@zap-studio/permit 0.3.4 → 1.1.0

package/CHANGELOG.md

@@ -1,106 +1,118 @@
-## @zap-studio/permit@0.3.4
+# Changelog
 
-### Tree-shakeable root re-exports
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.1.0]
+
+### Added
+
+`createPolicy(...)` gains an optional `logger?: Logger` option (from `@zap-studio/logger`). When provided, it logs allow decisions at `debug` and deny decisions at `info`. Internal-error warnings (resource validation and policy evaluation errors) route through the logger's `warn` instead of `console.warn` when a logger is provided; without one, they still print via `console.warn` as before. See [Logging](https://www.zapstudio.dev/permit/logging).
+
+## [1.0.0]
+
+### Changed
+
+- Clarified tree-shakeable design in the package description and README (no code change).
+
+### Removed
+
+`assertNever` is no longer exported — it had no internal consumers and existed only as a generic exhaustiveness-check convenience. Use your own `never`-typed helper if you relied on it.
+
+### Fixed
+
+Neither merge strategy short-circuits anymore. All policies now run concurrently via `Promise.allSettled`, and every policy is invoked regardless of outcome, for both `mergePoliciesSome` (allow) and `mergePoliciesEvery` (deny). A rejecting policy no longer sinks the whole check — it's treated as a deny (`false`) and logged with `console.warn`, consistent with how `createPolicy` handles internal validation/evaluation errors.
+
+## [0.3.4]
+
+### Added
 
 The package root now re-exports the full public API, so everything can be imported from `@zap-studio/permit` directly, including `PolicyError`, `assertNever`, and all public types. All exports are side-effect free and tree-shakeable; granular subpath imports keep working.
 
 - The implementation moved out of the entrypoint into two new subpaths: `./conditions` (`allow`, `deny`, `when`, `and`, `or`, `not`, `has`, `hasRole`, `collectInheritedRoles`) and `./policy` (`createPolicy`, `mergePolicies`, `mergePoliciesAny`).
 
-## @zap-studio/permit@0.3.3
+## [0.3.3]
 
-### Migrate to ultracite lint/format
+### Changed
 
 Internal formatting and lint cleanup only. No public API or behavior change.
 
-# @zap-studio/permit
+## [0.3.2]
 
-## 0.3.2
-
-### Dependencies
+### Changed
 
 - Updated dependency `@zap-studio/validation` to `0.3.4`.
 
-## 0.3.1
-
-### Fixed
-
-- d10d8c4: Removed the TanStack Intent-specific authoring helper from the package surface.
-- d9ba7d1: Reworked the packaged permit skill content.
+## [0.3.1]
 
 ### Changed
 
 - 5fa58b1: Reduced policy evaluation complexity by extracting permission parsing and merge strategy helpers without changing the `policy.can(...)` API.
 - abfda4b: Cleaned up public option typings by removing redundant `| undefined` unions from package types.
 - 9f31f87: Switched the package build to ESNext-aligned output and updated package tooling and publish metadata.
+- d9ba7d1: Reworked the packaged permit skill content.
+- Updated dependency `@zap-studio/validation` to `0.3.3`.
 
-### Dependencies
+### Removed
 
-- Updated dependency `@zap-studio/validation` to `0.3.3`.
+- d10d8c4: Removed the TanStack Intent-specific authoring helper from the package surface.
 
-## 0.3.0
+## [0.3.0]
 
-### Minor Changes
+### Changed
 
-- fe60f55: Change `policy.can()` to use a single permission string plus the resource object.
+- fe60f55: **Breaking:** Changed `policy.can()` to use a single permission string plus the resource object.
 
   `policy.can(ctx, "read", "post", post)` is replaced by `policy.can(ctx, "post:read", post)`.
 
   This is a breaking API change in the `0.x` line. Docs and examples now use the new permission-string format consistently.
 
-## 0.2.2
+## [0.2.2]
 
-### Patch Changes
+### Changed
 
 - e26293e: Updated dependencies.
   - @zap-studio/validation@0.3.2
 
-## 0.2.1
+## [0.2.1]
 
-### Patch Changes
+### Changed
 
 - 5ea3d3b: Updated dependencies.
   - @zap-studio/validation@0.3.1
 
-## 0.2.0
+## [0.2.0]
 
 ### Changed
 
 - f0f503e: Made policy evaluation asynchronous by default.
-
-### Breaking Changes
-
-- f0f503e: `policy.can(...)` now returns `Promise<boolean>`.
-- f0f503e: `createPolicy()` now uses async-safe Standard Schema validation for resource schemas (including async resource schemas); this is not a separate `Policy` schema API.
-- f0f503e: The `Policy` interface changed so `can()` is async, and `mergePolicies`/`mergePoliciesAny` are async accordingly.
+- f0f503e: **Breaking:** `policy.can(...)` now returns `Promise<boolean>`.
+- f0f503e: **Breaking:** `createPolicy()` now uses async-safe Standard Schema validation for resource schemas (including async resource schemas); this is not a separate `Policy` schema API.
+- f0f503e: **Breaking:** The `Policy` interface changed so `can()` is async, and `mergePolicies`/`mergePoliciesAny` are async accordingly.
 - Action required: callers must `await policy.can(...)` and handle `mergePolicies`/`mergePoliciesAny` as async operations; also account for async-safe resource schema validation in `createPolicy()`.
-
-### Dependencies
-
 - f75b984: Updated dependency `@zap-studio/validation` to `0.3.0`.
 
-## 0.1.3
+## [0.1.3]
 
-### Dependencies
+### Changed
 
 - e4542bb: Updated dependency `@zap-studio/validation` to `0.2.1`.
 
-## 0.1.2
+## [0.1.2]
 
 ### Changed
 
 - 2de8183: Adopted shared synchronous Standard Schema validator utilities from `@zap-studio/validation` for resource schema validation in `createPolicy`.
-
-### Dependencies
-
 - 2de8183: Updated dependency `@zap-studio/validation` to `0.2.0`.
 
-## 0.1.1
+## [0.1.1]
 
 ### Fixed
 
 - 907d903: Added runtime resource validation and fail-closed behavior, including deny-by-default when merges are invoked with no policies.
 
-## 0.1.0
+## [0.1.0]
 
 ### Added
 

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 alexandretrotel
+Copyright (c) 2026 Alexandre Trotel
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -2,14 +2,7 @@
 
 A type-safe, declarative authorization library for TypeScript with [Standard Schema](https://standardschema.dev/) support.
 
-## Features
-
-- Full type safety with TypeScript
-- Standard Schema support (Zod, Valibot, ArkType, etc.)
-- Declarative policy definitions
-- Role hierarchy support
-- Composable conditions (`and`, `or`, `not`)
-- Policy merging strategies
+Full documentation: [zapstudio.dev/permit](https://www.zapstudio.dev/permit)
 
 ## Installation
 
@@ -17,120 +10,90 @@ A type-safe, declarative authorization library for TypeScript with [Standard Sch
 npm install @zap-studio/permit
 ```
 
+You also need a schema library that implements [Standard Schema](https://standardschema.dev/), such as Zod, Valibot, or ArkType.
+
+## Features
+
+- **Full type safety** — actions, resources, and permissions are inferred from your schemas and `satisfies` declarations.
+- **Standard Schema support** via `Resources` — works with Zod, Valibot, ArkType, or any compatible library.
+- **Declarative policies** through `createPolicy(...)` with `allow()`, `deny()`, and `when(condition)`.
+- **Role hierarchy support** via `hasRole(role, hierarchy?)`, with inheritance resolved by `collectInheritedRoles`.
+- **Composable conditions** via `and`, `or`, and `not`.
+- **Policy merging strategies** via `mergePoliciesAnd` and `mergePoliciesOr`.
+- **Structured errors** with `PolicyError` for invalid configuration or evaluation failures.
+- **Optional logging** through `createPolicy({ logger })` ([`@zap-studio/logger`](https://www.npmjs.com/package/@zap-studio/logger)) — omit it and there's zero added logging overhead.
+- **Tree-shakeable** — policies and conditions are plain functions; unused exports are dropped by any modern bundler.
+
 ## Quick Start
 
 ```ts
 import { z } from "zod";
+import { ConsoleLogger } from "@zap-studio/logger";
 import { createPolicy, allow, deny, when } from "@zap-studio/permit";
 import type { Resources, Actions } from "@zap-studio/permit";
 
-// 1. Define your resource schemas
 const resources = {
-  post: z.object({
-    id: z.string(),
-    authorId: z.string(),
-    visibility: z.enum(["public", "private"]),
-  }),
-  comment: z.object({
-    id: z.string(),
-    postId: z.string(),
-    authorId: z.string(),
-  }),
+  post: z.object({ id: z.string(), authorId: z.string() }),
 } satisfies Resources;
 
-// 2. Define actions per resource
 const actions = {
   post: ["read", "write", "delete"],
-  comment: ["read", "write"],
 } as const satisfies Actions<typeof resources>;
 
-// 3. Define your context type
-type AppContext = {
-  user: { id: string; role: "guest" | "user" | "admin" };
-};
+type AppContext = { user: { id: string } };
+
+const logger = new ConsoleLogger({ minLevel: "debug" });
 
-// 4. Create your policy
 const policy = createPolicy<AppContext>({
   resources,
   actions,
   rules: {
     post: {
-      read: when((ctx, action, resource) => resource.visibility === "public"),
-      write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-      delete: deny(),
-    },
-    comment: {
       read: allow(),
       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+      delete: deny(),
     },
   },
+  logger,
 });
 
-// 5. Check permissions
-const ctx: AppContext = { user: { id: "user-1", role: "user" } };
-const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+const ctx: AppContext = { user: { id: "user-1" } };
+const post = { id: "1", authorId: "user-1" };
 
-await policy.can(ctx, "post:read", post); // true
-await policy.can(ctx, "post:write", post); // true (user is author)
-await policy.can(ctx, "post:delete", post); // false (always denied)
+await policy.can(ctx, "post:write", post); // true, inferred as boolean
 ```
 
-## API Reference
-
-### Policy Builders
+## Declarative Policies
 
-#### `allow()`
-
-Returns a policy function that always allows the action.
+Through `createPolicy(...)` with `allow()`, `deny()`, and `when(condition)`.
 
 ```ts
 rules: {
   post: {
-    read: allow(), // Anyone can read
+    read: allow(),
+    delete: deny(),
+    write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
   },
 }
 ```
 
-#### `deny()`
+## Role Hierarchy Support
 
-Returns a policy function that always denies the action.
+Via `hasRole(role, hierarchy?)`, with inheritance resolved by `collectInheritedRoles`.
 
 ```ts
-rules: {
-  post: {
-    delete: deny(), // No one can delete
-  },
-}
-```
-
-#### `when(condition)`
-
-Returns a policy function that allows or denies based on a condition.
+const hierarchy = { guest: [], user: ["guest"], admin: ["user"] };
 
-```ts
 rules: {
   post: {
-    write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+    read: when(hasRole("guest", hierarchy)), // admins and users inherit guest access
   },
 }
 ```
 
-### Condition Combinators
+## Composable Conditions
 
-#### `and(...conditions)`
-
-Returns a condition that is true only if all conditions are true.
-
-```ts
-const isOwnerAndPublished = and(
-  (ctx, action, resource) => ctx.user.id === resource.authorId,
-  (ctx, action, resource) => resource.status === "published"
-);
-```
-
-#### `or(...conditions)`
-
-Returns a condition that is true if any condition is true.
+Via `and`, `or`, and `not`.
 
 ```ts
 const isOwnerOrAdmin = or(
@@ -139,134 +102,54 @@ const isOwnerOrAdmin = or(
 );
 ```
 
-#### `not(condition)`
+## Policy Merging Strategies
 
-Returns a condition that negates another condition.
+Via `mergePoliciesAnd` and `mergePoliciesOr`.
 
 ```ts
-const isNotOwner = not(
-  (ctx, action, resource) => ctx.user.id === resource.authorId
-);
+const merged = mergePoliciesAnd(basePolicy, restrictivePolicy);
 ```
 
-### Context Helpers
-
-#### `has(key, value)`
-
-Checks if a context property equals a specific value.
-
-```ts
-rules: {
-  post: {
-    write: when(has("role", "admin")),
-  },
-}
-```
-
-#### `hasRole(role, hierarchy?)`
-
-Checks if the user has a specific role, with optional hierarchy support.
-
-```ts
-const hierarchy = {
-  guest: [],
-  user: ["guest"],
-  admin: ["user"],
-};
-
-rules: {
-  post: {
-    read: when(hasRole("guest", hierarchy)), // Admins and users inherit guest permissions
-  },
-}
-```
-
-### Policy Merging
-
-#### `mergePolicies(...policies)`
-
-Merges policies with "deny-overrides" strategy. All policies must allow for the action to be permitted.
-
-```ts
-const merged = mergePolicies(basePolicy, restrictivePolicy);
-```
-
-#### `mergePoliciesAny(...policies)`
-
-Merges policies with "allow-overrides" strategy. Any policy allowing is sufficient.
-
-```ts
-const merged = mergePoliciesAny(guestPolicy, memberPolicy);
-```
-
-## Type Helpers
-
-### `Resources`
+## Standard Schema Support
 
-Type helper for defining resource schemas with `satisfies`.
+Works with Zod, Valibot, ArkType, or any compatible library.
 
 ```ts
+// Zod, Valibot, ArkType, or any Standard Schema-compatible library
 const resources = {
   post: z.object({ id: z.string() }),
 } satisfies Resources;
 ```
 
-### `Actions<TResources>`
+## Structured Errors
 
-Type helper for defining actions with `satisfies`. Ensures action keys match resource keys.
+`PolicyError` for invalid configuration or evaluation failures.
 
 ```ts
-const actions = {
-  post: ["read", "write"],
-} as const satisfies Actions<typeof resources>;
-```
-
-### `InferResource<TResources, K>`
+import { PolicyError } from "@zap-studio/permit";
 
-Infers the TypeScript type for a specific resource.
-
-```ts
-type Post = InferResource<typeof resources, "post">;
-// { id: string }
-```
-
-### `InferAction<TActions, K>`
-
-Infers the action union type for a specific resource.
-
-```ts
-type PostAction = InferAction<typeof actions, "post">;
-// "read" | "write"
+try {
+  const policy = createPolicy(config);
+  await policy.can(ctx, "post:read", post);
+} catch (error) {
+  if (error instanceof PolicyError) console.error(error.message);
+}
 ```
 
-## Standard Schema Support
+## Logging
 
-This library uses [Standard Schema](https://standardschema.dev/) for resource validation, which means it works with any compatible schema library:
-
-- [Zod](https://zod.dev/)
-- [Valibot](https://valibot.dev/)
-- [ArkType](https://arktype.io/)
+Pass a `logger?: Logger` from [`@zap-studio/logger`](https://www.npmjs.com/package/@zap-studio/logger) to `createPolicy(...)` to observe allow/deny decisions. Omit it and only the pre-existing internal-error warnings still print, unchanged.
 
 ```ts
-// With Zod
-import { z } from "zod";
-const resources = {
-  post: z.object({ id: z.string() }),
-} satisfies Resources;
-
-// With Valibot
-import * as v from "valibot";
-const resources = {
-  post: v.object({ id: v.string() }),
-} satisfies Resources;
+import { ConsoleLogger } from "@zap-studio/logger";
+import { createPolicy } from "@zap-studio/permit";
 
-// With ArkType
-import { type } from "arktype";
-const resources = {
-  post: type({ id: "string" }),
-} satisfies Resources;
+const logger = new ConsoleLogger({ minLevel: "debug" });
+const policy = createPolicy({ resources, actions, rules, logger });
 ```
 
+Allow decisions log at `debug`, deny decisions log at `info`. Resource validation and policy evaluation errors log at `warn` through the logger when one is provided, instead of `console.warn`.
+
 ## Runtime Support
 
 | Runtime            | Minimum version                                  |
@@ -278,3 +161,7 @@ const resources = {
 | Browsers           | Latest evergreen (Chrome, Edge, Firefox, Safari) |
 
 The package ships standard ESM only and uses no runtime-specific APIs. Deno 1.42 is the first release that can install packages from JSR (`deno add jsr:@zap-studio/permit`).
+
+## License
+
+MIT

package/dist/conditions.d.ts

@@ -1,4 +1,4 @@
-import { ConditionFn, Context, PolicyFn, Role, RoleHierarchy } from "./types.js";
+import { ConditionFn, Context, HasRoleFn, PolicyFn, Role, RoleHierarchy } from "./types.js";
 //#region src/conditions.d.ts
 /**
  * Returns a policy function that always allows the action.
@@ -133,17 +133,6 @@ declare const has: <TContext extends Context, K extends keyof TContext>(key: K,
  * ```
  */
 declare const collectInheritedRoles: <TRole extends Role = Role>(roles: TRole[], hierarchy: RoleHierarchy<TRole>) => Set<TRole>;
-/**
- * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.
- */
-interface HasRoleFn {
-  <TContext extends {
-    role: Role | Role[];
-  }, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
-  <TContext extends {
-    role: TRole | TRole[];
-  }, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
-}
 /**
  * Returns a condition function that checks if the user has a specific role.
  * Supports role hierarchy for inherited permissions.

package/dist/conditions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditions.d.ts","names":[],"sources":["../src/conditions.ts"],"mappings":";;;;;;;;;;;;;;;;;;cA+Ba,QAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBpB,MAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBvB,KAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;cAkBvB,MAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,YAAY,UAAU,SAAS;;;;;;;;;;;;;cAgBvB,MACV,iBAAiB,SAAS,gBAAgB,UACzC,KAAK,GACL,OAAO,SAAS,OACf,YAAY;;;;;;;;;;;;;;;;;;cAqBJ,wBAAyB,cAAc,OAAO,MACzD,OAAO,SACP,WAAW,cAAc,WACxB,IAAI;;;;UAwBG;GAEN;IAAmB,MAAM,OAAO;KAChC,iCACA,qBAEA,MAAM,OACL,YAAY,UAAU,SAAS;GAEhC;IAAmB,MAAM,QAAQ;KACjC,iCACA,qBACA,cAAc,OAAO,MAErB,MAAM,OACN,WAAW,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BvB,SAAS"}
+{"version":3,"file":"conditions.d.ts","names":[],"sources":["../src/conditions.ts"],"mappings":";;;;;;;;;;;;;;;;;;cAgCa,QAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,0BACG,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;cAoBtB,OAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,SAAS,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBpB,MAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;cAqBvB,KAET,iBAAiB,SACjB,iCACA,wBAEG,YAAY,YAAY,UAAU,SAAS,iBAC7C,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;cAkBvB,MAET,iBAAiB,SACjB,iCACA,qBAEA,WAAW,YAAY,UAAU,SAAS,eACzC,YAAY,UAAU,SAAS;;;;;;;;;;;;;cAgBvB,MACV,iBAAiB,SAAS,gBAAgB,UACzC,KAAK,GACL,OAAO,SAAS,OACf,YAAY;;;;;;;;;;;;;;;;;;cAqBJ,wBAAyB,cAAc,OAAO,MACzD,OAAO,SACP,WAAW,cAAc,WACxB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgDM,SAAS"}

package/dist/conditions.js

@@ -136,8 +136,8 @@ const collectInheritedRoles = (roles, hierarchy) => {
 	const add = (role) => {
 		if (inherited.has(role)) return;
 		inherited.add(role);
-		const parents = hierarchy[role] ?? [];
-		for (const parent of parents) add(parent);
+		const baseRoles = hierarchy[role] ?? [];
+		for (const baseRole of baseRoles) add(baseRole);
 	};
 	for (const role of roles) add(role);
 	return inherited;

package/dist/conditions.js.map

@@ -1 +1 @@
-{"version":3,"file":"conditions.js","names":[],"sources":["../src/conditions.ts"],"sourcesContent":["/**\n * Policy and condition combinators: `allow`, `deny`, `when`, boolean\n * composition, and role helpers.\n *\n * @module @zap-studio/permit/conditions\n */\n\nimport type {\n  ConditionFn,\n  Context,\n  PolicyFn,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const parents = hierarchy[role] ?? [];\n    for (const parent of parents) {\n      add(parent);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.\n */\ninterface HasRoleFn {\n  <\n    TContext extends { role: Role | Role[] },\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    role: Role\n  ): ConditionFn<TContext, TAction, TResource>;\n  <\n    TContext extends { role: TRole | TRole[] },\n    TAction extends string = string,\n    TResource = unknown,\n    TRole extends Role = Role,\n  >(\n    role: TRole,\n    hierarchy: RoleHierarchy<TRole>\n  ): ConditionFn<TContext, TAction, TResource>;\n}\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;AA+BA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,UAAU,UAAU,SAAS,CAAC;EACpC,KAAK,MAAM,UAAU,SACnB,IAAI,MAAM;CAEd;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B"}
+{"version":3,"file":"conditions.js","names":[],"sources":["../src/conditions.ts"],"sourcesContent":["/**\n * Policy and condition combinators: `allow`, `deny`, `when`, boolean\n * composition, and role helpers.\n *\n * @module @zap-studio/permit/conditions\n */\n\nimport type {\n  ConditionFn,\n  Context,\n  HasRoleFn,\n  PolicyFn,\n  Role,\n  RoleHierarchy,\n} from \"./types.js\";\n\n/**\n * Returns a policy function that always allows the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: allow(), // Always allow reading posts\n *     },\n *   },\n * });\n * ```\n */\nexport const allow =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"allow\";\n\n/**\n * Returns a policy function that always denies the action.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       delete: deny(), // Never allow deleting posts\n *     },\n *   },\n * });\n * ```\n */\nexport const deny =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(): PolicyFn<TContext, TAction, TResource> =>\n  () =>\n    \"deny\";\n\n/**\n * Returns a policy function that allows or denies based on a condition.\n *\n * @example\n * ```ts\n * const policy = createPolicy({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n * ```\n */\nexport const when =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): PolicyFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    condition(context, action, resource) ? \"allow\" : \"deny\";\n\n/**\n * Returns a condition function that returns `true` if all conditions are met.\n *\n * @example\n * ```ts\n * const isOwnerAndPublished = and(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => resource.status === \"published\"\n * );\n *\n * rules: {\n *   post: {\n *     delete: when(isOwnerAndPublished),\n *   },\n * }\n * ```\n */\nexport const and =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.every((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that returns `true` if any condition is met.\n *\n * @example\n * ```ts\n * const isOwnerOrAdmin = or(\n *   (ctx, action, resource) => ctx.user.id === resource.authorId,\n *   (ctx, action, resource) => ctx.user.role === \"admin\"\n * );\n *\n * rules: {\n *   post: {\n *     write: when(isOwnerOrAdmin),\n *   },\n * }\n * ```\n */\nexport const or =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    ...conditions: ConditionFn<TContext, TAction, TResource>[]\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    conditions.some((condition) => condition(context, action, resource));\n\n/**\n * Returns a condition function that negates another condition.\n *\n * @example\n * ```ts\n * const isNotOwner = not((ctx, action, resource) => ctx.user.id === resource.authorId);\n *\n * rules: {\n *   post: {\n *     like: when(isNotOwner), // Can only like posts you don't own\n *   },\n * }\n * ```\n */\nexport const not =\n  <\n    TContext extends Context,\n    TAction extends string = string,\n    TResource = unknown,\n  >(\n    condition: ConditionFn<TContext, TAction, TResource>\n  ): ConditionFn<TContext, TAction, TResource> =>\n  (context, action, resource) =>\n    !condition(context, action, resource);\n\n/**\n * Returns a condition function that checks if a context property equals a value.\n *\n * @example\n * ```ts\n * rules: {\n *   post: {\n *     write: when(has(\"role\", \"admin\")), // Only admins can write\n *   },\n * }\n * ```\n */\nexport const has =\n  <TContext extends Context, K extends keyof TContext>(\n    key: K,\n    value: TContext[K]\n  ): ConditionFn<TContext> =>\n  (context) =>\n    context[key] === value;\n\n/**\n * Collects all roles including inherited ones from a role hierarchy.\n *\n * @example\n * ```ts\n * type Role = \"guest\" | \"user\" | \"admin\";\n *\n * const hierarchy: RoleHierarchy<Role> = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * collectInheritedRoles([\"admin\"], hierarchy);\n * // Returns: Set { \"admin\", \"user\", \"guest\" }\n * ```\n */\nexport const collectInheritedRoles = <TRole extends Role = Role>(\n  roles: TRole[],\n  hierarchy: RoleHierarchy<TRole>\n): Set<TRole> => {\n  const inherited = new Set<TRole>();\n\n  const add = (role: TRole): void => {\n    if (inherited.has(role)) {\n      return;\n    }\n\n    inherited.add(role);\n    const baseRoles = hierarchy[role] ?? [];\n    for (const baseRole of baseRoles) {\n      add(baseRole);\n    }\n  };\n\n  for (const role of roles) {\n    add(role);\n  }\n  return inherited;\n};\n\n/**\n * Returns a condition function that checks if the user has a specific role.\n * Supports role hierarchy for inherited permissions.\n *\n * @example\n * ```ts\n * // Without hierarchy\n * rules: {\n *   post: {\n *     delete: when(hasRole(\"admin\")),\n *   },\n * }\n *\n * // With hierarchy\n * const hierarchy = {\n *   guest: [],\n *   user: [\"guest\"],\n *   admin: [\"user\"],\n * };\n *\n * rules: {\n *   post: {\n *     read: when(hasRole(\"guest\", hierarchy)), // Admins and users can also read\n *   },\n * }\n * ```\n */\nexport const hasRole: HasRoleFn =\n  (\n    role: Role,\n    hierarchy?: RoleHierarchy\n  ): ConditionFn<{ role: Role | Role[] }> =>\n  (context) => {\n    const userRoles = Array.isArray(context.role)\n      ? context.role\n      : [context.role];\n\n    if (hierarchy === undefined) {\n      return userRoles.includes(role);\n    }\n\n    const inherited = collectInheritedRoles(userRoles, hierarchy);\n    return inherited.has(role);\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;AAgCA,MAAa,oBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,mBAOT;;;;;;;;;;;;;;;;;AAkBJ,MAAa,QAMT,eAED,SAAS,QAAQ,aAChB,UAAU,SAAS,QAAQ,QAAQ,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBrD,MAAa,OAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,OAAO,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBxE,MAAa,MAMT,GAAG,gBAEJ,SAAS,QAAQ,aAChB,WAAW,MAAM,cAAc,UAAU,SAAS,QAAQ,QAAQ,CAAC;;;;;;;;;;;;;;;AAgBvE,MAAa,OAMT,eAED,SAAS,QAAQ,aAChB,CAAC,UAAU,SAAS,QAAQ,QAAQ;;;;;;;;;;;;;AAcxC,MAAa,OAET,KACA,WAED,YACC,QAAQ,SAAS;;;;;;;;;;;;;;;;;;AAmBrB,MAAa,yBACX,OACA,cACe;CACf,MAAM,4BAAY,IAAI,IAAW;CAEjC,MAAM,OAAO,SAAsB;EACjC,IAAI,UAAU,IAAI,IAAI,GACpB;EAGF,UAAU,IAAI,IAAI;EAClB,MAAM,YAAY,UAAU,SAAS,CAAC;EACtC,KAAK,MAAM,YAAY,WACrB,IAAI,QAAQ;CAEhB;CAEA,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI;CAEV,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,WAET,MACA,eAED,YAAY;CACX,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,IACxC,QAAQ,OACR,CAAC,QAAQ,IAAI;CAEjB,IAAI,cAAc,KAAA,GAChB,OAAO,UAAU,SAAS,IAAI;CAIhC,OADkB,sBAAsB,WAAW,SACpC,CAAC,CAAC,IAAI,IAAI;AAC3B"}

package/dist/errors.d.ts

@@ -7,6 +7,20 @@
 /**
  * Represents an error that occurs during policy evaluation or enforcement.
  * Use this error to indicate issues related to policy logic, configuration, or execution.
+ *
+ * @example
+ * ```ts
+ * import { PolicyError } from "@zap-studio/permit";
+ *
+ * try {
+ *   const policy = createPolicy(config);
+ *   await policy.can(ctx, "post:read", post);
+ * } catch (error) {
+ *   if (error instanceof PolicyError) {
+ *     console.error("Invalid policy configuration:", error.message);
+ *   }
+ * }
+ * ```
  */
 declare class PolicyError extends Error {
   /**

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;cAUa,oBAAoB;;;;;;EAM/B,YAAY"}
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;cAwBa,oBAAoB;;;;;;EAM/B,YAAY"}

package/dist/errors.js

@@ -7,6 +7,20 @@
 /**
 * Represents an error that occurs during policy evaluation or enforcement.
 * Use this error to indicate issues related to policy logic, configuration, or execution.
+*
+* @example
+* ```ts
+* import { PolicyError } from "@zap-studio/permit";
+*
+* try {
+*   const policy = createPolicy(config);
+*   await policy.can(ctx, "post:read", post);
+* } catch (error) {
+*   if (error instanceof PolicyError) {
+*     console.error("Invalid policy configuration:", error.message);
+*   }
+* }
+* ```
 */
 var PolicyError = class extends Error {
 	/**

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for policy evaluation and configuration failures.\n *\n * @module @zap-studio/permit/errors\n */\n\n/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n */\nexport class PolicyError extends Error {\n  /**\n   * Creates a policy error with a human-readable message.\n   *\n   * @param message - Error message describing the policy failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,IAAa,cAAb,cAAiC,MAAM;;;;;;CAMrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for policy evaluation and configuration failures.\n *\n * @module @zap-studio/permit/errors\n */\n\n/**\n * Represents an error that occurs during policy evaluation or enforcement.\n * Use this error to indicate issues related to policy logic, configuration, or execution.\n *\n * @example\n * ```ts\n * import { PolicyError } from \"@zap-studio/permit\";\n *\n * try {\n *   const policy = createPolicy(config);\n *   await policy.can(ctx, \"post:read\", post);\n * } catch (error) {\n *   if (error instanceof PolicyError) {\n *     console.error(\"Invalid policy configuration:\", error.message);\n *   }\n * }\n * ```\n */\nexport class PolicyError extends Error {\n  /**\n   * Creates a policy error with a human-readable message.\n   *\n   * @param message - Error message describing the policy failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"PolicyError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAa,cAAb,cAAiC,MAAM;;;;;;CAMrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 import { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules } from "./types.js";
 import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
 import { PolicyError } from "./errors.js";
-import { assertNever } from "./helpers.js";
-import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
-export { type ActionPolicyMap, type Actions, type ConditionFn, type Context, type Decision, type InferAction, type InferPermission, type InferResource, type PermitConfig, type Policy, PolicyError, type PolicyFn, type Resources, type Role, type RoleHierarchy, type Rules, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+import { createPolicy, mergePoliciesAnd, mergePoliciesOr } from "./policy.js";
+export { type ActionPolicyMap, type Actions, type ConditionFn, type Context, type Decision, type InferAction, type InferPermission, type InferResource, type PermitConfig, type Policy, PolicyError, type PolicyFn, type Resources, type Role, type RoleHierarchy, type Rules, allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePoliciesAnd, mergePoliciesOr, not, or, when };

package/dist/index.js

@@ -1,5 +1,4 @@
 import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
 import { PolicyError } from "./errors.js";
-import { assertNever } from "./helpers.js";
-import { createPolicy, mergePolicies, mergePoliciesAny } from "./policy.js";
-export { PolicyError, allow, and, assertNever, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePolicies, mergePoliciesAny, not, or, when };
+import { createPolicy, mergePoliciesAnd, mergePoliciesOr } from "./policy.js";
+export { PolicyError, allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePoliciesAnd, mergePoliciesOr, not, or, when };

package/dist/policy.d.ts

@@ -57,33 +57,35 @@ import { Actions, Context, PermitConfig, Policy, Resources } from "./types.js";
  */
 declare const createPolicy: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(config: PermitConfig<TContext, TResources, TActions>) => Policy<TContext, TResources, TActions>;
 /**
- * Merges multiple policies into one using "deny-overrides" strategy.
- * If any policy denies, the merged policy denies. All must allow for the result to allow.
+ * Merges multiple policies into one, requiring every policy to allow.
+ * If any policy denies, the merged policy denies. Policies are evaluated
+ * in parallel; every policy is invoked regardless of outcome.
  *
  * @example
  * ```ts
  * const basePolicy = createPolicy({ ... });
  * const adminPolicy = createPolicy({ ... });
  *
- * const merged = mergePolicies(basePolicy, adminPolicy);
+ * const merged = mergePoliciesAnd(basePolicy, adminPolicy);
  * // Both policies must allow for the action to be permitted
  * ```
  */
-declare const mergePolicies: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+declare const mergePoliciesAnd: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
 /**
- * Merges multiple policies into one using "allow-overrides" strategy.
- * If any policy allows, the merged policy allows. All must deny for the result to deny.
+ * Merges multiple policies into one, requiring at least one policy to allow.
+ * If every policy denies, the merged policy denies. Policies are evaluated
+ * in parallel; every policy is invoked regardless of outcome.
  *
  * @example
  * ```ts
  * const guestPolicy = createPolicy({ ... });
  * const memberPolicy = createPolicy({ ... });
  *
- * const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+ * const merged = mergePoliciesOr(guestPolicy, memberPolicy);
  * // If either policy allows, the action is permitted
  * ```
  */
-declare const mergePoliciesAny: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
+declare const mergePoliciesOr: <TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>>(...policies: Policy<TContext, TResources, TActions>[]) => Policy<TContext, TResources, TActions>;
 //#endregion
-export { createPolicy, mergePolicies, mergePoliciesAny };
+export { createPolicy, mergePoliciesAnd, mergePoliciesOr };
 //# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyGa,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cA2InB,gBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;cAgBnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8Ga,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cAoKnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cAiBnB,kBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}

package/dist/policy.js

@@ -3,11 +3,13 @@ import { createStandardValidator } from "@zap-studio/validation";
 //#region src/policy.ts
 /**
 * Splits a typed `resource:action` permission string into its parts.
-* Returns `null` when the string is malformed (missing/empty part or extra segments).
+* Returns `null` when the string is malformed (missing/empty part or extra
+* segments) or `resourceType` is not one of `actions`' keys.
 */
-const parsePermission = (permission) => {
+const parsePermission = (permission, actions) => {
+	const isValidResourceKey = (value) => Object.keys(actions).includes(value);
 	const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
-	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0) return null;
+	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0 || !isValidResourceKey(resourceTypeValue)) return null;
 	return {
 		action: actionValue,
 		resourceType: resourceTypeValue
@@ -69,7 +71,7 @@ const parsePermission = (permission) => {
 * ```
 */
 const createPolicy = (config) => {
-	const { rules, resources, actions } = config;
+	const { rules, resources, actions, logger } = config;
 	const validators = /* @__PURE__ */ new Map();
 	const getValidatedResource = async (resourceType, resource) => {
 		const validator = validators.get(resourceType);
@@ -79,7 +81,10 @@ const createPolicy = (config) => {
 			if (result.issues) return null;
 			return result.value;
 		} catch (error) {
-			console.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`);
+			logger?.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`, {
+				error,
+				resourceType: String(resourceType)
+			});
 			return null;
 		}
 	};
@@ -88,9 +93,22 @@ const createPolicy = (config) => {
 		const policyFn = rules[resourceType]?.[action];
 		if (policyFn === void 0) return false;
 		try {
-			return policyFn(context, action, resource) === "allow";
+			const allowed = policyFn(context, action, resource) === "allow";
+			if (allowed) logger?.debug("permission allowed", {
+				action,
+				resourceType: String(resourceType)
+			});
+			else logger?.info("permission denied", {
+				action,
+				resourceType: String(resourceType)
+			});
+			return allowed;
 		} catch (error) {
-			console.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`);
+			logger?.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`, {
+				action,
+				error,
+				resourceType: String(resourceType)
+			});
 			return false;
 		}
 	};
@@ -101,7 +119,7 @@ const createPolicy = (config) => {
 		validators.set(key, async (input) => await validator(input));
 	}
 	return { async can(context, permission, resource) {
-		const parsedPermission = parsePermission(permission);
+		const parsedPermission = parsePermission(permission, actions);
 		if (parsedPermission === null) return false;
 		const { action, resourceType } = parsedPermission;
 		if (!hasAllowedAction(resourceType, action)) return false;
@@ -112,42 +130,43 @@ const createPolicy = (config) => {
 };
 const mergePoliciesWithStrategy = (policies, strategy) => ({ async can(context, permission, resource) {
 	if (policies.length === 0) return false;
-	for (const policy of policies) {
-		const allowed = await policy.can(context, permission, resource);
-		if (strategy === "allow-overrides" && allowed) return true;
-		if (strategy === "deny-overrides" && !allowed) return false;
-	}
-	return strategy === "deny-overrides";
+	const results = (await Promise.allSettled(policies.map(async (policy) => await policy.can(context, permission, resource)))).map((result) => {
+		if (result.status === "fulfilled") return result.value;
+		return false;
+	});
+	return strategy === "and" ? results.every(Boolean) : results.some(Boolean);
 } });
 /**
-* Merges multiple policies into one using "deny-overrides" strategy.
-* If any policy denies, the merged policy denies. All must allow for the result to allow.
+* Merges multiple policies into one, requiring every policy to allow.
+* If any policy denies, the merged policy denies. Policies are evaluated
+* in parallel; every policy is invoked regardless of outcome.
 *
 * @example
 * ```ts
 * const basePolicy = createPolicy({ ... });
 * const adminPolicy = createPolicy({ ... });
 *
-* const merged = mergePolicies(basePolicy, adminPolicy);
+* const merged = mergePoliciesAnd(basePolicy, adminPolicy);
 * // Both policies must allow for the action to be permitted
 * ```
 */
-const mergePolicies = (...policies) => mergePoliciesWithStrategy(policies, "deny-overrides");
+const mergePoliciesAnd = (...policies) => mergePoliciesWithStrategy(policies, "and");
 /**
-* Merges multiple policies into one using "allow-overrides" strategy.
-* If any policy allows, the merged policy allows. All must deny for the result to deny.
+* Merges multiple policies into one, requiring at least one policy to allow.
+* If every policy denies, the merged policy denies. Policies are evaluated
+* in parallel; every policy is invoked regardless of outcome.
 *
 * @example
 * ```ts
 * const guestPolicy = createPolicy({ ... });
 * const memberPolicy = createPolicy({ ... });
 *
-* const merged = mergePoliciesAny(guestPolicy, memberPolicy);
+* const merged = mergePoliciesOr(guestPolicy, memberPolicy);
 * // If either policy allows, the action is permitted
 * ```
 */
-const mergePoliciesAny = (...policies) => mergePoliciesWithStrategy(policies, "allow-overrides");
+const mergePoliciesOr = (...policies) => mergePoliciesWithStrategy(policies, "or");
 //#endregion
-export { createPolicy, mergePolicies, mergePoliciesAny };
+export { createPolicy, mergePoliciesAnd, mergePoliciesOr };
 
 //# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["/**\n * Policy creation and composition: `createPolicy`, `mergePolicies`, and\n * `mergePoliciesAny`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra segments).\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TActions, K> & string}`\n): { action: InferAction<TActions, K>; resourceType: K } | null => {\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Parsed permission strings are constrained by the typed permission template.\n    resourceType: resourceTypeValue as K,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      console.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      return policyFn(context, action, resource) === \"allow\";\n    } catch (error) {\n      console.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"allow-overrides\" | \"deny-overrides\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n    for (const policy of policies) {\n      // oxlint-disable-next-line no-await-in-loop -- Policies must evaluate sequentially to preserve short-circuit semantics.\n      const allowed = await policy.can(context, permission, resource);\n\n      if (strategy === \"allow-overrides\" && allowed) {\n        return true;\n      }\n      if (strategy === \"deny-overrides\" && !allowed) {\n        return false;\n      }\n    }\n    return strategy === \"deny-overrides\";\n  },\n});\n\n/**\n * Merges multiple policies into one using \"deny-overrides\" strategy.\n * If any policy denies, the merged policy denies. All must allow for the result to allow.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePolicies(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePolicies = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"deny-overrides\");\n\n/**\n * Merges multiple policies into one using \"allow-overrides\" strategy.\n * If any policy allows, the merged policy allows. All must deny for the result to deny.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAny(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesAny = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"allow-overrides\");\n"],"mappings":";;;;;;;AAyBA,MAAM,mBAKJ,eACiE;CACjE,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,GAEd,OAAO;CAGT,OAAO;EACL,QAAQ;EAER,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,YAAY;CACtC,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,GACzE;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,OAAO,SAAS,SAAS,QAAQ,QAAQ,MAAM;EACjD,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,GAChF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,UACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAET,KAAK,MAAM,UAAU,UAAU;EAE7B,MAAM,UAAU,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ;EAE9D,IAAI,aAAa,qBAAqB,SACpC,OAAO;EAET,IAAI,aAAa,oBAAoB,CAAC,SACpC,OAAO;CAEX;CACA,OAAO,aAAa;AACtB,EACF;;;;;;;;;;;;;;AAeA,MAAa,iBAKX,GAAG,aAEH,0BAA0B,UAAU,gBAAgB;;;;;;;;;;;;;;AAetD,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,iBAAiB"}
+{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["/**\n * Policy creation and composition: `createPolicy`, `mergePoliciesAnd`, and\n * `mergePoliciesOr`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra\n * segments) or `resourceType` is not one of `actions`' keys.\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n  actions: TActions\n): { action: InferAction<TResources, TActions, K>; resourceType: K } | null => {\n  const isValidResourceKey = (value: string): value is K & string =>\n    Object.keys(actions).includes(value);\n\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0 ||\n    !isValidResourceKey(resourceTypeValue)\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    resourceType: resourceTypeValue,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions, logger } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      logger?.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`,\n        { error, resourceType: String(resourceType) }\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      const allowed = policyFn(context, action, resource) === \"allow\";\n\n      if (allowed) {\n        logger?.debug(\"permission allowed\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      } else {\n        logger?.info(\"permission denied\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      }\n\n      return allowed;\n    } catch (error) {\n      logger?.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`,\n        {\n          action,\n          error,\n          resourceType: String(resourceType),\n        }\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission,\n        actions\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"and\" | \"or\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n\n    const settled = await Promise.allSettled(\n      policies.map(\n        async (policy) => await policy.can(context, permission, resource)\n      )\n    );\n\n    const results = settled.map((result) => {\n      if (result.status === \"fulfilled\") {\n        return result.value;\n      }\n      return false;\n    });\n\n    return strategy === \"and\" ? results.every(Boolean) : results.some(Boolean);\n  },\n});\n\n/**\n * Merges multiple policies into one, requiring every policy to allow.\n * If any policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAnd(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePoliciesAnd = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"and\");\n\n/**\n * Merges multiple policies into one, requiring at least one policy to allow.\n * If every policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesOr(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesOr = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"or\");\n"],"mappings":";;;;;;;;AA0BA,MAAM,mBAKJ,YACA,YAC6E;CAC7E,MAAM,sBAAsB,UAC1B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,KAAK;CAErC,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,KACd,CAAC,mBAAmB,iBAAiB,GAErC,OAAO;CAGT,OAAO;EACL,QAAQ;EACR,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,SAAS,WAAW;CAC9C,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,KACvE;IAAE;IAAO,cAAc,OAAO,YAAY;GAAE,CAC9C;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,MAAM,UAAU,SAAS,SAAS,QAAQ,QAAQ,MAAM;GAExD,IAAI,SACF,QAAQ,MAAM,sBAAsB;IAClC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;QAED,QAAQ,KAAK,qBAAqB;IAChC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,KAC9E;IACE;IACA;IACA,cAAc,OAAO,YAAY;GACnC,CACF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,YACA,OACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAST,MAAM,WAAU,MANM,QAAQ,WAC5B,SAAS,IACP,OAAO,WAAW,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ,CAClE,CACF,EAAA,CAEwB,KAAK,WAAW;EACtC,IAAI,OAAO,WAAW,aACpB,OAAO,OAAO;EAEhB,OAAO;CACT,CAAC;CAED,OAAO,aAAa,QAAQ,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO;AAC3E,EACF;;;;;;;;;;;;;;;AAgBA,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,KAAK;;;;;;;;;;;;;;;AAgB3C,MAAa,mBAKX,GAAG,aAEH,0BAA0B,UAAU,IAAI"}

package/dist/types.d.ts

@@ -1,18 +1,34 @@
 import { StandardSchemaV1 } from "@zap-studio/validation";
+import { Logger } from "@zap-studio/logger";
 //#region src/types.d.ts
 /**
  * Represents the possible outcomes of a policy decision.
  * - "allow": The action is permitted.
  * - "deny": The action is not permitted.
+ *
+ * @example
+ * ```ts
+ * const decision: Decision = "allow";
+ * ```
  */
 type Decision = "allow" | "deny";
 /**
  * Represents the context in which a policy decision is made.
  * Can include user information, environment, or any relevant data.
+ *
+ * @example
+ * ```ts
+ * type AppContext = Context<{ user: { id: string; role: string } }>;
+ * ```
  */
 type Context<TContext = unknown> = TContext;
 /**
  * Represents a role within the system.
+ *
+ * @example
+ * ```ts
+ * type AppRole = Role<"guest" | "user" | "admin">;
+ * ```
  */
 type Role<TRole extends string = string> = TRole;
 /**
@@ -64,12 +80,23 @@ type Resources<TResourceKey extends string = string> = Record<TResourceKey, Stan
 type Actions<TResources extends Resources> = { [K in keyof TResources]: readonly string[]; };
 /**
  * Infers the output type from a Standard Schema.
+ *
+ * @example
+ * ```ts
+ * type Post = InferResource<typeof resources, "post">;
+ * ```
  */
 type InferResource<TResources extends Resources, TResourceKey extends keyof TResources> = StandardSchemaV1.InferOutput<TResources[TResourceKey]>;
 /**
  * Infers the action union type for a specific resource.
+ *
+ * @example
+ * ```ts
+ * type PostAction = InferAction<typeof resources, typeof actions, "post">;
+ * // "read" | "write" | "delete"
+ * ```
  */
-type InferAction<TActions extends Record<string, readonly string[]>, K extends keyof TActions> = TActions[K][number];
+type InferAction<TResources extends Resources, TActions extends Actions<TResources>, K extends keyof TActions> = TActions[K][number];
 /**
  * Infers the permission-string union for all resource/action combinations.
  *
@@ -79,24 +106,88 @@ type InferAction<TActions extends Record<string, readonly string[]>, K extends k
  * // "post:read" | "post:write" | "comment:read"
  * ```
  */
-type InferPermission<TResources extends Resources, TActions extends Actions<TResources>> = { [K in keyof TResources & keyof TActions]: `${K & string}:${InferAction<TActions, K> & string}`; }[keyof TResources & keyof TActions];
+type InferPermission<TResources extends Resources, TActions extends Actions<TResources>> = { [K in keyof TResources & keyof TActions]: `${K & string}:${InferAction<TResources, TActions, K> & string}`; }[keyof TResources & keyof TActions];
 /**
  * A function that determines whether a given action on a resource is allowed in a specific context.
+ *
+ * @example
+ * ```ts
+ * const readPolicy: PolicyFn<AppContext, "read", Post> = (context, action, post) =>
+ *   post.visibility === "public" ? "allow" : "deny";
+ * ```
  */
 type PolicyFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => Decision;
 /**
  * A function that evaluates a condition for a given action and resource in a specific context.
+ *
+ * @example
+ * ```ts
+ * const isOwner: ConditionFn<AppContext, "write", Post> = (context, action, post) =>
+ *   context.user.id === post.authorId;
+ * ```
  */
 type ConditionFn<TContext extends Context, TAction extends string = string, TResource = unknown> = (context: TContext, action: TAction, resource: TResource) => boolean;
+/**
+ * Call signatures for {@link hasRole}, preserving the with/without hierarchy overloads.
+ */
+interface HasRoleFn {
+  /**
+   * Checks membership in `role` only, with no inherited roles.
+   *
+   * @param role - Role the context's `role` (or `role[]`) must include.
+   */
+  <TContext extends {
+    role: Role | Role[];
+  }, TAction extends string = string, TResource = unknown>(role: Role): ConditionFn<TContext, TAction, TResource>;
+  /**
+   * Checks membership in `role`, treating any role that inherits from it
+   * (per `hierarchy`) as also satisfying the check.
+   *
+   * @param role - Role the context's `role` (or `role[]`) must include or inherit.
+   * @param hierarchy - Maps each role to the roles it inherits from.
+   */
+  <TContext extends {
+    role: TRole | TRole[];
+  }, TAction extends string = string, TResource = unknown, TRole extends Role = Role>(role: TRole, hierarchy: RoleHierarchy<TRole>): ConditionFn<TContext, TAction, TResource>;
+}
 /**
  * Maps actions to their corresponding policy functions for a specific resource.
+ *
+ * @example
+ * ```ts
+ * import type { ActionPolicyMap } from "@zap-studio/permit/types";
+ *
+ * type PostActions = "read" | "write" | "delete";
+ *
+ * const postPolicies: ActionPolicyMap<AppContext, PostActions, Post> = {
+ *   read: (context, action, post) => "allow",
+ *   write: (context, action, post) =>
+ *     post.authorId === context.userId ? "allow" : "deny",
+ * };
+ * ```
  */
 type ActionPolicyMap<TContext extends Context, TAction extends string = string, TResource = unknown> = { [A in TAction]?: PolicyFn<TContext, A, TResource>; };
 /**
  * Defines the rules for each resource and action combination.
  * Each resource key maps to an object where each action key maps to a policy function.
+ *
+ * @example
+ * ```ts
+ * import type { Rules } from "@zap-studio/permit/types";
+ *
+ * const rules: Rules<AppContext, typeof resources, typeof actions> = {
+ *   post: {
+ *     read: (context, action, post) => "allow",
+ *     write: (context, action, post) =>
+ *       post.authorId === context.userId ? "allow" : "deny",
+ *   },
+ *   comment: {
+ *     read: (context, action, comment) => "allow",
+ *   },
+ * };
+ * ```
  */
-type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TActions, K>, InferResource<TResources, K>>; };
+type Rules<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> = { [K in keyof TResources & keyof TActions]: ActionPolicyMap<TContext, InferAction<TResources, TActions, K>, InferResource<TResources, K>>; };
 /**
  * Configuration object for creating a permit policy.
  *
@@ -112,8 +203,27 @@ type Rules<TContext extends Context, TResources extends Resources = Resources, T
  * ```
  */
 interface PermitConfig<TContext extends Context, TResources extends Resources = Resources, TActions extends Actions<TResources> = Actions<TResources>> {
+  /**
+   * Allowed actions per resource type. Determines which `resource:action`
+   * permission strings are valid to check with `Policy.can(...)`.
+   */
   actions: TActions;
+  /**
+   * Optional logger for policy evaluation internals. When omitted, nothing
+   * is logged.
+   *
+   * Logs allow decisions at `debug` and deny decisions at `info`.
+   */
+  logger?: Logger;
+  /**
+   * Standard Schema resource definitions, keyed by resource type. Each
+   * resource is validated against its schema before rules are evaluated.
+   */
   resources: TResources;
+  /**
+   * Policy functions for each resource/action combination, deciding
+   * `"allow"` or `"deny"` for a given context and resource.
+   */
   rules: Rules<TContext, TResources, TActions>;
 }
 /**
@@ -135,8 +245,8 @@ interface Policy<TContext extends Context, TResources extends Resources = Resour
   /**
    * Determines if the specified action is permitted on the resource in the given context.
    */
-  can: <K extends keyof TResources & keyof TActions>(context: TContext, permission: `${K & string}:${InferAction<TActions, K> & string}`, resource: InferResource<TResources, K>) => Promise<boolean>;
+  can: <K extends keyof TResources & keyof TActions>(context: TContext, permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`, resource: InferResource<TResources, K>) => Promise<boolean>;
 }
 //#endregion
-export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };
+export { ActionPolicyMap, Actions, ConditionFn, Context, Decision, HasRoleFn, InferAction, InferPermission, InferResource, PermitConfig, Policy, PolicyFn, Resources, Role, RoleHierarchy, Rules };
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;KAaY;;;;;KAMA,QAAQ,sBAAsB;;;;KAK9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;KAMF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;KAKhC,YACV,iBAAiB,mCACjB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAExB,WAAW,mBACJ,cAAc,cAAc,YAAY,UAAU,uBACpD,mBAAmB;;;;KAKf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;KAKrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;KAKvC,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;KAO7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,UAAU,IACtB,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;EAE/C,SAAS;EACT,WAAW;EACX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,UAAU,eACnD,UAAU,cAAc,YAAY,OACjC"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;;;;;;KAmBY;;;;;;;;;;KAWA,QAAQ,sBAAsB;;;;;;;;;KAU9B,KAAK,iCAAiC;;;;;;;;;;;;;;;;KAiBtC,cAAc,cAAc,OAAO,QAAQ,OAAO,OAAO;;;;;;;;;;;;;;;;KAiBzD,UAAU,wCAAwC,OAC5D,cACA;;;;;;;;;;;;;;;KAiBU,QAAQ,mBAAmB,gBACpC,WAAW;;;;;;;;;KAWF,cACV,mBAAmB,WACnB,2BAA2B,cACzB,iBAAiB,YAAY,WAAW;;;;;;;;;;KAWhC,YACV,mBAAmB,WACnB,iBAAiB,QAAQ,aACzB,gBAAgB,YACd,SAAS;;;;;;;;;;KAWD,gBACV,mBAAmB,WACnB,iBAAiB,QAAQ,kBAGvB,WAAW,mBAAmB,cAC1B,cAAc,YAAY,YAAY,UAAU,uBAChD,mBAAmB;;;;;;;;;;KAWf,SACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU,cAAc;;;;;;;;;;KAWrD,YACV,iBAAiB,SACjB,iCACA,wBACG,SAAS,UAAU,QAAQ,SAAS,UAAU;;;;UAKlC;;;;;;GAOb;IAAmB,MAAM,OAAO;KAChC,iCACA,qBAEA,MAAM,OACL,YAAY,UAAU,SAAS;;;;;;;;GAShC;IAAmB,MAAM,QAAQ;KACjC,iCACA,qBACA,cAAc,OAAO,MAErB,MAAM,OACN,WAAW,cAAc,SACxB,YAAY,UAAU,SAAS;;;;;;;;;;;;;;;;;;KAmBxB,gBACV,iBAAiB,SACjB,iCACA,0BAEC,KAAK,WAAW,SAAS,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;KAuB7B,MACV,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,kBAE9C,WAAW,mBAAmB,WAAW,gBACxC,UACA,YAAY,YAAY,UAAU,IAClC,cAAc,YAAY;;;;;;;;;;;;;;;UAkBb,aACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;;EAM/C,SAAS;;;;;;;EAOT,SAAS;;;;;EAKT,WAAW;;;;;EAKX,OAAO,MAAM,UAAU,YAAY;;;;;;;;;;;;;;;;;UAkBpB,OACf,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ;;;;EAK/C,MAAM,gBAAgB,mBAAmB,UACvC,SAAS,UACT,eAAe,cAAc,YAAY,YAAY,UAAU,eAC/D,UAAU,cAAc,YAAY,OACjC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zap-studio/permit",
-  "version": "0.3.4",
+  "version": "1.1.0",
   "private": false,
-  "description": "A type-safe, declarative authorization library for TypeScript with Standard Schema support",
+  "description": "A type-safe, declarative, tree-shakeable authorization library for TypeScript with Standard Schema support",
   "keywords": [
     "abac",
     "access-control",
@@ -36,7 +36,6 @@
     ".": "./dist/index.js",
     "./conditions": "./dist/conditions.js",
     "./errors": "./dist/errors.js",
-    "./helpers": "./dist/helpers.js",
     "./policy": "./dist/policy.js",
     "./types": "./dist/types.js",
     "./package.json": "./package.json"
@@ -45,15 +44,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "workspace:*"
+    "@zap-studio/logger": "1.0.0",
+    "@zap-studio/validation": "1.0.0"
   },
   "devDependencies": {
-    "@zap-studio/typescript": "workspace:*",
-    "tsdown": "catalog:",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
+    "tsdown": "^0.22.14",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10",
+    "@zap-studio/typescript": "0.0.0"
   },
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}

package/dist/helpers.d.ts

@@ -1,32 +0,0 @@
-//#region src/helpers.d.ts
-/**
- * Helper utilities for permit consumers.
- *
- * @module @zap-studio/permit/helpers
- */
-/**
- * Ensures that a value of type `never` is actually never encountered at runtime.
- * This is useful for exhaustive checks on discriminated unions.
- *
- * @example
- * ```ts
- * type Action = 'read' | 'write'
- *
- * function performAction(action: Action) {
- *   switch (action) {
- *     case 'read':
- *       console.log('Reading...')
- *       break
- *     case 'write':
- *       console.log('Writing...')
- *       break
- *     default:
- *       assertNever(action) // TypeScript will error if a new Action is added but not handled
- *   }
- * }
- * ```
- */
-declare const assertNever: (value: never) => never;
-//#endregion
-export { assertNever };
-//# sourceMappingURL=helpers.d.ts.map

package/dist/helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.d.ts","names":[],"sources":["../src/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4Ba,cAAe"}

package/dist/helpers.js

@@ -1,35 +0,0 @@
-//#region src/helpers.ts
-/**
-* Helper utilities for permit consumers.
-*
-* @module @zap-studio/permit/helpers
-*/
-/**
-* Ensures that a value of type `never` is actually never encountered at runtime.
-* This is useful for exhaustive checks on discriminated unions.
-*
-* @example
-* ```ts
-* type Action = 'read' | 'write'
-*
-* function performAction(action: Action) {
-*   switch (action) {
-*     case 'read':
-*       console.log('Reading...')
-*       break
-*     case 'write':
-*       console.log('Writing...')
-*       break
-*     default:
-*       assertNever(action) // TypeScript will error if a new Action is added but not handled
-*   }
-* }
-* ```
-*/
-const assertNever = (value) => {
-	throw new Error(`Unexpected value: ${String(value)}`);
-};
-//#endregion
-export { assertNever };
-
-//# sourceMappingURL=helpers.js.map

package/dist/helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.js","names":[],"sources":["../src/helpers.ts"],"sourcesContent":["/**\n * Helper utilities for permit consumers.\n *\n * @module @zap-studio/permit/helpers\n */\n\n/**\n * Ensures that a value of type `never` is actually never encountered at runtime.\n * This is useful for exhaustive checks on discriminated unions.\n *\n * @example\n * ```ts\n * type Action = 'read' | 'write'\n *\n * function performAction(action: Action) {\n *   switch (action) {\n *     case 'read':\n *       console.log('Reading...')\n *       break\n *     case 'write':\n *       console.log('Writing...')\n *       break\n *     default:\n *       assertNever(action) // TypeScript will error if a new Action is added but not handled\n *   }\n * }\n * ```\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${String(value)}`);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,eAAe,UAAwB;CAClD,MAAM,IAAI,MAAM,qBAAqB,OAAO,KAAK,GAAG;AACtD"}