@zudojs/permissions 0.0.1

package/dist/permissionErrors/permissionError.validation.js

@@ -0,0 +1,78 @@
+/**
+ * Validation and policy-related permission errors.
+ */
+import { ErrorCode } from "@zudojs/errors";
+import { PermissionError } from "./permissionError.base.js";
+/**
+ * A permission string is malformed.
+ */
+export class InvalidPermissionError extends PermissionError {
+    constructor(permission) {
+        super(`Invalid permission format: ${permission}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            metadata: { permission },
+        });
+    }
+}
+/**
+ * A role definition is invalid.
+ */
+export class InvalidRoleError extends PermissionError {
+    constructor(message) {
+        super(message, { code: ErrorCode.VALIDATION_FAILED });
+    }
+}
+/**
+ * Circular role inheritance detected.
+ */
+export class CircularRoleInheritanceError extends PermissionError {
+    constructor(chain) {
+        super(`Circular role inheritance: ${chain.join(" → ")}`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            metadata: { chain: chain.join(",") },
+        });
+    }
+}
+/**
+ * A policy evaluation failed.
+ */
+export class PolicyError extends PermissionError {
+    constructor(policyName, cause) {
+        super(`Policy evaluation failed: ${policyName}`, {
+            code: ErrorCode.OPERATION_FAILED,
+            cause,
+            metadata: { policyName },
+        });
+    }
+}
+/**
+ * A policy evaluation exceeded the timeout.
+ */
+export class PolicyTimeoutError extends PermissionError {
+    constructor(policyName, timeoutMs) {
+        super(`Policy timeout: ${policyName} exceeded ${timeoutMs}ms`, {
+            code: ErrorCode.TIMEOUT,
+            metadata: { policyName, timeoutMs },
+        });
+    }
+}
+/**
+ * A permission resolver failed.
+ */
+export class PermissionResolverError extends PermissionError {
+    constructor(message, cause) {
+        super(message, {
+            code: ErrorCode.OPERATION_FAILED,
+            cause,
+        });
+    }
+}
+/**
+ * Authorization was cancelled via AbortSignal.
+ */
+export class AuthorizationAbortedError extends PermissionError {
+    constructor() {
+        super("Authorization aborted", { code: ErrorCode.OPERATION_CANCELLED });
+    }
+}
+//# sourceMappingURL=permissionError.validation.js.map

package/dist/permissionErrors/permissionError.validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionError.validation.js","sourceRoot":"","sources":["../../src/permissionErrors/permissionError.validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACzD,YAAY,UAAkB;QAC5B,KAAK,CAAC,8BAA8B,UAAU,EAAE,EAAE;YAChD,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,EAAE,UAAU,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IAC/D,YAAY,KAAwB;QAClC,KAAK,CAAC,8BAA8B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;YACvD,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,eAAe;IAC9C,YAAY,UAAkB,EAAE,KAAe;QAC7C,KAAK,CAAC,6BAA6B,UAAU,EAAE,EAAE;YAC/C,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,KAAK;YACL,QAAQ,EAAE,EAAE,UAAU,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,UAAkB,EAAE,SAAiB;QAC/C,KAAK,CAAC,mBAAmB,UAAU,aAAa,SAAS,IAAI,EAAE;YAC7D,IAAI,EAAE,SAAS,CAAC,OAAO;YACvB,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D;QACE,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/permissionTypes/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Core transaction type definitions.
+ *
+ * @module permissionTypes
+ */
+export { type PermissionActor, type Permission, type PermissionString, } from "./permissionActor.js";
+export { type RuleEffect, type PermissionRule, type PermissionConditionFn, type PermissionContext, type PermissionDecision, } from "./ruleTypes.js";
+export { type RoleDefinition, type PermissionResolver, type RoleResolver, type PermissionCache, type PermissionPolicyDefinition, type ExplainStep, type ExplainResult, type AuthorizationOptions, } from "./policyTypes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/permissionTypes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permissionTypes/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}

package/dist/permissionTypes/index.js

@@ -0,0 +1,9 @@
+/**
+ * Core transaction type definitions.
+ *
+ * @module permissionTypes
+ */
+export {} from "./permissionActor.js";
+export {} from "./ruleTypes.js";
+export {} from "./policyTypes.js";
+//# sourceMappingURL=index.js.map

package/dist/permissionTypes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissionTypes/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIN,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAMN,MAAM,gBAAgB,CAAC;AAExB,OAAO,EASN,MAAM,kBAAkB,CAAC"}

package/dist/permissionTypes/permissionActor.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Core domain types: actor, permission, and permission string.
+ *
+ * @module permissionTypes/permissionActor
+ */
+/** An entity requesting access — user, service, worker, bot, etc. */
+export interface PermissionActor {
+    /** Unique identifier for the actor. */
+    readonly id: string;
+    /** Actor type (e.g. "user", "service", "system"). */
+    readonly type?: string;
+    /** Roles assigned to this actor. */
+    readonly roles?: readonly string[];
+    /** Direct permissions granted to this actor. */
+    readonly permissions?: readonly string[];
+    /** Permissions explicitly denied to this actor. */
+    readonly deniedPermissions?: readonly string[];
+}
+/** A parsed permission with resource and action. */
+export interface Permission {
+    /** Resource being accessed (e.g. "post", "billing.invoice"). */
+    readonly resource: string;
+    /** Action being performed (e.g. "read", "update", "*"). */
+    readonly action: string;
+}
+/** Permission string format: "resource:action" or wildcards like "post:*", "*:*". */
+export type PermissionString = string;
+//# sourceMappingURL=permissionActor.d.ts.map

package/dist/permissionTypes/permissionActor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionActor.d.ts","sourceRoot":"","sources":["../../src/permissionTypes/permissionActor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gDAAgD;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,mDAAmD;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qFAAqF;AACrF,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC"}

package/dist/permissionTypes/permissionActor.js

@@ -0,0 +1,7 @@
+/**
+ * Core domain types: actor, permission, and permission string.
+ *
+ * @module permissionTypes/permissionActor
+ */
+export {};
+//# sourceMappingURL=permissionActor.js.map

package/dist/permissionTypes/permissionActor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionActor.js","sourceRoot":"","sources":["../../src/permissionTypes/permissionActor.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/permissionTypes/policyTypes.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Role, resolver, cache, policy, explain, and options types.
+ *
+ * @module permissionTypes/policyTypes
+ */
+import type { PermissionActor } from "./permissionActor.js";
+import type { PermissionRule, PermissionContext, PermissionDecision } from "./ruleTypes.js";
+/** A role definition with permissions and optional inheritance. */
+export interface RoleDefinition {
+    /** Role name (e.g. "admin", "editor"). */
+    readonly name: string;
+    /** Permissions granted by this role. */
+    readonly permissions: readonly string[];
+    /** Roles this role inherits from. */
+    readonly inherits?: readonly string[];
+    /** Role description. */
+    readonly description?: string;
+    /** Whether this is a system role (cannot be deleted). */
+    readonly system?: boolean;
+}
+/** Resolves permissions for an actor from an external source. */
+export interface PermissionResolver {
+    resolvePermissions(actor: PermissionActor): Promise<readonly PermissionRule[]>;
+}
+/** Resolves roles for an actor from an external source. */
+export interface RoleResolver {
+    resolveRoles(actor: PermissionActor): Promise<readonly string[]>;
+}
+/** Cache adapter for authorization decisions. */
+export interface PermissionCache {
+    get(key: string): Promise<PermissionDecision | undefined>;
+    set(key: string, value: PermissionDecision, options?: {
+        readonly ttl?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+    invalidateActor(actorId: string): Promise<void>;
+}
+/** A named authorization policy. */
+export interface PermissionPolicyDefinition {
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly cacheable?: boolean;
+    readonly priority?: number;
+    evaluate(context: PermissionContext): PermissionDecision | Promise<PermissionDecision>;
+}
+/** A step in an explain trace. */
+export interface ExplainStep {
+    readonly type: "role" | "permission" | "rule" | "policy" | "deny";
+    readonly detail: string;
+    readonly matched: boolean;
+}
+/** Full explanation of an authorization decision. */
+export interface ExplainResult {
+    readonly allowed: boolean;
+    readonly steps: readonly ExplainStep[];
+}
+/** Options for authorization checks. */
+export interface AuthorizationOptions {
+    readonly signal?: AbortSignal;
+    readonly policyTimeout?: number;
+}
+//# sourceMappingURL=policyTypes.d.ts.map

package/dist/permissionTypes/policyTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyTypes.d.ts","sourceRoot":"","sources":["../../src/permissionTypes/policyTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAExB,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,wBAAwB;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;CACvC;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAClE;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC1D,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,oCAAoC;AACpC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CACN,OAAO,EAAE,iBAAiB,GACzB,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACrD;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC"}

package/dist/permissionTypes/policyTypes.js

@@ -0,0 +1,7 @@
+/**
+ * Role, resolver, cache, policy, explain, and options types.
+ *
+ * @module permissionTypes/policyTypes
+ */
+export {};
+//# sourceMappingURL=policyTypes.js.map

package/dist/permissionTypes/policyTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyTypes.js","sourceRoot":"","sources":["../../src/permissionTypes/policyTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/permissionTypes/ruleTypes.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Rule, condition, context, and decision types.
+ *
+ * @module permissionTypes/ruleTypes
+ */
+import type { PermissionActor, Permission } from "./permissionActor.js";
+/** Whether a rule allows or denies access. */
+export type RuleEffect = "allow" | "deny";
+/** A permission rule that grants or denies access under conditions. */
+export interface PermissionRule {
+    /** Allow or deny. */
+    readonly effect: RuleEffect;
+    /** Action(s) this rule applies to. */
+    readonly action: string | readonly string[];
+    /** Resource(s) this rule applies to. */
+    readonly resource: string | readonly string[];
+    /** Optional condition function for ABAC. */
+    readonly condition?: PermissionConditionFn;
+    /** Rule priority — higher wins. Same priority: deny wins. */
+    readonly priority?: number;
+    /** Human-readable rule name for debugging. */
+    readonly name?: string;
+}
+/** A function that evaluates whether a condition is met. */
+export type PermissionConditionFn = (context: PermissionContext) => boolean | Promise<boolean>;
+/** Context provided during authorization evaluation. */
+export interface PermissionContext {
+    /** The actor requesting access. */
+    readonly actor: PermissionActor;
+    /** The permission string being checked (e.g. "post:update"). */
+    readonly permission: Permission;
+    /** The target resource (optional). */
+    readonly resource?: unknown;
+    /** Arbitrary metadata (IP, tenant, timestamp, etc.). */
+    readonly metadata?: ReadonlyMap<string, unknown>;
+}
+/** Result of an authorization check. */
+export interface PermissionDecision {
+    /** Whether the action is allowed. */
+    readonly allowed: boolean;
+    /** Human-readable reason for the decision. */
+    readonly reason?: string;
+    /** Name of the policy/rule that produced the decision. */
+    readonly policy?: string;
+    /** The matched permission string. */
+    readonly matchedPermission?: string;
+    /** Additional decision metadata. */
+    readonly metadata?: unknown;
+}
+//# sourceMappingURL=ruleTypes.d.ts.map

package/dist/permissionTypes/ruleTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleTypes.d.ts","sourceRoot":"","sources":["../../src/permissionTypes/ruleTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAExE,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC5C,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC9C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAC3C,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,iBAAiB,KACvB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClD;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qCAAqC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B"}

package/dist/permissionTypes/ruleTypes.js

@@ -0,0 +1,7 @@
+/**
+ * Rule, condition, context, and decision types.
+ *
+ * @module permissionTypes/ruleTypes
+ */
+export {};
+//# sourceMappingURL=ruleTypes.js.map

package/dist/permissionTypes/ruleTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleTypes.js","sourceRoot":"","sources":["../../src/permissionTypes/ruleTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/policy/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Policy registry and management for authorization.
+ *
+ * @module policy
+ */
+export { createPolicyRegistry } from "./policyRegistry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,7 @@
+/**
+ * Policy registry and management for authorization.
+ *
+ * @module policy
+ */
+export { createPolicyRegistry } from "./policyRegistry.js";
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/policy/policyRegistry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Policy registry — manages named authorization policies.
+ *
+ * @module policy/policyRegistry
+ */
+import type { PermissionPolicyDefinition } from "../permissionTypes/index.js";
+/**
+ * Create a policy registry.
+ */
+export declare function createPolicyRegistry(): {
+    /**
+     * Register a policy.
+     */
+    define(definition: PermissionPolicyDefinition): void;
+    /**
+     * Get a policy by name.
+     */
+    get(name: string): PermissionPolicyDefinition | undefined;
+    /**
+     * Get all policies that apply to a given permission string.
+     */
+    forPermission(permission: string): readonly PermissionPolicyDefinition[];
+    /**
+     * Get all registered policy names.
+     */
+    names(): readonly string[];
+    /**
+     * Remove a policy.
+     */
+    remove(name: string): boolean;
+    /**
+     * Clear all policies.
+     */
+    clear(): void;
+};
+//# sourceMappingURL=policyRegistry.d.ts.map

package/dist/policy/policyRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/policyRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;GAEG;AACH,wBAAgB,oBAAoB;IAIhC;;OAEG;IACH,MAAM,aAAa,0BAA0B,GAAG,IAAI;IAIpD;;OAEG;IACH,GAAG,OAAO,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAIzD;;OAEG;IACH,aAAa,aAAa,MAAM,GAAG,SAAS,0BAA0B,EAAE;IAWxE;;OAEG;IACH,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B;;OAEG;IACH,MAAM,OAAO,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;EAIhB"}

package/dist/policy/policyRegistry.js

@@ -0,0 +1,57 @@
+/**
+ * Policy registry — manages named authorization policies.
+ *
+ * @module policy/policyRegistry
+ */
+/**
+ * Create a policy registry.
+ */
+export function createPolicyRegistry() {
+    const policies = new Map();
+    return {
+        /**
+         * Register a policy.
+         */
+        define(definition) {
+            policies.set(definition.name, Object.freeze({ ...definition }));
+        },
+        /**
+         * Get a policy by name.
+         */
+        get(name) {
+            return policies.get(name);
+        },
+        /**
+         * Get all policies that apply to a given permission string.
+         */
+        forPermission(permission) {
+            const results = [];
+            for (const [, policy] of policies) {
+                if (policy.permissions.includes(permission)) {
+                    results.push(policy);
+                }
+            }
+            // Sort by priority descending
+            return results.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        /**
+         * Get all registered policy names.
+         */
+        names() {
+            return Array.from(policies.keys());
+        },
+        /**
+         * Remove a policy.
+         */
+        remove(name) {
+            return policies.delete(name);
+        },
+        /**
+         * Clear all policies.
+         */
+        clear() {
+            policies.clear();
+        },
+    };
+}
+//# sourceMappingURL=policyRegistry.js.map

package/dist/policy/policyRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyRegistry.js","sourceRoot":"","sources":["../../src/policy/policyRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;IAE/D,OAAO;QACL;;WAEG;QACH,MAAM,CAAC,UAAsC;YAC3C,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED;;WAEG;QACH,GAAG,CAAC,IAAY;YACd,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED;;WAEG;QACH,aAAa,CAAC,UAAkB;YAC9B,MAAM,OAAO,GAAiC,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,8BAA8B;YAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QAED;;WAEG;QACH,KAAK;YACH,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED;;WAEG;QACH,MAAM,CAAC,IAAY;YACjB,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED;;WAEG;QACH,KAAK;YACH,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/resolvers/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Permission, role, and actor resolvers.
+ *
+ * @module resolvers
+ */
+export { createMemoryPermissionResolver, createMemoryRoleResolver, createStaticPermissionResolver, createStaticRoleResolver, } from "./resolvers.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/resolvers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC"}

package/dist/resolvers/index.js

@@ -0,0 +1,7 @@
+/**
+ * Permission, role, and actor resolvers.
+ *
+ * @module resolvers
+ */
+export { createMemoryPermissionResolver, createMemoryRoleResolver, createStaticPermissionResolver, createStaticRoleResolver, } from "./resolvers.core.js";
+//# sourceMappingURL=index.js.map

package/dist/resolvers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC"}

package/dist/resolvers/resolvers.core.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Resolver implementations for permissions, roles, and actors.
+ *
+ * @module resolvers/resolvers
+ */
+import type { PermissionRule, PermissionResolver, RoleResolver } from "../permissionTypes/index.js";
+/**
+ * In-memory permission resolver — returns permissions from a map.
+ */
+export declare function createMemoryPermissionResolver(store: Map<string, readonly PermissionRule[]>): PermissionResolver;
+/**
+ * In-memory role resolver — returns roles from a map.
+ */
+export declare function createMemoryRoleResolver(store: Map<string, readonly string[]>): RoleResolver;
+/**
+ * Static permission resolver — always returns the same rules.
+ */
+export declare function createStaticPermissionResolver(rules: readonly PermissionRule[]): PermissionResolver;
+/**
+ * Static role resolver — always returns the same roles.
+ */
+export declare function createStaticRoleResolver(roles: readonly string[]): RoleResolver;
+//# sourceMappingURL=resolvers.core.d.ts.map

package/dist/resolvers/resolvers.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.core.d.ts","sourceRoot":"","sources":["../../src/resolvers/resolvers.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,cAAc,EACd,kBAAkB,EAClB,YAAY,EACb,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,GAC5C,kBAAkB,CAQpB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACpC,YAAY,CAMd;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,cAAc,EAAE,GAC/B,kBAAkB,CAMpB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,YAAY,CAMd"}

package/dist/resolvers/resolvers.core.js

@@ -0,0 +1,46 @@
+/**
+ * Resolver implementations for permissions, roles, and actors.
+ *
+ * @module resolvers/resolvers
+ */
+/**
+ * In-memory permission resolver — returns permissions from a map.
+ */
+export function createMemoryPermissionResolver(store) {
+    return {
+        async resolvePermissions(actor) {
+            return store.get(actor.id) ?? [];
+        },
+    };
+}
+/**
+ * In-memory role resolver — returns roles from a map.
+ */
+export function createMemoryRoleResolver(store) {
+    return {
+        async resolveRoles(actor) {
+            return store.get(actor.id) ?? [];
+        },
+    };
+}
+/**
+ * Static permission resolver — always returns the same rules.
+ */
+export function createStaticPermissionResolver(rules) {
+    return {
+        async resolvePermissions() {
+            return rules;
+        },
+    };
+}
+/**
+ * Static role resolver — always returns the same roles.
+ */
+export function createStaticRoleResolver(roles) {
+    return {
+        async resolveRoles() {
+            return roles;
+        },
+    };
+}
+//# sourceMappingURL=resolvers.core.js.map

package/dist/resolvers/resolvers.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.core.js","sourceRoot":"","sources":["../../src/resolvers/resolvers.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,kBAAkB,CACtB,KAAsB;YAEtB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAqC;IAErC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,KAAsB;YACvC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,kBAAkB;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAwB;IAExB,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/role/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Role definitions, registry, and inheritance hierarchy.
+ *
+ * @module role
+ */
+export { createRoleRegistry, type RoleRegistryOptions, } from "./roleRegistry.js";
+export { resolveRolePermissions } from "./roleHierarchy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/role/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/role/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/role/index.js

@@ -0,0 +1,8 @@
+/**
+ * Role definitions, registry, and inheritance hierarchy.
+ *
+ * @module role
+ */
+export { createRoleRegistry, } from "./roleRegistry.js";
+export { resolveRolePermissions } from "./roleHierarchy.js";
+//# sourceMappingURL=index.js.map

package/dist/role/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/role/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/role/roleHierarchy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Role hierarchy resolver — resolves inherited permissions from role chains.
+ *
+ * @module role/roleHierarchy
+ */
+import type { RoleDefinition } from "../permissionTypes/index.js";
+/**
+ * Resolve all permissions for a set of role names, following inheritance chains.
+ *
+ * @param roleNames - Direct role names assigned to the actor.
+ * @param getRole - Function to look up a role definition by name.
+ * @returns Deduplicated list of all permission strings.
+ */
+export declare function resolveRolePermissions(roleNames: readonly string[], getRole: (name: string) => RoleDefinition | undefined): readonly string[];
+//# sourceMappingURL=roleHierarchy.d.ts.map

package/dist/role/roleHierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleHierarchy.d.ts","sourceRoot":"","sources":["../../src/role/roleHierarchy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAMlE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,GACpD,SAAS,MAAM,EAAE,CASnB"}

package/dist/role/roleHierarchy.js

@@ -0,0 +1,48 @@
+/**
+ * Role hierarchy resolver — resolves inherited permissions from role chains.
+ *
+ * @module role/roleHierarchy
+ */
+import { CircularRoleInheritanceError, RoleNotFoundError, } from "../permissionErrors/index.js";
+/**
+ * Resolve all permissions for a set of role names, following inheritance chains.
+ *
+ * @param roleNames - Direct role names assigned to the actor.
+ * @param getRole - Function to look up a role definition by name.
+ * @returns Deduplicated list of all permission strings.
+ */
+export function resolveRolePermissions(roleNames, getRole) {
+    const permissions = new Set();
+    const visited = new Set();
+    for (const name of roleNames) {
+        collectPermissions(name, getRole, permissions, visited, []);
+    }
+    return Array.from(permissions);
+}
+/**
+ * Collect permissions from a role and its ancestors, detecting cycles.
+ */
+function collectPermissions(roleName, getRole, permissions, visited, chain) {
+    const role = getRole(roleName);
+    if (!role) {
+        throw new RoleNotFoundError(roleName);
+    }
+    // Cycle detection — check before adding to visited
+    if (chain.includes(roleName)) {
+        throw new CircularRoleInheritanceError([...chain, roleName]);
+    }
+    // Skip if already fully processed (not in current chain)
+    if (visited.has(roleName))
+        return;
+    visited.add(roleName);
+    const newChain = [...chain, roleName];
+    for (const perm of role.permissions) {
+        permissions.add(perm);
+    }
+    if (role.inherits) {
+        for (const parent of role.inherits) {
+            collectPermissions(parent, getRole, permissions, visited, newChain);
+        }
+    }
+}
+//# sourceMappingURL=roleHierarchy.js.map

package/dist/role/roleHierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleHierarchy.js","sourceRoot":"","sources":["../../src/role/roleHierarchy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA4B,EAC5B,OAAqD;IAErD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,OAAqD,EACrD,WAAwB,EACxB,OAAoB,EACpB,KAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,4BAA4B,CAAC,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IAElC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC"}