@zap-studio/permit 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## @zap-studio/permit@0.3.4
+
+### Tree-shakeable root re-exports
+
+The package root now re-exports the full public API, so everything can be imported from `@zap-studio/permit` directly, including `PolicyError`, `assertNever`, and all public types. All exports are side-effect free and tree-shakeable; granular subpath imports keep working.
+
+- The implementation moved out of the entrypoint into two new subpaths: `./conditions` (`allow`, `deny`, `when`, `and`, `or`, `not`, `has`, `hasRole`, `collectInheritedRoles`) and `./policy` (`createPolicy`, `mergePolicies`, `mergePoliciesAny`).
+
+## @zap-studio/permit@0.3.3
+
+### Migrate to ultracite lint/format
+
+Internal formatting and lint cleanup only. No public API or behavior change.
+
 # @zap-studio/permit
 
 ## 0.3.2
@@ -29,11 +43,9 @@
 
 - fe60f55: Change `policy.can()` to use a single permission string plus the resource object.
 
-  `policy.can(ctx, "read", "post", post)` is replaced by
-  `policy.can(ctx, "post:read", post)`.
+  `policy.can(ctx, "read", "post", post)` is replaced by `policy.can(ctx, "post:read", post)`.
 
-  This is a breaking API change in the `0.x` line. Docs and examples now use the
-  new permission-string format consistently.
+  This is a breaking API change in the `0.x` line. Docs and examples now use the new permission-string format consistently.
 
 ## 0.2.2
 

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Alexandre Trotel
+Copyright (c) 2026 alexandretrotel
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -14,8 +14,6 @@ A type-safe, declarative authorization library for TypeScript with [Standard Sch
 ## Installation
 
 ```bash
-pnpm add @zap-studio/permit
-# or
 npm install @zap-studio/permit
 ```
 
@@ -24,7 +22,7 @@ npm install @zap-studio/permit
 ```ts
 import { z } from "zod";
 import { createPolicy, allow, deny, when } from "@zap-studio/permit";
-import type { Resources, Actions } from "@zap-studio/permit/types";
+import type { Resources, Actions } from "@zap-studio/permit";
 
 // 1. Define your resource schemas
 const resources = {
@@ -126,7 +124,7 @@ Returns a condition that is true only if all conditions are true.
 ```ts
 const isOwnerAndPublished = and(
   (ctx, action, resource) => ctx.user.id === resource.authorId,
-  (ctx, action, resource) => resource.status === "published",
+  (ctx, action, resource) => resource.status === "published"
 );
 ```
 
@@ -137,7 +135,7 @@ Returns a condition that is true if any condition is true.
 ```ts
 const isOwnerOrAdmin = or(
   (ctx, action, resource) => ctx.user.id === resource.authorId,
-  (ctx, action, resource) => ctx.user.role === "admin",
+  (ctx, action, resource) => ctx.user.role === "admin"
 );
 ```
 
@@ -146,7 +144,9 @@ const isOwnerOrAdmin = or(
 Returns a condition that negates another condition.
 
 ```ts
-const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+const isNotOwner = not(
+  (ctx, action, resource) => ctx.user.id === resource.authorId
+);
 ```
 
 ### Context Helpers
@@ -266,3 +266,15 @@ const resources = {
   post: type({ id: "string" }),
 } satisfies Resources;
 ```
+
+## Runtime Support
+
+| Runtime            | Minimum version                                  |
+| ------------------ | ------------------------------------------------ |
+| Node.js            | 18.0.0                                           |
+| Bun                | 1.0.0                                            |
+| Deno               | 1.42                                             |
+| Cloudflare Workers | Any current release                              |
+| Browsers           | Latest evergreen (Chrome, Edge, Firefox, Safari) |
+
+The package ships standard ESM only and uses no runtime-specific APIs. Deno 1.42 is the first release that can install packages from JSR (`deno add jsr:@zap-studio/permit`).

package/dist/conditions.d.ts

@@ -0,0 +1,177 @@
+import { ConditionFn, Context, PolicyFn, Role, RoleHierarchy } from "./types.js";
+//#region src/conditions.d.ts
+/**
+ * Returns a policy function that always allows the action.
+ *
+ * @example
+ * ```ts
+ * const policy = createPolicy({
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: {
+ *       read: allow(), // Always allow reading posts
+ *     },
+ *   },
+ * });
+ * ```
+ */
+declare const allow: <TContext extends Context, TAction extends string = string, TResource = unknown>() => PolicyFn<TContext, TAction, TResource>;
+/**
+ * Returns a policy function that always denies the action.
+ *
+ * @example
+ * ```ts
+ * const policy = createPolicy({
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: {
+ *       delete: deny(), // Never allow deleting posts
+ *     },
+ *   },
+ * });
+ * ```
+ */
+declare const deny: <TContext extends Context, TAction extends string = string, TResource = unknown>() => PolicyFn<TContext, TAction, TResource>;
+/**
+ * Returns a policy function that allows or denies based on a condition.
+ *
+ * @example
+ * ```ts
+ * const policy = createPolicy({
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: {
+ *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+ *     },
+ *   },
+ * });
+ * ```
+ */
+declare const when: <TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>) => PolicyFn<TContext, TAction, TResource>;
+/**
+ * Returns a condition function that returns `true` if all conditions are met.
+ *
+ * @example
+ * ```ts
+ * const isOwnerAndPublished = and(
+ *   (ctx, action, resource) => ctx.user.id === resource.authorId,
+ *   (ctx, action, resource) => resource.status === "published"
+ * );
+ *
+ * rules: {
+ *   post: {
+ *     delete: when(isOwnerAndPublished),
+ *   },
+ * }
+ * ```
+ */
+declare const and: <TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]) => ConditionFn<TContext, TAction, TResource>;
+/**
+ * Returns a condition function that returns `true` if any condition is met.
+ *
+ * @example
+ * ```ts
+ * const isOwnerOrAdmin = or(
+ *   (ctx, action, resource) => ctx.user.id === resource.authorId,
+ *   (ctx, action, resource) => ctx.user.role === "admin"
+ * );
+ *
+ * rules: {
+ *   post: {
+ *     write: when(isOwnerOrAdmin),
+ *   },
+ * }
+ * ```
+ */
+declare const or: <TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]) => ConditionFn<TContext, TAction, TResource>;
+/**
+ * Returns a condition function that negates another condition.
+ *
+ * @example
+ * ```ts
+ * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+ *
+ * rules: {
+ *   post: {
+ *     like: when(isNotOwner), // Can only like posts you don't own
+ *   },
+ * }
+ * ```
+ */
+declare const not: <TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>) => ConditionFn<TContext, TAction, TResource>;
+/**
+ * Returns a condition function that checks if a context property equals a value.
+ *
+ * @example
+ * ```ts
+ * rules: {
+ *   post: {
+ *     write: when(has("role", "admin")), // Only admins can write
+ *   },
+ * }
+ * ```
+ */
+declare const has: <TContext extends Context, K extends keyof TContext>(key: K, value: TContext[K]) => ConditionFn<TContext>;
+/**
+ * Collects all roles including inherited ones from a role hierarchy.
+ *
+ * @example
+ * ```ts
+ * type Role = "guest" | "user" | "admin";
+ *
+ * const hierarchy: RoleHierarchy<Role> = {
+ *   guest: [],
+ *   user: ["guest"],
+ *   admin: ["user"],
+ * };
+ *
+ * collectInheritedRoles(["admin"], hierarchy);
+ * // Returns: Set { "admin", "user", "guest" }
+ * ```
+ */
+declare const collectInheritedRoles: <TRole extends Role = Role>(roles: TRole[], hierarchy: RoleHierarchy<TRole>) => Set<TRole>;
+/**
+ * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.
+ */
+interface HasRoleFn {
+  <TContext extends {
+    role: Role | Role[];
+  }, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
+  <TContext extends {
+    role: TRole | TRole[];
+  }, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
+}
+/**
+ * Returns a condition function that checks if the user has a specific role.
+ * Supports role hierarchy for inherited permissions.
+ *
+ * @example
+ * ```ts
+ * // Without hierarchy
+ * rules: {
+ *   post: {
+ *     delete: when(hasRole("admin")),
+ *   },
+ * }
+ *
+ * // With hierarchy
+ * const hierarchy = {
+ *   guest: [],
+ *   user: ["guest"],
+ *   admin: ["user"],
+ * };
+ *
+ * rules: {
+ *   post: {
+ *     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
+ *   },
+ * }
+ * ```
+ */
+declare const hasRole: HasRoleFn;
+//#endregion
+export { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when };
+//# sourceMappingURL=conditions.d.ts.map

package/dist/conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.d.ts","names":[],"sources":["../src/conditions.ts"],"mappings":";;;;;;;;;;;;;;;;;;cA+Ba,QAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBpB,MAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBvB,KAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;cAkBvB,MAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,YAAY,UAAU,SAAS;;;;;;;;;;;;;cAgBvB,MACV,iBAAiB,SAAS,gBAAgB,UACzC,KAAK,GACL,OAAO,SAAS,OACf,YAAY;;;;;;;;;;;;;;;;;;cAqBJ,wBAAyB,cAAc,OAAO,MACzD,OAAO,SACP,WAAW,cAAc,WACxB,IAAI;;;;UAwBG;GAEN;IAAmB,MAAM,OAAO;KAChC,iCACA,qBAEA,MAAM,OACL,YAAY,UAAU,SAAS;GAEhC;IAAmB,MAAM,QAAQ;KACjC,iCACA,qBACA,cAAc,OAAO,MAErB,MAAM,OACN,WAAW,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BvB,SAAS"}

package/dist/conditions.js

@@ -0,0 +1,180 @@
+//#region src/conditions.ts
+/**
+* Returns a policy function that always allows the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: allow(), // Always allow reading posts
+*     },
+*   },
+* });
+* ```
+*/
+const allow = () => () => "allow";
+/**
+* Returns a policy function that always denies the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       delete: deny(), // Never allow deleting posts
+*     },
+*   },
+* });
+* ```
+*/
+const deny = () => () => "deny";
+/**
+* Returns a policy function that allows or denies based on a condition.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+* ```
+*/
+const when = (condition) => (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
+/**
+* Returns a condition function that returns `true` if all conditions are met.
+*
+* @example
+* ```ts
+* const isOwnerAndPublished = and(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => resource.status === "published"
+* );
+*
+* rules: {
+*   post: {
+*     delete: when(isOwnerAndPublished),
+*   },
+* }
+* ```
+*/
+const and = (...conditions) => (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
+/**
+* Returns a condition function that returns `true` if any condition is met.
+*
+* @example
+* ```ts
+* const isOwnerOrAdmin = or(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => ctx.user.role === "admin"
+* );
+*
+* rules: {
+*   post: {
+*     write: when(isOwnerOrAdmin),
+*   },
+* }
+* ```
+*/
+const or = (...conditions) => (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
+/**
+* Returns a condition function that negates another condition.
+*
+* @example
+* ```ts
+* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+*
+* rules: {
+*   post: {
+*     like: when(isNotOwner), // Can only like posts you don't own
+*   },
+* }
+* ```
+*/
+const not = (condition) => (context, action, resource) => !condition(context, action, resource);
+/**
+* Returns a condition function that checks if a context property equals a value.
+*
+* @example
+* ```ts
+* rules: {
+*   post: {
+*     write: when(has("role", "admin")), // Only admins can write
+*   },
+* }
+* ```
+*/
+const has = (key, value) => (context) => context[key] === value;
+/**
+* Collects all roles including inherited ones from a role hierarchy.
+*
+* @example
+* ```ts
+* type Role = "guest" | "user" | "admin";
+*
+* const hierarchy: RoleHierarchy<Role> = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* collectInheritedRoles(["admin"], hierarchy);
+* // Returns: Set { "admin", "user", "guest" }
+* ```
+*/
+const collectInheritedRoles = (roles, hierarchy) => {
+	const inherited = /* @__PURE__ */ new Set();
+	const add = (role) => {
+		if (inherited.has(role)) return;
+		inherited.add(role);
+		const parents = hierarchy[role] ?? [];
+		for (const parent of parents) add(parent);
+	};
+	for (const role of roles) add(role);
+	return inherited;
+};
+/**
+* Returns a condition function that checks if the user has a specific role.
+* Supports role hierarchy for inherited permissions.
+*
+* @example
+* ```ts
+* // Without hierarchy
+* rules: {
+*   post: {
+*     delete: when(hasRole("admin")),
+*   },
+* }
+*
+* // With hierarchy
+* const hierarchy = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* rules: {
+*   post: {
+*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
+*   },
+* }
+* ```
+*/
+const hasRole = (role, hierarchy) => (context) => {
+	const userRoles = Array.isArray(context.role) ? context.role : [context.role];
+	if (hierarchy === void 0) return userRoles.includes(role);
+	return collectInheritedRoles(userRoles, hierarchy).has(role);
+};
+//#endregion
+export { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when };
+
+//# sourceMappingURL=conditions.js.map

package/dist/conditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.js","names":[],"sources":["../src/conditions.ts"],"sourcesContent":["/**\n * Policy and condition combinators: `allow`, `deny`, `when`, boolean\n * composition, and role helpers.\n *\n * @module @zap-studio/permit/conditions\n */\n\nimport type {\n  ConditionFn,\n  Context,\n  PolicyFn,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const parents = hierarchy[role] ?? [];\n    for (const parent of parents) {\n      add(parent);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.\n */\ninterface HasRoleFn {\n  <\n    TContext extends { role: Role | Role[] },\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    role: Role\n  ): ConditionFn<TContext, TAction, TResource>;\n  <\n    TContext extends { role: TRole | TRole[] },\n    TAction extends string = string,\n    TResource = unknown,\n    TRole extends Role = Role,\n  >(\n    role: TRole,\n    hierarchy: RoleHierarchy<TRole>\n  ): ConditionFn<TContext, TAction, TResource>;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;AA+BA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,UAAU,UAAU,SAAS,CAAC;EACpC,KAAK,MAAM,UAAU,SACnB,IAAI,MAAM;CAEd;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B"}

package/dist/errors.d.ts

@@ -0,0 +1,21 @@
+//#region src/errors.d.ts
+/**
+ * Error primitives for policy evaluation and configuration failures.
+ *
+ * @module @zap-studio/permit/errors
+ */
+/**
+ * Represents an error that occurs during policy evaluation or enforcement.
+ * Use this error to indicate issues related to policy logic, configuration, or execution.
+ */
+declare class PolicyError extends Error {
+  /**
+   * Creates a policy error with a human-readable message.
+   *
+   * @param message - Error message describing the policy failure.
+   */
+  constructor(message: string);
+}
+//#endregion
+export { PolicyError };
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;cAUa,oBAAoB;;;;;;EAM/B,YAAY"}

package/dist/{errors.mjs → errors.js}

@@ -1,9 +1,19 @@
 //#region src/errors.ts
 /**
+* Error primitives for policy evaluation and configuration failures.
+*
+* @module @zap-studio/permit/errors
+*/
+/**
 * Represents an error that occurs during policy evaluation or enforcement.
 * Use this error to indicate issues related to policy logic, configuration, or execution.
 */
 var PolicyError = class extends Error {
+	/**
+	* Creates a policy error with a human-readable message.
+	*
+	* @param message - Error message describing the policy failure.
+	*/
 	constructor(message) {
 		super(message);
 		this.name = "PolicyError";
@@ -12,4 +22,4 @@ var PolicyError = class extends Error {
 //#endregion
 export { PolicyError };
 
-//# sourceMappingURL=errors.mjs.map
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for policy evaluation and configuration failures.\n *\n * @module @zap-studio/permit/errors\n */\n\n/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  /**\n   * Creates a policy error with a human-readable message.\n   *\n   * @param message - Error message describing the policy failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,IAAa,cAAb,cAAiC,MAAM;;;;;;CAMrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/helpers.d.ts

@@ -0,0 +1,32 @@
+//#region src/helpers.d.ts
+/**
+ * Helper utilities for permit consumers.
+ *
+ * @module @zap-studio/permit/helpers
+ */
+/**
+ * Ensures that a value of type `never` is actually never encountered at runtime.
+ * This is useful for exhaustive checks on discriminated unions.
+ *
+ * @example
+ * ```ts
+ * type Action = 'read' | 'write'
+ *
+ * function performAction(action: Action) {
+ *   switch (action) {
+ *     case 'read':
+ *       console.log('Reading...')
+ *       break
+ *     case 'write':
+ *       console.log('Writing...')
+ *       break
+ *     default:
+ *       assertNever(action) // TypeScript will error if a new Action is added but not handled
+ *   }
+ * }
+ * ```
+ */
+declare const assertNever: (value: never) => never;
+//#endregion
+export { assertNever };
+//# sourceMappingURL=helpers.d.ts.map

package/dist/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","names":[],"sources":["../src/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4Ba,cAAe"}

package/dist/{helpers.mjs → helpers.js}

@@ -1,5 +1,10 @@
 //#region src/helpers.ts
 /**
+* Helper utilities for permit consumers.
+*
+* @module @zap-studio/permit/helpers
+*/
+/**
 * Ensures that a value of type `never` is actually never encountered at runtime.
 * This is useful for exhaustive checks on discriminated unions.
 *
@@ -21,10 +26,10 @@
 * }
 * ```
 */
-function assertNever(value) {
+const assertNever = (value) => {
 	throw new Error(`Unexpected value: ${String(value)}`);
-}
+};
 //#endregion
 export { assertNever };
 
-//# sourceMappingURL=helpers.mjs.map
+//# sourceMappingURL=helpers.js.map

package/dist/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Helper utilities for permit consumers.\n *\n * @module @zap-studio/permit/helpers\n */\n\n/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${String(value)}`);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,eAAe,UAAwB;CAClD,MAAM,IAAI,MAAM,qBAAqB,OAAO,KAAK,GAAG;AACtD"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules } from "./types.js";
+import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
+import { PolicyError } from "./errors.js";
+import { assertNever } from "./helpers.js";
+import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
+export { type ActionPolicyMap, type Actions, type ConditionFn, type Context, type Decision, type InferAction, type InferPermission, type InferResource, type PermitConfig, type Policy, PolicyError, type PolicyFn, type Resources, type Role, type RoleHierarchy, type Rules, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };

package/dist/index.js

@@ -0,0 +1,5 @@
+import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
+import { PolicyError } from "./errors.js";
+import { assertNever } from "./helpers.js";
+import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
+export { PolicyError, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };