@zap-studio/permit 0.3.2 → 0.3.4

package/dist/policy.d.ts

@@ -0,0 +1,89 @@
+import { Actions, Context, PermitConfig, Policy, Resources } from "./types.js";
+//#region src/policy.d.ts
+/**
+ * Creates a type-safe policy from resource schemas, actions, and rules.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+ * import type { Resources, Actions } from "@zap-studio/permit/types";
+ *
+ * // Define resource schemas
+ * const resources = {
+ *   post: z.object({
+ *     id: z.string(),
+ *     authorId: z.string(),
+ *     visibility: z.enum(["public", "private"]),
+ *   }),
+ *   comment: z.object({
+ *     id: z.string(),
+ *     postId: z.string(),
+ *     authorId: z.string(),
+ *   }),
+ * } satisfies Resources;
+ *
+ * // Define actions per resource
+ * const actions = {
+ *   post: ["read", "write", "delete"],
+ *   comment: ["read", "write"],
+ * } as const satisfies Actions<typeof resources>;
+ *
+ * // Define context type
+ * type AppContext = { user: { id: string; role: string } };
+ *
+ * // Create the policy
+ * const policy = createPolicy<AppContext>({
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: {
+ *       read: when((ctx, action, resource) => resource.visibility === "public"),
+ *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+ *       delete: deny(),
+ *     },
+ *     comment: {
+ *       read: allow(),
+ *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+ *     },
+ *   },
+ * });
+ *
+ * // Check permissions
+ * const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+ * await policy.can(ctx, "post:read", post); // true
+ * await policy.can(ctx, "post:write", post); // depends on ctx.user.id
+ * ```
+ */
+declare const createPolicy: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>) => Policy<TContext, TResources, TActions>;
+/**
+ * Merges multiple policies into one using "deny-overrides" strategy.
+ * If any policy denies, the merged policy denies. All must allow for the result to allow.
+ *
+ * @example
+ * ```ts
+ * const basePolicy = createPolicy({ ... });
+ * const adminPolicy = createPolicy({ ... });
+ *
+ * const merged = mergePolicies(basePolicy, adminPolicy);
+ * // Both policies must allow for the action to be permitted
+ * ```
+ */
+declare const mergePolicies: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+/**
+ * Merges multiple policies into one using "allow-overrides" strategy.
+ * If any policy allows, the merged policy allows. All must deny for the result to deny.
+ *
+ * @example
+ * ```ts
+ * const guestPolicy = createPolicy({ ... });
+ * const memberPolicy = createPolicy({ ... });
+ *
+ * const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+ * // If either policy allows, the action is permitted
+ * ```
+ */
+declare const mergePoliciesAny: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+//#endregion
+export { createPolicy, mergePolicies, mergePoliciesAny };
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyGa,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cA2InB,gBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cAgBnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}

package/dist/policy.js

@@ -0,0 +1,153 @@
+import { PolicyError } from "./errors.js";
+import { createStandardValidator } from "@zap-studio/validation";
+//#region src/policy.ts
+/**
+* Splits a typed `resource:action` permission string into its parts.
+* Returns `null` when the string is malformed (missing/empty part or extra segments).
+*/
+const parsePermission = (permission) => {
+	const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
+	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0) return null;
+	return {
+		action: actionValue,
+		resourceType: resourceTypeValue
+	};
+};
+/**
+* Creates a type-safe policy from resource schemas, actions, and rules.
+*
+* @example
+* ```ts
+* import { z } from "zod";
+* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+* import type { Resources, Actions } from "@zap-studio/permit/types";
+*
+* // Define resource schemas
+* const resources = {
+*   post: z.object({
+*     id: z.string(),
+*     authorId: z.string(),
+*     visibility: z.enum(["public", "private"]),
+*   }),
+*   comment: z.object({
+*     id: z.string(),
+*     postId: z.string(),
+*     authorId: z.string(),
+*   }),
+* } satisfies Resources;
+*
+* // Define actions per resource
+* const actions = {
+*   post: ["read", "write", "delete"],
+*   comment: ["read", "write"],
+* } as const satisfies Actions<typeof resources>;
+*
+* // Define context type
+* type AppContext = { user: { id: string; role: string } };
+*
+* // Create the policy
+* const policy = createPolicy<AppContext>({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: when((ctx, action, resource) => resource.visibility === "public"),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*       delete: deny(),
+*     },
+*     comment: {
+*       read: allow(),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+*
+* // Check permissions
+* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+* await policy.can(ctx, "post:read", post); // true
+* await policy.can(ctx, "post:write", post); // depends on ctx.user.id
+* ```
+*/
+const createPolicy = (config) => {
+	const { rules, resources, actions } = config;
+	const validators = /* @__PURE__ */ new Map();
+	const getValidatedResource = async (resourceType, resource) => {
+		const validator = validators.get(resourceType);
+		if (validator === void 0) return null;
+		try {
+			const result = await validator(resource);
+			if (result.issues) return null;
+			return result.value;
+		} catch (error) {
+			console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);
+			return null;
+		}
+	};
+	const hasAllowedAction = (resourceType, action) => actions[resourceType]?.includes(action) ?? false;
+	const evaluatePolicy = (context, resourceType, action, resource) => {
+		const policyFn = rules[resourceType]?.[action];
+		if (policyFn === void 0) return false;
+		try {
+			return policyFn(context, action, resource) === "allow";
+		} catch (error) {
+			console.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`);
+			return false;
+		}
+	};
+	for (const key of Object.keys(resources)) {
+		const schema = resources[key];
+		if (schema === void 0) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
+		const validator = createStandardValidator(schema);
+		validators.set(key, async (input) => await validator(input));
+	}
+	return { async can(context, permission, resource) {
+		const parsedPermission = parsePermission(permission);
+		if (parsedPermission === null) return false;
+		const { action, resourceType } = parsedPermission;
+		if (!hasAllowedAction(resourceType, action)) return false;
+		const validatedResource = await getValidatedResource(resourceType, resource);
+		if (validatedResource === null) return false;
+		return evaluatePolicy(context, resourceType, action, validatedResource);
+	} };
+};
+const mergePoliciesWithStrategy = (policies, strategy) => ({ async can(context, permission, resource) {
+	if (policies.length === 0) return false;
+	for (const policy of policies) {
+		const allowed = await policy.can(context, permission, resource);
+		if (strategy === "allow-overrides" && allowed) return true;
+		if (strategy === "deny-overrides" && !allowed) return false;
+	}
+	return strategy === "deny-overrides";
+} });
+/**
+* Merges multiple policies into one using "deny-overrides" strategy.
+* If any policy denies, the merged policy denies. All must allow for the result to allow.
+*
+* @example
+* ```ts
+* const basePolicy = createPolicy({ ... });
+* const adminPolicy = createPolicy({ ... });
+*
+* const merged = mergePolicies(basePolicy, adminPolicy);
+* // Both policies must allow for the action to be permitted
+* ```
+*/
+const mergePolicies = (...policies) => mergePoliciesWithStrategy(policies, "deny-overrides");
+/**
+* Merges multiple policies into one using "allow-overrides" strategy.
+* If any policy allows, the merged policy allows. All must deny for the result to deny.
+*
+* @example
+* ```ts
+* const guestPolicy = createPolicy({ ... });
+* const memberPolicy = createPolicy({ ... });
+*
+* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+* // If either policy allows, the action is permitted
+* ```
+*/
+const mergePoliciesAny = (...policies) => mergePoliciesWithStrategy(policies, "allow-overrides");
+//#endregion
+export { createPolicy, mergePolicies, mergePoliciesAny };
+
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["/**\n * Policy creation and composition: `createPolicy`, `mergePolicies`, and\n * `mergePoliciesAny`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra segments).\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TActions, K> & string}`\n): { action: InferAction<TActions, K>; resourceType: K } | null => {\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Parsed permission strings are constrained by the typed permission template.\n    resourceType: resourceTypeValue as K,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n    for (const policy of policies) {\n      // oxlint-disable-next-line no-await-in-loop -- Policies must evaluate sequentially to preserve short-circuit semantics.\n      const allowed = await policy.can(context, permission, resource);\n\n      if (strategy === \"allow-overrides\" && allowed) {\n        return true;\n      }\n      if (strategy === \"deny-overrides\" && !allowed) {\n        return false;\n      }\n    }\n    return strategy === \"deny-overrides\";\n  },\n});\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePolicies = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"deny-overrides\");\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesAny = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"allow-overrides\");\n"],"mappings":";;;;;;;AAyBA,MAAM,mBAKJ,eACiE;CACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,GAEd,OAAO;CAGT,OAAO;EACL,QAAQ;EAER,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,GACzE;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,OAAO,SAAS,SAAS,QAAQ,QAAQ,MAAM;EACjD,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,GAChF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,UACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAET,KAAK,MAAM,UAAU,UAAU;EAE7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ;EAE9D,IAAI,aAAa,qBAAqB,SACpC,OAAO;EAET,IAAI,aAAa,oBAAoB,CAAC,SACpC,OAAO;CAEX;CACA,OAAO,aAAa;AACtB,EACF;;;;;;;;;;;;;;AAeA,MAAa,iBAKX,GAAG,aAEH,0BAA0B,UAAU,gBAAgB;;;;;;;;;;;;;;AAetD,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,iBAAiB"}

package/dist/types.d.ts

@@ -0,0 +1,142 @@
+import { StandardSchemaV1 } from "@zap-studio/validation";
+//#region src/types.d.ts
+/**
+ * Represents the possible outcomes of a policy decision.
+ * - "allow": The action is permitted.
+ * - "deny": The action is not permitted.
+ */
+type Decision = "allow" | "deny";
+/**
+ * Represents the context in which a policy decision is made.
+ * Can include user information, environment, or any relevant data.
+ */
+type Context<TContext = unknown> = TContext;
+/**
+ * Represents a role within the system.
+ */
+type Role<TRole extends string = string> = TRole;
+/**
+ * Represents a role hierarchy within the system.
+ * Maps each role to an array of roles it inherits from.
+ *
+ * @example
+ * ```ts
+ * type Roles = "guest" | "user" | "admin";
+ *
+ * const hierarchy: RoleHierarchy<Roles> = {
+ *   guest: [],
+ *   user: ["guest"],
+ *   admin: ["user"],
+ * };
+ * ```
+ */
+type RoleHierarchy<TRole extends Role = Role> = Record<TRole, TRole[]>;
+/**
+ * Type helper for defining resource schemas using Standard Schema.
+ * Use with `satisfies` to ensure type safety when defining resources.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import type { Resources } from "@zap-studio/permit/types";
+ *
+ * const resources = {
+ *   post: z.object({ id: z.string(), authorId: z.string() }),
+ *   comment: z.object({ id: z.string(), postId: z.string() }),
+ * } satisfies Resources;
+ * ```
+ */
+type Resources<TResourceKey extends string = string> = Record<TResourceKey, StandardSchemaV1>;
+/**
+ * Type helper for defining actions per resource.
+ * Use with `satisfies` to ensure keys match the resource definitions.
+ *
+ * @example
+ * ```ts
+ * import type { Actions } from "@zap-studio/permit/types";
+ *
+ * const actions = {
+ *   post: ["read", "write", "delete"],
+ *   comment: ["read", "write"],
+ * } as const satisfies Actions<typeof resources>;
+ * ```
+ */
+type Actions<TResources extends Resources> = { [K in keyof TResources]: readonly string[]; };
+/**
+ * Infers the output type from a Standard Schema.
+ */
+type InferResource<TResources extends Resources, TResourceKey extends keyof TResources> = StandardSchemaV1.InferOutput<TResources[TResourceKey]>;
+/**
+ * Infers the action union type for a specific resource.
+ */
+type InferAction<TActions extends Record<string, readonly string[]>, K extends keyof TActions> = TActions[K][number];
+/**
+ * Infers the permission-string union for all resource/action combinations.
+ *
+ * @example
+ * ```ts
+ * type Permission = InferPermission<typeof resources, typeof actions>;
+ * // "post:read" | "post:write" | "comment:read"
+ * ```
+ */
+type InferPermission<TResources extends Resources, TActions extends Actions<TResources>> = { [K in keyof TResources & keyof TActions]: `${K & string}:${InferAction<TActions, K> & string}`; }[keyof TResources & keyof TActions];
+/**
+ * A function that determines whether a given action on a resource is allowed in a specific context.
+ */
+type PolicyFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => Decision;
+/**
+ * A function that evaluates a condition for a given action and resource in a specific context.
+ */
+type ConditionFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => boolean;
+/**
+ * Maps actions to their corresponding policy functions for a specific resource.
+ */
+type ActionPolicyMap<TContext extends Context, TAction extends string = string, TResource = unknown> = { [A in TAction]?: PolicyFn<TContext, A, TResource>; };
+/**
+ * Defines the rules for each resource and action combination.
+ * Each resource key maps to an object where each action key maps to a policy function.
+ */
+type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TActions, K>, InferResource<TResources, K>>; };
+/**
+ * Configuration object for creating a permit policy.
+ *
+ * @example
+ * ```ts
+ * const config: PermitConfig<MyContext> = {
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: { read: allow(), write: deny() },
+ *   },
+ * };
+ * ```
+ */
+interface PermitConfig<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> {
+  actions: TActions;
+  resources: TResources;
+  rules: Rules<TContext, TResources, TActions>;
+}
+/**
+ * Represents a policy object that can evaluate permissions.
+ * The `can` method checks if a given action is permitted on a resource in a specific context.
+ *
+ * @example
+ * ```ts
+ * const policy: Policy<MyContext> = createPolicy({
+ *   resources,
+ *   actions,
+ *   rules: { ... },
+ * });
+ *
+ * await policy.can(ctx, "post:read", postData); // true or false
+ * ```
+ */
+interface Policy<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> {
+  /**
+   * Determines if the specified action is permitted on the resource in the given context.
+   */
+  can: <K extends keyof TResources & keyof TActions>(context: TContext, permission: `${K & string}:${InferAction<TActions, K> & string}`, resource: InferResource<TResources, K>) => Promise<boolean>;
+}
+//#endregion
+export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;KAaY;;;;;KAMA,QAAQ,sBAAsB;;;;KAK9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;KAMF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;KAKhC,YACV,iBAAiB,mCACjB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAExB,WAAW,mBACJ,cAAc,cAAc,YAAY,UAAU,uBACpD,mBAAmB;;;;KAKf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;KAKrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;KAKvC,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;KAO7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;EAE/C,SAAS;EACT,WAAW;EACX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,UAAU,eACnD,UAAU,cAAc,YAAY,OACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zap-studio/permit",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "private": false,
   "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
   "keywords": [
@@ -31,31 +31,29 @@
   ],
   "type": "module",
   "sideEffects": false,
-  "types": "./dist/index.d.mts",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./dist/index.mjs",
-    "./errors": "./dist/errors.mjs",
-    "./helpers": "./dist/helpers.mjs",
-    "./types": "./dist/types.mjs",
+    ".": "./dist/index.js",
+    "./conditions": "./dist/conditions.js",
+    "./errors": "./dist/errors.js",
+    "./helpers": "./dist/helpers.js",
+    "./policy": "./dist/policy.js",
+    "./types": "./dist/types.js",
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "0.3.4"
+    "@zap-studio/validation": "workspace:*"
   },
   "devDependencies": {
-    "typescript": "^6.0.3",
-    "vite-plus": "^0.1.19",
-    "@zap-studio/typescript": "0.0.0"
+    "@zap-studio/typescript": "workspace:*",
+    "tsdown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "test": "vp test run",
-    "test:watch": "vp test watch"
   }
-}
+}

package/dist/errors.d.mts

@@ -1,11 +0,0 @@
-//#region src/errors.d.ts
-/**
-* Represents an error that occurs during policy evaluation or enforcement.
-* Use this error to indicate issues related to policy logic, configuration, or execution.
-*/
-declare class PolicyError extends Error {
-  constructor(message: string);
-}
-//#endregion
-export { PolicyError };
-//# sourceMappingURL=errors.d.mts.map

package/dist/errors.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;AAIA;;;cAAa,WAAA,SAAoB,KAAA;EAC/B,WAAA,CAAY,OAAA;AAAA"}

package/dist/errors.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;AAIA,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO"}

package/dist/helpers.d.mts

@@ -1,27 +0,0 @@
-//#region src/helpers.d.ts
-/**
-* Ensures that a value of type `never` is actually never encountered at runtime.
-* This is useful for exhaustive checks on discriminated unions.
-*
-* @example
-* ```ts
-* type Action = 'read' | 'write'
-*
-* function performAction(action: Action) {
-*   switch (action) {
-*     case 'read':
-*       console.log('Reading...')
-*       break
-*     case 'write':
-*       console.log('Writing...')
-*       break
-*     default:
-*       assertNever(action) // TypeScript will error if a new Action is added but not handled
-*   }
-* }
-* ```
-*/
-declare function assertNever(value: never): never;
-//#endregion
-export { assertNever };
-//# sourceMappingURL=helpers.d.mts.map

package/dist/helpers.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.d.mts","names":[],"sources":["../src/helpers.ts"],"mappings":";;AAsBA;;;;;;;;;;;;;;;;;;;;;iBAAgB,WAAA,CAAY,KAAA"}

package/dist/helpers.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.mjs","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport function assertNever(value: never): never {\n  throw new Error(`Unexpected value: ${String(value)}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,YAAY,OAAqB;AAC/C,OAAM,IAAI,MAAM,qBAAqB,OAAO,MAAM,GAAG"}