@zap-studio/permit 0.3.2 → 0.3.4

package/dist/index.d.mts

@@ -1,256 +0,0 @@
-import { Actions, ConditionFn, Context, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy } from "./types.mjs";
-
-//#region src/index.d.ts
-/**
-* Returns a policy function that always allows the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: allow(), // Always allow reading posts
-*     },
-*   },
-* });
-* ```
-*/
-declare function allow<TContext extends Context, TAction extends string = string, TResource = unknown>(): PolicyFn<TContext, TAction, TResource>;
-/**
-* Returns a policy function that always denies the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       delete: deny(), // Never allow deleting posts
-*     },
-*   },
-* });
-* ```
-*/
-declare function deny<TContext extends Context, TAction extends string = string, TResource = unknown>(): PolicyFn<TContext, TAction, TResource>;
-/**
-* Returns a policy function that allows or denies based on a condition.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-* ```
-*/
-declare function when<TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>): PolicyFn<TContext, TAction, TResource>;
-/**
-* Returns a condition function that returns `true` if all conditions are met.
-*
-* @example
-* ```ts
-* const isOwnerAndPublished = and(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => resource.status === "published"
-* );
-*
-* rules: {
-*   post: {
-*     delete: when(isOwnerAndPublished),
-*   },
-* }
-* ```
-*/
-declare function and<TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]): ConditionFn<TContext, TAction, TResource>;
-/**
-* Returns a condition function that returns `true` if any condition is met.
-*
-* @example
-* ```ts
-* const isOwnerOrAdmin = or(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => ctx.user.role === "admin"
-* );
-*
-* rules: {
-*   post: {
-*     write: when(isOwnerOrAdmin),
-*   },
-* }
-* ```
-*/
-declare function or<TContext extends Context, TAction extends string = string, TResource = unknown>(...conditions: ConditionFn<TContext, TAction, TResource>[]): ConditionFn<TContext, TAction, TResource>;
-/**
-* Returns a condition function that negates another condition.
-*
-* @example
-* ```ts
-* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
-*
-* rules: {
-*   post: {
-*     like: when(isNotOwner), // Can only like posts you don't own
-*   },
-* }
-* ```
-*/
-declare function not<TContext extends Context, TAction extends string = string, TResource = unknown>(condition: ConditionFn<TContext, TAction, TResource>): ConditionFn<TContext, TAction, TResource>;
-/**
-* Returns a condition function that checks if a context property equals a value.
-*
-* @example
-* ```ts
-* rules: {
-*   post: {
-*     write: when(has("role", "admin")), // Only admins can write
-*   },
-* }
-* ```
-*/
-declare function has<TContext extends Context, K extends keyof TContext>(key: K, value: TContext[K]): ConditionFn<TContext>;
-/**
-* Collects all roles including inherited ones from a role hierarchy.
-*
-* @example
-* ```ts
-* type Role = "guest" | "user" | "admin";
-*
-* const hierarchy: RoleHierarchy<Role> = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-*
-* collectInheritedRoles(["admin"], hierarchy);
-* // Returns: Set { "admin", "user", "guest" }
-* ```
-*/
-declare function collectInheritedRoles<TRole extends Role = Role>(roles: TRole[], hierarchy: RoleHierarchy<TRole>): Set<TRole>;
-/**
-* Returns a condition function that checks if the user has a specific role.
-* Supports role hierarchy for inherited permissions.
-*
-* @example
-* ```ts
-* // Without hierarchy
-* rules: {
-*   post: {
-*     delete: when(hasRole("admin")),
-*   },
-* }
-*
-* // With hierarchy
-* const hierarchy = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-*
-* rules: {
-*   post: {
-*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
-*   },
-* }
-* ```
-*/
-declare function hasRole<TContext extends {
-  role: Role | Role[];
-}, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
-declare function hasRole<TContext extends {
-  role: TRole | TRole[];
-}, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
-/**
-* Creates a type-safe policy from resource schemas, actions, and rules.
-*
-* @example
-* ```ts
-* import { z } from "zod";
-* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
-* import type { Resources, Actions } from "@zap-studio/permit/types";
-*
-* // Define resource schemas
-* const resources = {
-*   post: z.object({
-*     id: z.string(),
-*     authorId: z.string(),
-*     visibility: z.enum(["public", "private"]),
-*   }),
-*   comment: z.object({
-*     id: z.string(),
-*     postId: z.string(),
-*     authorId: z.string(),
-*   }),
-* } satisfies Resources;
-*
-* // Define actions per resource
-* const actions = {
-*   post: ["read", "write", "delete"],
-*   comment: ["read", "write"],
-* } as const satisfies Actions<typeof resources>;
-*
-* // Define context type
-* type AppContext = { user: { id: string; role: string } };
-*
-* // Create the policy
-* const policy = createPolicy<AppContext>({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: when((ctx, action, resource) => resource.visibility === "public"),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*       delete: deny(),
-*     },
-*     comment: {
-*       read: allow(),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-*
-* // Check permissions
-* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
-* await policy.can(ctx, "post:read", post); // true
-* await policy.can(ctx, "post:write", post); // depends on ctx.user.id
-* ```
-*/
-declare function createPolicy<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>): Policy<TContext, TResources, TActions>;
-/**
-* Merges multiple policies into one using "deny-overrides" strategy.
-* If any policy denies, the merged policy denies. All must allow for the result to allow.
-*
-* @example
-* ```ts
-* const basePolicy = createPolicy({ ... });
-* const adminPolicy = createPolicy({ ... });
-*
-* const merged = mergePolicies(basePolicy, adminPolicy);
-* // Both policies must allow for the action to be permitted
-* ```
-*/
-declare function mergePolicies<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions>;
-/**
-* Merges multiple policies into one using "allow-overrides" strategy.
-* If any policy allows, the merged policy allows. All must deny for the result to deny.
-*
-* @example
-* ```ts
-* const guestPolicy = createPolicy({ ... });
-* const memberPolicy = createPolicy({ ... });
-*
-* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
-* // If either policy allows, the action is permitted
-* ```
-*/
-declare function mergePoliciesAny<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions>;
-//#endregion
-export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
-//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;AAkCA;;;;;;;;;;;;;;iBAAgB,KAAA,kBACG,OAAA,uDAAA,CAAA,GAGd,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;;AAoBjC;;;;;;;;;;;;;;;iBAAgB,IAAA,kBACG,OAAA,uDAAA,CAAA,GAGd,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;AAoBjC;;;;;;;;;;;;;;;;AAAA,iBAAgB,IAAA,kBACG,OAAA,uDAAA,CAGjB,SAAA,EAAW,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,IAAa,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;AAqBrF;;;;;;;;;iBAAgB,GAAA,kBAAqB,OAAA,uDAAA,CAAA,GAChC,UAAA,EAAY,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,MAC7C,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;;;;;;;;AAsBlC;;iBAAgB,EAAA,kBAAoB,OAAA,uDAAA,CAAA,GAC/B,UAAA,EAAY,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,MAC7C,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;;;;;;;;;;iBAmBlB,GAAA,kBAAqB,OAAA,uDAAA,CACnC,SAAA,EAAW,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA,IACzC,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;AAFlC;;;;;;;;;iBAkBgB,GAAA,kBAAqB,OAAA,kBAAyB,QAAA,CAAA,CAC5D,GAAA,EAAK,CAAA,EACL,KAAA,EAAO,QAAA,CAAS,CAAA,IACf,WAAA,CAAY,QAAA;;;;;;;;;;;;;;;;;AAHf;iBAwBgB,qBAAA,eAAoC,IAAA,GAAO,IAAA,CAAA,CACzD,KAAA,EAAO,KAAA,IACP,SAAA,EAAW,aAAA,CAAc,KAAA,IACxB,GAAA,CAAI,KAAA;;;;;;;;;;;;;;;;;;;;;;;;AAHP;;;;iBA6CgB,OAAA;EACK,IAAA,EAAM,IAAA,GAAO,IAAA;AAAA,wDAAA,CAGhC,IAAA,EAAM,IAAA,GAAO,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;AAAA,iBAE9B,OAAA;EACK,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,uEAGnB,IAAA,GAAO,IAAA,CAAA,CACrB,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,aAAA,CAAc,KAAA,IAAS,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS,SAAA;;;;;;AAXhF;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;;;;;;;;;;;;;;;;;;;;;;;iBA+EgB,YAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAC/C,MAAA,EAAQ,YAAA,CAAa,QAAA,EAAU,UAAA,EAAY,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA;;;;;;;;AAJtF;;;;;;iBAuHgB,aAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAAA,GAC5C,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA,MAAc,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA;;;;;;;;;;;;;;iBAiBvE,gBAAA,kBACG,OAAA,qBACE,SAAA,GAAY,SAAA,mBACd,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,EAAA,CAAA,GAC5C,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA,MAAc,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,QAAA"}

package/dist/index.mjs

@@ -1,319 +0,0 @@
-import { PolicyError } from "./errors.mjs";
-import { createStandardValidator } from "@zap-studio/validation";
-//#region src/index.ts
-/**
-* Returns a policy function that always allows the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: allow(), // Always allow reading posts
-*     },
-*   },
-* });
-* ```
-*/
-function allow() {
-	return () => "allow";
-}
-/**
-* Returns a policy function that always denies the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       delete: deny(), // Never allow deleting posts
-*     },
-*   },
-* });
-* ```
-*/
-function deny() {
-	return () => "deny";
-}
-/**
-* Returns a policy function that allows or denies based on a condition.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-* ```
-*/
-function when(condition) {
-	return (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
-}
-/**
-* Returns a condition function that returns `true` if all conditions are met.
-*
-* @example
-* ```ts
-* const isOwnerAndPublished = and(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => resource.status === "published"
-* );
-*
-* rules: {
-*   post: {
-*     delete: when(isOwnerAndPublished),
-*   },
-* }
-* ```
-*/
-function and(...conditions) {
-	return (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
-}
-/**
-* Returns a condition function that returns `true` if any condition is met.
-*
-* @example
-* ```ts
-* const isOwnerOrAdmin = or(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => ctx.user.role === "admin"
-* );
-*
-* rules: {
-*   post: {
-*     write: when(isOwnerOrAdmin),
-*   },
-* }
-* ```
-*/
-function or(...conditions) {
-	return (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
-}
-/**
-* Returns a condition function that negates another condition.
-*
-* @example
-* ```ts
-* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
-*
-* rules: {
-*   post: {
-*     like: when(isNotOwner), // Can only like posts you don't own
-*   },
-* }
-* ```
-*/
-function not(condition) {
-	return (context, action, resource) => !condition(context, action, resource);
-}
-/**
-* Returns a condition function that checks if a context property equals a value.
-*
-* @example
-* ```ts
-* rules: {
-*   post: {
-*     write: when(has("role", "admin")), // Only admins can write
-*   },
-* }
-* ```
-*/
-function has(key, value) {
-	return (context) => context[key] === value;
-}
-/**
-* Collects all roles including inherited ones from a role hierarchy.
-*
-* @example
-* ```ts
-* type Role = "guest" | "user" | "admin";
-*
-* const hierarchy: RoleHierarchy<Role> = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-*
-* collectInheritedRoles(["admin"], hierarchy);
-* // Returns: Set { "admin", "user", "guest" }
-* ```
-*/
-function collectInheritedRoles(roles, hierarchy) {
-	const inherited = /* @__PURE__ */ new Set();
-	function add(role) {
-		if (!inherited.has(role)) {
-			inherited.add(role);
-			(hierarchy[role] ?? []).forEach(add);
-		}
-	}
-	roles.forEach(add);
-	return inherited;
-}
-function hasRole(role, hierarchy) {
-	return (context) => {
-		const userRoles = Array.isArray(context.role) ? context.role : [context.role];
-		if (!hierarchy) return userRoles.includes(role);
-		return collectInheritedRoles(userRoles, hierarchy).has(role);
-	};
-}
-/**
-* Creates a type-safe policy from resource schemas, actions, and rules.
-*
-* @example
-* ```ts
-* import { z } from "zod";
-* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
-* import type { Resources, Actions } from "@zap-studio/permit/types";
-*
-* // Define resource schemas
-* const resources = {
-*   post: z.object({
-*     id: z.string(),
-*     authorId: z.string(),
-*     visibility: z.enum(["public", "private"]),
-*   }),
-*   comment: z.object({
-*     id: z.string(),
-*     postId: z.string(),
-*     authorId: z.string(),
-*   }),
-* } satisfies Resources;
-*
-* // Define actions per resource
-* const actions = {
-*   post: ["read", "write", "delete"],
-*   comment: ["read", "write"],
-* } as const satisfies Actions<typeof resources>;
-*
-* // Define context type
-* type AppContext = { user: { id: string; role: string } };
-*
-* // Create the policy
-* const policy = createPolicy<AppContext>({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: when((ctx, action, resource) => resource.visibility === "public"),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*       delete: deny(),
-*     },
-*     comment: {
-*       read: allow(),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-*
-* // Check permissions
-* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
-* await policy.can(ctx, "post:read", post); // true
-* await policy.can(ctx, "post:write", post); // depends on ctx.user.id
-* ```
-*/
-function createPolicy(config) {
-	const { rules, resources, actions } = config;
-	const validators = /* @__PURE__ */ new Map();
-	const getValidatedResource = async (resourceType, resource) => {
-		const validator = validators.get(resourceType);
-		if (!validator) return null;
-		try {
-			const result = await validator(resource);
-			if (result.issues) return null;
-			return result.value;
-		} catch (error) {
-			console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);
-			return null;
-		}
-	};
-	const parsePermission = (permission) => {
-		const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
-		if (!resourceTypeValue || !actionValue || rest.length > 0) return null;
-		return {
-			action: actionValue,
-			resourceType: resourceTypeValue
-		};
-	};
-	const hasAllowedAction = (resourceType, action) => actions[resourceType]?.includes(action) ?? false;
-	const evaluatePolicy = (context, resourceType, action, resource) => {
-		const policyFn = rules[resourceType]?.[action];
-		if (!policyFn) return false;
-		try {
-			return policyFn(context, action, resource) === "allow";
-		} catch (error) {
-			console.warn(`Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`);
-			return false;
-		}
-	};
-	for (const key of Object.keys(resources)) {
-		const schema = resources[key];
-		if (!schema) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
-		const validator = createStandardValidator(schema);
-		validators.set(key, async (input) => validator(input));
-	}
-	return { async can(context, permission, resource) {
-		const parsedPermission = parsePermission(permission);
-		if (!parsedPermission) return false;
-		const { action, resourceType } = parsedPermission;
-		if (!hasAllowedAction(resourceType, action)) return false;
-		const validatedResource = await getValidatedResource(resourceType, resource);
-		if (!validatedResource) return false;
-		return evaluatePolicy(context, resourceType, action, validatedResource);
-	} };
-}
-/**
-* Merges multiple policies into one using "deny-overrides" strategy.
-* If any policy denies, the merged policy denies. All must allow for the result to allow.
-*
-* @example
-* ```ts
-* const basePolicy = createPolicy({ ... });
-* const adminPolicy = createPolicy({ ... });
-*
-* const merged = mergePolicies(basePolicy, adminPolicy);
-* // Both policies must allow for the action to be permitted
-* ```
-*/
-function mergePolicies(...policies) {
-	return mergePoliciesWithStrategy(policies, "deny-overrides");
-}
-/**
-* Merges multiple policies into one using "allow-overrides" strategy.
-* If any policy allows, the merged policy allows. All must deny for the result to deny.
-*
-* @example
-* ```ts
-* const guestPolicy = createPolicy({ ... });
-* const memberPolicy = createPolicy({ ... });
-*
-* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
-* // If either policy allows, the action is permitted
-* ```
-*/
-function mergePoliciesAny(...policies) {
-	return mergePoliciesWithStrategy(policies, "allow-overrides");
-}
-function mergePoliciesWithStrategy(policies, strategy) {
-	return { async can(context, permission, resource) {
-		if (!policies.length) return false;
-		for (const policy of policies) {
-			const allowed = await policy.can(context, permission, resource);
-			if (strategy === "allow-overrides" && allowed) return true;
-			if (strategy === "deny-overrides" && !allowed) return false;
-		}
-		return strategy === "deny-overrides";
-	} };
-}
-//#endregion
-export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
-
-//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport function allow<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"allow\";\n}\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport function deny<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(): PolicyFn<TContext, TAction, TResource> {\n  return () => \"deny\";\n}\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport function when<\n  TContext extends Context,\n  TAction extends string = string,\n  TResource = unknown,\n>(condition: ConditionFn<TContext, TAction, TResource>): PolicyFn<TContext, TAction, TResource> {\n  return (context, action, resource) => (condition(context, action, resource) ? \"allow\" : \"deny\");\n}\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport function and<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport function or<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  ...conditions: ConditionFn<TContext, TAction, TResource>[]\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n}\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport function not<TContext extends Context, TAction extends string = string, TResource = unknown>(\n  condition: ConditionFn<TContext, TAction, TResource>,\n): ConditionFn<TContext, TAction, TResource> {\n  return (context, action, resource) => !condition(context, action, resource);\n}\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport function has<TContext extends Context, K extends keyof TContext>(\n  key: K,\n  value: TContext[K],\n): ConditionFn<TContext> {\n  return (context) => context[key] === value;\n}\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport function collectInheritedRoles<TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>,\n): Set<TRole> {\n  const inherited = new Set<TRole>();\n\n  function add(role: TRole) {\n    if (!inherited.has(role)) {\n      inherited.add(role);\n      const parents = hierarchy[role] ?? [];\n      parents.forEach(add); // recursively add parent roles\n    }\n  }\n\n  roles.forEach(add);\n  return inherited;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: TRole | TRole[] },\n  TAction extends string = string,\n  TResource = unknown,\n  TRole extends Role = Role,\n>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;\n\nexport function hasRole<\n  TContext extends { role: Role | Role[] },\n  TAction extends string = string,\n  TResource = unknown,\n>(role: Role, hierarchy?: RoleHierarchy<Role>): ConditionFn<TContext, TAction, TResource> {\n  return (context) => {\n    const userRoles = Array.isArray(context.role) ? context.role : [context.role];\n\n    if (!hierarchy) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n}\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport function createPolicy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(config: PermitConfig<TContext, TResources, TActions>): Policy<TContext, TResources, TActions> {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>,\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (!validator) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value as InferResource<TResources, K>;\n    } catch (error) {\n      console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);\n      return null;\n    }\n  };\n\n  const parsePermission = <K extends keyof TResources & keyof TActions>(\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n  ): { action: InferAction<TActions, K>; resourceType: K } | null => {\n    const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n    if (!resourceTypeValue || !actionValue || rest.length > 0) {\n      return null;\n    }\n\n    return {\n      action: actionValue as InferAction<TActions, K>,\n      resourceType: resourceTypeValue as K,\n    };\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>,\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>,\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (!policyFn) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${String(action)}: ${String(error)}`,\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as Array<keyof TResources>) {\n    const schema = resources[key];\n    if (!schema) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission(permission);\n      if (!parsedPermission) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(resourceType, resource);\n      if (!validatedResource) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n}\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport function mergePolicies<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return mergePoliciesWithStrategy(policies, \"deny-overrides\");\n}\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport function mergePoliciesAny<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(...policies: Policy<TContext, TResources, TActions>[]): Policy<TContext, TResources, TActions> {\n  return mergePoliciesWithStrategy(policies, \"allow-overrides\");\n}\n\nfunction mergePoliciesWithStrategy<\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\",\n): Policy<TContext, TResources, TActions> {\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>,\n    ): Promise<boolean> {\n      if (!policies.length) {\n        return false;\n      }\n      for (const policy of policies) {\n        const allowed = await policy.can(context, permission, resource);\n\n        if (strategy === \"allow-overrides\" && allowed) {\n          return true;\n        }\n        if (strategy === \"deny-overrides\" && !allowed) {\n          return false;\n        }\n      }\n      return strategy === \"deny-overrides\";\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,QAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,OAI4B;AAC1C,cAAa;;;;;;;;;;;;;;;;;;AAmBf,SAAgB,KAId,WAA8F;AAC9F,SAAQ,SAAS,QAAQ,aAAc,UAAU,SAAS,QAAQ,SAAS,GAAG,UAAU;;;;;;;;;;;;;;;;;;;AAoB1F,SAAgB,IACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;;;;AAoBzE,SAAgB,GACd,GAAG,YACwC;AAC3C,SAAQ,SAAS,QAAQ,aACvB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,SAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,SAAgB,IACd,WAC2C;AAC3C,SAAQ,SAAS,QAAQ,aAAa,CAAC,UAAU,SAAS,QAAQ,SAAS;;;;;;;;;;;;;;AAe7E,SAAgB,IACd,KACA,OACuB;AACvB,SAAQ,YAAY,QAAQ,SAAS;;;;;;;;;;;;;;;;;;;AAoBvC,SAAgB,sBACd,OACA,WACY;CACZ,MAAM,4BAAY,IAAI,KAAY;CAElC,SAAS,IAAI,MAAa;AACxB,MAAI,CAAC,UAAU,IAAI,KAAK,EAAE;AACxB,aAAU,IAAI,KAAK;AAEnB,IADgB,UAAU,SAAS,EAAE,EAC7B,QAAQ,IAAI;;;AAIxB,OAAM,QAAQ,IAAI;AAClB,QAAO;;AA2CT,SAAgB,QAId,MAAY,WAA4E;AACxF,SAAQ,YAAY;EAClB,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,GAAG,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAE7E,MAAI,CAAC,UACH,QAAO,UAAU,SAAS,KAAK;AAIjC,SADkB,sBAAsB,WAAW,UAAU,CAC5C,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2D9B,SAAgB,aAId,QAA8F;CAC9F,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,KAGpB;CAEH,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,aAAa;AAC9C,MAAI,CAAC,UACH,QAAO;AAET,MAAI;GACF,MAAM,SAAS,MAAM,UAAU,SAAS;AACxC,OAAI,OAAO,OACT,QAAO;AAET,UAAO,OAAO;WACP,OAAO;AACd,WAAQ,KAAK,kCAAkC,OAAO,aAAa,CAAC,IAAI,OAAO,MAAM,GAAG;AACxF,UAAO;;;CAIX,MAAM,mBACJ,eACiE;EACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,IAAI;AACvE,MAAI,CAAC,qBAAqB,CAAC,eAAe,KAAK,SAAS,EACtD,QAAO;AAGT,SAAO;GACL,QAAQ;GACR,cAAc;GACf;;CAGH,MAAM,oBACJ,cACA,WACY,QAAQ,eAAe,SAAS,OAAO,IAAI;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,gBAAgB;AACvC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;AACF,UAAO,SAAS,SAAS,QAAQ,SAAS,KAAK;WACxC,OAAO;AACd,WAAQ,KACN,+BAA+B,OAAO,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,IAAI,OAAO,MAAM,GACxF;AACD,UAAO;;;AAIX,MAAK,MAAM,OAAO,OAAO,KAAK,UAAU,EAA6B;EACnE,MAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OACH,OAAM,IAAI,YAAY,gCAAgC,OAAO,IAAI,GAAG;EAEtE,MAAM,YAAY,wBAAwB,OAAO;AACjD,aAAW,IAAI,KAAK,OAAO,UAAmB,UAAU,MAAM,CAAC;;AAGjE,QAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBAAgB,WAAW;AACpD,MAAI,CAAC,iBACH,QAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;AACjC,MAAI,CAAC,iBAAiB,cAAc,OAAO,CACzC,QAAO;EAGT,MAAM,oBAAoB,MAAM,qBAAqB,cAAc,SAAS;AAC5E,MAAI,CAAC,kBACH,QAAO;AAGT,SAAO,eAAe,SAAS,cAAc,QAAQ,kBAAkB;IAE1E;;;;;;;;;;;;;;;AAgBH,SAAgB,cAId,GAAG,UAA4F;AAC/F,QAAO,0BAA0B,UAAU,iBAAiB;;;;;;;;;;;;;;;AAgB9D,SAAgB,iBAId,GAAG,UAA4F;AAC/F,QAAO,0BAA0B,UAAU,kBAAkB;;AAG/D,SAAS,0BAKP,UACA,UACwC;AACxC,QAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;AAClB,MAAI,CAAC,SAAS,OACZ,QAAO;AAET,OAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,SAAS;AAE/D,OAAI,aAAa,qBAAqB,QACpC,QAAO;AAET,OAAI,aAAa,oBAAoB,CAAC,QACpC,QAAO;;AAGX,SAAO,aAAa;IAEvB"}