@zap-studio/permit 0.3.2 → 0.3.3

package/dist/index.mjs

@@ -17,9 +17,7 @@ import { createStandardValidator } from "@zap-studio/validation";
 * });
 * ```
 */
-function allow() {
-	return () => "allow";
-}
+const allow = () => () => "allow";
 /**
 * Returns a policy function that always denies the action.
 *
@@ -36,9 +34,7 @@ function allow() {
 * });
 * ```
 */
-function deny() {
-	return () => "deny";
-}
+const deny = () => () => "deny";
 /**
 * Returns a policy function that allows or denies based on a condition.
 *
@@ -55,9 +51,7 @@ function deny() {
 * });
 * ```
 */
-function when(condition) {
-	return (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
-}
+const when = (condition) => (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
 /**
 * Returns a condition function that returns `true` if all conditions are met.
 *
@@ -75,9 +69,7 @@ function when(condition) {
 * }
 * ```
 */
-function and(...conditions) {
-	return (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
-}
+const and = (...conditions) => (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
 /**
 * Returns a condition function that returns `true` if any condition is met.
 *
@@ -95,9 +87,7 @@ function and(...conditions) {
 * }
 * ```
 */
-function or(...conditions) {
-	return (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
-}
+const or = (...conditions) => (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
 /**
 * Returns a condition function that negates another condition.
 *
@@ -112,9 +102,7 @@ function or(...conditions) {
 * }
 * ```
 */
-function not(condition) {
-	return (context, action, resource) => !condition(context, action, resource);
-}
+const not = (condition) => (context, action, resource) => !condition(context, action, resource);
 /**
 * Returns a condition function that checks if a context property equals a value.
 *
@@ -127,9 +115,7 @@ function not(condition) {
 * }
 * ```
 */
-function has(key, value) {
-	return (context) => context[key] === value;
-}
+const has = (key, value) => (context) => context[key] === value;
 /**
 * Collects all roles including inherited ones from a role hierarchy.
 *
@@ -147,24 +133,61 @@ function has(key, value) {
 * // Returns: Set { "admin", "user", "guest" }
 * ```
 */
-function collectInheritedRoles(roles, hierarchy) {
+const collectInheritedRoles = (roles, hierarchy) => {
 	const inherited = /* @__PURE__ */ new Set();
-	function add(role) {
-		if (!inherited.has(role)) {
-			inherited.add(role);
-			(hierarchy[role] ?? []).forEach(add);
-		}
-	}
-	roles.forEach(add);
+	const add = (role) => {
+		if (inherited.has(role)) return;
+		inherited.add(role);
+		const parents = hierarchy[role] ?? [];
+		for (const parent of parents) add(parent);
+	};
+	for (const role of roles) add(role);
 	return inherited;
-}
-function hasRole(role, hierarchy) {
-	return (context) => {
-		const userRoles = Array.isArray(context.role) ? context.role : [context.role];
-		if (!hierarchy) return userRoles.includes(role);
-		return collectInheritedRoles(userRoles, hierarchy).has(role);
+};
+/**
+* Returns a condition function that checks if the user has a specific role.
+* Supports role hierarchy for inherited permissions.
+*
+* @example
+* ```ts
+* // Without hierarchy
+* rules: {
+*   post: {
+*     delete: when(hasRole("admin")),
+*   },
+* }
+*
+* // With hierarchy
+* const hierarchy = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* rules: {
+*   post: {
+*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
+*   },
+* }
+* ```
+*/
+const hasRole = (role, hierarchy) => (context) => {
+	const userRoles = Array.isArray(context.role) ? context.role : [context.role];
+	if (hierarchy === void 0) return userRoles.includes(role);
+	return collectInheritedRoles(userRoles, hierarchy).has(role);
+};
+/**
+* Splits a typed `resource:action` permission string into its parts.
+* Returns `null` when the string is malformed (missing/empty part or extra segments).
+*/
+const parsePermission = (permission) => {
+	const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
+	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0) return null;
+	return {
+		action: actionValue,
+		resourceType: resourceTypeValue
 	};
-}
+};
 /**
 * Creates a type-safe policy from resource schemas, actions, and rules.
 *
@@ -220,12 +243,12 @@ function hasRole(role, hierarchy) {
 * await policy.can(ctx, "post:write", post); // depends on ctx.user.id
 * ```
 */
-function createPolicy(config) {
+const createPolicy = (config) => {
 	const { rules, resources, actions } = config;
 	const validators = /* @__PURE__ */ new Map();
 	const getValidatedResource = async (resourceType, resource) => {
 		const validator = validators.get(resourceType);
-		if (!validator) return null;
+		if (validator === void 0) return null;
 		try {
 			const result = await validator(resource);
 			if (result.issues) return null;
@@ -235,41 +258,42 @@ function createPolicy(config) {
 			return null;
 		}
 	};
-	const parsePermission = (permission) => {
-		const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
-		if (!resourceTypeValue || !actionValue || rest.length > 0) return null;
-		return {
-			action: actionValue,
-			resourceType: resourceTypeValue
-		};
-	};
 	const hasAllowedAction = (resourceType, action) => actions[resourceType]?.includes(action) ?? false;
 	const evaluatePolicy = (context, resourceType, action, resource) => {
 		const policyFn = rules[resourceType]?.[action];
-		if (!policyFn) return false;
+		if (policyFn === void 0) return false;
 		try {
 			return policyFn(context, action, resource) === "allow";
 		} catch (error) {
-			console.warn(`Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`);
+			console.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`);
 			return false;
 		}
 	};
 	for (const key of Object.keys(resources)) {
 		const schema = resources[key];
-		if (!schema) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
+		if (schema === void 0) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
 		const validator = createStandardValidator(schema);
-		validators.set(key, async (input) => validator(input));
+		validators.set(key, async (input) => await validator(input));
 	}
 	return { async can(context, permission, resource) {
 		const parsedPermission = parsePermission(permission);
-		if (!parsedPermission) return false;
+		if (parsedPermission === null) return false;
 		const { action, resourceType } = parsedPermission;
 		if (!hasAllowedAction(resourceType, action)) return false;
 		const validatedResource = await getValidatedResource(resourceType, resource);
-		if (!validatedResource) return false;
+		if (validatedResource === null) return false;
 		return evaluatePolicy(context, resourceType, action, validatedResource);
 	} };
-}
+};
+const mergePoliciesWithStrategy = (policies, strategy) => ({ async can(context, permission, resource) {
+	if (policies.length === 0) return false;
+	for (const policy of policies) {
+		const allowed = await policy.can(context, permission, resource);
+		if (strategy === "allow-overrides" && allowed) return true;
+		if (strategy === "deny-overrides" && !allowed) return false;
+	}
+	return strategy === "deny-overrides";
+} });
 /**
 * Merges multiple policies into one using "deny-overrides" strategy.
 * If any policy denies, the merged policy denies. All must allow for the result to allow.
@@ -283,9 +307,7 @@ function createPolicy(config) {
 * // Both policies must allow for the action to be permitted
 * ```
 */
-function mergePolicies(...policies) {
-	return mergePoliciesWithStrategy(policies, "deny-overrides");
-}
+const mergePolicies = (...policies) => mergePoliciesWithStrategy(policies, "deny-overrides");
 /**
 * Merges multiple policies into one using "allow-overrides" strategy.
 * If any policy allows, the merged policy allows. All must deny for the result to deny.
@@ -299,20 +321,7 @@ function mergePolicies(...policies) {
 * // If either policy allows, the action is permitted
 * ```
 */
-function mergePoliciesAny(...policies) {
-	return mergePoliciesWithStrategy(policies, "allow-overrides");
-}
-function mergePoliciesWithStrategy(policies, strategy) {
-	return { async can(context, permission, resource) {
-		if (!policies.length) return false;
-		for (const policy of policies) {
-			const allowed = await policy.can(context, permission, resource);
-			if (strategy === "allow-overrides" && allowed) return true;
-			if (strategy === "deny-overrides" && !allowed) return false;
-		}
-		return strategy === "deny-overrides";
-	} };
-}
+const mergePoliciesAny = (...policies) => mergePoliciesWithStrategy(policies, "allow-overrides");
 //#endregion
 export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
 

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport function allow<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"allow\";\n}\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport function deny<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"deny\";\n}\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport function when<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(condition: ConditionFn<TContext, TAction, TResource>): PolicyFn<TContext, TAction, TResource> {\n  return (context, action, resource) => (condition(context, action, resource) ? \"allow\" : \"deny\");\n}\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport function and<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport function or<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport function not<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  condition: ConditionFn<TContext, TAction, TResource>,\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) => !condition(context, action, resource);\n}\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport function has<TContext extends Context, K extends keyof TContext>(\n  key: K,\n  value: TContext[K],\n): ConditionFn<TContext> {\n  return (context) => context[key] === value;\n}\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport function collectInheritedRoles<TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>,\n): Set<TRole> {\n  const inherited = new Set<TRole>();\n\n  function add(role: TRole) {\n    if (!inherited.has(role)) {\n      inherited.add(role);\n      const parents = hierarchy[role] ?? [];\n      parents.forEach(add); // recursively add parent roles\n    }\n  }\n\n  roles.forEach(add);\n  return inherited;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: TRole | TRole[] },\n  TAction extends string = string,\n  TResource = unknown,\n  TRole extends Role = Role,\n>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role, hierarchy?: RoleHierarchy<Role>): ConditionFn<TContext, TAction, TResource> {\n  return (context) => {\n    const userRoles = Array.isArray(context.role) ? context.role : [context.role];\n\n    if (!hierarchy) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n}\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport function createPolicy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(config: PermitConfig<TContext, TResources, TActions>): Policy<TContext, TResources, TActions> {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>,\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (!validator) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value as InferResource<TResources, K>;\n    } catch (error) {\n      console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);\n      return null;\n    }\n  };\n\n  const parsePermission = <K extends keyof TResources & keyof TActions>(\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n  ): { action: InferAction<TActions, K>; resourceType: K } | null => {\n    const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n    if (!resourceTypeValue || !actionValue || rest.length > 0) {\n      return null;\n    }\n\n    return {\n      action: actionValue as InferAction<TActions, K>,\n      resourceType: resourceTypeValue as K,\n    };\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>,\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>,\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (!policyFn) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`,\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as Array<keyof TResources>) {\n    const schema = resources[key];\n    if (!schema) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission(permission);\n      if (!parsedPermission) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(resourceType, resource);\n      if (!validatedResource) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport function mergePolicies<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return mergePoliciesWithStrategy(policies, \"deny-overrides\");\n}\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport function mergePoliciesAny<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return mergePoliciesWithStrategy(policies, \"allow-overrides\");\n}\n\nfunction mergePoliciesWithStrategy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\",\n): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        const allowed = await policy.can(context, permission, resource);\n\n        if (strategy === \"allow-overrides\" && allowed) {\n          return true;\n        }\n        if (strategy === \"deny-overrides\" && !allowed) {\n          return false;\n        }\n      }\n      return strategy === \"deny-overrides\";\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,QAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,OAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,KAId,WAA8F;AAC9F,SAAQ,SAAS,QAAQ,aAAc,UAAU,SAAS,QAAQ,SAAS,GAAG,UAAU;;;;;;;;;;;;;;;;;;;AAoB1F,SAAgB,IACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;;;;AAoBzE,SAAgB,GACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,SAAgB,IACd,WAC2C;AAC3C,SAAQ,SAAS,QAAQ,aAAa,CAAC,UAAU,SAAS,QAAQ,SAAS;;;;;;;;;;;;;;AAe7E,SAAgB,IACd,KACA,OACuB;AACvB,SAAQ,YAAY,QAAQ,SAAS;;;;;;;;;;;;;;;;;;;AAoBvC,SAAgB,sBACd,OACA,WACY;CACZ,MAAM,4BAAY,IAAI,KAAY;CAElC,SAAS,IAAI,MAAa;AACxB,MAAI,CAAC,UAAU,IAAI,KAAK,EAAE;AACxB,aAAU,IAAI,KAAK;AAEnB,IADgB,UAAU,SAAS,EAAE,EAC7B,QAAQ,IAAI;;;AAIxB,OAAM,QAAQ,IAAI;AAClB,QAAO;;AA2CT,SAAgB,QAId,MAAY,WAA4E;AACxF,SAAQ,YAAY;EAClB,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,GAAG,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAE7E,MAAI,CAAC,UACH,QAAO,UAAU,SAAS,KAAK;AAIjC,SADkB,sBAAsB,WAAW,UAAU,CAC5C,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2D9B,SAAgB,aAId,QAA8F;CAC9F,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,KAGpB;CAEH,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,aAAa;AAC9C,MAAI,CAAC,UACH,QAAO;AAET,MAAI;GACF,MAAM,SAAS,MAAM,UAAU,SAAS;AACxC,OAAI,OAAO,OACT,QAAO;AAET,UAAO,OAAO;WACP,OAAO;AACd,WAAQ,KAAK,kCAAkC,OAAO,aAAa,CAAC,IAAI,OAAO,MAAM,GAAG;AACxF,UAAO;;;CAIX,MAAM,mBACJ,eACiE;EACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,IAAI;AACvE,MAAI,CAAC,qBAAqB,CAAC,eAAe,KAAK,SAAS,EACtD,QAAO;AAGT,SAAO;GACL,QAAQ;GACR,cAAc;GACf;;CAGH,MAAM,oBACJ,cACA,WACY,QAAQ,eAAe,SAAS,OAAO,IAAI;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,gBAAgB;AACvC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;AACF,UAAO,SAAS,SAAS,QAAQ,SAAS,KAAK;WACxC,OAAO;AACd,WAAQ,KACN,+BAA+B,OAAO,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,IAAI,OAAO,MAAM,GACxF;AACD,UAAO;;;AAIX,MAAK,MAAM,OAAO,OAAO,KAAK,UAAU,EAA6B;EACnE,MAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OACH,OAAM,IAAI,YAAY,gCAAgC,OAAO,IAAI,GAAG;EAEtE,MAAM,YAAY,wBAAwB,OAAO;AACjD,aAAW,IAAI,KAAK,OAAO,UAAmB,UAAU,MAAM,CAAC;;AAGjE,QAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBAAgB,WAAW;AACpD,MAAI,CAAC,iBACH,QAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;AACjC,MAAI,CAAC,iBAAiB,cAAc,OAAO,CACzC,QAAO;EAGT,MAAM,oBAAoB,MAAM,qBAAqB,cAAc,SAAS;AAC5E,MAAI,CAAC,kBACH,QAAO;AAGT,SAAO,eAAe,SAAS,cAAc,QAAQ,kBAAkB;IAE1E;;;;;;;;;;;;;;;AAgBH,SAAgB,cAId,GAAG,UAA4F;AAC/F,QAAO,0BAA0B,UAAU,iBAAiB;;;;;;;;;;;;;;;AAgB9D,SAAgB,iBAId,GAAG,UAA4F;AAC/F,QAAO,0BAA0B,UAAU,kBAAkB;;AAG/D,SAAS,0BAKP,UACA,UACwC;AACxC,QAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,SAAS;AAE/D,OAAI,aAAa,qBAAqB,QACpC,QAAO;AAET,OAAI,aAAa,oBAAoB,CAAC,QACpC,QAAO;;AAGX,SAAO,aAAa;IAEvB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * Policy composition and evaluation utilities.\n *\n * @module @zap-studio/permit\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const parents = hierarchy[role] ?? [];\n    for (const parent of parents) {\n      add(parent);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.\n */\ninterface HasRoleFn {\n  <\n    TContext extends { role: Role | Role[] },\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    role: Role\n  ): ConditionFn<TContext, TAction, TResource>;\n  <\n    TContext extends { role: TRole | TRole[] },\n    TAction extends string = string,\n    TResource = unknown,\n    TRole extends Role = Role,\n  >(\n    role: TRole,\n    hierarchy: RoleHierarchy<TRole>\n  ): ConditionFn<TContext, TAction, TResource>;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra segments).\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TActions, K> & string}`\n): { action: InferAction<TActions, K>; resourceType: K } | null => {\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Parsed permission strings are constrained by the typed permission template.\n    resourceType: resourceTypeValue as K,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n    for (const policy of policies) {\n      // oxlint-disable-next-line no-await-in-loop -- Policies must evaluate sequentially to preserve short-circuit semantics.\n      const allowed = await policy.can(context, permission, resource);\n\n      if (strategy === \"allow-overrides\" && allowed) {\n        return true;\n      }\n      if (strategy === \"deny-overrides\" && !allowed) {\n        return false;\n      }\n    }\n    return strategy === \"deny-overrides\";\n  },\n});\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePolicies = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"deny-overrides\");\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesAny = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"allow-overrides\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwCA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,UAAU,UAAU,SAAS,CAAC;EACpC,KAAK,MAAM,UAAU,SACnB,IAAI,MAAM;CAEd;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B;;;;;AAMF,MAAM,mBAKJ,eACiE;CACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,GAEd,OAAO;CAGT,OAAO;EACL,QAAQ;EAER,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,GACzE;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,OAAO,SAAS,SAAS,QAAQ,QAAQ,MAAM;EACjD,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,GAChF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,UACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAET,KAAK,MAAM,UAAU,UAAU;EAE7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ;EAE9D,IAAI,aAAa,qBAAqB,SACpC,OAAO;EAET,IAAI,aAAa,oBAAoB,CAAC,SACpC,OAAO;CAEX;CACA,OAAO,aAAa;AACtB,EACF;;;;;;;;;;;;;;AAeA,MAAa,iBAKX,GAAG,aAEH,0BAA0B,UAAU,gBAAgB;;;;;;;;;;;;;;AAetD,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,iBAAiB"}

package/dist/types.d.mts

@@ -1,142 +1,141 @@
 import { StandardSchemaV1 } from "@zap-studio/validation";
-
 //#region src/types.d.ts
 /**
-* Represents the possible outcomes of a policy decision.
-* - "allow": The action is permitted.
-* - "deny": The action is not permitted.
-*/
+ * Represents the possible outcomes of a policy decision.
+ * - "allow": The action is permitted.
+ * - "deny": The action is not permitted.
+ */
 type Decision = "allow" | "deny";
 /**
-* Represents the context in which a policy decision is made.
-* Can include user information, environment, or any relevant data.
-*/
+ * Represents the context in which a policy decision is made.
+ * Can include user information, environment, or any relevant data.
+ */
 type Context<TContext = unknown> = TContext;
 /**
-* Represents a role within the system.
-*/
+ * Represents a role within the system.
+ */
 type Role<TRole extends string = string> = TRole;
 /**
-* Represents a role hierarchy within the system.
-* Maps each role to an array of roles it inherits from.
-*
-* @example
-* ```ts
-* type Roles = "guest" | "user" | "admin";
-*
-* const hierarchy: RoleHierarchy<Roles> = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-* ```
-*/
+ * Represents a role hierarchy within the system.
+ * Maps each role to an array of roles it inherits from.
+ *
+ * @example
+ * ```ts
+ * type Roles = "guest" | "user" | "admin";
+ *
+ * const hierarchy: RoleHierarchy<Roles> = {
+ *   guest: [],
+ *   user: ["guest"],
+ *   admin: ["user"],
+ * };
+ * ```
+ */
 type RoleHierarchy<TRole extends Role = Role> = Record<TRole, TRole[]>;
 /**
-* Type helper for defining resource schemas using Standard Schema.
-* Use with `satisfies` to ensure type safety when defining resources.
-*
-* @example
-* ```ts
-* import { z } from "zod";
-* import type { Resources } from "@zap-studio/permit/types";
-*
-* const resources = {
-*   post: z.object({ id: z.string(), authorId: z.string() }),
-*   comment: z.object({ id: z.string(), postId: z.string() }),
-* } satisfies Resources;
-* ```
-*/
+ * Type helper for defining resource schemas using Standard Schema.
+ * Use with `satisfies` to ensure type safety when defining resources.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import type { Resources } from "@zap-studio/permit/types";
+ *
+ * const resources = {
+ *   post: z.object({ id: z.string(), authorId: z.string() }),
+ *   comment: z.object({ id: z.string(), postId: z.string() }),
+ * } satisfies Resources;
+ * ```
+ */
 type Resources<TResourceKey extends string = string> = Record<TResourceKey, StandardSchemaV1>;
 /**
-* Type helper for defining actions per resource.
-* Use with `satisfies` to ensure keys match the resource definitions.
-*
-* @example
-* ```ts
-* import type { Actions } from "@zap-studio/permit/types";
-*
-* const actions = {
-*   post: ["read", "write", "delete"],
-*   comment: ["read", "write"],
-* } as const satisfies Actions<typeof resources>;
-* ```
-*/
-type Actions<TResources extends Resources> = { [K in keyof TResources]: readonly string[] };
+ * Type helper for defining actions per resource.
+ * Use with `satisfies` to ensure keys match the resource definitions.
+ *
+ * @example
+ * ```ts
+ * import type { Actions } from "@zap-studio/permit/types";
+ *
+ * const actions = {
+ *   post: ["read", "write", "delete"],
+ *   comment: ["read", "write"],
+ * } as const satisfies Actions<typeof resources>;
+ * ```
+ */
+type Actions<TResources extends Resources> = { [K in keyof TResources]: readonly string[]; };
 /**
-* Infers the output type from a Standard Schema.
-*/
+ * Infers the output type from a Standard Schema.
+ */
 type InferResource<TResources extends Resources, TResourceKey extends keyof TResources> = StandardSchemaV1.InferOutput<TResources[TResourceKey]>;
 /**
-* Infers the action union type for a specific resource.
-*/
+ * Infers the action union type for a specific resource.
+ */
 type InferAction<TActions extends Record<string, readonly string[]>, K extends keyof TActions> = TActions[K][number];
 /**
-* Infers the permission-string union for all resource/action combinations.
-*
-* @example
-* ```ts
-* type Permission = InferPermission<typeof resources, typeof actions>;
-* // "post:read" | "post:write" | "comment:read"
-* ```
-*/
-type InferPermission<TResources extends Resources, TActions extends Actions<TResources>> = { [K in keyof TResources & keyof TActions]: `${K & string}:${InferAction<TActions, K> & string}` }[keyof TResources & keyof TActions];
+ * Infers the permission-string union for all resource/action combinations.
+ *
+ * @example
+ * ```ts
+ * type Permission = InferPermission<typeof resources, typeof actions>;
+ * // "post:read" | "post:write" | "comment:read"
+ * ```
+ */
+type InferPermission<TResources extends Resources, TActions extends Actions<TResources>> = { [K in keyof TResources & keyof TActions]: `${K & string}:${InferAction<TActions, K> & string}`; }[keyof TResources & keyof TActions];
 /**
-* A function that determines whether a given action on a resource is allowed in a specific context.
-*/
+ * A function that determines whether a given action on a resource is allowed in a specific context.
+ */
 type PolicyFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => Decision;
 /**
-* A function that evaluates a condition for a given action and resource in a specific context.
-*/
+ * A function that evaluates a condition for a given action and resource in a specific context.
+ */
 type ConditionFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => boolean;
 /**
-* Maps actions to their corresponding policy functions for a specific resource.
-*/
-type ActionPolicyMap<TContext extends Context, TAction extends string = string, TResource = unknown> = { [A in TAction]?: PolicyFn<TContext, A, TResource> };
+ * Maps actions to their corresponding policy functions for a specific resource.
+ */
+type ActionPolicyMap<TContext extends Context, TAction extends string = string, TResource = unknown> = { [A in TAction]?: PolicyFn<TContext, A, TResource>; };
 /**
-* Defines the rules for each resource and action combination.
-* Each resource key maps to an object where each action key maps to a policy function.
-*/
-type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TActions, K>, InferResource<TResources, K>> };
+ * Defines the rules for each resource and action combination.
+ * Each resource key maps to an object where each action key maps to a policy function.
+ */
+type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TActions, K>, InferResource<TResources, K>>; };
 /**
-* Configuration object for creating a permit policy.
-*
-* @example
-* ```ts
-* const config: PermitConfig<MyContext> = {
-*   resources,
-*   actions,
-*   rules: {
-*     post: { read: allow(), write: deny() },
-*   },
-* };
-* ```
-*/
+ * Configuration object for creating a permit policy.
+ *
+ * @example
+ * ```ts
+ * const config: PermitConfig<MyContext> = {
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: { read: allow(), write: deny() },
+ *   },
+ * };
+ * ```
+ */
 interface PermitConfig<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> {
   actions: TActions;
   resources: TResources;
   rules: Rules<TContext, TResources, TActions>;
 }
 /**
-* Represents a policy object that can evaluate permissions.
-* The `can` method checks if a given action is permitted on a resource in a specific context.
-*
-* @example
-* ```ts
-* const policy: Policy<MyContext> = createPolicy({
-*   resources,
-*   actions,
-*   rules: { ... },
-* });
-*
-* await policy.can(ctx, "post:read", postData); // true or false
-* ```
-*/
+ * Represents a policy object that can evaluate permissions.
+ * The `can` method checks if a given action is permitted on a resource in a specific context.
+ *
+ * @example
+ * ```ts
+ * const policy: Policy<MyContext> = createPolicy({
+ *   resources,
+ *   actions,
+ *   rules: { ... },
+ * });
+ *
+ * await policy.can(ctx, "post:read", postData); // true or false
+ * ```
+ */
 interface Policy<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> {
   /**
-  * Determines if the specified action is permitted on the resource in the given context.
-  */
-  can<K extends keyof TResources & keyof TActions>(context: TContext, permission: `${K & string}:${InferAction<TActions, K> & string}`, resource: InferResource<TResources, K>): Promise<boolean>;
+   * Determines if the specified action is permitted on the resource in the given context.
+   */
+  can: <K extends keyof TResources & keyof TActions>(context: TContext, permission: `${K & string}:${InferAction<TActions, K> & string}`, resource: InferResource<TResources, K>) => Promise<boolean>;
 }
 //#endregion
 export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;AAOA;;;KAAY,QAAA;;AAMZ;;;KAAY,OAAA,uBAA8B,QAAA;;AAK1C;;KAAY,IAAA,kCAAsC,KAAA;;;AAiBlD;;;;;;;;;;;;;KAAY,aAAA,eAA4B,IAAA,GAAO,IAAA,IAAQ,MAAA,CAAO,KAAA,EAAO,KAAA;;;;;AAiBrE;;;;;;;;;;;KAAY,SAAA,yCAAkD,MAAA,CAC5D,YAAA,EACA,gBAAA;;;AAiBF;;;;;;;;;;AAOA;;KAPY,OAAA,oBAA2B,SAAA,kBACzB,UAAA;;;;KAMF,aAAA,oBACS,SAAA,6BACQ,UAAA,IACzB,gBAAA,CAAiB,WAAA,CAAY,UAAA,CAAW,YAAA;;;;KAKhC,WAAA,kBACO,MAAA,6CACD,QAAA,IACd,QAAA,CAAS,CAAA;;;;AAHb;;;;;;KAcY,eAAA,oBAAmC,SAAA,mBAA4B,OAAA,CAAQ,UAAA,mBACrE,UAAA,SAAmB,QAAA,MAAc,CAAA,aAAc,WAAA,CAAY,QAAA,EAAU,CAAA,qBAC3E,UAAA,SAAmB,QAAA;;;;KAKf,QAAA,kBACO,OAAA,2DAGd,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,SAAA,KAAc,QAAA;;;;KAKrD,WAAA,kBACO,OAAA,2DAGd,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,SAAA;;;;KAKvC,eAAA,kBACO,OAAA,kEAIX,OAAA,IAAW,QAAA,CAAS,QAAA,EAAU,CAAA,EAAG,SAAA;;;;;KAO7B,KAAA,kBACO,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,mBAEnC,UAAA,SAAmB,QAAA,GAAW,eAAA,CACxC,QAAA,EACA,WAAA,CAAY,QAAA,EAAU,CAAA,GACtB,aAAA,CAAc,UAAA,EAAY,CAAA;;;;;;;AAtC9B;;;;;;;;UAwDiB,YAAA,kBACE,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA;EAE/C,OAAA,EAAS,QAAA;EACT,SAAA,EAAW,UAAA;EACX,KAAA,EAAO,KAAA,CAAM,QAAA,EAAU,UAAA,EAAY,QAAA;AAAA;;;;;;;AAtDrC;;;;;;;;;UAwEiB,MAAA,kBACE,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA;;;;EAK/C,GAAA,iBAAoB,UAAA,SAAmB,QAAA,EACrC,OAAA,EAAS,QAAA,EACT,UAAA,KAAe,CAAA,aAAc,WAAA,CAAY,QAAA,EAAU,CAAA,cACnD,QAAA,EAAU,aAAA,CAAc,UAAA,EAAY,CAAA,IACnC,OAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;KAaY;;;;;KAMA,QAAQ,sBAAsB;;;;KAK9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;KAMF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;KAKhC,YACV,iBAAiB,mCACjB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAExB,WAAW,mBACJ,cAAc,cAAc,YAAY,UAAU,uBACpD,mBAAmB;;;;KAKf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;KAKrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;KAKvC,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;KAO7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;EAE/C,SAAS;EACT,WAAW;EACX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,UAAU,eACnD,UAAU,cAAc,YAAY,OACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zap-studio/permit",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "private": false,
   "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
   "keywords": [
@@ -43,19 +43,18 @@
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "0.3.4"
+    "@zap-studio/validation": "0.3.5"
   },
   "devDependencies": {
-    "typescript": "^6.0.3",
-    "vite-plus": "^0.1.19",
+    "tsdown": "^0.22.4",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10",
     "@zap-studio/typescript": "0.0.0"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "vp pack",
-    "test": "vp test run",
-    "test:watch": "vp test watch"
+    "build": "tsdown --config ./tsdown.config.ts"
   }
 }