sBACd,OACA,WACY;CACZ,MAAM,4BAAY,IAAI,KAAY;CAElC,SAAS,IAAI,MAAa;AACxB,MAAI,CAAC,UAAU,IAAI,KAAK,EAAE;AACxB,aAAU,IAAI,KAAK;AAEnB,IADgB,UAAU,SAAS,EAAE,EAC7B,QAAQ,IAAI;;;AAIxB,OAAM,QAAQ,IAAI;AAClB,QAAO;;AA2CT,SAAgB,QAId,MAAY,WAA4E;AACxF,SAAQ,YAAY;EAClB,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,GAAG,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAE7E,MAAI,CAAC,UACH,QAAO,UAAU,SAAS,KAAK;AAIjC,SADkB,sBAAsB,WAAW,UAAU,CAC5C,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2D9B,SAAgB,aAId,QAA8F;CAC9F,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,KAGpB;CAEH,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,aAAa;AAC9C,MAAI,CAAC,UACH,QAAO;AAET,MAAI;GACF,MAAM,SAAS,MAAM,UAAU,SAAS;AACxC,OAAI,OAAO,OACT,QAAO;AAET,UAAO,OAAO;WACP,OAAO;AACd,WAAQ,KAAK,kCAAkC,OAAO,aAAa,CAAC,IAAI,OAAO,MAAM,GAAG;AACxF,UAAO;;;AAIX,MAAK,MAAM,OAAO,OAAO,KAAK,UAAU,EAA6B;EACnE,MAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OACH,OAAM,IAAI,YAAY,gCAAgC,OAAO,IAAI,GAAG;EAEtE,MAAM,YAAY,wBAAwB,OAAO;AACjD,aAAW,IAAI,KAAK,OAAO,UAAmB,UAAU,MAAM,CAAC;;AAGjE,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;EAClB,MAAM,iBAAiB,QAAQ;AAC/B,MAAI,CAAC,eACH,QAAO;AAET,MAAI,CAAC,eAAe,SAAS,OAAO,CAClC,QAAO;EAGT,MAAM,oBAAoB,MAAM,qBAAqB,cAAc,SAAS;AAC5E,MAAI,CAAC,kBACH,QAAO;EAGT,MAAM,gBAAgB,MAAM;AAC5B,MAAI,CAAC,cACH,QAAO;EAGT,MAAM,WAAW,cAAc;AAE/B,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;AACF,UAAO,SAAS,SAAS,QAAQ,kBAAkB,KAAK;WACjD,OAAO;AACd,WAAQ,KACN,+BAA+B,OAAO,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,IAAI,OAAO,MAAM,GACxF;AACD,UAAO;;IAGZ;;;;;;;;;;;;;;;AAgBH,SAAgB,cAId,GAAG,UAA4F;AAC/F,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,SACnB,KAAI,CAAE,MAAM,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CAC7D,QAAO;AAGX,SAAO;IAEV;;;;;;;;;;;;;;;AAgBH,SAAgB,iBAId,GAAG,UAA4F;AAC/F,QAAO,EACL,MAAM,IACJ,SACA,QACA,cACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,SACnB,KAAI,MAAM,OAAO,IAAI,SAAS,QAAQ,cAAc,SAAS,CAC3D,QAAO;AAGX,SAAO;IAEV"}

package/dist/types.d.mts

@@ -1,7 +1,6 @@
-import { StandardSchemaV1 } from "@standard-schema/spec";
+import { StandardSchemaV1 } from "@zap-studio/validation";
 
 //#region src/types.d.ts
-
 /**
 * Represents the possible outcomes of a policy decision.
 * - "allow": The action is permitted.
@@ -71,7 +70,7 @@ type InferResource<TResources extends Resources, TResourceKey extends keyof TRes
 /**
 * Infers the action union type for a specific resource.
 */
-type InferAction<TActions extends Record<string, readonly string[]>, K$1 extends keyof TActions> = TActions[K$1][number];
+type InferAction<TActions extends Record<string, readonly string[]>, K extends keyof TActions> = TActions[K][number];
 /**
 * A function that determines whether a given action on a resource is allowed in a specific context.
 */
@@ -127,7 +126,7 @@ interface Policy<TContext extends Context, TResources extends Resources = Resour
   /**
   * Determines if the specified action is permitted on the resource in the given context.
   */
-  can<K$1 extends keyof TResources & keyof TActions>(context: TContext, action: InferAction<TActions, K$1>, resourceType: K$1, resource: InferResource<TResources, K$1>): Promise<boolean>;
+  can<K extends keyof TResources & keyof TActions>(context: TContext, action: InferAction<TActions, K>, resourceType: K, resource: InferResource<TResources, K>): Promise<boolean>;
 }
 //#endregion
 export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAMA;AAKA;AAiBY,KA5BA,QAAA,GA4BA,OAAA,GAAA,MAAA;;;;;AAA2C,KAtB3C,OAsB2C,CAAA,WAAA,OAAA,CAAA,GAtBb,QAsBa;;AAiBvD;;AAEE,KApCU,IAoCV,CAAA,cAAA,MAAA,GAAA,MAAA,CAAA,GApCgD,KAoChD;;;AAiBF;AAOA;;;;;;;AAQA;;;;;AAGa,KAtDD,aAsDC,CAAA,cAtD2B,IAsD3B,GAtDkC,IAsDlC,CAAA,GAtD0C,MAsD1C,CAtDiD,KAsDjD,EAtDwD,KAsDxD,EAAA,CAAA;AAKb;;;;;;;AASA;;;;;;AASA;;AAKQ,KAjEI,SAiEJ,CAAA,qBAAA,MAAA,GAAA,MAAA,CAAA,GAjEsD,MAiEtD,CAhEN,YAgEM,EA/DN,gBA+DM,CAAA;;;;;;AAOR;;;;;;;;;AAKiC,KA1DrB,OA0DqB,CAAA,mBA1DM,SA0DN,CAAA,GAAA,QAAA,MAzDnB,UAyDmB,GAAA,SAAA,MAAA,EAAA,EAAA;;;;AAE7B,KArDQ,aAqDR,CACc,mBArDG,SAqDH,EAAY,qBAAA,MApDD,UAoDC,CAA1B,GAnDA,gBAAA,CAAiB,WAmDjB,CAnD6B,UAmD7B,CAnDwC,YAmDxC,CAAA,CAAA;;;AAkBJ;AACmB,KAjEP,WAiEO,CACE,iBAjEF,MAiEE,CAAA,MAAA,EAAA,SAAA,MAAA,EAAA,CAAA,EAAY,YAAA,MAhEf,QAgEe,CACN,GAhEvB,QAgEuB,CAhEd,GAgEc,CAAA,CAAA,MAAA,CAAA;;;;AAEhB,KA7DC,QA6DD,CACE,iBA7DM,OA6DN,EACE,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAY,GAAA,CAAA,OAAA,EA3DvB,QA2DuB,EAAA,MAAA,EA3DL,OA2DK,EAAA,QAAA,EA3Dc,SA2Dd,EAAA,GA3D4B,QA2D5B;;;AAkBrC;AACmB,KAzEP,WAyEO,CACE,iBAzEF,OAyEE,EAAY,gBAAA,MAAA,GAAA,MAAA,EACN,YAAA,OAAA,CAAR,GAAA,CAAA,OAAA,EAvEL,QAuEK,EAAA,MAAA,EAvEa,OAuEb,EAAA,QAAA,EAvEgC,SAuEhC,EAAA,GAAA,OAAA;;;;AAKsB,KAvE7B,eAuE6B,CAC5B,iBAvEM,OAuEN,EACW,gBAAA,MAAA,GAAA,MAAA,EAAU,YAAA,OAAA,CAAtB,GAAA,QApEJ,OAoEI,IApEO,QAoEP,CApEgB,QAoEhB,EApE0B,CAoE1B,EApE6B,SAoE7B,CAAA,EAAA;;;;;AAGP,KAhEO,KAgEP,CAAA,iBA/Dc,OA+Dd,qBA9DgB,YAAY,4BACd,QAAQ,cAAc,QAAQ,6BAEnC,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,8BACE,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ;WAEtC;aACE;SACJ,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,wBACE,4BACE,YAAY,4BACd,QAAQ,cAAc,QAAQ;;;;wBAK3B,mBAAmB,mBAC5B,kBACD,YAAY,UAAU,oBAChB,eACJ,cAAc,YAAY,OACnC"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;AAOA;;;KAAY,QAAA;;AAMZ;;;KAAY,OAAA,uBAA8B,QAAA;;AAK1C;;KAAY,IAAA,kCAAsC,KAAA;;;AAiBlD;;;;;;;;;;;;;KAAY,aAAA,eAA4B,IAAA,GAAO,IAAA,IAAQ,MAAA,CAAO,KAAA,EAAO,KAAA;;;;;AAiBrE;;;;;;;;;;;KAAY,SAAA,yCAAkD,MAAA,CAC5D,YAAA,EACA,gBAAA;;;AAiBF;;;;;;;;;;AAOA;;KAPY,OAAA,oBAA2B,SAAA,kBACzB,UAAA;;;;KAMF,aAAA,oBACS,SAAA,6BACQ,UAAA,IACzB,gBAAA,CAAiB,WAAA,CAAY,UAAA,CAAW,YAAA;;;;KAKhC,WAAA,kBACO,MAAA,6CACD,QAAA,IACd,QAAA,CAAS,CAAA;;;;KAKD,QAAA,kBACO,OAAA,2DAGd,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,SAAA,KAAc,QAAA;;;;KAKrD,WAAA,kBACO,OAAA,2DAGd,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,SAAA;;;;KAKvC,eAAA,kBACO,OAAA,kEAIX,OAAA,IAAW,QAAA,CAAS,QAAA,EAAU,CAAA,EAAG,SAAA;;;;;KAO7B,KAAA,kBACO,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,mBAEnC,UAAA,SAAmB,QAAA,GAAW,eAAA,CACxC,QAAA,EACA,WAAA,CAAY,QAAA,EAAU,CAAA,GACtB,aAAA,CAAc,UAAA,EAAY,CAAA;;;;;;;;;;;AA7B9B;;;;UA+CiB,YAAA,kBACE,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA;EAE/C,OAAA,EAAS,QAAA;EACT,SAAA,EAAW,UAAA;EACX,KAAA,EAAO,KAAA,CAAM,QAAA,EAAU,UAAA,EAAY,QAAA;AAAA;;;;;;;;;AA7CrC;;;;;;;UA+DiB,MAAA,kBACE,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA;;;;EAK/C,GAAA,iBAAoB,UAAA,SAAmB,QAAA,EACrC,OAAA,EAAS,QAAA,EACT,MAAA,EAAQ,WAAA,CAAY,QAAA,EAAU,CAAA,GAC9B,YAAA,EAAc,CAAA,EACd,QAAA,EAAU,aAAA,CAAc,UAAA,EAAY,CAAA,IACnC,OAAA;AAAA"}

package/dist/types.mjs

@@ -1 +1 @@
-export {  };
+export {};

package/package.json

@@ -1,52 +1,43 @@
 {
   "name": "@zap-studio/permit",
-  "version": "0.2.1",
-  "type": "module",
-  "license": "MIT",
+  "version": "0.3.0",
   "private": false,
-  "homepage": "https://www.zapstudio.dev/packages/permit",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/zap-studio/monorepo.git",
-    "directory": "packages/permit"
-  },
   "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
   "keywords": [
+    "abac",
+    "access-control",
+    "arktype",
     "authorization",
     "permissions",
-    "access-control",
-    "rbac",
-    "abac",
     "policy",
-    "typescript",
+    "rbac",
     "standard-schema",
-    "zod",
+    "typescript",
     "valibot",
-    "arktype"
+    "zod"
   ],
-  "publishConfig": {
-    "access": "public"
+  "homepage": "https://www.zapstudio.dev/packages/permit",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zap-studio/monorepo.git",
+    "directory": "packages/permit"
+  },
+  "bin": {
+    "intent": "./bin/intent.js"
   },
   "files": [
     "dist",
     "CHANGELOG.md",
-    "LICENSE.md",
-    "README.md"
+    "LICENSE",
+    "README.md",
+    "skills",
+    "bin",
+    "!skills/_artifacts"
   ],
-  "dependencies": {
-    "@standard-schema/spec": "^1.1.0",
-    "@zap-studio/validation": "0.3.1"
-  },
-  "devDependencies": {
-    "@types/node": "^25.0.2",
-    "@vitest/coverage-v8": "^4.0.15",
-    "tsdown": "^0.18.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.18",
-    "@zap-studio/vitest-config": "0.0.0",
-    "@zap-studio/typescript-config": "0.0.0",
-    "@zap-studio/tsdown-config": "0.0.0"
-  },
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.mts",
   "exports": {
     ".": "./dist/index.mjs",
     "./errors": "./dist/errors.mjs",
@@ -54,13 +45,23 @@
     "./types": "./dist/types.mjs",
     "./package.json": "./package.json"
   },
-  "main": "./dist/index.mjs",
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.mts",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@zap-studio/validation": "0.3.2"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.2",
+    "vite-plus": "^0.1.15",
+    "@zap-studio/typescript": "0.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "scripts": {
-    "build": "tsdown --config tsdown.config.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest --watch"
+    "build": "vp pack",
+    "test": "vp test run",
+    "test:watch": "vp test watch"
   }
 }

package/skills/zap-permit-policy-authoring/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: zap-permit-policy-authoring
+description: >
+  Author typed authorization policies with @zap-studio/permit using
+  createPolicy, allow/deny/when, condition combinators, has/hasRole,
+  and mergePolicies vs mergePoliciesAny decision strategies.
+type: core
+library: "@zap-studio/permit"
+library_version: "0.2.1"
+sources:
+  - "zap-studio/monorepo:packages/permit/README.md"
+  - "zap-studio/monorepo:packages/permit/src/index.ts"
+  - "zap-studio/monorepo:packages/permit/src/types.ts"
+---
+
+# @zap-studio/permit — Policy Authoring
+
+## Setup
+
+```ts
+import { z } from "zod";
+import { createPolicy, allow, when } from "@zap-studio/permit";
+import type { Resources, Actions } from "@zap-studio/permit/types";
+
+const resources = {
+  post: z.object({ id: z.string(), authorId: z.string() }),
+} satisfies Resources;
+
+const actions = {
+  post: ["read", "write"],
+} as const satisfies Actions<typeof resources>;
+
+type AppContext = { user: { id: string; role: "user" | "admin" } };
+
+const policy = createPolicy<AppContext>({
+  resources,
+  actions,
+  rules: {
+    post: {
+      read: allow(),
+      write: when((ctx, _action, post) => ctx.user.id === post.authorId),
+    },
+  },
+});
+```
+
+## Core Patterns
+
+### Compose conditions with `and`, `or`, and `not`
+
+```ts
+import { when, and, or, not } from "@zap-studio/permit";
+
+const canEdit = when(
+  and(
+    (ctx, _action, post) => ctx.user.id === post.authorId,
+    not((_ctx, _action, post) => post.locked === true),
+  ),
+);
+
+const canRead = when(
+  or(
+    (_ctx, _action, post) => post.visibility === "public",
+    (ctx, _action, post) => ctx.user.id === post.authorId,
+  ),
+);
+```
+
+### Add role inheritance checks with `hasRole`
+
+```ts
+import { when, hasRole } from "@zap-studio/permit";
+
+const hierarchy = {
+  guest: [],
+  user: ["guest"],
+  admin: ["user"],
+} as const;
+
+const adminOnly = when(hasRole("admin", hierarchy));
+```
+
+### Choose merge strategy explicitly
+
+```ts
+import { mergePolicies, mergePoliciesAny } from "@zap-studio/permit";
+
+const strict = mergePolicies(basePolicy, tenantPolicy); // all must allow
+const permissive = mergePoliciesAny(basePolicy, temporaryOverridePolicy); // any can allow
+```
+
+## Common Mistakes
+
+### HIGH Using action missing from actions map
+
+Wrong:
+
+```ts
+await policy.can(ctx, "publish", "post", post);
+```
+
+Correct:
+
+```ts
+const actions = {
+  post: ["read", "write", "publish"],
+} as const;
+
+await policy.can(ctx, "publish", "post", post);
+```
+
+`can()` first checks `actions[resourceType]`; missing actions always resolve to `false`.
+
+Source: zap-studio/monorepo:packages/permit/src/index.ts
+
+### HIGH Assuming invalid resources still hit rule function
+
+Wrong:
+
+```ts
+await policy.can(ctx, "write", "post", { id: 123 } as any);
+```
+
+Correct:
+
+```ts
+await policy.can(ctx, "write", "post", {
+  id: "123",
+  authorId: ctx.user.id,
+});
+```
+
+Resource validation runs before policy evaluation; invalid payloads short-circuit to deny.
+
+Source: zap-studio/monorepo:packages/permit/src/index.ts
+
+### MEDIUM Expecting `mergePoliciesAny` to enforce deny-overrides
+
+Wrong:
+
+```ts
+const merged = mergePoliciesAny(basePolicy, restrictivePolicy);
+// expecting restrictivePolicy to always win
+```
+
+Correct:
+
+```ts
+const merged = mergePolicies(basePolicy, restrictivePolicy);
+// deny-overrides behavior
+```
+
+`mergePoliciesAny` returns allowed when any policy allows; use `mergePolicies` for strict composition.
+
+Source: zap-studio/monorepo:packages/permit/src/index.ts
+
+See also: zap-validation-standard-schema/SKILL.md — invalid resource payload behavior.