@zudojs/permissions 0.0.1

package/dist/actor/actor.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.core.d.ts","sourceRoot":"","sources":["../../src/actor/actor.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GACA,eAAe,CAYjB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAE7D"}

package/dist/actor/actor.core.js

@@ -0,0 +1,40 @@
+/**
+ * Actor helper functions for creating and inspecting permission actors.
+ *
+ * @module actor/actor
+ */
+/**
+ * Create a permission actor.
+ */
+export function createPermissionActor(id, options) {
+    return Object.freeze({
+        id,
+        type: options?.type,
+        roles: options?.roles ? Object.freeze([...options.roles]) : undefined,
+        permissions: options?.permissions
+            ? Object.freeze([...options.permissions])
+            : undefined,
+        deniedPermissions: options?.deniedPermissions
+            ? Object.freeze([...options.deniedPermissions])
+            : undefined,
+    });
+}
+/**
+ * Check if an actor has a specific role.
+ */
+export function actorHasRole(actor, role) {
+    return actor.roles?.includes(role) ?? false;
+}
+/**
+ * Check if an actor has a direct permission.
+ */
+export function actorHasPermission(actor, permission) {
+    return actor.permissions?.includes(permission) ?? false;
+}
+/**
+ * Check if an actor is a system/service actor.
+ */
+export function isSystemActor(actor) {
+    return actor.type === "system" || actor.type === "service";
+}
+//# sourceMappingURL=actor.core.js.map

package/dist/actor/actor.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.core.js","sourceRoot":"","sources":["../../src/actor/actor.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAU,EACV,OAKC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,WAAW,EAAE,OAAO,EAAE,WAAW;YAC/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACzC,CAAC,CAAC,SAAS;QACb,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;YAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC/C,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAsB,EAAE,IAAY;IAC/D,OAAO,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,UAAkB;IAElB,OAAO,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;AAC7D,CAAC"}

package/dist/actor/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Actor helpers for creating and inspecting permission actors.
+ *
+ * @module actor
+ */
+export { createPermissionActor, actorHasRole, actorHasPermission, isSystemActor, } from "./actor.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/actor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/actor/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAC"}

package/dist/actor/index.js

@@ -0,0 +1,7 @@
+/**
+ * Actor helpers for creating and inspecting permission actors.
+ *
+ * @module actor
+ */
+export { createPermissionActor, actorHasRole, actorHasPermission, isSystemActor, } from "./actor.core.js";
+//# sourceMappingURL=index.js.map

package/dist/actor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/actor/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAC"}

package/dist/cache/cache.core.d.ts

@@ -0,0 +1,17 @@
+/**
+ * In-memory permission cache implementation.
+ *
+ * @module cache/cache
+ */
+import type { PermissionCache } from "../permissionTypes/index.js";
+/**
+ * Create an in-memory permission cache.
+ *
+ * @param defaultTtlMs - Default TTL in milliseconds. Defaults to 60000 (1 minute).
+ */
+export declare function createMemoryPermissionCache(defaultTtlMs?: number): PermissionCache;
+/**
+ * Generate a cache key for a permission check.
+ */
+export declare function permissionCacheKey(actorId: string, permission: string, resourceId?: string): string;
+//# sourceMappingURL=cache.core.d.ts.map

package/dist/cache/cache.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.core.d.ts","sourceRoot":"","sources":["../../src/cache/cache.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,6BAA6B,CAAC;AAQrC;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,GAAE,MAAc,GAC3B,eAAe,CAuCjB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAGR"}

package/dist/cache/cache.core.js

@@ -0,0 +1,51 @@
+/**
+ * In-memory permission cache implementation.
+ *
+ * @module cache/cache
+ */
+/**
+ * Create an in-memory permission cache.
+ *
+ * @param defaultTtlMs - Default TTL in milliseconds. Defaults to 60000 (1 minute).
+ */
+export function createMemoryPermissionCache(defaultTtlMs = 60000) {
+    const store = new Map();
+    return {
+        async get(key) {
+            const entry = store.get(key);
+            if (!entry)
+                return undefined;
+            if (entry.expiresAt && Date.now() > entry.expiresAt) {
+                store.delete(key);
+                return undefined;
+            }
+            return entry.value;
+        },
+        async set(key, value, options) {
+            const ttl = options?.ttl ?? defaultTtlMs;
+            store.set(key, {
+                value,
+                expiresAt: ttl > 0 ? Date.now() + ttl : undefined,
+            });
+        },
+        async delete(key) {
+            store.delete(key);
+        },
+        async invalidateActor(actorId) {
+            const prefix = `actor:${actorId}`;
+            for (const key of store.keys()) {
+                if (key.startsWith(prefix)) {
+                    store.delete(key);
+                }
+            }
+        },
+    };
+}
+/**
+ * Generate a cache key for a permission check.
+ */
+export function permissionCacheKey(actorId, permission, resourceId) {
+    const base = `actor:${actorId}:${permission}`;
+    return resourceId ? `${base}:${resourceId}` : base;
+}
+//# sourceMappingURL=cache.core.js.map

package/dist/cache/cache.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.core.js","sourceRoot":"","sources":["../../src/cache/cache.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAY,GAAW,KAAK;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAW;YACnB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,KAAyB,EACzB,OAAmC;YAEnC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,YAAY,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACb,KAAK;gBACL,SAAS,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS;aAClD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAe;YACnC,MAAM,MAAM,GAAG,SAAS,OAAO,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,UAAkB,EAClB,UAAmB;IAEnB,MAAM,IAAI,GAAG,SAAS,OAAO,IAAI,UAAU,EAAE,CAAC;IAC9C,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/dist/cache/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Permission decision caching.
+ *
+ * @module cache
+ */
+export { createMemoryPermissionCache, permissionCacheKey, } from "./cache.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cache/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC"}

package/dist/cache/index.js

@@ -0,0 +1,7 @@
+/**
+ * Permission decision caching.
+ *
+ * @module cache
+ */
+export { createMemoryPermissionCache, permissionCacheKey, } from "./cache.core.js";
+//# sourceMappingURL=index.js.map

package/dist/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC"}

package/dist/conditions/conditions.core.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Condition combinators for composing authorization policies.
+ *
+ * @module conditions/conditions
+ */
+import type { PermissionConditionFn } from "../permissionTypes/index.js";
+/**
+ * All conditions must return true.
+ */
+export declare function allOf(...conditions: readonly PermissionConditionFn[]): PermissionConditionFn;
+/**
+ * At least one condition must return true.
+ */
+export declare function anyOf(...conditions: readonly PermissionConditionFn[]): PermissionConditionFn;
+/**
+ * Negate a condition.
+ */
+export declare function not(condition: PermissionConditionFn): PermissionConditionFn;
+/**
+ * Always allow — unconditional pass.
+ */
+export declare function always(): PermissionConditionFn;
+/**
+ * Always deny — unconditional fail.
+ */
+export declare function never(): PermissionConditionFn;
+/**
+ * Check that the actor owns the resource.
+ *
+ * @param ownerField - The field on the resource that holds the owner's ID. Defaults to "ownerId".
+ */
+export declare function isOwner(ownerField?: string): PermissionConditionFn;
+/**
+ * Enforce tenant isolation — actor and resource must share the same tenant.
+ *
+ * @param actorTenantField - Field on actor metadata holding tenant ID. Defaults to "tenantId".
+ * @param resourceTenantField - Field on resource holding tenant ID. Defaults to "tenantId".
+ */
+export declare function tenantIsolation(actorTenantField?: string, resourceTenantField?: string): PermissionConditionFn;
+//# sourceMappingURL=conditions.core.d.ts.map

package/dist/conditions/conditions.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.core.d.ts","sourceRoot":"","sources":["../../src/conditions/conditions.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,wBAAgB,KAAK,CACnB,GAAG,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAC9C,qBAAqB,CAOvB;AAED;;GAEG;AACH,wBAAgB,KAAK,CACnB,GAAG,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAC9C,qBAAqB,CAOvB;AAED;;GAEG;AACH,wBAAgB,GAAG,CAAC,SAAS,EAAE,qBAAqB,GAAG,qBAAqB,CAE3E;AAED;;GAEG;AACH,wBAAgB,MAAM,IAAI,qBAAqB,CAE9C;AAED;;GAEG;AACH,wBAAgB,KAAK,IAAI,qBAAqB,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,UAAU,GAAE,MAAkB,GAAG,qBAAqB,CAO7E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,gBAAgB,GAAE,MAAmB,EACrC,mBAAmB,GAAE,MAAmB,GACvC,qBAAqB,CAQvB"}

package/dist/conditions/conditions.core.js

@@ -0,0 +1,78 @@
+/**
+ * Condition combinators for composing authorization policies.
+ *
+ * @module conditions/conditions
+ */
+/**
+ * All conditions must return true.
+ */
+export function allOf(...conditions) {
+    return async (context) => {
+        for (const condition of conditions) {
+            if (!(await condition(context)))
+                return false;
+        }
+        return true;
+    };
+}
+/**
+ * At least one condition must return true.
+ */
+export function anyOf(...conditions) {
+    return async (context) => {
+        for (const condition of conditions) {
+            if (await condition(context))
+                return true;
+        }
+        return false;
+    };
+}
+/**
+ * Negate a condition.
+ */
+export function not(condition) {
+    return async (context) => !(await condition(context));
+}
+/**
+ * Always allow — unconditional pass.
+ */
+export function always() {
+    return () => true;
+}
+/**
+ * Always deny — unconditional fail.
+ */
+export function never() {
+    return () => false;
+}
+/**
+ * Check that the actor owns the resource.
+ *
+ * @param ownerField - The field on the resource that holds the owner's ID. Defaults to "ownerId".
+ */
+export function isOwner(ownerField = "ownerId") {
+    return (context) => {
+        if (!context.resource || typeof context.resource !== "object")
+            return false;
+        const resource = context.resource;
+        const ownerId = resource[ownerField];
+        return ownerId === context.actor.id;
+    };
+}
+/**
+ * Enforce tenant isolation — actor and resource must share the same tenant.
+ *
+ * @param actorTenantField - Field on actor metadata holding tenant ID. Defaults to "tenantId".
+ * @param resourceTenantField - Field on resource holding tenant ID. Defaults to "tenantId".
+ */
+export function tenantIsolation(actorTenantField = "tenantId", resourceTenantField = "tenantId") {
+    return (context) => {
+        const actorTenant = context.metadata?.get(actorTenantField);
+        if (!context.resource || typeof context.resource !== "object")
+            return false;
+        const resource = context.resource;
+        const resourceTenant = resource[resourceTenantField];
+        return actorTenant !== undefined && actorTenant === resourceTenant;
+    };
+}
+//# sourceMappingURL=conditions.core.js.map

package/dist/conditions/conditions.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.core.js","sourceRoot":"","sources":["../../src/conditions/conditions.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;GAEG;AACH,MAAM,UAAU,KAAK,CACnB,GAAG,UAA4C;IAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,KAAK,CACnB,GAAG,UAA4C;IAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,SAAgC;IAClD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM;IACpB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,KAAK;IACnB,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,UAAU,GAAW,SAAS;IACpD,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAmC,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,gBAAgB,GAAW,UAAU,EACrC,mBAAmB,GAAW,UAAU;IAExC,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAmC,CAAC;QAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACrD,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,cAAc,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC"}

package/dist/conditions/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Condition combinators for composing authorization policies.
+ *
+ * @module conditions
+ */
+export { allOf, anyOf, not, always, never, isOwner, tenantIsolation, } from "./conditions.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/conditions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/conditions/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,EACL,KAAK,EACL,GAAG,EACH,MAAM,EACN,KAAK,EACL,OAAO,EACP,eAAe,GAChB,MAAM,sBAAsB,CAAC"}

package/dist/conditions/index.js

@@ -0,0 +1,7 @@
+/**
+ * Condition combinators for composing authorization policies.
+ *
+ * @module conditions
+ */
+export { allOf, anyOf, not, always, never, isOwner, tenantIsolation, } from "./conditions.core.js";
+//# sourceMappingURL=index.js.map

package/dist/conditions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/conditions/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,EACL,KAAK,EACL,GAAG,EACH,MAAM,EACN,KAAK,EACL,OAAO,EACP,eAAe,GAChB,MAAM,sBAAsB,CAAC"}

package/dist/evaluator/authorizationEngine.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Authorization engine — the main public API for permission checks.
+ *
+ * @module evaluator/authorizationEngine
+ */
+import type { PermissionActor, PermissionDecision, ExplainResult, PermissionPolicyDefinition, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { RoleDefinition } from "../permissionTypes/index.js";
+import { type Ability } from "../ability/ability.core.js";
+/** Configuration for the permission engine. */
+export interface PermissionEngineOptions {
+    /** Roles available to the engine. */
+    readonly roles?: readonly RoleDefinition[];
+    /** Policies to evaluate during authorization. */
+    readonly policies?: readonly PermissionPolicyDefinition[];
+    /** Default timeout for async policy evaluation (ms). */
+    readonly policyTimeout?: number;
+}
+/**
+ * The public permission engine API.
+ */
+export interface PermissionEngine {
+    /**
+     * Check if the actor can perform the action. Returns boolean.
+     */
+    can(actor: PermissionActor, permission: string, resource?: unknown, options?: AuthorizationOptions): Promise<boolean>;
+    /**
+     * Full authorization check with decision details.
+     */
+    check(actor: PermissionActor, permission: string, resource?: unknown, options?: AuthorizationOptions): Promise<PermissionDecision>;
+    /**
+     * Throw PermissionDeniedError if the actor is not authorized.
+     */
+    authorize(actor: PermissionActor, permission: string, resource?: unknown, options?: AuthorizationOptions): Promise<void>;
+    /**
+     * Explain the authorization decision with step-by-step trace.
+     */
+    explain(actor: PermissionActor, permission: string, resource?: unknown, options?: AuthorizationOptions): Promise<ExplainResult>;
+    /**
+     * Create a pre-resolved Ability for an actor.
+     */
+    createAbility(actor: PermissionActor): Ability;
+}
+/**
+ * Create a permission engine.
+ */
+export declare function createPermissionEngine(options?: PermissionEngineOptions): PermissionEngine;
+//# sourceMappingURL=authorizationEngine.d.ts.map

package/dist/evaluator/authorizationEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationEngine.d.ts","sourceRoot":"","sources":["../../src/evaluator/authorizationEngine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EAEb,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGzE,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC1D,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,CACD,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;OAEG;IACH,KAAK,CACH,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;OAEG;IACH,SAAS,CACP,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;OAEG;IACH,OAAO,CACL,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;CAChD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,gBAAgB,CAsFlB"}

package/dist/evaluator/authorizationEngine.js

@@ -0,0 +1,49 @@
+/**
+ * Authorization engine — the main public API for permission checks.
+ *
+ * @module evaluator/authorizationEngine
+ */
+import { evaluate, evaluateWithExplain } from "./evaluator.core.js";
+import { createAbility } from "../ability/ability.core.js";
+import { PermissionDeniedError } from "../permissionErrors/index.js";
+/**
+ * Create a permission engine.
+ */
+export function createPermissionEngine(options) {
+    const roleMap = new Map();
+    if (options?.roles) {
+        for (const role of options.roles) {
+            roleMap.set(role.name, role);
+        }
+    }
+    const evaluatorOptions = {
+        getRole: (name) => roleMap.get(name),
+        policies: options?.policies,
+        policyTimeout: options?.policyTimeout,
+    };
+    return {
+        async can(actor, permission, resource, authOptions) {
+            const decision = await evaluate(actor, permission, resource, evaluatorOptions, authOptions);
+            return decision.allowed;
+        },
+        async check(actor, permission, resource, authOptions) {
+            return evaluate(actor, permission, resource, evaluatorOptions, authOptions);
+        },
+        async authorize(actor, permission, resource, authOptions) {
+            const decision = await evaluate(actor, permission, resource, evaluatorOptions, authOptions);
+            if (!decision.allowed) {
+                throw new PermissionDeniedError(decision.reason ?? "Access denied", {
+                    actorId: actor.id,
+                    permission,
+                });
+            }
+        },
+        async explain(actor, permission, resource, authOptions) {
+            return evaluateWithExplain(actor, permission, resource, evaluatorOptions, authOptions);
+        },
+        createAbility(actor) {
+            return createAbility(actor, evaluatorOptions);
+        },
+    };
+}
+//# sourceMappingURL=authorizationEngine.js.map

package/dist/evaluator/authorizationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationEngine.js","sourceRoot":"","sources":["../../src/evaluator/authorizationEngine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AA8DrE;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAqB;QACzC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5C,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,aAAa,EAAE,OAAO,EAAE,aAAa;KACtC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CACP,KAAsB,EACtB,UAAkB,EAClB,QAAkB,EAClB,WAAkC;YAElC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,KAAK,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,WAAW,CACZ,CAAC;YACF,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,KAAK,CACT,KAAsB,EACtB,UAAkB,EAClB,QAAkB,EAClB,WAAkC;YAElC,OAAO,QAAQ,CACb,KAAK,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CACb,KAAsB,EACtB,UAAkB,EAClB,QAAkB,EAClB,WAAkC;YAElC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,KAAK,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE;oBAClE,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CACX,KAAsB,EACtB,UAAkB,EAClB,QAAkB,EAClB,WAAkC;YAElC,OAAO,mBAAmB,CACxB,KAAK,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,aAAa,CAAC,KAAsB;YAClC,OAAO,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/evaluator/evaluator.core.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Core permission evaluator — resolves actor permissions and evaluates rules + policies.
+ */
+import type { PermissionActor, PermissionDecision, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { EvaluatorOptions } from "./evaluator.pipeline.js";
+export { evaluateWithExplain } from "./evaluator.explain.js";
+/**
+ * Evaluate a single permission check and return a decision.
+ */
+export declare function evaluate(actor: PermissionActor, permissionStr: string, resource: unknown, options: EvaluatorOptions, authOptions?: AuthorizationOptions): Promise<PermissionDecision>;
+//# sourceMappingURL=evaluator.core.d.ts.map

package/dist/evaluator/evaluator.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.core.d.ts","sourceRoot":"","sources":["../../src/evaluator/evaluator.core.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,eAAe,EAGf,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;GAEG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,kBAAkB,CAAC,CA8D7B"}

package/dist/evaluator/evaluator.core.js

@@ -0,0 +1,57 @@
+/**
+ * Core permission evaluator — resolves actor permissions and evaluates rules + policies.
+ */
+import { parsePermission, matches } from "../permission/permission.core.js";
+import { compileRules, findMatchingRules } from "../rule/ruleCompiler.js";
+import { evaluateRules } from "../rule/rule.core.js";
+import { resolveActorPermissions, evaluatePolicies, } from "./evaluator.pipeline.js";
+export { evaluateWithExplain } from "./evaluator.explain.js";
+/**
+ * Evaluate a single permission check and return a decision.
+ */
+export async function evaluate(actor, permissionStr, resource, options, authOptions) {
+    const permission = parsePermission(permissionStr);
+    if (actor.deniedPermissions) {
+        for (const denied of actor.deniedPermissions) {
+            if (denied === permissionStr ||
+                denied === `${permission.resource}:*` ||
+                denied === "*:*") {
+                return Object.freeze({
+                    allowed: false,
+                    reason: "explicit_deny",
+                    matchedPermission: denied,
+                });
+            }
+        }
+    }
+    const allPermissions = resolveActorPermissions(actor, options);
+    const matchingPermissions = allPermissions.filter((p) => matches(p, permissionStr));
+    const rules = matchingPermissions.map((p) => {
+        const parsed = parsePermission(p);
+        return {
+            effect: "allow",
+            action: parsed.action,
+            resource: parsed.resource,
+        };
+    });
+    const compiled = compileRules(rules);
+    const matching = findMatchingRules(compiled, permission);
+    const ruleResult = evaluateRules(matching, permission);
+    if (!ruleResult.allowed) {
+        const ctx = { actor, permission, resource };
+        const policyResult = await evaluatePolicies(ctx, options.policies ?? [], authOptions);
+        if (policyResult !== null)
+            return policyResult;
+        return Object.freeze({ allowed: false, reason: "no_matching_rule" });
+    }
+    const ctx = { actor, permission, resource };
+    const policyResult = await evaluatePolicies(ctx, options.policies ?? [], authOptions);
+    if (policyResult !== null)
+        return policyResult;
+    return Object.freeze({
+        allowed: true,
+        reason: "role_permission",
+        matchedPermission: permissionStr,
+    });
+}
+//# sourceMappingURL=evaluator.core.js.map

package/dist/evaluator/evaluator.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.core.js","sourceRoot":"","sources":["../../src/evaluator/evaluator.core.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAsB,EACtB,aAAqB,EACrB,QAAiB,EACjB,OAAyB,EACzB,WAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IACE,MAAM,KAAK,aAAa;gBACxB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,IAAI;gBACrC,MAAM,KAAK,KAAK,EAChB,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,eAAe;oBACvB,iBAAiB,EAAE,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAC1B,CAAC;IACF,MAAM,KAAK,GAAqB,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEvD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,EACH,OAAO,CAAC,QAAQ,IAAI,EAAE,EACtB,WAAW,CACZ,CAAC;QACF,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC;QAE/C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,GAAG,GAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,EACH,OAAO,CAAC,QAAQ,IAAI,EAAE,EACtB,WAAW,CACZ,CAAC;IACF,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAE/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,iBAAiB;QACzB,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/evaluator/evaluator.explain.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Permission evaluator with full explain trace.
+ *
+ * Records each evaluation step for debugging and auditing.
+ */
+import type { PermissionActor, ExplainResult, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { EvaluatorOptions } from "./evaluator.pipeline.js";
+/**
+ * Evaluate with full explain trace.
+ */
+export declare function evaluateWithExplain(actor: PermissionActor, permissionStr: string, resource: unknown, options: EvaluatorOptions, authOptions?: AuthorizationOptions): Promise<ExplainResult>;
+//# sourceMappingURL=evaluator.explain.d.ts.map

package/dist/evaluator/evaluator.explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.explain.d.ts","sourceRoot":"","sources":["../../src/evaluator/evaluator.explain.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EAIf,aAAa,EACb,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,aAAa,CAAC,CAoFxB"}

package/dist/evaluator/evaluator.explain.js

@@ -0,0 +1,79 @@
+/**
+ * Permission evaluator with full explain trace.
+ *
+ * Records each evaluation step for debugging and auditing.
+ */
+import { parsePermission, matches } from "../permission/permission.core.js";
+import { compileRules, findMatchingRules } from "../rule/ruleCompiler.js";
+import { evaluateRules } from "../rule/rule.core.js";
+import { resolveActorPermissions, evaluatePolicies, } from "./evaluator.pipeline.js";
+/**
+ * Evaluate with full explain trace.
+ */
+export async function evaluateWithExplain(actor, permissionStr, resource, options, authOptions) {
+    const permission = parsePermission(permissionStr);
+    const steps = [];
+    if (actor.deniedPermissions) {
+        for (const denied of actor.deniedPermissions) {
+            if (denied === permissionStr ||
+                denied === `${permission.resource}:*` ||
+                denied === "*:*") {
+                steps.push({
+                    type: "deny",
+                    detail: `Explicit deny: ${denied}`,
+                    matched: true,
+                });
+                return Object.freeze({ allowed: false, steps });
+            }
+        }
+    }
+    const allPermissions = resolveActorPermissions(actor, options);
+    if (actor.roles) {
+        for (const role of actor.roles) {
+            steps.push({ type: "role", detail: `Role: ${role}`, matched: true });
+        }
+    }
+    const matchingPermissions = allPermissions.filter((p) => matches(p, permissionStr));
+    const rules = matchingPermissions.map((p) => {
+        const parsed = parsePermission(p);
+        return {
+            effect: "allow",
+            action: parsed.action,
+            resource: parsed.resource,
+        };
+    });
+    const compiled = compileRules(rules);
+    const matching = findMatchingRules(compiled, permission);
+    const ruleResult = evaluateRules(matching, permission);
+    for (const perm of allPermissions) {
+        const matched = matches(perm, permissionStr);
+        steps.push({ type: "permission", detail: `Permission: ${perm}`, matched });
+    }
+    if (!ruleResult.allowed) {
+        const ctx = { actor, permission, resource };
+        const policyResult = await evaluatePolicies(ctx, options.policies ?? [], authOptions);
+        if (policyResult !== null) {
+            steps.push({
+                type: "policy",
+                detail: `Policy: ${policyResult.reason ?? "unknown"}`,
+                matched: policyResult.allowed,
+            });
+            return Object.freeze({ allowed: policyResult.allowed, steps });
+        }
+        steps.push({ type: "deny", detail: "No matching rule", matched: false });
+        return Object.freeze({ allowed: false, steps });
+    }
+    const ctx = { actor, permission, resource };
+    const policyResult = await evaluatePolicies(ctx, options.policies ?? [], authOptions);
+    if (policyResult !== null) {
+        steps.push({
+            type: "policy",
+            detail: `Policy: ${policyResult.reason ?? "unknown"}`,
+            matched: policyResult.allowed,
+        });
+        return Object.freeze({ allowed: policyResult.allowed, steps });
+    }
+    steps.push({ type: "permission", detail: "Rule matched", matched: true });
+    return Object.freeze({ allowed: true, steps });
+}
+//# sourceMappingURL=evaluator.explain.js.map

package/dist/evaluator/evaluator.explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.explain.js","sourceRoot":"","sources":["../../src/evaluator/evaluator.explain.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAsB,EACtB,aAAqB,EACrB,QAAiB,EACjB,OAAyB,EACzB,WAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IACE,MAAM,KAAK,aAAa;gBACxB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,IAAI;gBACrC,MAAM,KAAK,KAAK,EAChB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,kBAAkB,MAAM,EAAE;oBAClC,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAC1B,CAAC;IACF,MAAM,KAAK,GAAqB,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEvD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,EACH,OAAO,CAAC,QAAQ,IAAI,EAAE,EACtB,WAAW,CACZ,CAAC;QACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,WAAW,YAAY,CAAC,MAAM,IAAI,SAAS,EAAE;gBACrD,OAAO,EAAE,YAAY,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,EACH,OAAO,CAAC,QAAQ,IAAI,EAAE,EACtB,WAAW,CACZ,CAAC;IACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,WAAW,YAAY,CAAC,MAAM,IAAI,SAAS,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC"}