@zap-studio/permit 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## @zap-studio/permit@0.3.4
+
+### Tree-shakeable root re-exports
+
+The package root now re-exports the full public API, so everything can be imported from `@zap-studio/permit` directly, including `PolicyError`, `assertNever`, and all public types. All exports are side-effect free and tree-shakeable; granular subpath imports keep working.
+
+- The implementation moved out of the entrypoint into two new subpaths: `./conditions` (`allow`, `deny`, `when`, `and`, `or`, `not`, `has`, `hasRole`, `collectInheritedRoles`) and `./policy` (`createPolicy`, `mergePolicies`, `mergePoliciesAny`).
+
 ## @zap-studio/permit@0.3.3
 
 ### Migrate to ultracite lint/format

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Alexandre Trotel
+Copyright (c) 2026 alexandretrotel
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -14,8 +14,6 @@ A type-safe, declarative authorization library for TypeScript with [Standard Sch
 ## Installation
 
 ```bash
-pnpm add @zap-studio/permit
-# or
 npm install @zap-studio/permit
 ```
 
@@ -24,7 +22,7 @@ npm install @zap-studio/permit
 ```ts
 import { z } from "zod";
 import { createPolicy, allow, deny, when } from "@zap-studio/permit";
-import type { Resources, Actions } from "@zap-studio/permit/types";
+import type { Resources, Actions } from "@zap-studio/permit";
 
 // 1. Define your resource schemas
 const resources = {
@@ -268,3 +266,15 @@ const resources = {
   post: type({ id: "string" }),
 } satisfies Resources;
 ```
+
+## Runtime Support
+
+| Runtime            | Minimum version                                  |
+| ------------------ | ------------------------------------------------ |
+| Node.js            | 18.0.0                                           |
+| Bun                | 1.0.0                                            |
+| Deno               | 1.42                                             |
+| Cloudflare Workers | Any current release                              |
+| Browsers           | Latest evergreen (Chrome, Edge, Firefox, Safari) |
+
+The package ships standard ESM only and uses no runtime-specific APIs. Deno 1.42 is the first release that can install packages from JSR (`deno add jsr:@zap-studio/permit`).

package/dist/{index.d.mts → conditions.d.ts}

@@ -1,5 +1,5 @@
-import { Actions, ConditionFn, Context, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy } from "./types.mjs";
-//#region src/index.d.ts
+import { ConditionFn, Context, PolicyFn, Role, RoleHierarchy } from "./types.js";
+//#region src/conditions.d.ts
 /**
  * Returns a policy function that always allows the action.
  *
@@ -172,90 +172,6 @@ interface HasRoleFn {
  * ```
  */
 declare const hasRole: HasRoleFn;
-/**
- * Creates a type-safe policy from resource schemas, actions, and rules.
- *
- * @example
- * ```ts
- * import { z } from "zod";
- * import { createPolicy, allow, deny, when } from "@zap-studio/permit";
- * import type { Resources, Actions } from "@zap-studio/permit/types";
- *
- * // Define resource schemas
- * const resources = {
- *   post: z.object({
- *     id: z.string(),
- *     authorId: z.string(),
- *     visibility: z.enum(["public", "private"]),
- *   }),
- *   comment: z.object({
- *     id: z.string(),
- *     postId: z.string(),
- *     authorId: z.string(),
- *   }),
- * } satisfies Resources;
- *
- * // Define actions per resource
- * const actions = {
- *   post: ["read", "write", "delete"],
- *   comment: ["read", "write"],
- * } as const satisfies Actions<typeof resources>;
- *
- * // Define context type
- * type AppContext = { user: { id: string; role: string } };
- *
- * // Create the policy
- * const policy = createPolicy<AppContext>({
- *   resources,
- *   actions,
- *   rules: {
- *     post: {
- *       read: when((ctx, action, resource) => resource.visibility === "public"),
- *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
- *       delete: deny(),
- *     },
- *     comment: {
- *       read: allow(),
- *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
- *     },
- *   },
- * });
- *
- * // Check permissions
- * const post = { id: "1", authorId: "user-1", visibility: "public" as const };
- * await policy.can(ctx, "post:read", post); // true
- * await policy.can(ctx, "post:write", post); // depends on ctx.user.id
- * ```
- */
-declare const createPolicy: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>) => Policy<TContext, TResources, TActions>;
-/**
- * Merges multiple policies into one using "deny-overrides" strategy.
- * If any policy denies, the merged policy denies. All must allow for the result to allow.
- *
- * @example
- * ```ts
- * const basePolicy = createPolicy({ ... });
- * const adminPolicy = createPolicy({ ... });
- *
- * const merged = mergePolicies(basePolicy, adminPolicy);
- * // Both policies must allow for the action to be permitted
- * ```
- */
-declare const mergePolicies: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
-/**
- * Merges multiple policies into one using "allow-overrides" strategy.
- * If any policy allows, the merged policy allows. All must deny for the result to deny.
- *
- * @example
- * ```ts
- * const guestPolicy = createPolicy({ ... });
- * const memberPolicy = createPolicy({ ... });
- *
- * const merged = mergePoliciesAny(guestPolicy, memberPolicy);
- * // If either policy allows, the action is permitted
- * ```
- */
-declare const mergePoliciesAny: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
 //#endregion
-export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
-//# sourceMappingURL=index.d.mts.map
+export { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when };
+//# sourceMappingURL=conditions.d.ts.map

package/dist/conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.d.ts","names":[],"sources":["../src/conditions.ts"],"mappings":";;;;;;;;;;;;;;;;;;cA+Ba,QAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBpB,MAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBvB,KAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;cAkBvB,MAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,YAAY,UAAU,SAAS;;;;;;;;;;;;;cAgBvB,MACV,iBAAiB,SAAS,gBAAgB,UACzC,KAAK,GACL,OAAO,SAAS,OACf,YAAY;;;;;;;;;;;;;;;;;;cAqBJ,wBAAyB,cAAc,OAAO,MACzD,OAAO,SACP,WAAW,cAAc,WACxB,IAAI;;;;UAwBG;GAEN;IAAmB,MAAM,OAAO;KAChC,iCACA,qBAEA,MAAM,OACL,YAAY,UAAU,SAAS;GAEhC;IAAmB,MAAM,QAAQ;KACjC,iCACA,qBACA,cAAc,OAAO,MAErB,MAAM,OACN,WAAW,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BvB,SAAS"}

package/dist/conditions.js

@@ -0,0 +1,180 @@
+//#region src/conditions.ts
+/**
+* Returns a policy function that always allows the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: allow(), // Always allow reading posts
+*     },
+*   },
+* });
+* ```
+*/
+const allow = () => () => "allow";
+/**
+* Returns a policy function that always denies the action.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       delete: deny(), // Never allow deleting posts
+*     },
+*   },
+* });
+* ```
+*/
+const deny = () => () => "deny";
+/**
+* Returns a policy function that allows or denies based on a condition.
+*
+* @example
+* ```ts
+* const policy = createPolicy({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+* ```
+*/
+const when = (condition) => (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
+/**
+* Returns a condition function that returns `true` if all conditions are met.
+*
+* @example
+* ```ts
+* const isOwnerAndPublished = and(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => resource.status === "published"
+* );
+*
+* rules: {
+*   post: {
+*     delete: when(isOwnerAndPublished),
+*   },
+* }
+* ```
+*/
+const and = (...conditions) => (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
+/**
+* Returns a condition function that returns `true` if any condition is met.
+*
+* @example
+* ```ts
+* const isOwnerOrAdmin = or(
+*   (ctx, action, resource) => ctx.user.id === resource.authorId,
+*   (ctx, action, resource) => ctx.user.role === "admin"
+* );
+*
+* rules: {
+*   post: {
+*     write: when(isOwnerOrAdmin),
+*   },
+* }
+* ```
+*/
+const or = (...conditions) => (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
+/**
+* Returns a condition function that negates another condition.
+*
+* @example
+* ```ts
+* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
+*
+* rules: {
+*   post: {
+*     like: when(isNotOwner), // Can only like posts you don't own
+*   },
+* }
+* ```
+*/
+const not = (condition) => (context, action, resource) => !condition(context, action, resource);
+/**
+* Returns a condition function that checks if a context property equals a value.
+*
+* @example
+* ```ts
+* rules: {
+*   post: {
+*     write: when(has("role", "admin")), // Only admins can write
+*   },
+* }
+* ```
+*/
+const has = (key, value) => (context) => context[key] === value;
+/**
+* Collects all roles including inherited ones from a role hierarchy.
+*
+* @example
+* ```ts
+* type Role = "guest" | "user" | "admin";
+*
+* const hierarchy: RoleHierarchy<Role> = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* collectInheritedRoles(["admin"], hierarchy);
+* // Returns: Set { "admin", "user", "guest" }
+* ```
+*/
+const collectInheritedRoles = (roles, hierarchy) => {
+	const inherited = /* @__PURE__ */ new Set();
+	const add = (role) => {
+		if (inherited.has(role)) return;
+		inherited.add(role);
+		const parents = hierarchy[role] ?? [];
+		for (const parent of parents) add(parent);
+	};
+	for (const role of roles) add(role);
+	return inherited;
+};
+/**
+* Returns a condition function that checks if the user has a specific role.
+* Supports role hierarchy for inherited permissions.
+*
+* @example
+* ```ts
+* // Without hierarchy
+* rules: {
+*   post: {
+*     delete: when(hasRole("admin")),
+*   },
+* }
+*
+* // With hierarchy
+* const hierarchy = {
+*   guest: [],
+*   user: ["guest"],
+*   admin: ["user"],
+* };
+*
+* rules: {
+*   post: {
+*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
+*   },
+* }
+* ```
+*/
+const hasRole = (role, hierarchy) => (context) => {
+	const userRoles = Array.isArray(context.role) ? context.role : [context.role];
+	if (hierarchy === void 0) return userRoles.includes(role);
+	return collectInheritedRoles(userRoles, hierarchy).has(role);
+};
+//#endregion
+export { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when };
+
+//# sourceMappingURL=conditions.js.map

package/dist/conditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.js","names":[],"sources":["../src/conditions.ts"],"sourcesContent":["/**\n * Policy and condition combinators: `allow`, `deny`, `when`, boolean\n * composition, and role helpers.\n *\n * @module @zap-studio/permit/conditions\n */\n\nimport type {\n  ConditionFn,\n  Context,\n  PolicyFn,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const parents = hierarchy[role] ?? [];\n    for (const parent of parents) {\n      add(parent);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.\n */\ninterface HasRoleFn {\n  <\n    TContext extends { role: Role | Role[] },\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    role: Role\n  ): ConditionFn<TContext, TAction, TResource>;\n  <\n    TContext extends { role: TRole | TRole[] },\n    TAction extends string = string,\n    TResource = unknown,\n    TRole extends Role = Role,\n  >(\n    role: TRole,\n    hierarchy: RoleHierarchy<TRole>\n  ): ConditionFn<TContext, TAction, TResource>;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;AA+BA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,UAAU,UAAU,SAAS,CAAC;EACpC,KAAK,MAAM,UAAU,SACnB,IAAI,MAAM;CAEd;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B"}

package/dist/{errors.d.mts → errors.d.ts}

@@ -18,4 +18,4 @@ declare class PolicyError extends Error {
 }
 //#endregion
 export { PolicyError };
-//# sourceMappingURL=errors.d.mts.map
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;cAUa,oBAAoB;;;;;;EAM/B,YAAY"}

package/dist/{errors.mjs → errors.js}

@@ -22,4 +22,4 @@ var PolicyError = class extends Error {
 //#endregion
 export { PolicyError };
 
-//# sourceMappingURL=errors.mjs.map
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for policy evaluation and configuration failures.\n *\n * @module @zap-studio/permit/errors\n */\n\n/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  /**\n   * Creates a policy error with a human-readable message.\n   *\n   * @param message - Error message describing the policy failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,IAAa,cAAb,cAAiC,MAAM;;;;;;CAMrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/{helpers.d.mts → helpers.d.ts}

@@ -29,4 +29,4 @@
 declare const assertNever: (value: never) => never;
 //#endregion
 export { assertNever };
-//# sourceMappingURL=helpers.d.mts.map
+//# sourceMappingURL=helpers.d.ts.map

package/dist/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","names":[],"sources":["../src/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4Ba,cAAe"}

package/dist/{helpers.mjs → helpers.js}

@@ -32,4 +32,4 @@ const assertNever = (value) => {
 //#endregion
 export { assertNever };
 
-//# sourceMappingURL=helpers.mjs.map
+//# sourceMappingURL=helpers.js.map

package/dist/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Helper utilities for permit consumers.\n *\n * @module @zap-studio/permit/helpers\n */\n\n/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${String(value)}`);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,eAAe,UAAwB;CAClD,MAAM,IAAI,MAAM,qBAAqB,OAAO,KAAK,GAAG;AACtD"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules } from "./types.js";
+import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
+import { PolicyError } from "./errors.js";
+import { assertNever } from "./helpers.js";
+import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
+export { type ActionPolicyMap, type Actions, type ConditionFn, type Context, type Decision, type InferAction, type InferPermission, type InferResource, type PermitConfig, type Policy, PolicyError, type PolicyFn, type Resources, type Role, type RoleHierarchy, type Rules, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };

package/dist/index.js

@@ -0,0 +1,5 @@
+import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
+import { PolicyError } from "./errors.js";
+import { assertNever } from "./helpers.js";
+import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
+export { PolicyError, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };

package/dist/policy.d.ts

@@ -0,0 +1,89 @@
+import { Actions, Context, PermitConfig, Policy, Resources } from "./types.js";
+//#region src/policy.d.ts
+/**
+ * Creates a type-safe policy from resource schemas, actions, and rules.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+ * import type { Resources, Actions } from "@zap-studio/permit/types";
+ *
+ * // Define resource schemas
+ * const resources = {
+ *   post: z.object({
+ *     id: z.string(),
+ *     authorId: z.string(),
+ *     visibility: z.enum(["public", "private"]),
+ *   }),
+ *   comment: z.object({
+ *     id: z.string(),
+ *     postId: z.string(),
+ *     authorId: z.string(),
+ *   }),
+ * } satisfies Resources;
+ *
+ * // Define actions per resource
+ * const actions = {
+ *   post: ["read", "write", "delete"],
+ *   comment: ["read", "write"],
+ * } as const satisfies Actions<typeof resources>;
+ *
+ * // Define context type
+ * type AppContext = { user: { id: string; role: string } };
+ *
+ * // Create the policy
+ * const policy = createPolicy<AppContext>({
+ *   resources,
+ *   actions,
+ *   rules: {
+ *     post: {
+ *       read: when((ctx, action, resource) => resource.visibility === "public"),
+ *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+ *       delete: deny(),
+ *     },
+ *     comment: {
+ *       read: allow(),
+ *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+ *     },
+ *   },
+ * });
+ *
+ * // Check permissions
+ * const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+ * await policy.can(ctx, "post:read", post); // true
+ * await policy.can(ctx, "post:write", post); // depends on ctx.user.id
+ * ```
+ */
+declare const createPolicy: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>) => Policy<TContext, TResources, TActions>;
+/**
+ * Merges multiple policies into one using "deny-overrides" strategy.
+ * If any policy denies, the merged policy denies. All must allow for the result to allow.
+ *
+ * @example
+ * ```ts
+ * const basePolicy = createPolicy({ ... });
+ * const adminPolicy = createPolicy({ ... });
+ *
+ * const merged = mergePolicies(basePolicy, adminPolicy);
+ * // Both policies must allow for the action to be permitted
+ * ```
+ */
+declare const mergePolicies: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+/**
+ * Merges multiple policies into one using "allow-overrides" strategy.
+ * If any policy allows, the merged policy allows. All must deny for the result to deny.
+ *
+ * @example
+ * ```ts
+ * const guestPolicy = createPolicy({ ... });
+ * const memberPolicy = createPolicy({ ... });
+ *
+ * const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+ * // If either policy allows, the action is permitted
+ * ```
+ */
+declare const mergePoliciesAny: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+//#endregion
+export { createPolicy, mergePolicies, mergePoliciesAny };
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyGa,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cA2InB,gBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cAgBnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}

package/dist/{index.mjs → policy.js}

@@ -1,181 +1,6 @@
-import { PolicyError } from "./errors.mjs";
+import { PolicyError } from "./errors.js";
 import { createStandardValidator } from "@zap-studio/validation";
-//#region src/index.ts
-/**
-* Returns a policy function that always allows the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: allow(), // Always allow reading posts
-*     },
-*   },
-* });
-* ```
-*/
-const allow = () => () => "allow";
-/**
-* Returns a policy function that always denies the action.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       delete: deny(), // Never allow deleting posts
-*     },
-*   },
-* });
-* ```
-*/
-const deny = () => () => "deny";
-/**
-* Returns a policy function that allows or denies based on a condition.
-*
-* @example
-* ```ts
-* const policy = createPolicy({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-* ```
-*/
-const when = (condition) => (context, action, resource) => condition(context, action, resource) ? "allow" : "deny";
-/**
-* Returns a condition function that returns `true` if all conditions are met.
-*
-* @example
-* ```ts
-* const isOwnerAndPublished = and(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => resource.status === "published"
-* );
-*
-* rules: {
-*   post: {
-*     delete: when(isOwnerAndPublished),
-*   },
-* }
-* ```
-*/
-const and = (...conditions) => (context, action, resource) => conditions.every((condition) => condition(context, action, resource));
-/**
-* Returns a condition function that returns `true` if any condition is met.
-*
-* @example
-* ```ts
-* const isOwnerOrAdmin = or(
-*   (ctx, action, resource) => ctx.user.id === resource.authorId,
-*   (ctx, action, resource) => ctx.user.role === "admin"
-* );
-*
-* rules: {
-*   post: {
-*     write: when(isOwnerOrAdmin),
-*   },
-* }
-* ```
-*/
-const or = (...conditions) => (context, action, resource) => conditions.some((condition) => condition(context, action, resource));
-/**
-* Returns a condition function that negates another condition.
-*
-* @example
-* ```ts
-* const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);
-*
-* rules: {
-*   post: {
-*     like: when(isNotOwner), // Can only like posts you don't own
-*   },
-* }
-* ```
-*/
-const not = (condition) => (context, action, resource) => !condition(context, action, resource);
-/**
-* Returns a condition function that checks if a context property equals a value.
-*
-* @example
-* ```ts
-* rules: {
-*   post: {
-*     write: when(has("role", "admin")), // Only admins can write
-*   },
-* }
-* ```
-*/
-const has = (key, value) => (context) => context[key] === value;
-/**
-* Collects all roles including inherited ones from a role hierarchy.
-*
-* @example
-* ```ts
-* type Role = "guest" | "user" | "admin";
-*
-* const hierarchy: RoleHierarchy<Role> = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-*
-* collectInheritedRoles(["admin"], hierarchy);
-* // Returns: Set { "admin", "user", "guest" }
-* ```
-*/
-const collectInheritedRoles = (roles, hierarchy) => {
-	const inherited = /* @__PURE__ */ new Set();
-	const add = (role) => {
-		if (inherited.has(role)) return;
-		inherited.add(role);
-		const parents = hierarchy[role] ?? [];
-		for (const parent of parents) add(parent);
-	};
-	for (const role of roles) add(role);
-	return inherited;
-};
-/**
-* Returns a condition function that checks if the user has a specific role.
-* Supports role hierarchy for inherited permissions.
-*
-* @example
-* ```ts
-* // Without hierarchy
-* rules: {
-*   post: {
-*     delete: when(hasRole("admin")),
-*   },
-* }
-*
-* // With hierarchy
-* const hierarchy = {
-*   guest: [],
-*   user: ["guest"],
-*   admin: ["user"],
-* };
-*
-* rules: {
-*   post: {
-*     read: when(hasRole("guest", hierarchy)), // Admins and users can also read
-*   },
-* }
-* ```
-*/
-const hasRole = (role, hierarchy) => (context) => {
-	const userRoles = Array.isArray(context.role) ? context.role : [context.role];
-	if (hierarchy === void 0) return userRoles.includes(role);
-	return collectInheritedRoles(userRoles, hierarchy).has(role);
-};
+//#region src/policy.ts
 /**
 * Splits a typed `resource:action` permission string into its parts.
 * Returns `null` when the string is malformed (missing/empty part or extra segments).
@@ -323,6 +148,6 @@ const mergePolicies = (...policies) => mergePoliciesWithStrategy(policies, "deny
 */
 const mergePoliciesAny = (...policies) => mergePoliciesWithStrategy(policies, "allow-overrides");
 //#endregion
-export { allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+export { createPolicy, mergePolicies, mergePoliciesAny };
 
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["/**\n * Policy creation and composition: `createPolicy`, `mergePolicies`, and\n * `mergePoliciesAny`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra segments).\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TActions, K> & string}`\n): { action: InferAction<TActions, K>; resourceType: K } | null => {\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Parsed permission strings are constrained by the typed permission template.\n    resourceType: resourceTypeValue as K,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n    for (const policy of policies) {\n      // oxlint-disable-next-line no-await-in-loop -- Policies must evaluate sequentially to preserve short-circuit semantics.\n      const allowed = await policy.can(context, permission, resource);\n\n      if (strategy === \"allow-overrides\" && allowed) {\n        return true;\n      }\n      if (strategy === \"deny-overrides\" && !allowed) {\n        return false;\n      }\n    }\n    return strategy === \"deny-overrides\";\n  },\n});\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePolicies = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"deny-overrides\");\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesAny = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"allow-overrides\");\n"],"mappings":";;;;;;;AAyBA,MAAM,mBAKJ,eACiE;CACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,GAEd,OAAO;CAGT,OAAO;EACL,QAAQ;EAER,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,GACzE;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,OAAO,SAAS,SAAS,QAAQ,QAAQ,MAAM;EACjD,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,GAChF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,UACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAET,KAAK,MAAM,UAAU,UAAU;EAE7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ;EAE9D,IAAI,aAAa,qBAAqB,SACpC,OAAO;EAET,IAAI,aAAa,oBAAoB,CAAC,SACpC,OAAO;CAEX;CACA,OAAO,aAAa;AACtB,EACF;;;;;;;;;;;;;;AAeA,MAAa,iBAKX,GAAG,aAEH,0BAA0B,UAAU,gBAAgB;;;;;;;;;;;;;;AAetD,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,iBAAiB"}

package/dist/{types.d.mts → types.d.ts}

@@ -139,4 +139,4 @@ interface Policy<TContext extends Context, TResources extends Resources = Resour
 }
 //#endregion
 export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };
-//# sourceMappingURL=types.d.mts.map
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;KAaY;;;;;KAMA,QAAQ,sBAAsB;;;;KAK9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;KAMF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;KAKhC,YACV,iBAAiB,mCACjB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAExB,WAAW,mBACJ,cAAc,cAAc,YAAY,UAAU,uBACpD,mBAAmB;;;;KAKf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;KAKrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;KAKvC,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;KAO7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;EAE/C,SAAS;EACT,WAAW;EACX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,UAAU,eACnD,UAAU,cAAc,YAAY,OACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zap-studio/permit",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "private": false,
   "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
   "keywords": [
@@ -31,30 +31,29 @@
   ],
   "type": "module",
   "sideEffects": false,
-  "types": "./dist/index.d.mts",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./dist/index.mjs",
-    "./errors": "./dist/errors.mjs",
-    "./helpers": "./dist/helpers.mjs",
-    "./types": "./dist/types.mjs",
+    ".": "./dist/index.js",
+    "./conditions": "./dist/conditions.js",
+    "./errors": "./dist/errors.js",
+    "./helpers": "./dist/helpers.js",
+    "./policy": "./dist/policy.js",
+    "./types": "./dist/types.js",
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "0.3.5"
+    "@zap-studio/validation": "workspace:*"
   },
   "devDependencies": {
-    "tsdown": "^0.22.4",
-    "typescript": "^7.0.2",
-    "vitest": "^4.1.10",
-    "@zap-studio/typescript": "0.0.0"
+    "@zap-studio/typescript": "workspace:*",
+    "tsdown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "scripts": {
-    "build": "tsdown --config ./tsdown.config.ts"
   }
-}
+}

package/dist/errors.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;cAUa,oBAAoB;;;;;;EAM/B,YAAY"}

package/dist/errors.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for policy evaluation and configuration failures.\n *\n * @module @zap-studio/permit/errors\n */\n\n/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  /**\n   * Creates a policy error with a human-readable message.\n   *\n   * @param message - Error message describing the policy failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,IAAa,cAAb,cAAiC,MAAM;;;;;;CAMrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/helpers.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.d.mts","names":[],"sources":["../src/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4Ba,cAAe"}

package/dist/helpers.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.mjs","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Helper utilities for permit consumers.\n *\n * @module @zap-studio/permit/helpers\n */\n\n/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${String(value)}`);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,eAAe,UAAwB;CAClD,MAAM,IAAI,MAAM,qBAAqB,OAAO,KAAK,GAAG;AACtD"}

package/dist/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;cAwCa,QAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBpB,MAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBvB,KAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;cAkBvB,MAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,YAAY,UAAU,SAAS;;;;;;;;;;;;;cAgBvB,MACV,iBAAiB,SAAS,gBAAgB,UACzC,KAAK,GACL,OAAO,SAAS,OACf,YAAY;;;;;;;;;;;;;;;;;;cAqBJ,wBAAyB,cAAc,OAAO,MACzD,OAAO,SACP,WAAW,cAAc,WACxB,IAAI;;;;UAwBG;GAEN;IAAmB,MAAM,OAAO;KAChC,iCACA,qBAEA,MAAM,OACL,YAAY,UAAU,SAAS;GAEhC;IAAmB,MAAM,QAAQ;KACjC,iCACA,qBACA,cAAc,OAAO,MAErB,MAAM,OACN,WAAW,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BvB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsGT,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cA2InB,gBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cAgBnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * Policy composition and evaluation utilities.\n *\n * @module @zap-studio/permit\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  ConditionFn,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  PolicyFn,\n  Resources,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const parents = hierarchy[role] ?? [];\n    for (const parent of parents) {\n      add(parent);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.\n */\ninterface HasRoleFn {\n  <\n    TContext extends { role: Role | Role[] },\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    role: Role\n  ): ConditionFn<TContext, TAction, TResource>;\n  <\n    TContext extends { role: TRole | TRole[] },\n    TAction extends string = string,\n    TResource = unknown,\n    TRole extends Role = Role,\n  >(\n    role: TRole,\n    hierarchy: RoleHierarchy<TRole>\n  ): ConditionFn<TContext, TAction, TResource>;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra segments).\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TActions, K> & string}`\n): { action: InferAction<TActions, K>; resourceType: K } | null => {\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Parsed permission strings are constrained by the typed permission template.\n    resourceType: resourceTypeValue as K,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n    for (const policy of policies) {\n      // oxlint-disable-next-line no-await-in-loop -- Policies must evaluate sequentially to preserve short-circuit semantics.\n      const allowed = await policy.can(context, permission, resource);\n\n      if (strategy === \"allow-overrides\" && allowed) {\n        return true;\n      }\n      if (strategy === \"deny-overrides\" && !allowed) {\n        return false;\n      }\n    }\n    return strategy === \"deny-overrides\";\n  },\n});\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePolicies = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"deny-overrides\");\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesAny = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"allow-overrides\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwCA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,UAAU,UAAU,SAAS,CAAC;EACpC,KAAK,MAAM,UAAU,SACnB,IAAI,MAAM;CAEd;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B;;;;;AAMF,MAAM,mBAKJ,eACiE;CACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,GAEd,OAAO;CAGT,OAAO;EACL,QAAQ;EAER,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,GACzE;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,OAAO,SAAS,SAAS,QAAQ,QAAQ,MAAM;EACjD,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,GAChF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,UACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAET,KAAK,MAAM,UAAU,UAAU;EAE7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ;EAE9D,IAAI,aAAa,qBAAqB,SACpC,OAAO;EAET,IAAI,aAAa,oBAAoB,CAAC,SACpC,OAAO;CAEX;CACA,OAAO,aAAa;AACtB,EACF;;;;;;;;;;;;;;AAeA,MAAa,iBAKX,GAAG,aAEH,0BAA0B,UAAU,gBAAgB;;;;;;;;;;;;;;AAetD,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,iBAAiB"}

package/dist/types.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;KAaY;;;;;KAMA,QAAQ,sBAAsB;;;;KAK9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;KAMF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;KAKhC,YACV,iBAAiB,mCACjB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAExB,WAAW,mBACJ,cAAc,cAAc,YAAY,UAAU,uBACpD,mBAAmB;;;;KAKf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;KAKrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;KAKvC,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;KAO7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;EAE/C,SAAS;EACT,WAAW;EACX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,UAAU,eACnD,UAAU,cAAc,YAAY,OACjC"}

package/dist/types.mjs

@@ -1 +0,0 @@
-export {};