@zudojs/permissions 0.0.1

package/dist/observability/observability.core.js

@@ -0,0 +1,54 @@
+/**
+ * Observability helpers for authorization events and metrics.
+ *
+ * @module observability/observability
+ */
+/**
+ * Create a permission event emitter.
+ */
+export function createPermissionEventEmitter() {
+    const handlers = new Set();
+    return {
+        /** Register an event handler. */
+        on(handler) {
+            handlers.add(handler);
+            return () => {
+                handlers.delete(handler);
+            };
+        },
+        /** Emit a permission check event. */
+        emit(event) {
+            for (const handler of handlers) {
+                try {
+                    handler(event);
+                }
+                catch {
+                    // Swallow handler errors to prevent breaking authorization
+                }
+            }
+        },
+    };
+}
+/**
+ * Wrap a permission check with observability.
+ *
+ * @param emitter - The event emitter.
+ * @param fn - The permission check function.
+ * @returns Wrapped function that emits events.
+ */
+export function withObservability(emitter, fn) {
+    return (async (...args) => {
+        const start = performance.now();
+        const decision = await fn(...args);
+        const durationMs = performance.now() - start;
+        emitter.emit({
+            actorId: args[0]?.id ?? "unknown",
+            permission: args[1] ?? "unknown",
+            allowed: decision.allowed,
+            reason: decision.reason,
+            durationMs,
+        });
+        return decision;
+    });
+}
+//# sourceMappingURL=observability.core.js.map

package/dist/observability/observability.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.core.js","sourceRoot":"","sources":["../../src/observability/observability.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuBH;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD,OAAO;QACL,iCAAiC;QACjC,EAAE,CAAC,OAA+B;YAChC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,EAAE;gBACV,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,KAA2B;YAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,2DAA2D;gBAC7D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAE/B,OAAwD,EAAE,EAAK;IAC/D,OAAO,CAAC,KAAK,EAAE,GAAG,IAAwB,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAE7C,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAG,IAAI,CAAC,CAAC,CAA6B,EAAE,EAAE,IAAI,SAAS;YAC9D,UAAU,EAAG,IAAI,CAAC,CAAC,CAAY,IAAI,SAAS;YAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAM,CAAC;AACV,CAAC"}

package/dist/permission/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Permission parsing, matching, and registry.
+ *
+ * @module permission
+ */
+export { parsePermission, isValidPermission, matches, matchesPermission, } from "./permission.core.js";
+export { createPermissionRegistry, type PermissionRegistryOptions, } from "./permissionRegistry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,OAAO,EACP,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,yBAAyB,CAAC"}

package/dist/permission/index.js

@@ -0,0 +1,8 @@
+/**
+ * Permission parsing, matching, and registry.
+ *
+ * @module permission
+ */
+export { parsePermission, isValidPermission, matches, matchesPermission, } from "./permission.core.js";
+export { createPermissionRegistry, } from "./permissionRegistry.js";
+//# sourceMappingURL=index.js.map

package/dist/permission/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,OAAO,EACP,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC"}

package/dist/permission/permission.core.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Permission string parsing and wildcard matching.
+ *
+ * @module permission/permission
+ */
+import type { Permission } from "../permissionTypes/index.js";
+/**
+ * Parse a permission string into a structured Permission.
+ *
+ * @example parsePermission("post:update") → { resource: "post", action: "update" }
+ * @example parsePermission("billing.invoice:refund") → { resource: "billing.invoice", action: "refund" }
+ */
+export declare function parsePermission(permission: string): Permission;
+/**
+ * Check if a permission string is valid without throwing.
+ */
+export declare function isValidPermission(permission: string): boolean;
+/**
+ * Check if a permission matches a target permission, supporting wildcards.
+ *
+ * @example matches("post:*", "post:update") → true
+ * @example matches("*:*", "anything:goes") → true
+ * @example matches("post:read", "post:update") → false
+ */
+export declare function matches(pattern: string, target: string): boolean;
+/**
+ * Check if a permission string matches a structured Permission object.
+ */
+export declare function matchesPermission(pattern: string, permission: Permission): boolean;
+//# sourceMappingURL=permission.core.d.ts.map

package/dist/permission/permission.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.core.d.ts","sourceRoot":"","sources":["../../src/permission/permission.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAM9D;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAQ9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAiBhE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,UAAU,GACrB,OAAO,CAWT"}

package/dist/permission/permission.core.js

@@ -0,0 +1,72 @@
+/**
+ * Permission string parsing and wildcard matching.
+ *
+ * @module permission/permission
+ */
+import { InvalidPermissionError } from "../permissionErrors/index.js";
+/** Regex for valid permission format: resource:action (supports namespaces and wildcards). */
+const PERMISSION_REGEX = /^[a-zA-Z0-9._*-]+:[a-zA-Z0-9._*-]+$/;
+/**
+ * Parse a permission string into a structured Permission.
+ *
+ * @example parsePermission("post:update") → { resource: "post", action: "update" }
+ * @example parsePermission("billing.invoice:refund") → { resource: "billing.invoice", action: "refund" }
+ */
+export function parsePermission(permission) {
+    if (!PERMISSION_REGEX.test(permission)) {
+        throw new InvalidPermissionError(permission);
+    }
+    const lastColon = permission.lastIndexOf(":");
+    const resource = permission.slice(0, lastColon);
+    const action = permission.slice(lastColon + 1);
+    return Object.freeze({ resource, action });
+}
+/**
+ * Check if a permission string is valid without throwing.
+ */
+export function isValidPermission(permission) {
+    return PERMISSION_REGEX.test(permission);
+}
+/**
+ * Check if a permission matches a target permission, supporting wildcards.
+ *
+ * @example matches("post:*", "post:update") → true
+ * @example matches("*:*", "anything:goes") → true
+ * @example matches("post:read", "post:update") → false
+ */
+export function matches(pattern, target) {
+    if (pattern === "*:*")
+        return true;
+    const patternParsed = parsePermissionSafe(pattern);
+    const targetParsed = parsePermissionSafe(target);
+    if (!patternParsed || !targetParsed)
+        return false;
+    const resourceMatch = patternParsed.resource === "*" ||
+        patternParsed.resource === targetParsed.resource;
+    const actionMatch = patternParsed.action === "*" ||
+        patternParsed.action === targetParsed.action;
+    return resourceMatch && actionMatch;
+}
+/**
+ * Check if a permission string matches a structured Permission object.
+ */
+export function matchesPermission(pattern, permission) {
+    const parsed = parsePermissionSafe(pattern);
+    if (!parsed)
+        return false;
+    const resourceMatch = parsed.resource === "*" || parsed.resource === permission.resource;
+    const actionMatch = parsed.action === "*" || parsed.action === permission.action;
+    return resourceMatch && actionMatch;
+}
+/**
+ * Parse a permission string, returning null on invalid format instead of throwing.
+ */
+function parsePermissionSafe(permission) {
+    if (!PERMISSION_REGEX.test(permission))
+        return null;
+    const lastColon = permission.lastIndexOf(":");
+    const resource = permission.slice(0, lastColon);
+    const action = permission.slice(lastColon + 1);
+    return { resource, action };
+}
+//# sourceMappingURL=permission.core.js.map

package/dist/permission/permission.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.core.js","sourceRoot":"","sources":["../../src/permission/permission.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc;IACrD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,aAAa,GACjB,aAAa,CAAC,QAAQ,KAAK,GAAG;QAC9B,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,CAAC;IAEnD,MAAM,WAAW,GACf,aAAa,CAAC,MAAM,KAAK,GAAG;QAC5B,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;IAE/C,OAAO,aAAa,IAAI,WAAW,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAsB;IAEtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,aAAa,GACjB,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC;IAErE,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;IAE/D,OAAO,aAAa,IAAI,WAAW,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/permission/permissionRegistry.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Central registry for defining and looking up permissions.
+ *
+ * @module permission/permissionRegistry
+ */
+import type { Permission } from "../permissionTypes/index.js";
+/** A registered permission with optional metadata. */
+interface RegisteredPermission {
+    readonly parsed: Permission;
+    readonly description?: string;
+    readonly implies?: readonly string[];
+}
+/** Options for the permission registry. */
+export interface PermissionRegistryOptions {
+    /** Allow overwriting existing permissions. Defaults to false. */
+    readonly allowOverride?: boolean;
+}
+/**
+ * Create a permission registry.
+ */
+export declare function createPermissionRegistry(options?: PermissionRegistryOptions): {
+    /**
+     * Register a permission by string or structured object.
+     */
+    define(permission: string | Permission, opts?: {
+        readonly description?: string;
+        readonly implies?: readonly string[];
+    }): void;
+    /**
+     * Look up a registered permission by string.
+     */
+    get(permission: string): Permission | undefined;
+    /**
+     * Get the full registered permission entry.
+     */
+    getEntry(permission: string): RegisteredPermission | undefined;
+    /**
+     * Check if a permission is registered.
+     */
+    has(permission: string): boolean;
+    /**
+     * Get all registered permission strings.
+     */
+    all(): readonly string[];
+    /**
+     * Get permissions that match a pattern.
+     */
+    match(pattern: string): readonly Permission[];
+    /**
+     * Get permissions implied by a given permission.
+     */
+    getImplied(permission: string): readonly string[];
+    /**
+     * Remove a permission from the registry.
+     */
+    remove(permission: string): boolean;
+    /**
+     * Clear all registered permissions.
+     */
+    clear(): void;
+};
+export {};
+//# sourceMappingURL=permissionRegistry.d.ts.map

package/dist/permission/permissionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionRegistry.d.ts","sourceRoot":"","sources":["../../src/permission/permissionRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAO9D,sDAAsD;AACtD,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,yBAAyB;IAKxE;;OAEG;IACH,MAAM,aACQ,MAAM,GAAG,UAAU,SACxB;QACL,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,GACA,IAAI;IAkBP;;OAEG;IACH,GAAG,aAAa,MAAM,GAAG,UAAU,GAAG,SAAS;IAI/C;;OAEG;IACH,QAAQ,aAAa,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAI9D;;OAEG;IACH,GAAG,aAAa,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,GAAG,IAAI,SAAS,MAAM,EAAE;IAIxB;;OAEG;IACH,KAAK,UAAU,MAAM,GAAG,SAAS,UAAU,EAAE;IAU7C;;OAEG;IACH,UAAU,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE;IAIjD;;OAEG;IACH,MAAM,aAAa,MAAM,GAAG,OAAO;IAInC;;OAEG;IACH,KAAK,IAAI,IAAI;EAIhB"}

package/dist/permission/permissionRegistry.js

@@ -0,0 +1,88 @@
+/**
+ * Central registry for defining and looking up permissions.
+ *
+ * @module permission/permissionRegistry
+ */
+import { DuplicatePermissionError, PermissionNotFoundError, } from "../permissionErrors/index.js";
+import { parsePermission, matchesPermission } from "./permission.core.js";
+/**
+ * Create a permission registry.
+ */
+export function createPermissionRegistry(options) {
+    const permissions = new Map();
+    const allowOverride = options?.allowOverride ?? false;
+    return {
+        /**
+         * Register a permission by string or structured object.
+         */
+        define(permission, opts) {
+            const parsed = typeof permission === "string"
+                ? parsePermission(permission)
+                : permission;
+            const key = `${parsed.resource}:${parsed.action}`;
+            if (permissions.has(key) && !allowOverride) {
+                throw new DuplicatePermissionError(key);
+            }
+            permissions.set(key, {
+                parsed: Object.freeze(parsed),
+                description: opts?.description,
+                implies: opts?.implies,
+            });
+        },
+        /**
+         * Look up a registered permission by string.
+         */
+        get(permission) {
+            return permissions.get(permission)?.parsed;
+        },
+        /**
+         * Get the full registered permission entry.
+         */
+        getEntry(permission) {
+            return permissions.get(permission);
+        },
+        /**
+         * Check if a permission is registered.
+         */
+        has(permission) {
+            return permissions.has(permission);
+        },
+        /**
+         * Get all registered permission strings.
+         */
+        all() {
+            return Array.from(permissions.keys());
+        },
+        /**
+         * Get permissions that match a pattern.
+         */
+        match(pattern) {
+            const results = [];
+            for (const [, entry] of permissions) {
+                if (matchesPermission(pattern, entry.parsed)) {
+                    results.push(entry.parsed);
+                }
+            }
+            return results;
+        },
+        /**
+         * Get permissions implied by a given permission.
+         */
+        getImplied(permission) {
+            return permissions.get(permission)?.implies ?? [];
+        },
+        /**
+         * Remove a permission from the registry.
+         */
+        remove(permission) {
+            return permissions.delete(permission);
+        },
+        /**
+         * Clear all registered permissions.
+         */
+        clear() {
+            permissions.clear();
+        },
+    };
+}
+//# sourceMappingURL=permissionRegistry.js.map

package/dist/permission/permissionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionRegistry.js","sourceRoot":"","sources":["../../src/permission/permissionRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAe1E;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAmC;IAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,KAAK,CAAC;IAEtD,OAAO;QACL;;WAEG;QACH,MAAM,CACJ,UAA+B,EAC/B,IAGC;YAED,MAAM,MAAM,GACV,OAAO,UAAU,KAAK,QAAQ;gBAC5B,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC;gBAC7B,CAAC,CAAC,UAAU,CAAC;YACjB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAElD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;YAED,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,IAAI,EAAE,WAAW;gBAC9B,OAAO,EAAE,IAAI,EAAE,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QAED;;WAEG;QACH,GAAG,CAAC,UAAkB;YACpB,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC;QAED;;WAEG;QACH,QAAQ,CAAC,UAAkB;YACzB,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED;;WAEG;QACH,GAAG,CAAC,UAAkB;YACpB,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED;;WAEG;QACH,GAAG;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,OAAe;YACnB,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;gBACpC,IAAI,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED;;WAEG;QACH,UAAU,CAAC,UAAkB;YAC3B,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;QACpD,CAAC;QAED;;WAEG;QACH,MAAM,CAAC,UAAkB;YACvB,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAED;;WAEG;QACH,KAAK;YACH,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/permissionErrors/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Permission error types.
+ *
+ * @module permissionErrors
+ */
+export { PermissionError } from "./permissionError.base.js";
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/permissionErrors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permissionErrors/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,EACX,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC"}

package/dist/permissionErrors/index.js

@@ -0,0 +1,8 @@
+/**
+ * Permission error types.
+ *
+ * @module permissionErrors
+ */
+export { PermissionError } from "./permissionError.base.js";
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.types.js";
+//# sourceMappingURL=index.js.map

package/dist/permissionErrors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissionErrors/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,EACX,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC"}

package/dist/permissionErrors/permissionError.access.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Access-related permission errors.
+ */
+import { PermissionError } from "./permissionError.base.js";
+/**
+ * Access denied — the actor is not authorized.
+ */
+export declare class PermissionDeniedError extends PermissionError {
+    constructor(message?: string, options?: {
+        readonly actorId?: string;
+        readonly permission?: string;
+        readonly resourceType?: string;
+    });
+}
+/**
+ * A referenced permission does not exist in the registry.
+ */
+export declare class PermissionNotFoundError extends PermissionError {
+    constructor(permission: string);
+}
+/**
+ * A duplicate permission was registered.
+ */
+export declare class DuplicatePermissionError extends PermissionError {
+    constructor(permission: string);
+}
+/**
+ * A referenced role does not exist in the registry.
+ */
+export declare class RoleNotFoundError extends PermissionError {
+    constructor(role: string);
+}
+/**
+ * A duplicate role was registered.
+ */
+export declare class DuplicateRoleError extends PermissionError {
+    constructor(role: string);
+}
+//# sourceMappingURL=permissionError.access.d.ts.map

package/dist/permissionErrors/permissionError.access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.access.d.ts","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.access.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,YACE,OAAO,SAAkB,EACzB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,EAUF;CACF;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,UAAU,EAAE,MAAM,EAK7B;CACF;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,eAAe;IAC3D,YAAY,UAAU,EAAE,MAAM,EAK7B;CACF;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF"}

package/dist/permissionErrors/permissionError.access.js

@@ -0,0 +1,65 @@
+/**
+ * Access-related permission errors.
+ */
+import { ErrorCode } from "@zudojs/errors";
+import { PermissionError } from "./permissionError.base.js";
+/**
+ * Access denied — the actor is not authorized.
+ */
+export class PermissionDeniedError extends PermissionError {
+    constructor(message = "Access denied", options) {
+        super(message, {
+            code: ErrorCode.ACCESS_DENIED,
+            metadata: {
+                actorId: options?.actorId,
+                permission: options?.permission,
+                resourceType: options?.resourceType,
+            },
+        });
+    }
+}
+/**
+ * A referenced permission does not exist in the registry.
+ */
+export class PermissionNotFoundError extends PermissionError {
+    constructor(permission) {
+        super(`Permission not found: ${permission}`, {
+            code: ErrorCode.NOT_FOUND,
+            metadata: { permission },
+        });
+    }
+}
+/**
+ * A duplicate permission was registered.
+ */
+export class DuplicatePermissionError extends PermissionError {
+    constructor(permission) {
+        super(`Duplicate permission: ${permission}`, {
+            code: ErrorCode.CONFLICT,
+            metadata: { permission },
+        });
+    }
+}
+/**
+ * A referenced role does not exist in the registry.
+ */
+export class RoleNotFoundError extends PermissionError {
+    constructor(role) {
+        super(`Role not found: ${role}`, {
+            code: ErrorCode.NOT_FOUND,
+            metadata: { role },
+        });
+    }
+}
+/**
+ * A duplicate role was registered.
+ */
+export class DuplicateRoleError extends PermissionError {
+    constructor(role) {
+        super(`Duplicate role: ${role}`, {
+            code: ErrorCode.CONFLICT,
+            metadata: { role },
+        });
+    }
+}
+//# sourceMappingURL=permissionError.access.js.map

package/dist/permissionErrors/permissionError.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.access.js","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.access.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IACxD,YACE,OAAO,GAAG,eAAe,EACzB,OAIC;QAED,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,SAAS,CAAC,aAAa;YAC7B,QAAQ,EAAE;gBACR,OAAO,EAAE,OAAO,EAAE,OAAO;gBACzB,UAAU,EAAE,OAAO,EAAE,UAAU;gBAC/B,YAAY,EAAE,OAAO,EAAE,YAAY;aACpC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,UAAkB;QAC5B,KAAK,CAAC,yBAAyB,UAAU,EAAE,EAAE;YAC3C,IAAI,EAAE,SAAS,CAAC,SAAS;YACzB,QAAQ,EAAE,EAAE,UAAU,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,eAAe;IAC3D,YAAY,UAAkB;QAC5B,KAAK,CAAC,yBAAyB,UAAU,EAAE,EAAE;YAC3C,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,QAAQ,EAAE,EAAE,UAAU,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACpD,YAAY,IAAY;QACtB,KAAK,CAAC,mBAAmB,IAAI,EAAE,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,SAAS;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,IAAY;QACtB,KAAK,CAAC,mBAAmB,IAAI,EAAE,EAAE;YAC/B,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/permissionErrors/permissionError.base.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Base PermissionError class.
+ *
+ * @module permissionErrors/permissionError
+ *
+ * Extends AuthorizationError from @zudojs/errors.
+ */
+import { AuthorizationError, ErrorCode, type ErrorMetadata } from "@zudojs/errors";
+/**
+ * Base error for all permission-related failures.
+ */
+export declare class PermissionError extends AuthorizationError {
+    constructor(message: string, options?: {
+        readonly code?: ErrorCode;
+        readonly metadata?: ErrorMetadata;
+        readonly cause?: unknown;
+    });
+}
+//# sourceMappingURL=permissionError.base.d.ts.map

package/dist/permissionErrors/permissionError.base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.base.d.ts","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,YACE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B,EAOF;CACF"}

package/dist/permissionErrors/permissionError.base.js

@@ -0,0 +1,21 @@
+/**
+ * Base PermissionError class.
+ *
+ * @module permissionErrors/permissionError
+ *
+ * Extends AuthorizationError from @zudojs/errors.
+ */
+import { AuthorizationError, ErrorCode, } from "@zudojs/errors";
+/**
+ * Base error for all permission-related failures.
+ */
+export class PermissionError extends AuthorizationError {
+    constructor(message, options) {
+        super(message, {
+            code: options?.code ?? ErrorCode.FORBIDDEN,
+            metadata: options?.metadata,
+            cause: options?.cause,
+        });
+    }
+}
+//# sourceMappingURL=permissionError.base.js.map

package/dist/permissionErrors/permissionError.base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.base.js","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,GAEV,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IACrD,YACE,OAAe,EACf,OAIC;QAED,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,SAAS;YAC1C,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/permissionErrors/permissionError.types.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Permission error types — re-exports from focused files.
+ */
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, } from "./permissionError.access.js";
+export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
+//# sourceMappingURL=permissionError.types.d.ts.map

package/dist/permissionErrors/permissionError.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.types.d.ts","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,EACX,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC"}

package/dist/permissionErrors/permissionError.types.js

@@ -0,0 +1,6 @@
+/**
+ * Permission error types — re-exports from focused files.
+ */
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, } from "./permissionError.access.js";
+export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
+//# sourceMappingURL=permissionError.types.js.map

package/dist/permissionErrors/permissionError.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.types.js","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,WAAW,EACX,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC"}

package/dist/permissionErrors/permissionError.validation.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Validation and policy-related permission errors.
+ */
+import { PermissionError } from "./permissionError.base.js";
+/**
+ * A permission string is malformed.
+ */
+export declare class InvalidPermissionError extends PermissionError {
+    constructor(permission: string);
+}
+/**
+ * A role definition is invalid.
+ */
+export declare class InvalidRoleError extends PermissionError {
+    constructor(message: string);
+}
+/**
+ * Circular role inheritance detected.
+ */
+export declare class CircularRoleInheritanceError extends PermissionError {
+    constructor(chain: readonly string[]);
+}
+/**
+ * A policy evaluation failed.
+ */
+export declare class PolicyError extends PermissionError {
+    constructor(policyName: string, cause?: unknown);
+}
+/**
+ * A policy evaluation exceeded the timeout.
+ */
+export declare class PolicyTimeoutError extends PermissionError {
+    constructor(policyName: string, timeoutMs: number);
+}
+/**
+ * A permission resolver failed.
+ */
+export declare class PermissionResolverError extends PermissionError {
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * Authorization was cancelled via AbortSignal.
+ */
+export declare class AuthorizationAbortedError extends PermissionError {
+    constructor();
+}
+//# sourceMappingURL=permissionError.validation.d.ts.map

package/dist/permissionErrors/permissionError.validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.validation.d.ts","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,UAAU,EAAE,MAAM,EAK7B;CACF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,eAAe;IAC/D,YAAY,KAAK,EAAE,SAAS,MAAM,EAAE,EAKnC;CACF;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,eAAe;IAC9C,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM9C;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAKhD;CACF;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAK3C;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;IAC5D,cAEC;CACF"}