@zap-studio/permit 1.1.0 → 2.0.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0]
+
+### Added
+
+Native OpenTelemetry support. Every `can(...)` call gets an `INTERNAL` span (`permit.check {resourceType}:{action}`) with the decision (`"allow"`/`"deny"`) set as a span attribute, plus a `permit.checks` counter tagged the same way. `mergePoliciesAnd`/`mergePoliciesOr` get their own wrapping span around the composite check. See [OpenTelemetry](https://www.zapstudio.dev/permit/opentelemetry).
+
+### Changed
+
+**Breaking:** `@opentelemetry/api` is now a required peer dependency. It's tiny, side-effect-free, and a no-op until an app registers a real SDK, so nothing changes at runtime for consumers who don't set one up — but the package won't resolve without it installed: `npm install @opentelemetry/api`.
+
+## [1.1.1]
+
+### Changed
+
+`@zap-studio/logger` is now an optional peer dependency instead of a regular dependency. Every import from it is type-only (`import type { Logger }`), so it was never pulled in at runtime — pass any object matching the `Logger` shape (including `pino`) with no install required. Existing consumers of `logger?: Logger` are unaffected.
+
 ## [1.1.0]
 
 ### Added

package/README.md

@@ -4,6 +4,16 @@ A type-safe, declarative authorization library for TypeScript with [Standard Sch
 
 Full documentation: [zapstudio.dev/permit](https://www.zapstudio.dev/permit)
 
+## Motivation
+
+Authorization checks written by hand, like `if (user.role === "admin")`, spread through a codebase over time. After a while, nobody can answer "who is allowed to delete a post?" without searching the whole app.
+
+A framework like CASL solves the spreading problem, but it comes with its own vocabulary to learn (`subject`, `can`, `cannot`, `rules`), and its rules are not checked against your actual data shapes — you can write a rule that references a field your resource does not have, and it will only fail once that code runs.
+
+`@zap-studio/permit` keeps all rules in one place, through `createPolicy(...)` with `allow()`, `deny()`, and `when(condition)` — one file answers "who can do what."
+
+And because resources come from your Standard Schema schemas, policy types are derived straight from your real data shapes. Reference a field that does not exist, and you get an error while writing the code, not a silent `undefined` in production.
+
 ## Installation
 
 ```bash
@@ -150,6 +160,27 @@ const policy = createPolicy({ resources, actions, rules, logger });
 
 Allow decisions log at `debug`, deny decisions log at `info`. Resource validation and policy evaluation errors log at `warn` through the logger when one is provided, instead of `console.warn`.
 
+## OpenTelemetry
+
+`@opentelemetry/api` is a required peer dependency — tiny, side-effect-free, and a no-op until an app registers a real SDK, so installing it costs nothing at runtime for consumers who never set one up.
+
+Every `can(...)` check gets an `INTERNAL` span named `permit.check {resourceType}:{action}`, with the decision (`"allow"` or `"deny"`) set as a span attribute, plus a `permit.checks` counter tagged the same way. `mergePoliciesAnd`/`mergePoliciesOr` get their own span around the composite check, on top of the spans each underlying policy already produces:
+
+```bash
+npm install @opentelemetry/api
+```
+
+```ts
+import { createPolicy } from "@zap-studio/permit";
+
+const policy = createPolicy({ resources, actions, rules });
+
+// If your app has registered an OpenTelemetry SDK, this call now produces a
+// span attributed with the allow/deny decision. If not, it's a no-op — no
+// wiring required either way.
+await policy.can(ctx, "post:write", post);
+```
+
 ## Runtime Support
 
 | Runtime            | Minimum version                                  |

package/dist/index.js

@@ -1,4 +1,4 @@
 import { allow, and, collectInheritedRoles, deny, has, hasRole, not, or, when } from "./conditions.js";
 import { PolicyError } from "./errors.js";
-import { createPolicy, mergePoliciesAnd, mergePoliciesOr } from "./policy.js";
+import { n as mergePoliciesAnd, r as mergePoliciesOr, t as createPolicy } from "./policy-BvQ4lr0v.js";
 export { PolicyError, allow, and, collectInheritedRoles, createPolicy, deny, has, hasRole, mergePoliciesAnd, mergePoliciesOr, not, or, when };

package/dist/policy-BvQ4lr0v.js

@@ -0,0 +1,230 @@
+import { PolicyError } from "./errors.js";
+import { createStandardValidator } from "@zap-studio/validation";
+import { SpanKind, context, metrics, trace } from "@opentelemetry/api";
+//#region package.json
+var name = "@zap-studio/permit";
+var version = "2.0.0";
+//#endregion
+//#region src/_otel.ts
+/**
+* Internal OpenTelemetry wiring for the permit package: tracer resolution,
+* the per-check span, and the checks counter. Kept out of `policy.ts` so
+* authorization logic doesn't get tangled with tracing/metrics concerns.
+*
+* @module @zap-studio/permit/otel
+*/
+/**
+* OpenTelemetry tracer for this package. Resolved once against the global
+* `TracerProvider`; a no-op provider (the default until an app registers an
+* SDK) makes every span call below a no-op too.
+*/
+const tracer = trace.getTracer(name, version);
+/**
+* Records one authorization check, tagged with `permit.decision: "allow" |
+* "deny"`.
+*
+* Resolves the meter and counter fresh on every call instead of caching
+* them at module scope: unlike `trace.getTracer()`, `metrics.getMeter()`
+* has no proxy indirection — a reference grabbed before an app registers
+* its `MeterProvider` (the common case, since ESM imports resolve before
+* the importing module's own SDK-bootstrap code runs) would stay a no-op
+* forever. Repeated `createCounter` calls with the same name are cheap and
+* idempotent, so this costs nothing meaningful.
+*/
+const recordPermitCheck = (decision) => {
+	metrics.getMeter(name, version).createCounter("permit.checks", { description: "Number of authorization checks made, tagged by decision." }).add(1, { "permit.decision": decision });
+};
+/**
+* Wraps one authorization check in an `INTERNAL` span named
+* `permit.check {permission}`, setting `permit.decision` and recording the
+* `permit.checks` counter from `run`'s boolean result.
+*/
+const withCheckSpan = async (permission, run) => {
+	const span = tracer.startSpan(`permit.check ${permission}`, { kind: SpanKind.INTERNAL });
+	try {
+		return await context.with(trace.setSpan(context.active(), span), async () => {
+			const allowed = await run();
+			const decision = allowed ? "allow" : "deny";
+			span.setAttribute("permit.decision", decision);
+			recordPermitCheck(decision);
+			return allowed;
+		});
+	} finally {
+		span.end();
+	}
+};
+//#endregion
+//#region src/policy.ts
+/**
+* Splits a typed `resource:action` permission string into its parts.
+* Returns `null` when the string is malformed (missing/empty part or extra
+* segments) or `resourceType` is not one of `actions`' keys.
+*/
+const parsePermission = (permission, actions) => {
+	const isValidResourceKey = (value) => Object.keys(actions).includes(value);
+	const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
+	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0 || !isValidResourceKey(resourceTypeValue)) return null;
+	return {
+		action: actionValue,
+		resourceType: resourceTypeValue
+	};
+};
+/**
+* Creates a type-safe policy from resource schemas, actions, and rules.
+*
+* @example
+* ```ts
+* import { z } from "zod";
+* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
+* import type { Resources, Actions } from "@zap-studio/permit/types";
+*
+* // Define resource schemas
+* const resources = {
+*   post: z.object({
+*     id: z.string(),
+*     authorId: z.string(),
+*     visibility: z.enum(["public", "private"]),
+*   }),
+*   comment: z.object({
+*     id: z.string(),
+*     postId: z.string(),
+*     authorId: z.string(),
+*   }),
+* } satisfies Resources;
+*
+* // Define actions per resource
+* const actions = {
+*   post: ["read", "write", "delete"],
+*   comment: ["read", "write"],
+* } as const satisfies Actions<typeof resources>;
+*
+* // Define context type
+* type AppContext = { user: { id: string; role: string } };
+*
+* // Create the policy
+* const policy = createPolicy<AppContext>({
+*   resources,
+*   actions,
+*   rules: {
+*     post: {
+*       read: when((ctx, action, resource) => resource.visibility === "public"),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*       delete: deny(),
+*     },
+*     comment: {
+*       read: allow(),
+*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
+*     },
+*   },
+* });
+*
+* // Check permissions
+* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
+* await policy.can(ctx, "post:read", post); // true
+* await policy.can(ctx, "post:write", post); // depends on ctx.user.id
+* ```
+*/
+const createPolicy = (config) => {
+	const { rules, resources, actions, logger } = config;
+	const validators = /* @__PURE__ */ new Map();
+	const getValidatedResource = async (resourceType, resource) => {
+		const validator = validators.get(resourceType);
+		if (validator === void 0) return null;
+		try {
+			const result = await validator(resource);
+			if (result.issues) return null;
+			return result.value;
+		} catch (error) {
+			logger?.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`, {
+				error,
+				resourceType: String(resourceType)
+			});
+			return null;
+		}
+	};
+	const hasAllowedAction = (resourceType, action) => actions[resourceType]?.includes(action) ?? false;
+	const evaluatePolicy = (context, resourceType, action, resource) => {
+		const policyFn = rules[resourceType]?.[action];
+		if (policyFn === void 0) return false;
+		try {
+			const allowed = policyFn(context, action, resource) === "allow";
+			if (allowed) logger?.debug("permission allowed", {
+				action,
+				resourceType: String(resourceType)
+			});
+			else logger?.info("permission denied", {
+				action,
+				resourceType: String(resourceType)
+			});
+			return allowed;
+		} catch (error) {
+			logger?.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`, {
+				action,
+				error,
+				resourceType: String(resourceType)
+			});
+			return false;
+		}
+	};
+	for (const key of Object.keys(resources)) {
+		const schema = resources[key];
+		if (schema === void 0) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
+		const validator = createStandardValidator(schema);
+		validators.set(key, async (input) => await validator(input));
+	}
+	return { async can(context, permission, resource) {
+		return await withCheckSpan(permission, async () => {
+			const parsedPermission = parsePermission(permission, actions);
+			if (parsedPermission === null) return false;
+			const { action, resourceType } = parsedPermission;
+			if (!hasAllowedAction(resourceType, action)) return false;
+			const validatedResource = await getValidatedResource(resourceType, resource);
+			if (validatedResource === null) return false;
+			return evaluatePolicy(context, resourceType, action, validatedResource);
+		});
+	} };
+};
+const mergePoliciesWithStrategy = (policies, strategy) => ({ async can(context, permission, resource) {
+	return await withCheckSpan(permission, async () => {
+		if (policies.length === 0) return false;
+		const results = (await Promise.allSettled(policies.map(async (policy) => await policy.can(context, permission, resource)))).map((result) => {
+			if (result.status === "fulfilled") return result.value;
+			return false;
+		});
+		return strategy === "and" ? results.every(Boolean) : results.some(Boolean);
+	});
+} });
+/**
+* Merges multiple policies into one, requiring every policy to allow.
+* If any policy denies, the merged policy denies. Policies are evaluated
+* in parallel; every policy is invoked regardless of outcome.
+*
+* @example
+* ```ts
+* const basePolicy = createPolicy({ ... });
+* const adminPolicy = createPolicy({ ... });
+*
+* const merged = mergePoliciesAnd(basePolicy, adminPolicy);
+* // Both policies must allow for the action to be permitted
+* ```
+*/
+const mergePoliciesAnd = (...policies) => mergePoliciesWithStrategy(policies, "and");
+/**
+* Merges multiple policies into one, requiring at least one policy to allow.
+* If every policy denies, the merged policy denies. Policies are evaluated
+* in parallel; every policy is invoked regardless of outcome.
+*
+* @example
+* ```ts
+* const guestPolicy = createPolicy({ ... });
+* const memberPolicy = createPolicy({ ... });
+*
+* const merged = mergePoliciesOr(guestPolicy, memberPolicy);
+* // If either policy allows, the action is permitted
+* ```
+*/
+const mergePoliciesOr = (...policies) => mergePoliciesWithStrategy(policies, "or");
+//#endregion
+export { mergePoliciesAnd as n, mergePoliciesOr as r, createPolicy as t };
+
+//# sourceMappingURL=policy-BvQ4lr0v.js.map

package/dist/policy-BvQ4lr0v.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-BvQ4lr0v.js","names":["pkg.name","pkg.version"],"sources":["../package.json","../src/_otel.ts","../src/policy.ts"],"sourcesContent":["","/**\n * Internal OpenTelemetry wiring for the permit package: tracer resolution,\n * the per-check span, and the checks counter. Kept out of `policy.ts` so\n * authorization logic doesn't get tangled with tracing/metrics concerns.\n *\n * @module @zap-studio/permit/otel\n */\n\nimport { SpanKind, context, metrics, trace } from \"@opentelemetry/api\";\n\nimport pkg from \"../package.json\" with { type: \"json\" };\n\n/**\n * OpenTelemetry tracer for this package. Resolved once against the global\n * `TracerProvider`; a no-op provider (the default until an app registers an\n * SDK) makes every span call below a no-op too.\n */\nconst tracer = trace.getTracer(pkg.name, pkg.version);\n\n/**\n * Records one authorization check, tagged with `permit.decision: \"allow\" |\n * \"deny\"`.\n *\n * Resolves the meter and counter fresh on every call instead of caching\n * them at module scope: unlike `trace.getTracer()`, `metrics.getMeter()`\n * has no proxy indirection — a reference grabbed before an app registers\n * its `MeterProvider` (the common case, since ESM imports resolve before\n * the importing module's own SDK-bootstrap code runs) would stay a no-op\n * forever. Repeated `createCounter` calls with the same name are cheap and\n * idempotent, so this costs nothing meaningful.\n */\nconst recordPermitCheck = (decision: \"allow\" | \"deny\"): void => {\n  metrics\n    .getMeter(pkg.name, pkg.version)\n    .createCounter(\"permit.checks\", {\n      description: \"Number of authorization checks made, tagged by decision.\",\n    })\n    .add(1, { \"permit.decision\": decision });\n};\n\n/**\n * Wraps one authorization check in an `INTERNAL` span named\n * `permit.check {permission}`, setting `permit.decision` and recording the\n * `permit.checks` counter from `run`'s boolean result.\n */\nexport const withCheckSpan = async (\n  permission: string,\n  run: () => Promise<boolean>\n): Promise<boolean> => {\n  const span = tracer.startSpan(`permit.check ${permission}`, {\n    kind: SpanKind.INTERNAL,\n  });\n\n  try {\n    return await context.with(\n      trace.setSpan(context.active(), span),\n      async () => {\n        const allowed = await run();\n        const decision = allowed ? \"allow\" : \"deny\";\n        span.setAttribute(\"permit.decision\", decision);\n        recordPermitCheck(decision);\n        return allowed;\n      }\n    );\n  } finally {\n    span.end();\n  }\n};\n","/**\n * Policy creation and composition: `createPolicy`, `mergePoliciesAnd`, and\n * `mergePoliciesOr`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { withCheckSpan } from \"./_otel.js\";\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra\n * segments) or `resourceType` is not one of `actions`' keys.\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n  actions: TActions\n): { action: InferAction<TResources, TActions, K>; resourceType: K } | null => {\n  const isValidResourceKey = (value: string): value is K & string =>\n    Object.keys(actions).includes(value);\n\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0 ||\n    !isValidResourceKey(resourceTypeValue)\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    resourceType: resourceTypeValue,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions, logger } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      logger?.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`,\n        { error, resourceType: String(resourceType) }\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      const allowed = policyFn(context, action, resource) === \"allow\";\n\n      if (allowed) {\n        logger?.debug(\"permission allowed\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      } else {\n        logger?.info(\"permission denied\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      }\n\n      return allowed;\n    } catch (error) {\n      logger?.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`,\n        {\n          action,\n          error,\n          resourceType: String(resourceType),\n        }\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      return await withCheckSpan(permission, async () => {\n        const parsedPermission = parsePermission<TResources, TActions, K>(\n          permission,\n          actions\n        );\n        if (parsedPermission === null) {\n          return false;\n        }\n\n        const { action, resourceType } = parsedPermission;\n        if (!hasAllowedAction(resourceType, action)) {\n          return false;\n        }\n\n        const validatedResource = await getValidatedResource(\n          resourceType,\n          resource\n        );\n        if (validatedResource === null) {\n          return false;\n        }\n\n        return evaluatePolicy(context, resourceType, action, validatedResource);\n      });\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"and\" | \"or\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    return await withCheckSpan(permission, async () => {\n      if (policies.length === 0) {\n        return false;\n      }\n\n      const settled = await Promise.allSettled(\n        policies.map(\n          async (policy) => await policy.can(context, permission, resource)\n        )\n      );\n\n      const results = settled.map((result) => {\n        if (result.status === \"fulfilled\") {\n          return result.value;\n        }\n        return false;\n      });\n\n      return strategy === \"and\"\n        ? results.every(Boolean)\n        : results.some(Boolean);\n    });\n  },\n});\n\n/**\n * Merges multiple policies into one, requiring every policy to allow.\n * If any policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAnd(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePoliciesAnd = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"and\");\n\n/**\n * Merges multiple policies into one, requiring at least one policy to allow.\n * If every policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesOr(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesOr = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"or\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;;ACiBA,MAAM,SAAS,MAAM,UAAUA,MAAUC,OAAW;;;;;;;;;;;;;AAcpD,MAAM,qBAAqB,aAAqC;CAC9D,QACG,SAASD,MAAUC,OAAW,CAAC,CAC/B,cAAc,iBAAiB,EAC9B,aAAa,2DACf,CAAC,CAAC,CACD,IAAI,GAAG,EAAE,mBAAmB,SAAS,CAAC;AAC3C;;;;;;AAOA,MAAa,gBAAgB,OAC3B,YACA,QACqB;CACrB,MAAM,OAAO,OAAO,UAAU,gBAAgB,cAAc,EAC1D,MAAM,SAAS,SACjB,CAAC;CAED,IAAI;EACF,OAAO,MAAM,QAAQ,KACnB,MAAM,QAAQ,QAAQ,OAAO,GAAG,IAAI,GACpC,YAAY;GACV,MAAM,UAAU,MAAM,IAAI;GAC1B,MAAM,WAAW,UAAU,UAAU;GACrC,KAAK,aAAa,mBAAmB,QAAQ;GAC7C,kBAAkB,QAAQ;GAC1B,OAAO;EACT,CACF;CACF,UAAU;EACR,KAAK,IAAI;CACX;AACF;;;;;;;;ACxCA,MAAM,mBAKJ,YACA,YAC6E;CAC7E,MAAM,sBAAsB,UAC1B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,KAAK;CAErC,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,KACd,CAAC,mBAAmB,iBAAiB,GAErC,OAAO;CAGT,OAAO;EACL,QAAQ;EACR,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,SAAS,WAAW;CAC9C,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,KACvE;IAAE;IAAO,cAAc,OAAO,YAAY;GAAE,CAC9C;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,MAAM,UAAU,SAAS,SAAS,QAAQ,QAAQ,MAAM;GAExD,IAAI,SACF,QAAQ,MAAM,sBAAsB;IAClC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;QAED,QAAQ,KAAK,qBAAqB;IAChC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,KAC9E;IACE;IACA;IACA,cAAc,OAAO,YAAY;GACnC,CACF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,OAAO,MAAM,cAAc,YAAY,YAAY;GACjD,MAAM,mBAAmB,gBACvB,YACA,OACF;GACA,IAAI,qBAAqB,MACvB,OAAO;GAGT,MAAM,EAAE,QAAQ,iBAAiB;GACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;GAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;GACA,IAAI,sBAAsB,MACxB,OAAO;GAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;EACxE,CAAC;CACH,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,OAAO,MAAM,cAAc,YAAY,YAAY;EACjD,IAAI,SAAS,WAAW,GACtB,OAAO;EAST,MAAM,WAAU,MANM,QAAQ,WAC5B,SAAS,IACP,OAAO,WAAW,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ,CAClE,CACF,EAAA,CAEwB,KAAK,WAAW;GACtC,IAAI,OAAO,WAAW,aACpB,OAAO,OAAO;GAEhB,OAAO;EACT,CAAC;EAED,OAAO,aAAa,QAChB,QAAQ,MAAM,OAAO,IACrB,QAAQ,KAAK,OAAO;CAC1B,CAAC;AACH,EACF;;;;;;;;;;;;;;;AAgBA,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,KAAK;;;;;;;;;;;;;;;AAgB3C,MAAa,mBAKX,GAAG,aAEH,0BAA0B,UAAU,IAAI"}

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8Ga,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cAoKnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cAiBnB,kBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../src/policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+Ga,eACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,aAE/C,QAAQ,aAAa,UAAU,YAAY,cAC1C,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cA0KnB,mBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY;;;;;;;;;;;;;;;cAiBnB,kBACX,iBAAiB,SACjB,mBAAmB,YAAY,WAC/B,iBAAiB,QAAQ,cAAc,QAAQ,gBAE5C,UAAU,OAAO,UAAU,YAAY,gBACzC,OAAO,UAAU,YAAY"}

package/dist/policy.js

@@ -1,172 +1,3 @@
-import { PolicyError } from "./errors.js";
-import { createStandardValidator } from "@zap-studio/validation";
-//#region src/policy.ts
-/**
-* Splits a typed `resource:action` permission string into its parts.
-* Returns `null` when the string is malformed (missing/empty part or extra
-* segments) or `resourceType` is not one of `actions`' keys.
-*/
-const parsePermission = (permission, actions) => {
-	const isValidResourceKey = (value) => Object.keys(actions).includes(value);
-	const [resourceTypeValue, actionValue, ...rest] = permission.split(":");
-	if (resourceTypeValue === void 0 || resourceTypeValue.length === 0 || actionValue === void 0 || actionValue.length === 0 || rest.length > 0 || !isValidResourceKey(resourceTypeValue)) return null;
-	return {
-		action: actionValue,
-		resourceType: resourceTypeValue
-	};
-};
-/**
-* Creates a type-safe policy from resource schemas, actions, and rules.
-*
-* @example
-* ```ts
-* import { z } from "zod";
-* import { createPolicy, allow, deny, when } from "@zap-studio/permit";
-* import type { Resources, Actions } from "@zap-studio/permit/types";
-*
-* // Define resource schemas
-* const resources = {
-*   post: z.object({
-*     id: z.string(),
-*     authorId: z.string(),
-*     visibility: z.enum(["public", "private"]),
-*   }),
-*   comment: z.object({
-*     id: z.string(),
-*     postId: z.string(),
-*     authorId: z.string(),
-*   }),
-* } satisfies Resources;
-*
-* // Define actions per resource
-* const actions = {
-*   post: ["read", "write", "delete"],
-*   comment: ["read", "write"],
-* } as const satisfies Actions<typeof resources>;
-*
-* // Define context type
-* type AppContext = { user: { id: string; role: string } };
-*
-* // Create the policy
-* const policy = createPolicy<AppContext>({
-*   resources,
-*   actions,
-*   rules: {
-*     post: {
-*       read: when((ctx, action, resource) => resource.visibility === "public"),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*       delete: deny(),
-*     },
-*     comment: {
-*       read: allow(),
-*       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),
-*     },
-*   },
-* });
-*
-* // Check permissions
-* const post = { id: "1", authorId: "user-1", visibility: "public" as const };
-* await policy.can(ctx, "post:read", post); // true
-* await policy.can(ctx, "post:write", post); // depends on ctx.user.id
-* ```
-*/
-const createPolicy = (config) => {
-	const { rules, resources, actions, logger } = config;
-	const validators = /* @__PURE__ */ new Map();
-	const getValidatedResource = async (resourceType, resource) => {
-		const validator = validators.get(resourceType);
-		if (validator === void 0) return null;
-		try {
-			const result = await validator(resource);
-			if (result.issues) return null;
-			return result.value;
-		} catch (error) {
-			logger?.warn(`Resource validation failed for ${String(resourceType)}: ${String(error)}`, {
-				error,
-				resourceType: String(resourceType)
-			});
-			return null;
-		}
-	};
-	const hasAllowedAction = (resourceType, action) => actions[resourceType]?.includes(action) ?? false;
-	const evaluatePolicy = (context, resourceType, action, resource) => {
-		const policyFn = rules[resourceType]?.[action];
-		if (policyFn === void 0) return false;
-		try {
-			const allowed = policyFn(context, action, resource) === "allow";
-			if (allowed) logger?.debug("permission allowed", {
-				action,
-				resourceType: String(resourceType)
-			});
-			else logger?.info("permission denied", {
-				action,
-				resourceType: String(resourceType)
-			});
-			return allowed;
-		} catch (error) {
-			logger?.warn(`Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`, {
-				action,
-				error,
-				resourceType: String(resourceType)
-			});
-			return false;
-		}
-	};
-	for (const key of Object.keys(resources)) {
-		const schema = resources[key];
-		if (schema === void 0) throw new PolicyError(`Missing schema for resource: ${String(key)}`);
-		const validator = createStandardValidator(schema);
-		validators.set(key, async (input) => await validator(input));
-	}
-	return { async can(context, permission, resource) {
-		const parsedPermission = parsePermission(permission, actions);
-		if (parsedPermission === null) return false;
-		const { action, resourceType } = parsedPermission;
-		if (!hasAllowedAction(resourceType, action)) return false;
-		const validatedResource = await getValidatedResource(resourceType, resource);
-		if (validatedResource === null) return false;
-		return evaluatePolicy(context, resourceType, action, validatedResource);
-	} };
-};
-const mergePoliciesWithStrategy = (policies, strategy) => ({ async can(context, permission, resource) {
-	if (policies.length === 0) return false;
-	const results = (await Promise.allSettled(policies.map(async (policy) => await policy.can(context, permission, resource)))).map((result) => {
-		if (result.status === "fulfilled") return result.value;
-		return false;
-	});
-	return strategy === "and" ? results.every(Boolean) : results.some(Boolean);
-} });
-/**
-* Merges multiple policies into one, requiring every policy to allow.
-* If any policy denies, the merged policy denies. Policies are evaluated
-* in parallel; every policy is invoked regardless of outcome.
-*
-* @example
-* ```ts
-* const basePolicy = createPolicy({ ... });
-* const adminPolicy = createPolicy({ ... });
-*
-* const merged = mergePoliciesAnd(basePolicy, adminPolicy);
-* // Both policies must allow for the action to be permitted
-* ```
-*/
-const mergePoliciesAnd = (...policies) => mergePoliciesWithStrategy(policies, "and");
-/**
-* Merges multiple policies into one, requiring at least one policy to allow.
-* If every policy denies, the merged policy denies. Policies are evaluated
-* in parallel; every policy is invoked regardless of outcome.
-*
-* @example
-* ```ts
-* const guestPolicy = createPolicy({ ... });
-* const memberPolicy = createPolicy({ ... });
-*
-* const merged = mergePoliciesOr(guestPolicy, memberPolicy);
-* // If either policy allows, the action is permitted
-* ```
-*/
-const mergePoliciesOr = (...policies) => mergePoliciesWithStrategy(policies, "or");
-//#endregion
+import "./errors.js";
+import { n as mergePoliciesAnd, r as mergePoliciesOr, t as createPolicy } from "./policy-BvQ4lr0v.js";
 export { createPolicy, mergePoliciesAnd, mergePoliciesOr };
-
-//# sourceMappingURL=policy.js.map

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zap-studio/permit",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "private": false,
-  "description": "A type-safe, declarative, tree-shakeable authorization library for TypeScript with Standard Schema support",
+  "description": "A type-safe, declarative, tree-shakeable authorization library for TypeScript with Standard Schema support.",
   "keywords": [
     "abac",
     "access-control",
@@ -44,14 +44,27 @@
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/logger": "1.0.0",
     "@zap-studio/validation": "1.0.0"
   },
   "devDependencies": {
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/context-async-hooks": "^2.10.0",
+    "@opentelemetry/sdk-metrics": "^2.10.0",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10",
-    "@zap-studio/typescript": "0.0.0"
+    "@zap-studio/typescript": "0.0.0",
+    "@zap-studio/logger": "2.0.0"
+  },
+  "peerDependencies": {
+    "@opentelemetry/api": "^1.9.0",
+    "@zap-studio/logger": "2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@zap-studio/logger": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=18.0.0"

package/dist/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","names":[],"sources":["../src/policy.ts"],"sourcesContent":["/**\n * Policy creation and composition: `createPolicy`, `mergePoliciesAnd`, and\n * `mergePoliciesOr`.\n *\n * @module @zap-studio/permit/policy\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { createStandardValidator } from \"@zap-studio/validation\";\n\nimport { PolicyError } from \"./errors.js\";\nimport type {\n  Actions,\n  Context,\n  InferAction,\n  InferResource,\n  PermitConfig,\n  Policy,\n  Resources,\n} from \"./types.js\";\n\n/**\n * Splits a typed `resource:action` permission string into its parts.\n * Returns `null` when the string is malformed (missing/empty part or extra\n * segments) or `resourceType` is not one of `actions`' keys.\n */\nconst parsePermission = <\n  TResources extends Resources,\n  TActions extends Actions<TResources>,\n  K extends keyof TResources & keyof TActions,\n>(\n  permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n  actions: TActions\n): { action: InferAction<TResources, TActions, K>; resourceType: K } | null => {\n  const isValidResourceKey = (value: string): value is K & string =>\n    Object.keys(actions).includes(value);\n\n  const [resourceTypeValue, actionValue, ...rest] = permission.split(\":\");\n  if (\n    resourceTypeValue === undefined ||\n    resourceTypeValue.length === 0 ||\n    actionValue === undefined ||\n    actionValue.length === 0 ||\n    rest.length > 0 ||\n    !isValidResourceKey(resourceTypeValue)\n  ) {\n    return null;\n  }\n\n  return {\n    action: actionValue,\n    resourceType: resourceTypeValue,\n  };\n};\n\n/**\n * Creates a type-safe policy from resource schemas, actions, and rules.\n *\n * @example\n * ```ts\n * import { z } from \"zod\";\n * import { createPolicy, allow, deny, when } from \"@zap-studio/permit\";\n * import type { Resources, Actions } from \"@zap-studio/permit/types\";\n *\n * // Define resource schemas\n * const resources = {\n *   post: z.object({\n *     id: z.string(),\n *     authorId: z.string(),\n *     visibility: z.enum([\"public\", \"private\"]),\n *   }),\n *   comment: z.object({\n *     id: z.string(),\n *     postId: z.string(),\n *     authorId: z.string(),\n *   }),\n * } satisfies Resources;\n *\n * // Define actions per resource\n * const actions = {\n *   post: [\"read\", \"write\", \"delete\"],\n *   comment: [\"read\", \"write\"],\n * } as const satisfies Actions<typeof resources>;\n *\n * // Define context type\n * type AppContext = { user: { id: string; role: string } };\n *\n * // Create the policy\n * const policy = createPolicy<AppContext>({\n *   resources,\n *   actions,\n *   rules: {\n *     post: {\n *       read: when((ctx, action, resource) => resource.visibility === \"public\"),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *       delete: deny(),\n *     },\n *     comment: {\n *       read: allow(),\n *       write: when((ctx, action, resource) => ctx.user.id === resource.authorId),\n *     },\n *   },\n * });\n *\n * // Check permissions\n * const post = { id: \"1\", authorId: \"user-1\", visibility: \"public\" as const };\n * await policy.can(ctx, \"post:read\", post); // true\n * await policy.can(ctx, \"post:write\", post); // depends on ctx.user.id\n * ```\n */\nexport const createPolicy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  config: PermitConfig<TContext, TResources, TActions>\n): Policy<TContext, TResources, TActions> => {\n  const { rules, resources, actions, logger } = config;\n  const validators = new Map<\n    keyof TResources,\n    (input: unknown) => Promise<StandardSchemaV1.Result<unknown>>\n  >();\n\n  const getValidatedResource = async <K extends keyof TResources>(\n    resourceType: K,\n    resource: InferResource<TResources, K>\n  ): Promise<InferResource<TResources, K> | null> => {\n    const validator = validators.get(resourceType);\n    if (validator === undefined) {\n      return null;\n    }\n    try {\n      const result = await validator(resource);\n      if (result.issues) {\n        return null;\n      }\n      return result.value;\n    } catch (error) {\n      logger?.warn(\n        `Resource validation failed for ${String(resourceType)}: ${String(error)}`,\n        { error, resourceType: String(resourceType) }\n      );\n      return null;\n    }\n  };\n\n  const hasAllowedAction = <K extends keyof TResources & keyof TActions>(\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>\n  ): boolean => actions[resourceType]?.includes(action) ?? false;\n\n  const evaluatePolicy = <K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    resourceType: K,\n    action: InferAction<TResources, TActions, K>,\n    resource: InferResource<TResources, K>\n  ): boolean => {\n    const policyFn = rules[resourceType]?.[action];\n    if (policyFn === undefined) {\n      return false;\n    }\n\n    try {\n      const allowed = policyFn(context, action, resource) === \"allow\";\n\n      if (allowed) {\n        logger?.debug(\"permission allowed\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      } else {\n        logger?.info(\"permission denied\", {\n          action,\n          resourceType: String(resourceType),\n        });\n      }\n\n      return allowed;\n    } catch (error) {\n      logger?.warn(\n        `Policy evaluation error for ${String(resourceType)}.${action}: ${String(error)}`,\n        {\n          action,\n          error,\n          resourceType: String(resourceType),\n        }\n      );\n      return false;\n    }\n  };\n\n  for (const key of Object.keys(resources) as (keyof TResources)[]) {\n    const schema = resources[key];\n    if (schema === undefined) {\n      throw new PolicyError(`Missing schema for resource: ${String(key)}`);\n    }\n    const validator = createStandardValidator(schema);\n    validators.set(key, async (input: unknown) => await validator(input));\n  }\n\n  return {\n    async can<K extends keyof TResources & keyof TActions>(\n      context: TContext,\n      permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n      resource: InferResource<TResources, K>\n    ): Promise<boolean> {\n      const parsedPermission = parsePermission<TResources, TActions, K>(\n        permission,\n        actions\n      );\n      if (parsedPermission === null) {\n        return false;\n      }\n\n      const { action, resourceType } = parsedPermission;\n      if (!hasAllowedAction(resourceType, action)) {\n        return false;\n      }\n\n      const validatedResource = await getValidatedResource(\n        resourceType,\n        resource\n      );\n      if (validatedResource === null) {\n        return false;\n      }\n\n      return evaluatePolicy(context, resourceType, action, validatedResource);\n    },\n  };\n};\n\nconst mergePoliciesWithStrategy = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  policies: Policy<TContext, TResources, TActions>[],\n  strategy: \"and\" | \"or\"\n): Policy<TContext, TResources, TActions> => ({\n  async can<K extends keyof TResources & keyof TActions>(\n    context: TContext,\n    permission: `${K & string}:${InferAction<TResources, TActions, K> & string}`,\n    resource: InferResource<TResources, K>\n  ): Promise<boolean> {\n    if (policies.length === 0) {\n      return false;\n    }\n\n    const settled = await Promise.allSettled(\n      policies.map(\n        async (policy) => await policy.can(context, permission, resource)\n      )\n    );\n\n    const results = settled.map((result) => {\n      if (result.status === \"fulfilled\") {\n        return result.value;\n      }\n      return false;\n    });\n\n    return strategy === \"and\" ? results.every(Boolean) : results.some(Boolean);\n  },\n});\n\n/**\n * Merges multiple policies into one, requiring every policy to allow.\n * If any policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const basePolicy = createPolicy({ ... });\n * const adminPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesAnd(basePolicy, adminPolicy);\n * // Both policies must allow for the action to be permitted\n * ```\n */\nexport const mergePoliciesAnd = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"and\");\n\n/**\n * Merges multiple policies into one, requiring at least one policy to allow.\n * If every policy denies, the merged policy denies. Policies are evaluated\n * in parallel; every policy is invoked regardless of outcome.\n *\n * @example\n * ```ts\n * const guestPolicy = createPolicy({ ... });\n * const memberPolicy = createPolicy({ ... });\n *\n * const merged = mergePoliciesOr(guestPolicy, memberPolicy);\n * // If either policy allows, the action is permitted\n * ```\n */\nexport const mergePoliciesOr = <\n  TContext extends Context,\n  TResources extends Resources = Resources,\n  TActions extends Actions<TResources> = Actions<TResources>,\n>(\n  ...policies: Policy<TContext, TResources, TActions>[]\n): Policy<TContext, TResources, TActions> =>\n  mergePoliciesWithStrategy(policies, \"or\");\n"],"mappings":";;;;;;;;AA0BA,MAAM,mBAKJ,YACA,YAC6E;CAC7E,MAAM,sBAAsB,UAC1B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,KAAK;CAErC,MAAM,CAAC,mBAAmB,aAAa,GAAG,QAAQ,WAAW,MAAM,GAAG;CACtE,IACE,sBAAsB,KAAA,KACtB,kBAAkB,WAAW,KAC7B,gBAAgB,KAAA,KAChB,YAAY,WAAW,KACvB,KAAK,SAAS,KACd,CAAC,mBAAmB,iBAAiB,GAErC,OAAO;CAGT,OAAO;EACL,QAAQ;EACR,cAAc;CAChB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,gBAKX,WAC2C;CAC3C,MAAM,EAAE,OAAO,WAAW,SAAS,WAAW;CAC9C,MAAM,6BAAa,IAAI,IAGrB;CAEF,MAAM,uBAAuB,OAC3B,cACA,aACiD;EACjD,MAAM,YAAY,WAAW,IAAI,YAAY;EAC7C,IAAI,cAAc,KAAA,GAChB,OAAO;EAET,IAAI;GACF,MAAM,SAAS,MAAM,UAAU,QAAQ;GACvC,IAAI,OAAO,QACT,OAAO;GAET,OAAO,OAAO;EAChB,SAAS,OAAO;GACd,QAAQ,KACN,kCAAkC,OAAO,YAAY,EAAE,IAAI,OAAO,KAAK,KACvE;IAAE;IAAO,cAAc,OAAO,YAAY;GAAE,CAC9C;GACA,OAAO;EACT;CACF;CAEA,MAAM,oBACJ,cACA,WACY,QAAQ,aAAa,EAAE,SAAS,MAAM,KAAK;CAEzD,MAAM,kBACJ,SACA,cACA,QACA,aACY;EACZ,MAAM,WAAW,MAAM,aAAa,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAGT,IAAI;GACF,MAAM,UAAU,SAAS,SAAS,QAAQ,QAAQ,MAAM;GAExD,IAAI,SACF,QAAQ,MAAM,sBAAsB;IAClC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;QAED,QAAQ,KAAK,qBAAqB;IAChC;IACA,cAAc,OAAO,YAAY;GACnC,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,+BAA+B,OAAO,YAAY,EAAE,GAAG,OAAO,IAAI,OAAO,KAAK,KAC9E;IACE;IACA;IACA,cAAc,OAAO,YAAY;GACnC,CACF;GACA,OAAO;EACT;CACF;CAEA,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,GAA2B;EAChE,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,YAAY,gCAAgC,OAAO,GAAG,GAAG;EAErE,MAAM,YAAY,wBAAwB,MAAM;EAChD,WAAW,IAAI,KAAK,OAAO,UAAmB,MAAM,UAAU,KAAK,CAAC;CACtE;CAEA,OAAO,EACL,MAAM,IACJ,SACA,YACA,UACkB;EAClB,MAAM,mBAAmB,gBACvB,YACA,OACF;EACA,IAAI,qBAAqB,MACvB,OAAO;EAGT,MAAM,EAAE,QAAQ,iBAAiB;EACjC,IAAI,CAAC,iBAAiB,cAAc,MAAM,GACxC,OAAO;EAGT,MAAM,oBAAoB,MAAM,qBAC9B,cACA,QACF;EACA,IAAI,sBAAsB,MACxB,OAAO;EAGT,OAAO,eAAe,SAAS,cAAc,QAAQ,iBAAiB;CACxE,EACF;AACF;AAEA,MAAM,6BAKJ,UACA,cAC4C,EAC5C,MAAM,IACJ,SACA,YACA,UACkB;CAClB,IAAI,SAAS,WAAW,GACtB,OAAO;CAST,MAAM,WAAU,MANM,QAAQ,WAC5B,SAAS,IACP,OAAO,WAAW,MAAM,OAAO,IAAI,SAAS,YAAY,QAAQ,CAClE,CACF,EAAA,CAEwB,KAAK,WAAW;EACtC,IAAI,OAAO,WAAW,aACpB,OAAO,OAAO;EAEhB,OAAO;CACT,CAAC;CAED,OAAO,aAAa,QAAQ,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO;AAC3E,EACF;;;;;;;;;;;;;;;AAgBA,MAAa,oBAKX,GAAG,aAEH,0BAA0B,UAAU,KAAK;;;;;;;;;;;;;;;AAgB3C,MAAa,mBAKX,GAAG,aAEH,0BAA0B,UAAU,IAAI"}